Information processing device and information processing method

Abstract

Attack cases (for example, including attack details, countermeasures, and the like) of each device forming each attack path are derived by comprehensively extracting attack paths assumed for a target system. An information processing device D includes: an input unit () configured to read a list of a device group included in a system and a list of connection relations between devices; an attack path extracting unit () configured to extract an attack path on the basis of the list of the device group and the list of the connection relations read by the input unit (); an attack case DB unit () configured to store a past attack case in association with an attack phase and a node condition at a time when the attack case occurred; an attack case search unit () configured to determine an attack phase and a node condition of each device serving as each node configuring the attack path extracted by the attack path extracting unit () and acquire an attack case corresponding to each device by searching the attack case DB unit () using the determined attack phase and the determined node condition; and an output unit () configured to output a result of the search.