# US 2021/0243219 A1 · Security handling skill measurement system, method, and program > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0243219 A1 - Document ID: US20210243219A1 - Status: Published application - Kind: A1 - Application number: 16/972,177 - Filed: 2018-05-23 - Published: 2021-08-05 - Earliest claimed: 2018-05-23 - Assignees: NEC Corporation - Applicants: NEC Corporation - Inventors: Masaru KAWAKITA - Web page: https://patentgrep.com/patent/US20210243219A1 ## CPC - G06F 21/55: Detecting local intrusion or implementing counter-measures - H04L 63/1433: {Vulnerability analysis} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A skill measurement apparatus comprises an action recording part that records a communicated content between a measuring subject whose skill in handling a cyber-attack is to be measured and a simulated cyber-attack source and a skill measurement part that evaluates the skill of the measuring subject in handling a cyber-attack on the basis of whether or not the communicated content between the measuring subject and the simulated cyber-attack source includes signature indicating a predetermined search action. ## Claims ### Claim 1 A skill measurement apparatus comprising: at least a processor; and a memory in circuit communication with the processor, wherein the processor is configured to execute program instructions stored in the memory to implement: an action recording part that records a communicated content between a measuring subject whose skill in handling a cyber-attack is to be measured and a simulated cyber-attack source; and a skill measurement part that evaluates the skill of the measuring subject in handling the cyber-attack on the basis of whether or not the communicated content between the measuring subject and the simulated cyber-attack source includes signature indicating a predetermined search action. ### Claim 2 (depends on 1) The skill measurement apparatus according to claim 1, wherein the skill measurement part evaluates the skill of the measuring subject in handling the cyber-attack by referring to a table that determines a score corresponding to each type of the search action and adding up scores of the search action taken by the measuring subject. ### Claim 3 (depends on 2) The skill measurement apparatus according to claim 2, wherein the skill measurement part comprises a second table for identifying the type of the search action taken by the measuring subject from a message included in the communication. ### Claim 4 (depends on 1) The skill measurement apparatus according to claim 1, wherein the processor is configured to execute the program instructions stored in the memory to implement: a content delivery part that transmits predetermined simulated content to the measuring subject when the measuring subject requests content from the simulated cyber-attack source at a predetermined port number. ### Claim 5 (depends on 4) The skill measurement apparatus according to claim 4, wherein the predetermined simulated content prompts the measuring subject to take a search action. ### Claim 6 (depends on 1) The skill measurement apparatus according to claim 1 wherein the action recording part receives the measuring subject whose skill in handling the cyber-attack is to be measured and an IP address representing the simulated cyber-attack source from a predetermined simulated cyber-attack apparatus. ### Claim 7 A simulated cyber-attack apparatus comprising: at least a processor; and a memory in circuit communication with the processor, wherein the processor is configured to execute program instructions stored in the memory to implement: a measuring subject table that stores a plurality of measuring subjects whose skill in security handling is to be measured; a simulated cyber-attack part that selects a measuring subject from the measuring subject table and launches a predetermined simulated cyber-attack thereon; and a notification part that notifies a predetermined skill measurement apparatus of the selected measuring subject and a source IP address used in the simulated cyber-attack. ### Claim 8 (depends on 7) The simulated cyber-attack apparatus according to claim 7, wherein the simulated cyber-attack part selects a source IP address used in the simulated cyber-attack from IP addresses prepared in advance and uses the selected IP address. ### Claim 9 A security handling skill measurement system including: a simulated cyber-attack apparatus that comprises a measuring subject table that stores a plurality of measuring subjects whose security handling skill is to be measured, a simulated cyber-attack part that selects a measuring subject from the measuring subject table and launches a predetermined simulated cyber-attack thereon, and a notification part that notifies a predetermined skill measurement apparatus of the selected measuring subject and a source IP address used in the simulated cyber-attack; and a skill measurement apparatus that comprises an action recording part that records the communicated content between a measuring subject whose skill in handling a cyber-attack is to be measured and the source of a simulated cyber-attack, and a skill measurement part that evaluates the skill of the measuring subject in handling a cyber-attack on the basis of whether or not the content of communication between the measuring subject and the simulated cyber-attack source includes signature indicating a predetermined search action. ### Claim 10 A skill measurement method including: recording a communicated content between a measuring subject whose skill in handling a cyber-attack is to be measured and a simulated cyber-attack source; and evaluating the skill of the measuring subject in handling a cyber-attack on the basis of whether or not the communicated content between the measuring subject and the simulated cyber-attack source includes signature indicating a predetermined search action. ### Claim 11 A simulated cyber-attack method including: selecting a measuring subject from a measuring subject table that stores a plurality of measuring subjects whose security handling skill is to be measured and launching a predetermined simulated cyber-attack thereon; and notifying a predetermined skill measurement apparatus of the selected measuring subject and a source IP address used in the simulated cyber-attack. ### Claim at position 12 -13. (canceled) ### Claim 14 (depends on 10) The skill measurement method according to claim 10, including: referring to a table that determines a score corresponding to each type of the search action and adding up scores of the search action taken by the measuring subject. ### Claim 15 (depends on 14) The skill measurement method according to claim 14, including: referring to a second table for identifying the type of the search action taken by the measuring subject from a message included in the communication. ### Claim 16 (depends on 10) The skill measurement method according to claim 10, including: transmitting predetermined simulated content to the measuring subject when the measuring subject requests content from the simulated cyber-attack source at a predetermined port number. ### Claim 17 (depends on 16) The skill measurement method according to claim 16, wherein the predetermined simulated content prompts the measuring subject to take a search action. ### Claim 18 (depends on 10) The skill measurement method according to claim 10, including: receiving the measuring subject whose skill in handling the cyber-attack is to be measured and an IP address representing the simulated cyber-attack source from a predetermined simulated cyber-attack apparatus. ### Claim 19 (depends on 11) The simulated cyber-attack method according to claim 11, including: selecting a source IP address used in the simulated cyber-attack from IP addresses prepared in advance and uses the selected IP address.