In this invention, in a network system, a security sensor that detects a sign of incursion is located in an electronic control device and a communication device on a subnetwork, the security sensor transmits an alert to the subnetwork when detecting the sign of incursion, and an intrusion path analysis device is located on the subnetwork and is composed of a security alert collection unit, an intrusion path analysis unit, and an analysis report output unit. The security alert collection unit receives a security alert, the intrusion path analysis unit performs an analysis on the basis of the security alert collected by the security alert collection unit and an intrusion depth representing the degree of attacker's intrusion and outputs the analysis result, and the analysis report output unit outputs the method of intrusion of the attack and a current intrusion level on the basis of the analysis result.
展开▼
