System, method, and program for inspecting vulnerability of web site

Abstract

To suppress inspection omission of an important function, in vulnerability inspection of a web site.SOLUTION: A vulnerability inspection server 10 provides vulnerability inspection service which inspects vulnerability (defect on information security) of a web site 22 etc. designated by a user, with respect to the user who operates a user terminal 30 communicably connected with each other via a communication network 20. The server 10, when automatically patrolling the web site 22, determines an inspection required function in which the vulnerability inspection is required, determines an association degree between each of a plurality of executable operations executable in the web page and the inspection required function, and executes the operation identified on the basis of the association degree, among a plurality of these executable operations. Thereby, execution of the operation identified on the basis of the association degree between the functions in which inspection is required is enabled. And, patrol to the web page corresponding to an important function may be facilitated.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a system, method, and program for automatically crawling a website and inspecting the vulnerability of the website. [Background technology]

[0002] Conventionally, various services have been provided for inspecting the vulnerability of websites (for example, see Patent Document 1 below). These services may automatically crawl websites, and typically, such automatic crawling involves repeating a process of extracting links, forms, and the like from the HTML data of a webpage and accessing these in sequence. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2012-133406 A Summary of the Invention [Problem to be solved by the invention]

[0004] However, in the above-mentioned automatic crawling, if an upper limit is set for the number of web pages to be accessed, the number of hierarchical levels, the elapsed time, etc., the automatic crawling may stop before crawling all the pages of the website, and as a result, some of the functions of the website may not be subject to vulnerability testing. For example, it is desirable to prevent functions that should be tested intensively, such as a product purchasing function on an EC site, from being excluded from the automatic crawling.

[0005] An object of the present invention is to prevent important functions from being left untested in a vulnerability test of a website. Other objects of the present invention will become apparent by referring to the entire specification. [Means for solving the problem]

[0006] A system according to one embodiment of the present invention is a system for testing vulnerabilities of a website by automatically crawling the website, the system having one or more computer processors, wherein the one or more computer processors execute the steps of obtaining a first web page included in the website, determining a function that requires testing for vulnerability based on first page information about the first web page, identifying a plurality of executable operations that can be performed on the first web page, determining a degree of association between each of the plurality of executable operations and the function that requires testing, executing a first operation among the plurality of executable operations that is identified based on the degree of association, and obtaining a second web page in response to the execution of the first operation.

[0007] A method according to one embodiment of the present invention is executed by one or more computers and is a method for testing vulnerabilities of a website involving automatic crawling of the website, and includes the steps of: obtaining a first web page included in the website; determining functions that require testing for vulnerabilities based on first page information about the first web page; identifying a plurality of executable operations that can be performed on the first web page; determining a degree of association between each of the plurality of executable operations and the functions that require testing; executing a first operation among the plurality of executable operations that is identified based on the degree of association; and obtaining a second web page in response to the execution of the first operation.

[0008] A program according to one embodiment of the present invention is a program for testing vulnerabilities of a website while automatically crawling the website, and causes one or more computers to execute the following steps: obtaining a first web page included in the website; determining functions that require testing for vulnerabilities based on first page information about the first web page; identifying a plurality of executable operations that can be executed on the first web page; determining the degree of association between each of the plurality of executable operations and the functions that require testing; executing a first operation among the plurality of executable operations that is identified based on the degree of association; and obtaining a second web page in response to the execution of the first operation. Effect of the Invention

[0009] Various embodiments of the present invention reduce the oversight of important functions in vulnerability testing of websites. [Brief description of the drawings]

