Abstract: A customer environment log generation unit (130) acquires a simulated environment log (410) being a log that indicates a behavior estimated to occur in a simulated environment (200) when an attack is made on the simulated environment (200) being a system environment which simulates a customer environment (300) being an actual system environment and which has a difference from the customer environment (300). Further, the customer environment log generation unit (130) converts the simulated environment log (410) into a customer environment log (430) being a log that indicates a behavior estimated to occur in the customer environment (300) when an attack corresponding to the attack against the simulated environment (200) is made on the customer environment (300), by reflecting the difference between the simulated environment (200) and the customer environment (300).

Abstract: An attack status evaluation apparatus (100) that emulates a cyberattack that steals information includes a degree of goal achievement calculation unit (105) and an attack route change determination unit (106). The degree of goal achievement calculation unit (105) calculates a degree of goal achievement that indicates a degree to which a goal is achieved in the cyberattack based on information that the attack status evaluation apparatus stole. The attack route change determination unit (106) determines whether or not to change an attack route of the cyberattack according to the degree of goal achievement.

Abstract: An acquisition unit (10) acquires normal sample data and non-normal sample data. A model generation unit (120) generates a normal model representing the normal sample data. A change unit (141) generates a non-normal feature vector of the non-normal sample data, and generates a non-normal changed vector obtained by changing an element of the non-normal feature vector. When the non-normal changed vector and the normal model are similar to each other, a verification unit (142) executes a process using sample data represented by the non-normal changed vector. The verification unit (142) verifies whether an anomalous event is detected by a detection device. Upon verification that an anomalous event is not detected, the verification unit (142) determines whether an anomalous event is present, independently of the detection device.

Abstract: An attack means evaluation apparatus (100) evaluates an attack means used in a cyberattack. A score value calculation unit (110) obtains a plurality of attack means, and for each attack means of the plurality of attack means, calculates a score value that shows validity of an attack on an attack target system. A means selection unit (120) selects an attack means that is valid as an attack on the attack target system from the plurality of attack means using the score value of each attack means of the plurality of attack means and a threshold (173). A means execution unit (130) executes the attack means that is selected on the attack target system, and verifies whether or not an attack for achieving a final aim of the cyberattack is possible based an execution result of the attack means that is selected.

Abstract: In an SNS server (103) corresponding to a false submission filter device, an event specifying unit (604) analyzes contents of a submission informing of an occurrence of an event and specifies a location (721) of occurrence of the event. A query destination specifying unit (605) searches a query destination database (613) and specifies a query destination corresponding to the location (721) specified by the event specifying unit (604). A query unit (606) transmits a request for checking the presence or absence of occurrence of the event from the observation result of one or more machines to the query destination specified by the query destination specifying unit (605). The query unit (606) receives a response to the request. A result reflecting unit (607) determines whether the contents of the submission are true or false from a check result indicated by the response received by the query unit (606).

Abstract: An acquisition unit (10) acquires normal sample data and non-normal sample data. A model generation unit (120) generates a normal model representing the normal sample data. A change unit (141) generates a non-normal feature vector of the non-normal sample data, and generates a non-normal changed vector obtained by changing an element of the non-normal feature vector. When the non-normal changed vector and the normal model are similar to each other, a verification unit (142) executes a process using sample data represented by the non-normal changed vector. The verification unit (142) verifies whether an anomalous event is detected by a detection device. Upon verification that an anomalous event is not detected, the verification unit (142) determines whether an anomalous event is present, independently of the detection device.

Abstract: A state replication apparatus (200) generates communication, between a main apparatus (421) and each sub-apparatus (422, 423), to cause a state combination to transit in accordance with transition order specified in an acquisition scenario. The state replication apparatus records each of the communication generated between the main apparatus and the each sub-apparatus. The state replication apparatus acquires a snapshot combination at each of acquisition timings specified in the acquisition scenario. The state replication apparatus replicates each of the main apparatus and the each sub-apparatus in states of a replication state combination based on the acquired each snapshot combination and the recorded each communication.

Abstract: A correlation value calculation unit calculates a correlation value between input data input to an inspection-targeted apparatus whose internal specifications are unknown and output data for the input data from the inspection-targeted apparatus. A state transition determination unit analyzes in a time-series manner, a plurality of correlation values calculated by the correlation value calculation unit for a plurality of pieces of input data and a plurality of pieces of output data for the plurality of pieces of input data, and determines whether or not a state transition has occurred in the inspection-targeted apparatus.

Abstract: In an evaluation apparatus (10), a profile database (31) is a database to store profile information indicating an individual characteristic of each of a plurality of persons. A security database (32) is a database to store security information indicating a behavior characteristic of each of the plurality of persons, which may become a security incident factor. A model generation unit (22) derives a relationship between the characteristic indicated by the profile information stored in the profile database (31) and the characteristic indicated by the security information stored in the security database (32), as a model. Upon receipt of an input of information indicating a characteristic of a different person, an estimation unit (23) estimates a behavior characteristic of the different person, which may become the security incident factor, by using the model derived by the model generation unit (22).

Abstract: In an exchange-type attack simulation device (10), an e-mail reception unit (22) receives a reply e-mail to an e-mail transmitted by an e-mail transmission unit (26). A state transition unit (24) refers to correspondence information (31) indicating feature of e-mails corresponding to each of state transitions in a state transition model and thereby identifies a state transition corresponding to the reply e-mail received by the e-mail reception unit (22). An e-mail generation unit (25) generates an e-mail corresponding to the state transition identified by the state transition unit (24). The e-mail generation unit (25) makes the e-mail transmission unit (26) transmit the generated e-mail.

Abstract: A packet format inference apparatus includes a classification unit and an inference unit. The classification unit classifies, among a plurality of packets which are included in a packet data set as packet data and of which formats are unknown, relevant packets transmitted in a fixed cycle, as a packet group having a same arrival cycle. The inference unit infers a packet format for each packet group having the same arrival cycle.

Abstract: In an evaluation device (100), an attack generation unit (111) generates an attack sample. The attack sample is data for simulating an unauthorized act on a system. A comparison unit (112) compares the attack sample generated by the attack generation unit (111) and a normal state model. The normal state model is data acquired by modeling an authorized act on the system. Based on the comparison result, the comparison unit (112) generates information for generating an attack sample similar to the normal state model, and feeds back the generated information to the attack generation unit (111). A verification unit (113) checks whether the attack sample generated by the attack generation unit (111) satisfies a requirement for simulating an unauthorized act, and verifies, by using the attack sample satisfying the requirement, a detection technique implemented in a security product.