Attack route extraction system, attack route extraction method, and program

An attack route extraction method performed by a computer including a processor and a memory, comprising:

• extracting one or more attack steps that can be performed by a system to be diagnosed according to configuration information of the system to be diagnosed;
• setting a cost to an attack step based countermeasure possibility information based on countermeasure information corresponding to an attack method;
• and
• determining a priority of each attack route acquired by concatenating the one or more attack steps from an intrusion point to an attack target of the system to be diagnosed based on the cost of the attack step set by the cost setting and extracting the one or more attack route in a descending order of the priority,
• wherein the countermeasure possibility information includes at least one of a number of applicable countermeasures calculated based on the countermeasure information corresponding to the attack method, a number of appearances in an attack graph from which the one or more attack steps of the same attack method are extracted, a number of appearances of attack methods to which the same countermeasure is usable in the attack graph, a number of appearances of a combination of an attack destination host and an attack method in the attack graph, an indegree to an attack destination node in the attack graph.

A computer-readable non-transitory recording medium recording a program, the program which causes a computer to perform processings of:

• extracting one or more attack steps that can be performed by a system to be diagnosed according to configuration information of the system to be diagnosed;
• setting a cost to an attack step based on countermeasure possibility information based on countermeasure information corresponding to an attack method;
• and
• determining a priority of each attack route acquired by concatenating the one or more attack steps from an intrusion point to an attack target of the system to be diagnosed based on the cost of the attack step set by the processing of setting the cost and extracting the one or more attack route in a descending order of the priority,
• wherein the countermeasure possibility information includes at least one of a number of applicable countermeasures calculated based on the countermeasure information corresponding to the attack method, a number of appearances in an attack graph from which the one or more attack steps of the same attack method are extracted, a number of appearances of attack methods to which the same countermeasure is usable in the attack graph, a number of appearances of a combination of an attack destination host and an attack method in the attack graph, an indegree to an attack destination node in the attack graph.