Information processor
Patent Information
- Application Number
- JP2022115422
- Authority / Receiving Office
- JP · JP
- Patent Type
- Applications
- Current Assignee / Owner
- Filing Date
- 2022-07-20
- Publication Date
- 2025-02-28
- Estimated Expiration
- 2042-07-20
AI Technical Summary
Existing systems fail to efficiently identify the software component causing an incident and the responsible organization, leading to increased workload and time in analyzing security alerts in IoT devices, particularly in automotive systems, due to the lack of accurate information sharing and feedback handling.
An information processing device with units for alert acquisition, component extraction, notification destination determination, accuracy setting, and notification, along with databases for threat, countermeasures, and feedback, enables quick identification of the software component and organization responsible for incidents, ensuring accurate and timely countermeasures.
The device quickly identifies the software component and organization responsible for incidents, reducing the workload and time to implement countermeasures by enhancing accuracy and efficiency in information sharing and feedback loops.
Smart Images
Figure 00000000_0000_ABST
Abstract
Description
[Technical field]
[0001] The present invention relates to an information processing apparatus, and more particularly to an information processing apparatus capable of identifying a software component that caused an alert when the alert occurs and quickly taking measures against the alert. [Background technology]
[0002] As the IoT revolution progresses, with everything being connected to the Internet, ensuring the security of IoT devices has become one of the most important social issues. In particular, when IoT devices are automobiles, such as connected cars and self-driving cars, security attacks on automobiles can pose a threat to human safety, and there is a demand for technology that can minimize such damage to safety.
[0003] For this reason, in recent years, vehicle-specific SOCs (Vehicle Security Operation Centers (VSOCs)) have been considered for managing security during operation after a vehicle is shipped. In a VSOC, when an alert indicates the occurrence of an incident, the company must respond in-house, including correcting the software component that caused the incident. To identify and correct the cause, it is necessary to share information with responsible organizations such as the development department and suppliers, and to request appropriate investigations and responses.
[0004] However, it takes a lot of time and effort to select the responsible organization for each software and to share the information that the organization needs accurately. In addition, the number of connected cars is increasing, and the number of vehicles monitored by VSOC will become larger. It is also expected that the methods of attacking automobiles will become more diverse. In such an environment, when a new alert is detected, it takes time to analyze it, and the workload of operators and analysts increases.
[0005] Patent Document 1 discloses a system that receives reports of problems, such as bug reports for software, and sends the reports on the problems to registered software developers from the corresponding developer organization. [Prior art documents] [Patent documents]
[0006] [Patent Document 1] JP 2016-173844 A Summary of the Invention [Problem to be solved by the invention]
[0007] However, the technology disclosed in Patent Document 1 cannot handle the correction of report contents, confirmation of accuracy, or handling of feedback information from report destinations, and therefore does not sufficiently reduce the workload of operators and analysts.
[0008] The present invention has been made in consideration of the above points, and aims to provide an information processing device that, when an incident occurs, can quickly identify the software component or responsible organization that caused the incident and quickly implement incident countermeasures. [Means for solving the problem]
[0009] An example of an information processing device according to the present invention includes an alert acquisition unit that acquires alert information, a component extraction unit that extracts software components that require countermeasures based on the alert information, a notification destination determination unit that determines organizations that can take countermeasures for the software components and determines notification information to notify the organizations, a reliability setting unit that sets the reliability of the notification information, and a notification unit that notifies the organizations of the software components if the reliability is equal to or greater than a predetermined threshold. Effect of the Invention
[0010] According to the present invention, when an incident occurs, it is possible to quickly identify the software component that caused the incident and the organization responsible, and quickly implement measures to deal with the incident. Further features related to the present invention will become apparent from the description of the present specification and the accompanying drawings. Furthermore, the objects, configurations and effects other than those described above will become apparent from the following description of the embodiments. [Brief description of the drawings]
[0011] [Figure 1] FIG. 1 is a functional block diagram showing a functional configuration of an information processing device according to an embodiment of the present invention. [Diagram 2] 1 is a diagram showing an overview of an entire process executed by an information processing device according to an embodiment of the present invention in cooperation with an external entity when an alert is received. [Diagram 3] FIG. 13 is a diagram showing a process in which a mapping unit generates a mapped alert. [Figure 4] FIG. 13 is a diagram showing a process in which a component extraction unit generates a component-extracted alert. [Diagram 5] 11 is a diagram showing a process in which a notification destination determination unit generates notification information. [Figure 6] 13 is a diagram showing a process in which a certainty setting unit generates certainty-set notification information; [Figure 7] FIG. 13 is a diagram showing a processing flow that a notification unit performs on certainty-set notification information. [Figure 8] FIG. 13 is a diagram showing a process in which a DB update unit updates each database. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS
[0012] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail using examples with reference to the drawings.
