Attack path generation method and attack path generation device

Abstract

An attack path generation method according to the present disclosure is an attack path generation method executed by acquiring logs in devices connected to a network including at least one of a branch and a merge where each device has an attack detection function. The method includes: generating a primary-attack path without the branch and merge based on the acquired logs; generating a secondary-attack path branching from the primary-attack path or merging with the primary-attack path based on the logs; and outputting the generated primary-attack path and secondary-attack path to a device that performs attack-determination. The secondary-attack path is an attack path including an upstream or downstream device in which an event assumed to be an attack occurs within a certain period of time from an event assumed to be an attack on a device included in the primary-attack path and connected to the network merging/branching point.