Attack estimation device, attack estimation method, and attack estimation program

An attack estimation method, comprising:

• a storage step of holding, in a storage memory, which is non-transitory computer-readable memory, an attack tree in which an attack method assumed in advance in an analysis target system and indicators of compromise are associated with each other, an abstract attack tree in which the attack method and an abstract attack name that is obtained by generalizing the attack method are associated with each other, and log check management information in which the abstract attack name, a device for which a log is to be checked, and a specific place in the log are associated with one another;
• and
• a prediction step of predicting, when a detection alert informing of occurrence of an attack on the analysis target system is received, a range of compromise from the attack by referring to the attack tree, the abstract attack tree, and the log check management information,
• wherein the prediction step includes:
• identifying, when the detection alert is received, the indicators of compromise that correspond to the attack by referring to the attack tree;
• determining that an attack of a known pattern has occurred as the attack when the indicators of compromise that correspond to the attack are successfully identified, and predicting the range of compromise from the identified indicators of compromise;
• determining that an attack of an unknown pattern has occurred as the attack when the indicators of compromise that correspond to the attack are unsuccessfully identified;
• identifying, when it is determined that the attack of the unknown pattern has occurred, the abstract attack name by referring to the abstract attack tree;
• and
• predicting the range of compromise from the attack of the unknown pattern by identifying the device for which the log is to be checked as a device in which indicators of the attack of the unknown pattern are anticipated, and by identifying a specific place in the log of the identified device, by referring to the identified abstract attack name and the log check management information.

A non-transitory computer-readable medium storing an attack estimation program for causing a computer to execute:

• a storage step of holding, in a non-transitory storage memory, an attack tree in which an attack method assumed in advance in an analysis target system and indicators of compromise are associated with each other, an abstract attack tree in which the attack method and an abstract attack name that is obtained by generalizing the attack method are associated with each other, and log check management information in which the abstract attack name, a device for which a log is to be checked, and a specific place in the log are associated with one another;
• and
• a prediction step of predicting, when a detection alert informing of occurrence of an attack on the analysis target system is received, a range of compromise from the attack by referring to the attack tree, the abstract attack tree, and the log check management information,
• wherein the prediction step includes:
• identifying, when the detection alert is received, the indicators of compromise that correspond to the attack by referring to the attack tree;
• determining that an attack of a known pattern has occurred as the attack when the indicators of compromise that correspond to the attack are successfully identified, and predicting the range of compromise from the identified indicators of compromise;
• determining that an attack of an unknown pattern has occurred as the attack when the indicators of compromise that correspond to the attack are unsuccessfully identified;
• identifying, when it is determined that the attack of the unknown pattern has occurred, the abstract attack name by referring to the abstract attack tree;
• and
• predicting the range of compromise from the attack of the unknown pattern by identifying the device for which the log is to be checked as a device in which indicators of the attack of the unknown pattern are anticipated, and by identifying a specific place in the log of the identified device, by referring to the identified abstract attack name and the log check management information.