[0013] First, a functional configuration of an information processing device 1 according to an embodiment of the present invention will be described. Note that the information processing device 1 may be, for example, a computer equipped with a memory and a processor as a hardware configuration, or may be a cloud implemented on a server.
[0014] The information processing device 1 includes an alert acquisition unit 11, a mapping unit 12, a component extraction unit 13, a notification destination determination unit 14, a reliability setting unit 15, a notification unit 16, a feedback reflection unit 17, a DB (database) update unit 18, and a storage unit 100. The storage unit 100 also stores an alert threat DB 101, a countermeasure DB 102, a countermeasure software DB 103, a responsible organization DB 104, and a feedback DB 105. Details of these functional units and databases will be described later.
[0015] The information processing device 1 is also connected to a plurality of external entities 3 via a communication path 2 connected to a communication interface (not shown) of the information processing device 1. The communication path 2 may physically include a plurality of communication buses, and the standards of each communication bus may be the same or different. The external entity 3 receives a message from the information processing device 1 via the communication path 2, and transmits a message to the information processing device 1 via the communication path 2. In this embodiment, the "external entity" refers to an external / internal system including a SIEM, which transmits and receives information to and from the information processing device 1, and an external / internal organization including a PSIRT analyst, which will be described later.
[0016] The functional block diagram shown in Fig. 1 is an example, and the units and names of the functions are not limited to those shown therein. For example, the functions realized by the component extractor 13 in this embodiment may be realized by other functional units shown in Fig. 1, or may be realized by a functional unit not shown in Fig. 1. In addition, the alert acquirer 11 may have the above-mentioned communication interface function.
[0017] 2 is a diagram showing an overview of the entire process that an information processing device according to an embodiment of the present invention executes in cooperation with an external entity when it receives an alert. An alert is a warning indicating the occurrence or possibility of an incident, and an incident is some kind of trouble that occurs in an electronic device, such as an electronic device mounted on a vehicle malfunctioning or not starting up. In the figure, dotted arrows represent reference of information to each database, which is a data collection stored in hardware such as a memory or software on the cloud, and solid arrows represent transmission of information.
[0018] 2 is a process executed by the CPU while each functional unit of the information processing device 1 refers to each database in the storage unit 100. Here, among the databases, information in the alert threat DB 101, the countermeasure DB 102, the countermeasure software DB 103, and the responsible organization DB 104 is generated in advance by the PSIRT analyst 32.
[0019] The above-mentioned PSIRT is an abbreviation for Product Security Incident Response Team, and refers to an organization that improves the security level and responds to incidents in products and services that are manufactured and developed in-house. In other words, PSIRT has a detailed understanding of errors that may occur in products (equipment, software components, etc.) that may cause incidents, as well as countermeasures against such errors, and is able to organize and create a database of these.
[0020] The PSIRT analyst 32 can create each of the above-mentioned databases by appropriately referring to the detailed design (specification) 19 of each product, the SBOM (Software Bill of Materials) 20 that shows the specifications of the software components, the results 21 of the risk assessment performed on each product, and the rules 22 for generating alerts.
[0021] Next, the process performed with reference to these databases will be described. When an alert is issued from any device, the alert is sent from the SIEM 31, which is one of the external entities 3, to the alert acquisition unit 11 of the information processing device 1. Here, SIEM is an abbreviation for Security Information and Event Management, and refers to a security product that centrally manages and analyzes logs from all IT devices, including network products and security products, and detects threats that may lead to incidents.
[0022] When the alert acquisition unit 11 acquires an alert, it is transferred to the mapping unit 12. The mapping unit 12 maps the alert by assigning a threat ID and a countermeasure ID to the alert with reference to the alert threat DB 101 and the countermeasure DB 102. The mapping result is transferred to the component extraction unit 13.
[0023] Upon receiving the mapping result, the component extraction unit 13 refers to the countermeasure software DB 103 and extracts software components related to the countermeasure ID. The extraction result is transferred to the notification destination determination unit 14.
