Analysis system, method, and program

Abstract

The topology identification unitidentifies a network topology of devices included in a system to be diagnosed. The detection unitdetects attack routes that indicate flows of attacks that can be executed in the system to be diagnosed, based on security information about each device. The time information identification unitidentifies time information that represents degree of time required to attack a device, for each device on each attack route. The display control unitdisplays the attack routes on a display device by superimposing the attack routes on the network topology. At this time, the display control unitdisplays each attack route on the display device in a manner that allows a user to recognize degree of spread of attack along each attack route, based on the time information identified for each device on each attack route.