Abstract: An estimation device (10) receives a device ID for identifying a device in a network and an observation event that has occurred in the device from a user terminal (20) as an input. The estimation device (10) acquires attribute information of the device corresponding to the received device ID from a device information storage unit (13c), estimates a risk that the device in the network is subject to an attack on the basis of the acquired attribute information and the received observation event, and outputs the estimated attack risk to the user terminal (20).

Abstract: A search device has a know-how storing unit for storing a log indicating a past crisis response instance, one of a “problem” label indicating that the log is of a problem instance that is to be responded and solved, a “result” label indicating that the log is of a result brought about by a responding action, and a “response” label indicating that the log is of a responding action that has been performed to solve a problem, and a task number corresponding to the log, in association with each other. Further, there is a know-how search unit for repeating a search to retrieve a log similar to a first search key that is an input log from logs assigned the “problem” label in the know-how storing unit, and a search to retrieve a log similar to a second search key.

Abstract: A danger response evaluation device estimates the content of a possible danger through simulation using observation data acquired from an external device. Then, when the estimated content of the danger exceeds a predetermined threshold value, the danger response evaluation device gives, to a user terminal of a user, notification of an alarm that prompts a response to the danger. Thereafter, when having acquired the content of a response of the user to the danger from the user terminal of the user, the danger response evaluation device determines how much the content of the response corresponds to execution of a plan of a response to the danger stored in a storage unit in advance. Then, the danger response evaluation device evaluates, based on a result of the determination, how much the content of the actual response of the user contributes to a damage prevention effect related to the danger.

Abstract: A danger response evaluation device estimates the content of a possible danger through simulation using observation data acquired from an external device. Then, when the estimated content of the danger exceeds a predetermined threshold value, the danger response evaluation device gives, to a user terminal of a user, notification of an alarm that prompts a response to the danger. Thereafter, when having acquired the content of a response of the user to the danger from the user terminal of the user, the danger response evaluation device determines how much the content of the response corresponds to execution of a plan of a response to the danger stored in a storage unit in advance. Then, the danger response evaluation device evaluates, based on a result of the determination, how much the content of the actual response of the user contributes to a damage prevention effect related to the danger.

Abstract: An estimation device (10) receives a device ID for identifying a device in a network and an observation event that has occurred in the device from a user terminal (20) as an input. The estimation device (10) acquires attribute information of the device corresponding to the received device ID from a device information storage unit (13c), estimates a risk that the device in the network is subject to an attack on the basis of the acquired attribute information and the received observation event, and outputs the estimated attack risk to the user terminal (20).

Abstract: A search device has a know-how storing unit for storing a log indicating a past crisis response instance, one of a “problem” label indicating that the log is of a problem instance that is to be responded and solved, a “result” label indicating that the log is of a result brought about by a responding action, and a “response” label indicating that the log is of a responding action that has been performed to solve a problem, and a task number corresponding to the log, in association with each other. Further, there is a know-how search unit for repeating a search to retrieve a log similar to a first search key that is an input log from logs assigned the “problem” label in the know-how storing unit, and a search to retrieve a log similar to a second search key.

Abstract: A collecting unit (11) of a presentation apparatus (10) collects information that is information regarding crisis management and is associated with each of a plurality of information sources (20), from the plurality of information sources (20). A supplementing unit (15) supplements information not collected by the collecting unit (11), in the information. An estimating unit (14) estimates a risk of a crisis, based on the information collected by the collecting unit (11) and the information supplemented by the supplementing unit (15). A calculating unit (13) calculates a reliability level of a risk estimated by the estimating unit (14), based on a level of supplementation by the supplementing unit (15). A presenting unit (17) presents the risk estimated by the estimating unit (14), together with the reliability level calculated by the calculating unit (13).