Attack estimation device, attack control method and attack estimation program

摘要

Attack estimation deviceAttack treeAbstract attack treeAnd storage section that holds confirmation log management informationReceive a detection alert that notifies that an attack has occurred on the target systemAttack treeAbstract attack treeAnd check log management information.Includes a prediction section for predicting the extent of contamination due to attackThe prediction sectionIf no threat trace information corresponding to an attack could be specified,An unknown attack occurred as an attackSee the abstract attack treeIdentify an abstract attack nameCheck log management informationIdentifying equipment with a high possibility of traces marked by unknown attacksThe specific range of the log is identified corresponding to the specific equipment to predict the contamination range by unknown attack.