[0010] [Figure 1] 1 is a diagram showing a schematic configuration of a network including a vulnerability testing server 10 according to an embodiment of the present invention. [Diagram 2] 4 is a diagram illustrating an example of information managed by the examination management table 152. [Diagram 3] FIG. 4 is a diagram illustrating an example of information managed by a page management table 154. [Figure 4] 4 is a diagram illustrating an example of information managed by an operation management table 156. [Diagram 5] 4 is a flowchart illustrating a process executed by the vulnerability check server 10 when checking for vulnerabilities in a website. [Figure 6] FIG. 4 is a diagram illustrating a target site setting screen 50. [Figure 7] 4 is a flowchart illustrating a process executed by the vulnerability test server 10 during automatic crawling of websites. [Figure 8] FIG. 13 is a diagram showing an example of input and output information in a large-scale language model when acquiring a functional relevance score. [Figure 9] FIG. 4 is a diagram showing an example of registered contents of an operation management table 156. [Figure 10] FIG. 13 is a diagram showing an example of input and output information in a large-scale language model when acquiring a functional relevance score. [Figure 11] FIG. 4 is a diagram showing an example of registered contents of an operation management table 156. [Figure 12] FIG. 6 is a diagram illustrating an example of a test result confirmation screen 60. [Figure 13] FIG. 13 is a diagram showing an example of input / output information in a large-scale language model when setting a target function (function to be inspected). [Figure 14] FIG. 13 is a diagram showing another example of input and output information in a large-scale language model when acquiring a functional relevance score. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Hereinafter, embodiments of the present invention will be described with reference to the drawings. In each drawing, the same reference numerals may be used to denote the same or similar components.

[0012] FIG. 1 is a diagram showing a schematic configuration of a network including a vulnerability testing server 10 according to an embodiment of the present invention. As shown in the figure, the server 10 is communicatively connected to a user terminal 30 via a communication network 20 such as the Internet. Although only one user terminal 30 is shown in FIG. 1, the server 10 is communicatively connected to a plurality of user terminals 30. The vulnerability testing server 10 provides a vulnerability testing service to a user who operates the user terminal 30, which tests for vulnerabilities (information security flaws) of a website 22 or the like designated by the user. The vulnerability testing server 10 is an example of a device that implements all or a part of the system of the present invention.

[0013] First, a description will be given of the hardware configuration of the vulnerability checking server 10. The vulnerability checking server 10 is configured as a general computer, and as shown in Fig. 1, includes a computer processor 11, a main memory 12, an input / output I / F 13, a communication I / F 14, and a storage (storage device) 15, and these components are electrically connected via a bus or the like (not shown).

[0014] The computer processor 11 is configured as a CPU, a GPU, or the like, and loads various programs stored in a storage 15 or the like into a main memory 12, and executes various instructions included in the programs. The main memory 12 is configured, for example, by a DRAM or the like.

[0015] The input / output I / F 13 includes various input / output devices for exchanging information with an operator, etc. The input / output I / F 13 includes, for example, an information input device such as a keyboard, a pointing device (e.g., a mouse, a touch panel, etc.), an audio input device such as a microphone, and an image input device such as a camera. The input / output I / F 13 also includes an image output device such as a display, and an audio output device such as a speaker.

[0016] The communication I / F 14 is implemented as hardware such as a network adapter, various communication software, or a combination of these, and is configured to realize wired or wireless communication via a communication network 20 or the like.

[0017] The storage 15 is configured, for example, by a magnetic disk or a flash memory. The storage 15 stores various programs including an operating system, various data, and the like. For example, as shown in Fig. 1, the storage 15 has an inspection management table 152 for managing information related to vulnerability inspections, a page management table 154 for managing information related to web pages included in the website 22 to be inspected, and an operation management table 156 for managing information related to operations executed on each web page. Some of these tables may be integrated into one table, or may be divided into multiple tables.

[0018] Furthermore, for example, the storage 15 stores a server-side program 40 according to an embodiment of the present invention. The program 40 is a program for causing the server 10 to function as all or part of a system for providing a vulnerability testing service. At least a part of the server-side program 40 can be configured to be executed on the user terminal 30 side via a terminal-side program 42, which will be described later.

[0019] In this embodiment, the vulnerability testing server 10 may be configured using a plurality of computers each having the above-mentioned hardware configuration. For example, the server 10 is configured by a plurality of server devices.

[0020] The vulnerability testing server 10 thus configured can be configured to have the functions of a web server and an application server, and executes various processes in response to requests from the user terminal 30, and transmits screen data (e.g., HTML data) and control data according to the results of the processes to the user terminal 30. The user terminal 30 outputs a web page or other screen based on the received data.

