Abstract: A display apparatus (10) includes an acquiring unit (11) configured to acquire configuration information of an information system that includes a plurality of nodes; a determining unit (12) configured to determine a display method of displaying an object of security information display concerning a node in the acquired configuration information, based on a security characteristic of an attackable element used to attack the object of security information display and a security characteristic of a preventive measure element preventing an attack on the object of security information display; and a display unit (13) configured to, when displaying a system configuration of the information system, display the object of security information display in accordance with the determined display method.

Abstract: Provided is an analysis system that allows a security administrator to understand the impact of known vulnerabilities on the system to be diagnosed. The topology identification unit 14 identifies network topology of devices included in a system to be diagnosed. The analysis unit 6 generates an attack pattern that includes an attack condition, an attack result, an attack means that is vulnerability that is used by an attack, and a segment where the attack can occur in the system to be diagnosed. The display control unit 8 displays segments included in attack patterns superimposed on the network topology, on a display device. At this time, the display control unit 8 changes a display mode of the segment according to a type of the vulnerability that corresponds to the attack means included in the attack pattern including the segment.

Abstract: A risk analysis is conducted without increasing the computational cost. A grouping means groups a plurality of hosts included in a system to be analyzed into a plurality of groups. A virtual analysis element generation means generates at least one virtual analysis element for each of the plurality of groups. An analysis means analyzes whether an attack against the virtual analysis element being an end point of an attack is possible by using the virtual analysis element. An analysis target element determination means determines, as a target of a risk analysis, a host corresponding to the virtual analysis element included in a path where the attack occurs among hosts included in the system to be analyzed. An analysis means analyzes whether an attack against the host being the end point of the attack is possible for the host determined as a target of the risk analysis.

Abstract: Generation of an attack scenario to be used for risk analysis of a system to be analyzed is enabled without depending on the technique and the knowledge of a person who creates it. An analysis result acquisition means acquires a risk analysis result of a first risk analysis performed on a system to be analyzed. A condition acquisition means acquires conditions for an attack scenario to be used for a second risk analysis on the basis of an attack scenario table and the risk analysis result. An attack scenario generation means generates an attack scenario to be used for the second risk analysis on the basis of the conditions for the attack scenario acquired by the condition acquisition means.

Abstract: The knowledge generation apparatus (2000) obtains a plural pieces of attack result information (100), which includes a configuration of an attack performed on the computer environment, a configuration of the computer environment attacked, and a result of the attack. By comparing the obtained attack result information (100), the knowledge generation apparatus (2000) detects environment conditions, which is regarding the configuration of the computer environment that are necessary for the success of the attack. The knowledge generation apparatus (2000) performs selection on the detected environment conditions based on a selection rule (200), and generates the knowledge information (300) that includes the selected environment conditions. The selection rule represents a rule for determining whether to include the environment condition in the knowledge information (300), with respect to a feature of a set of attacks that are affected by the environment condition.

Abstract: An attack information processing apparatus (10) includes an extraction unit (11) configured to extract first and second attack knowledge pieces indicating conditions of a cyber attack from first and second attack information pieces including descriptions of the cyber attack, a determination unit (12) configured to determine similarity between the first and second attack information pieces, and a complementing unit (13) configured to complement the first attack knowledge piece with the second attack knowledge piece based on the determined similarity.

Abstract: An analysis apparatus (10) includes: a setting unit (11) configured to set virtual vulnerabilities in a plurality of nodes configuring an information system to be analyzed; an extraction unit (12) configured to extract an attack route of the information system based on the virtual vulnerabilities set by the setting unit (11); and a discrimination unit (13) configured to discriminate vulnerabilities to be monitored based on the virtual vulnerabilities in the extracted attack route extracted by the extraction unit (12).

Abstract: A risk analysis result display apparatus, a risk analysis result display method, and a computer readable medium capable of enabling a user to recognize changes in risk in a system are provided. A risk analysis result (13) is a risk analysis result obtained by assessing a risk to a system to be analyzed in a first assessment period. A risk analysis result (14) is a risk analysis result obtained by assessing the risk to the system to be analyzed in a second assessment period different from the first assessment period. Comparison means (11) compares the risk analysis result (13) with the risk analysis result (14), and extracts a difference between the risk analysis result (13) and the risk analysis result (14). Output means (12) displays the difference extracted by the comparison means (11) for a user.

Abstract: An analysis apparatus (10) includes an environment assessment unit (11) for assessing environmental metrics of a Common Vulnerability Scoring System (CVSS) as regards a vulnerability in an information system based on an attack path extracted from the information system to which the vulnerability to be analyzed is applied, a base assessment unit (12) for assessing base metrics of the CVSS as regards the vulnerability in the information system based on obtained CVSS base value information of the vulnerability and a predetermined base value countermeasure determination condition of the information system, and a determination unit (13) for determining whether or not the vulnerability in the information system needs to be addressed based on an assessment result of the environmental metrics and an assessment result of the base metrics.