[0024] The notification destination determination unit 14 refers to the responsible organization DB 104 to determine an organization that can implement measures for the extracted software components, and also determines information to be notified to the organization. Then, notification information is generated that includes the organization selected as a result of the determination and the content to be notified. The notification information is transferred to the accuracy setting unit 15.
[0025] The accuracy setting unit 15 sets the accuracy for the received notification information by referring to the feedback DB 105. Here, the accuracy refers to the likelihood that the notification destination and notification content included in the notification information correctly correspond to the alert acquired by the alert acquisition unit 11. The notification information with the accuracy set is transferred to the notification unit 16.
[0026] The notification unit 16 compares the accuracy of the received notification information with a predetermined threshold. If the accuracy is equal to or higher than the predetermined threshold, it transfers the information directly to the organization to which the information is to be notified. If the accuracy is lower than the predetermined threshold, it transmits the information to an analyst 33, which is one of the external entities 3. Here, the analyst 33 is an expert (a specialized analysis organization) who usually monitors, detects, analyzes, and responds to cybersecurity incidents 24 hours a day, 365 days a year. The analyst 33 analyzes the notification information with low accuracy, and if it is determined that the notification information corresponds correctly to the alert, it approves the notification information and transmits it to the notification unit 16. If the notification information does not correspond correctly to the alert, it is changed or modified to information that corresponds correctly to the alert, and then transmitted to the notification unit 16.
[0027] The notification unit 16 then transmits the approved / changed notification information received from the analyst 33 as notification information to the notification destination 34. If the notification information received from the analyst 33 is changed, the notification unit 16 transfers the change information to the DB update unit 18.
[0028] When the notification destination 34 receives the notification information from the notification unit 16, it makes a final decision as to whether the notification information correctly corresponds to the alert. Then, it transmits the result of the decision to the feedback reflection unit 17.
[0029] The feedback reflection unit 17 transfers the feedback information received from the notification destination 34 to the notification unit 16 and the DB update unit 18. In other words, this feedback accurately indicates whether or not the notification information sent by the notification unit 16 to the notification destination 34 correctly corresponds to the alert.
[0030] The notification unit 16 that has received the feedback information modifies the notification information. The DB update unit 18 stores the received modification information and feedback information in the feedback DB 105.
[0031] Next, the processes executed by each functional unit will be described in further detail with reference to FIGS.
[0032] 3 is a diagram showing details of the process in which the mapping unit 12 generates a mapped alert. The alert threat DB 101 is a database that stores information on threats related to an issued alert (attack target module, attack target protected asset, attack source, attack reason, threat event). The countermeasure DB 102 is a database that stores a list of countermeasures to be taken for each threat stored in the alert threat DB.
[0033] First, it is assumed that the alert transferred from the alert acquisition unit 11 has an alert type of IVI-Navi-Error123 and has an alert ID of A123.
[0034] The mapping unit 12 searches for a threat related to the received alert by referring to the alert threat DB 101. In this embodiment, it is found from the alert threat DB 101 shown in Fig. 3 that the received alert is related to a threat with a threat ID: T1, which is a threat of intentionally causing an unauthorized operation of a function of a car navigation system in an IVI (In-Vehicle Infotainment system) from a NW (Network) 1.
[0035] Then, the countermeasures to be implemented for the threat ID: T1 are searched for by referring to the countermeasure DB 102. In this embodiment, it is found that two types of countermeasures, which are assigned countermeasure IDs: M1 and M2, are set for the threat ID: T1.
[0036] Based on the above processing, the mapping unit 12 generates a mapped alert by assigning a threat ID and a countermeasure ID to the alert, and transfers it to the component extraction unit 13.
[0037] 4 is a diagram showing a process of generating a component-extracted alert, which is performed by the component extraction unit 13 upon receiving a mapped alert from the mapping unit 12. The countermeasure software DB 103 stores software components corresponding to each of the countermeasures stored in the countermeasure DB 102. In other words, it stores software components capable of executing the countermeasures.
[0038] The component extraction unit 13 that has received the mapped alert searches for a software component that corresponds to the countermeasure ID assigned to the mapped alert, with reference to the countermeasure software DB 103. In this embodiment, it is found that the software component SW1 corresponds to the countermeasure content assigned with countermeasure ID: M1, and the software component SW2 corresponds to the countermeasure content assigned with countermeasure ID: M2.
