Impact range estimation apparatus, impact range estimation method, and computer-readable recording medium

Abstract

An impact range estimation apparatusestimates a range of impact due to infection by malware in a network system with a plurality of nodes. The impact range estimation apparatusincludes: a reverse propagation probability calculation unitconfigured to, when a specific node is infected with the malware, based on scenario information that specifies a pattern of attack by the malware and a communications log in the network system before infection by the malware, for each node other than the specific node, calculate a probability that the malware propagates from that other node to the specific node; and a simulation execution unitconfigured to, using the calculated probability, execute a plurality of times a simulation in which the malware is propagated to the specific node, and for each other node, calculate a number of times that that node becomes a propagation source of the malware.