Abstract: A comparison means compares a first risk analysis result with a second risk analysis result. The first risk analysis result includes a first risk evaluation value. The second risk analysis result includes a second risk evaluation value. Based on the result of the comparison, a display means displays the first risk evaluation value in such a manner that a first risk evaluation value for which there is a second risk evaluation value, in the second risk analysis result, for an attack step of which an attack destination coincides with an asset included in the first risk analysis result and an attack method coincides with an attack method included in the first risk analysis result can be distinguished from a first risk evaluation value for which there is no such second risk evaluation value.

Abstract: Attack path information includes information about an attack path including at least one attack step including an attack source, an attack destination, and an attack method. Vulnerability specification means refers to the attack path information and thereby specifies vulnerabilities exploitable by an attack on the attack destination in the attack step. In the vulnerability information DB, vulnerabilities and presence/absence of exploit codes for the vulnerabilities are stored and associated with each other. Diagnosis evaluation generation means refers to the vulnerability information DB, and thereby examines whether or not there is an exploit code for the specified vulnerability and generates, for the attack step, a risk diagnosis evaluation including the number of specified vulnerabilities and the presence/absence of the exploit codes therefor. Output means outputs the attack step and the risk diagnosis evaluation while associating them with each other.

Abstract: Provided is an analysis system that can analyze the degree of impact of vulnerability on individual systems. An analysis unit 6 generates an attack pattern that includes an attack condition, an attack result, an attack means that is vulnerability that is used by an attack, and a segment where the attack can occur in a system to be diagnosed. A calculation unit 12 calculates an evaluation value, for each vulnerability, which indicates degree of impact of the vulnerability on the system to be diagnosed. Specifically, the calculation unit 12 calculates the evaluation value, for each vulnerability, based on the number of the attack patterns that include the vulnerability focused on as the attack means and the number of the segments indicated by each attack pattern that includes the vulnerability focused on as the attack means.

Abstract: A rule generation apparatus 100 is an apparatus that automatically generates rules used to analyze an attack, and includes a collection unit 200, an attack success condition generation unit 300, an attack-time history generation unit 400, and a rule generation unit 500.

Abstract: At least one of nodes included in the second node group comprises a request means (521) for transmitting a request signal including verification information to at least any node of the first node group, and a verification means (522) for verifying response information for the request signal, the verification means determines, regarding the response information, whether or not desired information that is information requested by the request signal or a digest thereof is included, whether or not correct verification information is included, whether or not a value obtained by applying a one-way function to the response information satisfies a predetermined rule, and a response time that is the time taken between the transmission of the request signal and the obtainment of the desired information, and on the basis of the determination results thereof, assesses the presence or absence of reliability of the desired information or the degree of reliability thereof.

Abstract: A device management system includes a learning unit 81 for learning a state model representing a normal state of a system including a control target device, based on a control sequence representing one or more time-series commands and data indicating a state of the control target device when the control sequence is issued.

Abstract: A communication node includes: a control information sharing unit which distributes a relay node reselection request; a transmission power control unit which adjusts transmission power based on the relay node reselection request; a reselection necessity determination unit which determines whether another communication node is to become a new relay node, and, in the case of determining that the other communication node is to become the new relay node, calculating priority of the communication node in the wireless ad-hoc network; and a relay node reselection request unit which performs a relay node reselection request process for transmitting a relay node reselection request included in the control information, depending on the priority.

Abstract: At least one of nodes included in the second node group comprises a request means (521) for transmitting a request signal including verification information to at least any node of the first node group, and a verification means (522) for verifying response information for the request signal, the verification means determines, regarding the response information, whether or not desired information that is information requested by the request signal or a digest thereof is included, whether or not correct verification information is included, whether or not a value obtained by applying a one-way function to the response information satisfies a predetermined rule, and a response time that is the time taken between the transmission of the request signal and the obtainment of the desired information, and on the basis of the determination results thereof, assesses the presence or absence of reliability of the desired information or the degree of reliability thereof.

Abstract: A communication node includes: a control information sharing unit which distributes a relay node reselection request; a transmission power control unit which adjusts transmission power based on the relay node reselection request; a reselection necessity determination unit which determines whether another communication node is to become a new relay node, and, in the case of determining that the other communication node is to become the new relay node, calculating priority of the communication node in the wireless ad-hoc network; and a relay node reselection request unit which performs a relay node reselection request process for transmitting a relay node reselection request included in the control information, depending on the priority.

Abstract: Provided is a router to acquire a content, even when accessibility to a server is impossible due to a network failure. The router comprises: a unit for storing content data included in a content reply message transmitted from a content server; a unit for, when the content server becomes unreachable, broadcasting, to other routers, an MBC setting request message configured to set guidance information in the other routers, the guidance information being used, when a content request message which requests the content server for the content data is transmitted from a content request node, to transfer the content request message to the own router; and a unit for replying a content reply message including the stored content data, when the content request message used to request the content server for the content data is transferred in accordance with the guidance information.

Abstract: Disclosed is a communication node device constituting a communication system performing multicast, which is characterized by that: when having forwarded data to a child node subordinate to it along a normal distribution path, it sets a retransmission timer also with respect to a child node on a redundant distribution path; and when having received data, it sends a reception confirmation message to both the parent node of the normal distribution path and a parent node of the redundant distribution path.