Evaluation device, security product evaluation method, and computer readable medium

An evaluation device comprising:

• processing circuitry
• to generate an attack sample, which is data for simulating an unauthorized act on a system;
• to compare the attack sample generated and a normal state model, which is data acquired by modeling an authorized act on the system, to generate, based on the comparison result, information for generating an attack sample similar to the normal state model, and to feed back the generated information;
• and
• to check whether the attack sample generated by reflecting the information fed back satisfies a requirement for simulating the unauthorized act and to verify, by using the attack sample satisfying the requirement, a detection technique implemented in a security product for detecting the unauthorized act.

A security product evaluation method comprising:

• by processing circuitry, generating an attack sample, which is data for simulating an unauthorized act on a system;
• by processing circuitry, comparing the attack sample generated and a normal state model, which is data acquired by modeling an authorized act on the system, generating, based on the comparison result, information for generating an attack sample similar to the normal state model, and feeding back the generated information;
• and
• by processing circuitry, checking whether the attack sample generated by reflecting the information fed back satisfies a requirement for simulating the unauthorized act and verifying, by using the attack sample satisfying the requirement, a detection technique implemented in a security product for detecting the unauthorized act.

A non-transitory computer readable medium storing an evaluation program that causes a computer to execute:

• an attack generation process of generating an attack sample, which is data for simulating an unauthorized act on a system;
• a comparison process of comparing the attack sample generated by the attack generation process and a normal state model, which is data acquired by modeling an authorized act on the system, generating, based on the comparison result, information for generating an attack sample similar to the normal state model, and feeding back the generated information to the attack generation process;
• and
• a verification process of checking whether the attack sample generated by the attack generation process by reflecting the information fed back from the comparison process satisfies a requirement for simulating the unauthorized act and verifying, by using the attack sample satisfying the requirement, a detection technique implemented in a security product for detecting the unauthorized act.