[0039] The component extraction unit 13 then adds the component information to the mapped alert to generate a component-extracted alert. The generated component-extracted alert is transferred to the notification destination determination unit 14.
[0040] FIG. 5 is a diagram showing a process of generating notification information, which is performed by the notification destination determination unit 14 that receives a component extraction alert from the component extraction unit 13. The responsible organization DB 104 stores organizations associated with each software component stored in the countermeasure software DB 103. In the case of a company, an organization associated with a software component may be, for example, a department that developed the software component or a department in charge of maintenance. In the case of another company, an organization associated with the software component may be, for example, a responsible department within the company. The number of organizations is not limited to one, and there may be multiple organizations when, for example, a software component is jointly developed or development and maintenance are performed by different organizations. In addition, the responsible organization DB 104 also stores the contents of information to be notified to the organization. There may also be multiple notification contents depending on the role of the organization, as described above.
[0041] The notification destination determination unit 14 searches for organizations related to each software component by referring to the responsible organization DB 104. In this embodiment, it is found that the notification contents shown in the figure should be notified to organizations O1 and O2 for the software component SW1, and to organization O3 for the software component SW2.
[0042] Through the above process, the notification destination determination unit 14 generates notification information by adding the notification destination and notification content to the alert content. Note that, as shown in Fig. 5, alerts having the same alert type may be combined into one notification. The generated notification information is transferred to the accuracy setting unit 15.
[0043] FIG. 6 is a diagram showing a process of generating notification information with accuracy set, which is performed by the accuracy setting unit 15 that receives notification information from the notification destination determination unit 14. The feedback DB 105 is a database that stores change information and feedback information obtained through a series of processes performed up to that point. All alert information having a notification number has an alert type, a countermeasure ID, an extracted software component, a notification destination, and notification content. When a series of processes is performed, feedback is obtained from the analyst 33 or the notification destination 34, as explained in the process overview of FIG. 2. That is, feedback on whether or not the notification information generated by the notification unit 16 was ultimately correct is stored.
[0044] The accuracy setting unit 15 sets the accuracy of the notification information by referring to this feedback DB 105. Specifically, in the case of notification information of notification No. 45 in Fig. 6, when the threat ID is 1, the countermeasure ID is M1, and the extracted software component is SW1, one of the notification destinations is set as O1. In this case, 12 similar notifications are stored in the feedback DB 105, and it is shown that the notification destination is O1 and correct in 10 cases, which is 83% of the notifications. Similarly, with regard to the notification destination being O2, it is shown that O2 was correct in 8 cases, which is 66% of the 12 notifications. In other words, it is shown that O2 was incorrect as the notification destination in 4 cases out of the 12 notifications.
[0045] Similarly, the notification contents are compared with the feedback stored in the feedback DB 105, and the degree to which the notification contents were correct is set as the degree of accuracy. In this way, the accuracy setting unit 15 generates the accuracy-set notification information. The generated accuracy-set notification information is transferred to the notification unit 16.
[0046] FIG. 7 is a diagram showing a process performed by the notification unit 16 upon receiving the certainty-set notification information from the certainty setting unit 15. As shown in FIG.
[0047] The notification unit 16, which has received the notification information with the accuracy set, judges the accuracy of the notification destination and notification contents included in the notification information. Here, the notification unit 16 stores a threshold value for accuracy, and if the accuracy of either the notification destination or the notification contents is less than the threshold value, it judges that there is a relatively high possibility that the notification destination or the notification contents are incorrect, and transmits the notification information to an analyst (analysis organization) 33 for detailed analysis. If the accuracy is equal to or greater than the threshold value, it judges that detailed analysis is unnecessary, and transmits the notification information directly to the notification destination (organization capable of taking measures) 34. The threshold value for accuracy can be set as appropriate, for example, 75% for the accuracy and 5 for the number of feedbacks. This threshold value may be different for each alert type, and may be updated daily.
[0048] In this way, in this embodiment, by setting a degree of certainty in the notification information, if the notification information has a relatively high degree of certainty, a detailed analysis by an analyst can be omitted and the information can be sent directly to the notification recipient. This makes it possible to quickly share the contents of the alert and significantly reduce the time it takes to implement measures in response to the alert.
