Abstract: An attribute selection section (101) selects as a recommended attribute, based on analysis status in a past anomaly analysis on each of a plurality of attributes of a new anomaly which is a newly detected anomaly, an attribute being recommended to be emphasized in an analysis on the new anomaly, from among the plurality of attributes. An attribute presentation section (103) presents the recommended attribute selected by the attribute selection section (101).

Abstract: An erroneous detection amount obtaining unit (110) obtains using an overall detection rule group corresponding to an overall phase group that configures a series of attack activities, an erroneous detection amount of each phase of when attack detection is performed. A final stages verification unit (121) verifies whether or not an erroneous detection amount of a final phases group satisfies a final stages limitation. An overall verification unit (123) verifies whether or not the erroneous detection amount of the overall phase group satisfies an overall limitation. In a case where the erroneous detection amount of the final phases group does not satisfy the final stages limitation, a final stages adjustment unit (122) adjusts a parameter value of each detection rule of a final stages detection rule group.

Abstract: If an attack activity that belongs to any of a plurality of phases of a cyber-attack is detected, a calculation unit calculates an occurrence interval of an attack scenario, using activity interval data. The activity interval data indicates each occurrence interval of one or more attack activities for each phase. The attack scenario is composed of one attack activity of a phase to which a detected attack activity belongs and one attack activity of each phase before the phase to which the detected attack activity belongs. A determination unit determines necessity or non-necessity of an alert, based on the occurrence interval of the attack scenario.

Abstract: A classification unit classifies, per attack log data of a plurality of pieces of attack log data, one or more pieces of log information included in the attack log data, by value set consisting of a value of a first element and a value of a second element, thereby generating one or more log information groups. An integration unit integrates, per log information group, one or more pieces of log information included in the log information group, thereby generating integrated data. An extraction unit extracts, per value set, in one or more value sets, that is common among the plurality of pieces of attack log data, common information from a plurality of pieces of integrated data corresponding to the plurality of pieces of attack log data. A generation unit generates one or more attack detection rules based on one or more pieces of common information.

Abstract: A second communication unit (411) of a security management apparatus (201) externally receives dependency information (412) indicating a dependence relation between information assets individually held by a first system and a second system. Then, a selection unit (415) of the security management apparatus (201) selects a security measure to be implemented, from among candidates for a security measure against a threat to an information asset held by the first system, in accordance with a dependence relation indicated by the dependency information (412) received by the second communication unit (411).

Abstract: A monitor event designating unit (131) designates, if an attack event which attacks an information system in which a plurality of system component elements are included is detected and a notification of a detected event which is the detected attack event and an event involvement element which is a system component element involved in an occurrence of the detected event is provided, an attack event which can occur next to the detected event due to involvement of the event involvement element as a monitor event. An involvement candidate element designating unit (143) designates, as an involvement candidate element, a system component element of the plurality of system component elements, the system component element which can be involved in an occurrence of the monitor event other than the event involvement element.

Abstract: For a plurality of events, event stage information is stored which describes an event observed by an information system when an attack against the information system is underway, a pre-event stage, and a post-event stage. Observed event notice information is received which notifies an observed event observed by the information system. Event stage information is searched for which describes the observed event notified by the observed event notice information. Event stage information is searched for which describes a post-event stage coinciding with a pre-event stage of the event stage information searched for, or a pre-event stage coinciding with a post-event stage of the event stage information searched for.

Abstract: A candidate event derivation unit (101) derives, as a candidate event, an event predicted to occur in an information system (200) including a plurality of system components (300), the event being a candidate for a monitoring target. An attribute identification unit (102) derives, as a candidate system component, a system component (300) involved in occurrence of the candidate event from among the plurality of system components (300), and identifies an attribute of the candidate system component. A monitoring target decision unit (103) analyzes the attribute of the candidate system component identified by the attribute identification unit (102), and decides whether or not the candidate event is to be the monitoring target.

Abstract: For a plurality of events, event stage information is stored which describes an event observed by an information system when an attack against the information system is underway, a pre-event stage, and a post-event stage. Observed event notice information is received which notifies an observed event observed by the information system. Event stage information is searched for which describes the observed event notified by the observed event notice information. Event stage information is searched for which describes a post-event stage coinciding with a pre-event stage of the event stage information searched for, or a pre-event stage coinciding with a post-event stage of the event stage information searched for.