# US 2019/0319974 A1 · Incident effect range estimation device, incident effect range estimation method, storage medium, and system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0319974 A1 - Document ID: US20190319974A1 - Status: Published application - Kind: A1 - Application number: 16/345,555 - Filed: 2017-10-20 - Published: 2019-10-17 - Earliest claimed: 2016-10-27 - Assignees: NEC Corporation - Applicants: NEC Corporation - Inventors: Daichi HASUMI; Satoshi IKEDA; Shigeyoshi SHIMA - Web page: https://patentgrep.com/patent/US20190319974A1 ## CPC - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - H04L 45/28: using route fault recovery - G06F 11/07: Responding to the occurrence of a fault, e.g. fault tolerance - H04L 45/121: by minimising delays - H04L 45/306: {Route determination based on the nature of the carried application} - H04L 45/70: {Routing based on monitoring results} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Provided is an incident effect range estimation device which estimates the range of the effect of an incident and shortens incident handling time. This incident effect range estimation device 10 is provided with an incident origin log acquisition unit 11 which acquires log information for the incident-originating device which is related to the occurrence of the incident, a communication destination log acquisition unit 12 which acquires, on the basis of the log information for the incident-originating device, log information for a communication destination device which is the communication destination of the incident-originating device, and an effect range estimation unit 13 which estimates the range of the effect of the incident on the basis of the communication destination device. The range of the effect of the incident can thereby be estimated automatically, and thus incident handling time can be shortened significantly. ## Claims ### Claim 1 An incident effect range estimation device comprising: an occurrence-source-log acquisition means that acquires log information of an occurrence source device related to occurrence of an incident; a communication-destination-log acquisition means that acquires, based on the log information of the occurrence source device, log information of a communication destination device being a communication destination of the occurrence source device; and an effect range estimation means that estimates an extent of influence of the incident, based on the log information of the communication destination device. ### Claim 2 (depends on 1) The incident effect range estimation device according to claim 1, wherein, based on the log information acquired, the communication-destination-log acquisition means recursively repeats acquisition of log information of a next communication destination device being a next communication destination, and the effect range estimation means estimates an extent of influence of the incident, based on the log information of the next communication destination device, which is repeatedly acquired. ### Claim 3 (depends on 2) The incident effect range estimation device according to claim 2, wherein the communication-destination-log acquisition means repeats acquisition of log information of the next communication destination device a predetermined number of times. ### Claim 4 (depends on 2) The incident effect range estimation device according to claim 2, wherein the communication-destination-log acquisition means repeats acquisition of log information of the next communication destination device, based on weighting related to communication. ### Claim 5 (depends on 1, 2, 3, 4) The incident effect range estimation device according to any one of claims 1 to 4, wherein the occurrence-source-log acquisition means and the communication-destination-log acquisition means acquire log information according to a type of the incident. ### Claim 6 (depends on 1, 2, 3, 4, 5) The incident effect range estimation device according to any one of claims 1 to 5, wherein the effect range estimation means generates a graph in which the occurrence source device and the communication destination device are nodes. ### Claim 7 (depends on 6) The incident effect range estimation device according to claim 6, wherein the effect range estimation means determines a priority level of the node, based on the generated graph. ### Claim 8 An incident effect range estimation method in an incident effect range estimation device, the method comprising, by the incident effect range estimation device: acquiring log information of an occurrence source device related to occurrence of an incident; acquiring, based on the log information of the occurrence source device, log information of a communication destination device being a communication destination of the occurrence source device; and estimating an extent of influence of the incident, based on the log information of the communication destination device. ### Claim 9 A storage medium storing therein an incident effect range estimation program for causing a computer to perform incident effect range estimation processing, the incident effect range estimation processing including: acquiring log information of an occurrence source device related to occurrence of an incident; acquiring, based on the log information of the occurrence source device, log information of a communication destination device being a communication destination of the occurrence source device; and estimating an extent of influence of the incident, based on the log information of the communication destination device. ### Claim 10 An incident effect range estimation system comprising an incident effect range estimation device and a plurality of communication devices, the incident effect range estimation device including: an occurrence-source-log acquisition means that acquires log information of an occurrence source device that is included in the plurality of communication devices and related to occurrence of an incident; a communication-destination-log acquisition means that acquires, based on the log information of the occurrence source device, log information of a communication destination device that is included in the plurality of communication devices and is a communication destination of the occurrence source device; and an effect range estimation means that estimates an extent of influence of the incident, based on the log information of the communication destination device.