[0049] When the accuracy of the notification information is low and the notification information is sent to the analyst 33, the analyst 33 analyzes the notification information in detail, and if there is any part that needs to be changed, returns change information including the change content to the notification unit 16. The notification unit 16 that has received the change information corrects the notification information based on the change information and sends it to the notification destination 34. At the same time, it sends the change information to the DB update unit 18.
[0050] The notification destination 34 that has received the notification information makes a final decision as to whether the notification information is correct or not, and transmits the result as feedback information to the feedback reflection unit 17. The feedback reflection unit 17 generates final feedback information based on the received feedback information, and transmits the generated feedback information to the notification unit 16 and the DB update unit 18.
[0051] The notification unit 16 may notify the notification destination 34 of not only the above notification information but also information about the software component included in the notification information and the notification source of the countermeasure information. The notification destination 34 can improve the analysis accuracy by using such information.
[0052] The DB update unit 18 stores the received change information and feedback information in the feedback DB 105. The reason for storing both the change information and the feedback information is that the change information is the change content resulting from the analysis by the analyst 33, and the feedback information is the final feedback by the notification destination 34, and therefore, by clarifying the differences between them, it is expected that the accuracy of the analysis by the analyst will be improved.
[0053] In this manner, according to this embodiment, the database is updated based on final feedback obtained from the destination for the initially generated notification information, which is expected to improve the accuracy of the initial information generated when an alert is issued.
[0054] 8 is a diagram showing the process of updating each database, which is performed by the DB update unit 18. The DB update unit 18 compares the final feedback information received from the notification destination 34 with the information stored in the database before processing, and generates a proposal for the database to be updated and its contents.
[0055] In this embodiment, for example, with regard to the notification information of notification No. 45 shown in Fig. 7 etc., the countermeasure software DB 103 at the time of generating the notification information stored that software component SW2 corresponds to countermeasure ID: M2, but this was determined to be an error for software component SW3, and the change is included as a proposal. Also, with the update of the countermeasure software DB 103, the responsible organization DB 104 also includes as a proposal a change to the responsible organization and notification content corresponding to software component SW3.
[0056] The DB update unit 18 sends the DB update proposal obtained by the above-mentioned process to the PSIRT analyst 35 and requests its approval or further changes. Then, the update proposal returned from the PSIRT analyst 35 is treated as the final proposal, and each database is updated.
[0057] In this way, each database is updated based on the feedback information obtained, which makes it possible to improve the accuracy of notification information generation and reduce the amount of notification information that requires detailed analysis by analysts, and is expected to shorten the time it takes to share information and implement countermeasures.
[0058] According to the embodiment of the present invention described above, the following advantageous effects are obtained. (1) An information processing device according to one embodiment of the present invention includes an alert acquisition unit that acquires alert information, a component extraction unit that extracts software components that require countermeasures based on the alert information, a notification destination determination unit that determines organizations that can take countermeasures for the software components and determines notification information to notify the organizations, a reliability setting unit that sets the reliability of the notification information, and a notification unit that notifies the organizations of the software components if the reliability is equal to or greater than a predetermined threshold.
[0059] With the above configuration, when an incident occurs, it becomes possible to quickly identify the software component that caused the incident and the organization responsible, and quickly implement measures to deal with the incident.
[0060] (2) A mapping unit is further provided that assigns, to the alert information, threat information indicating information on a threat related to the alert information and countermeasure information corresponding to the threat information, and the component extraction unit extracts software components based on the assignment results by the mapping unit. This allows more information to be used when extracting software components, and is expected to improve the accuracy of software component extraction.
[0061] (3) When the reliability of the notification information is less than a threshold, the notification unit notifies the analysis organization of the notification information, and when change information is received from the analysis organization, notifies the organization of the software component and the countermeasure information based on the change information. Since the analysis organization analyzes notification information with low reliability, it is possible to avoid the problem of sending information with low reliability to the notification destination organization and taking extra time for analysis within the organization.
[0062] (4) When the certainty of the notification information is equal to or greater than a threshold, the notification unit notifies the organization of the software component and the countermeasure information without notifying the analysis organization of the notification information. This makes it possible to quickly transmit information with a relatively high certainty to the notification destination organization and reduce the time required to implement countermeasures.
[0063] (5) A feedback reflection unit that updates the notification information based on feedback information obtained from the organization is further provided. This allows the notification information to reflect correct information finally determined by the organization to which the notification is to be sent, which is expected to improve the accuracy of subsequent analyses.