[0021] Next, a description will be given of the hardware configuration of the user terminal 30. The user terminal 30 is configured as a general computer, and as shown in Fig. 1, includes a computer processor 31, a main memory 32, an input / output I / F 33, a communication I / F 34, and a storage (storage device) 35, and these components are electrically connected via a bus or the like (not shown).

[0022] The computer processor 31 is configured as a CPU, a GPU, or the like, and loads various programs stored in a storage 35 or the like into a main memory 32 and executes various instructions included in the programs. The main memory 32 is configured, for example, by a DRAM or the like.

[0023] The input / output I / F 33 includes various input / output devices for exchanging information with an operator, etc. The input / output I / F 33 includes, for example, an information input device such as a keyboard or a pointing device (e.g., a mouse, a touch panel, etc.), an audio input device such as a microphone, and an image input device such as a camera. The input / output I / F 33 also includes an image output device such as a display, and an audio output device such as a speaker.

[0024] The communication I / F 34 is implemented as hardware such as a network adapter, various communication software, or a combination of these, and is configured to realize wired or wireless communication via the communication network 20 or the like.

[0025] The storage 35 is configured, for example, by a magnetic disk or a flash memory. The storage 35 stores various programs including an operating system, various data, and the like. The programs stored in the storage 35 can be downloaded from an application market or the like and installed. The storage 35 also stores the above-mentioned terminal-side program 42. The program 42 is configured as a web browser or other application (for example, a terminal-side application for the vulnerability testing service of this embodiment, etc.) and can be configured to execute at least a part of the server-side program 40 as described above.

[0026] In this embodiment, the user terminal 30 may be configured as a smartphone, a tablet terminal, a personal computer, or the like.

[0027] A user operating a user terminal 30 configured in this manner can use the vulnerability testing service provided by the server 10 by communicating with the server 10 via a terminal-side program 42 installed in storage 35 or the like.

[0028] Next, a description will be given of the functions of the vulnerability testing server 10 configured as above. The computer processor 11 of the server 10 is configured to function as a management function control unit 112, an automatic loop control unit 114, and a testing control unit 116 by executing instructions included in a program (e.g., at least a part of the server-side program 40) loaded into the main memory 12, as shown in FIG.

[0029] The management function control unit 112 is configured to execute various processes related to the control of the management function of the vulnerability testing service. For example, the management function control unit 112 transmits screen data and control data of various screens related to the management function to the user terminal 30, executes various processes in response to an operation input by a user via the screen output on the user terminal 30, and transmits screen data and control data according to the results of the processes to the user terminal 30. The management functions controlled by the management function control unit 112 include, for example, login processing (user authentication), billing control, and management of user accounts.

[0030] The automatic patrol control unit 114 is configured to execute various processes related to the control of automatic patrol of the website 22. For example, the automatic patrol control unit 114 acquires a web page included in the website 22, executes an operation executable on the web page (such as clicking a transition target element (such as a link or various types of objects (such as buttons, images, and text) to which a script or the like is set)) to acquire a transition destination web page, and repeats these operations to patrol the website 22.

[0031] In this embodiment, the automatic loop control unit 114 is configured to determine functions that require testing for vulnerability based on page information about a web page. For example, the automatic loop control unit 114 determines functions that require testing based on HTML data of the web page.

[0032] The automatic patrol control unit 114 is also configured to identify a plurality of executable operations that can be performed on a web page, and to determine the degree of association between each executable operation and a function requiring inspection. For example, the automatic patrol control unit 114 identifies an operation that can be performed on the web page from among a plurality of predetermined operations based on the HTML data of the web page, etc. The predetermined operations include, for example, operations such as "clicking on a product link," "clicking on a login link," and "entering and submitting a login form."

