Cyber attack evaluation program, cyber attack evaluation method, and information processing device

摘要

PROBLEM TO BE SOLVED: To support the evaluation of detection indicators regarding cyber attacks. A cyber attack evaluation program according to an embodiment causes a computer to execute an inquiry process and an output process. The inquiry process is based on the domain information included in the input cyber attack information, and whether or not there is an address corresponding to the domain information in the plurality of first management servers that manage the association between the domain information and the address. To inquire. In addition, in the inquiry process, the communication of the first management server is monitored and the second management server that manages the reply history of the first management server regarding the correspondence between the domain information and the address is queried for the reply history regarding the domain information. .. The output process is a cyber attack on domain information, based on the ratio of responses in which the addresses corresponding to the domain information do not exist in the responses acquired from each of the first management servers and the response history acquired from the second management server. The diagnostic result of the threat content of is output. [Selection diagram] Figure 1