Analysis system, method, and program
AssigneeNEC Corporation
InventorNoboru NAGATANI
Life of this patent
Estimating the term…
Abstract
Provided is an analysis system that can display attack routes so that a security administrator can easily determine which attack routes is prioritized for dealing with. The topology identification unit 4 identifies a network topology of devices included in the system to be diagnosed. The detection unit 5 detects attack routes that indicate flows of attacks that can be executed in the system to be diagnosed, based on security information about each device. The display control unit 6 displays the attack routes on a display device by superimposing the attack routes on the network topology. At this time, the display control unit 6 displays the attack routes on the display device in a manner that corresponds to impact on the system to be diagnosed.
Claims11
An analysis system that virtualizes a system to be diagnosed and performs a simulation, comprising:
- a topology identification unit that identifies a network topology of devices included in the system to be diagnosed;
- a detection unit that detects attack routes that indicate flows of attacks that can be executed in the system to be diagnosed, based on security information about each device;
- and,
- a display control unit that displays the attack routes on a display device by superimposing the attack routes on the network topology,
- wherein the display control unit displays the attack routes on the display device in a manner that corresponds to impact on the system to be diagnosed.
An analysis method of virtualizing a system to be diagnosed and performing a simulation, implemented by a computer, comprising:
- identifying a network topology of devices included in the system to be diagnosed;
- detecting attack routes that indicate flows of attacks that can be executed in the system to be diagnosed, based on security information about each device;
- and,
- displaying the attack routes on a display device by superimposing the attack routes on the network topology,
- wherein when displaying the attack routes on the display device the computer displays the attack routes on the display device in a manner that corresponds to impact on the system to be diagnosed.
A non-transitory computer-readable recording medium in which an analysis program is recorded, the analysis program causing a computer to virtualize a system to be diagnosed and performs a simulation,
- the analysis program causing the computer to execute:
- a topology identification process of identifying a network topology of devices included in the system to be diagnosed;
- a detection process of detecting attack routes that indicate flows of attacks that can be executed in the system to be diagnosed, based on security information about each device;
- and,
- a display control process of displaying the attack routes on a display device by superimposing the attack routes on the network topology,
- wherein the analysis program causes the computer to execute,
- in the display control process, displaying the attack routes on the display device in a manner that corresponds to impact on the system to be diagnosed.
Dependencies are inferred from the claim text.