[0064] (6) An alert threat database that stores a type of alert information in association with threat information indicating information on a threat related to the type, a countermeasure database that stores threat information in association with countermeasures, a countermeasure software database that stores countermeasures in association with software components, a responsible organization database that stores a responsible organization for each set of countermeasures and software components, and a feedback database that stores feedback information and change information of notification information. By providing such components, it is expected that the convenience of the present invention will be improved.
[0065] (7) Further comprising a DB update unit that updates the alert threat database, countermeasure database, countermeasure software database, responsible organization database, and feedback database based on the feedback information and change information. This allows the information in each database to be updated to the correct information, which is expected to improve the accuracy of each process.
[0066] (8) The Notification Unit notifies the organization of the information about the software component and the organization that sent the countermeasure information. This enables the organization that received the notification to refer to the information about the organization that sent the notification and analyze the notification more appropriately.
[0067] The present invention is not limited to the above-described embodiments, and various modifications are possible. For example, the above-described embodiments have been described in detail to clearly explain the present invention, and the present invention is not necessarily limited to an embodiment having all of the configurations described. It is also possible to replace a part of the configuration of one embodiment with the configuration of another embodiment. It is also possible to add the configuration of another embodiment to the configuration of one embodiment. It is also possible to delete a part of the configuration of each embodiment, or to add or replace another configuration. [Explanation of symbols]
[0068] 1 Information processing device, 3 External entity, 11 Alert acquisition unit, 12 Mapping unit, 13 Component extraction unit, 14 Notification destination determination unit, 15 Accuracy setting unit, 16 Notification unit, 17 Feedback reflection unit, 18 DB update unit, 34 Notification destination, 101 Alert threat DB, 102 Countermeasure DB, 103 Countermeasure software DB, 104 Responsible organization DB, 105 Feedback DB
Claims
1. an alert acquisition unit that acquires alert information; a component extraction unit that extracts software components that require measures based on the alert information; a notification destination determination unit that determines an organization that is capable of taking the measures against the software component and determines notification information to be notified to the organization; an accuracy setting unit for setting the accuracy of the notification information; a notification unit that notifies the organization of the software component when the certainty is equal to or greater than a predetermined threshold; a mapping unit that assigns, to the alert information, threat information indicating information on a threat related to the alert information and countermeasure information corresponding to the threat information, The component extraction unit extracts the software components based on the assignment result of the mapping unit.
23. An information processing apparatus comprising:
2. 2. The information processing device according to claim 1, the notification unit notifies an analysis organization of the notification information when the certainty of the notification information is less than the threshold value, and when receiving change information from the analysis organization, notifies the organization of the software component and the countermeasure information based on the change information.
23. An information processing apparatus comprising:
3. 3. The information processing device according to claim 2, when the certainty of the notification information is equal to or greater than the threshold, the notification unit notifies the analysis organization of the software component and the countermeasure information, without notifying the analysis organization of the notification information; 23. An information processing apparatus comprising:
4. an alert acquisition unit that acquires alert information; a component extraction unit that extracts software components that require measures based on the alert information; a notification destination determination unit that determines an organization that is capable of taking the measures against the software component and determines notification information to be notified to the organization; an accuracy setting unit for setting the accuracy of the notification information; a notification unit that notifies the organization of the software component when the certainty is equal to or greater than a predetermined threshold; a feedback reflecting unit that updates the notification information based on feedback information acquired from the organization, 23. An information processing apparatus comprising:
5. 5. The information processing device according to claim 4, an alert threat database that stores a type of the alert information and threat information indicating information on a threat related to the type in association with each other; a countermeasure database that stores the threat information and the countermeasure in association with each other; a countermeasure software database that stores the countermeasures and the software components in association with each other; a responsible organization database that stores a responsible organization in association with each pair of the countermeasure and the software component; and a feedback database for storing the feedback information and change information of the notification information.
23. An information processing apparatus comprising:
6. 6. The information processing device according to claim 5, An information processing device further comprising a database update unit that updates the alert threat database, the countermeasure database, the countermeasure software database, the responsible organization database, and the feedback database based on the feedback information and the change information.
7. 2. The information processing device according to claim 1, the notification unit notifies the organization of information about the software component and the organization that has notified the countermeasure information.
23. An information processing apparatus comprising: