Information Processing Device Information Processing Method And Program

Abstract: An attack activity definition information database (111) stores for a plurality of events attack activity definition information wherein are delineated an event which is observed in an information system over a course whereupon an attack is carried out upon the information system a prior condition which is a precondition for the event to be observed and a fulfillment phenomenon which is a phenomenon after the event is observed. An event receiving unit (108) receives observed event notification information whereby the observed event which is observed in the information system is notified. An attack activity predict unit (105) acquires the fulfillment phenomenon from the attack activity definition information wherein the observed event is delineated whereof the notification is issued with the observed event notification information and on the basis of the attack activity definition information wherein the prior condition is delineated which matches the fulfillment phenomenon of the acquired observed event extracts the event which is predicted to be observed thereafter in the information system.

Patent Information

Applicants

Inventors

Specification

Documents

Application Documents

Search Strategy