[0033] In this embodiment, the operation to be executed on the web page is specified based on the degree of association between each executable operation and the function to be inspected. That is, the automatic loop control unit 114 is configured to execute an operation specified based on the degree of association among the multiple executable operations, and acquire a destination web page in response to the execution of the operation. For example, among the multiple executable operations, an operation having a high degree of association with the function to be inspected is executed preferentially.

[0034] The inspection control unit 116 is configured to execute various processes related to control of the inspection of vulnerabilities of the website 22. For example, when automatically crawling the website 22, the inspection control unit 116 transmits various requests for inspecting predetermined inspection items, and judges the corresponding inspection items based on the contents of the responses received from the website 22.

[0035] In this way, when automatically crawling the website 22, the vulnerability testing server 10 in this embodiment determines functions that require testing for vulnerabilities, determines the degree of association between each of a plurality of executable operations that can be executed on a web page and the functions that require testing, and executes an operation that is identified based on the degree of association among the plurality of executable operations, thereby making it possible to execute an operation that is identified based on the degree of association with the functions that require testing, and thus promoting crawling to web pages that correspond to important functions. In other words, the vulnerability testing server 10 suppresses the overlooking of testing important functions in vulnerability testing of websites.

[0036] In this embodiment, the determination of the functions that need to be inspected can be realized using various methods. For example, the determination of the functions that need to be inspected is realized using a rule-based method. In this case, for example, the functions that need to be inspected may be determined based on the label names in the web page (for example, if the corresponding HTML data includes label names such as "login", "login", "password", and "account", the "login function" is determined as the function that needs to be inspected).

[0037] The determination of the functions that need to be inspected may be realized using a trained model generated by machine learning. For example, the automatic loop control unit 114 may be configured to input input information including page information into a trained model for determining the functions that need to be inspected, and to determine the functions that need to be inspected based on output information for identifying the functions that are output from the trained model. Such a configuration enables the determination of the functions that need to be inspected using the trained model.

[0038] In this embodiment, the trained model for determining the function requiring inspection may be configured to output various information. For example, the trained model is configured to output information identifying the function requiring inspection. For example, the trained model is configured as a large-scale language model (LLM) that outputs information on the selected function requiring inspection when information instructing the selection of a function requiring inspection from among a plurality of predetermined functions is input together with HTML data of a web page. Such a configuration makes it possible to determine the function requiring inspection based on information identifying the function requiring inspection output from the trained model.

[0039] Moreover, such a trained model is configured to output, for example, inspection necessity possibility information indicating the possibility that an inspection for vulnerability is required for each of a plurality of predetermined functions. Such a trained model is generated, for example, through machine learning using a large amount of training data (for example, page information (HTML data, etc.) of web pages included in a website, and information identifying functions on the website that require inspection, etc.), and is configured to output, as the inspection necessity possibility information, a score indicating the possibility that an inspection is required. In this case, the automatic patrol control unit 114 determines the functions that require inspection based on the inspection necessity possibility information output from the trained model, such that functions that are highly likely to require vulnerability inspection are prioritized. Such a configuration enables the determination of the functions that require inspection based on the inspection necessity possibility information output from the trained model.

[0040] The automatic loop control unit 114 may be configured to determine the functions requiring inspection again based on the page information of the web page of the transition destination. For example, the automatic loop control unit 114 determines the first function as a function requiring inspection based on the first page information of the first web page, and then determines the second function as a function requiring inspection instead of or in addition to the first function based on the second page information of the second web page of the transition destination in addition to the first page information. This configuration makes it possible to repeatedly determine the functions requiring inspection based on the page information of multiple web pages.

[0041] In this embodiment, the determination of the degree of association between an executable operation and a function requiring inspection can be realized using various methods. For example, the determination of the degree of association is realized using a rule-based method. In this case, for example, the degree of association may be determined based on a label name corresponding to the operation (for example, if the corresponding label name is "login", the degree of association with the login function is set to "100", and if the corresponding label name is "account", the degree of association with the login function is set to "50").

[0042] The determination of the relevance may be realized using a trained model generated by machine learning. For example, the automatic navigation control unit 114 may be configured to input information including page information (HTML data, etc.) of a webpage and a combination of executable operations and functions to be inspected into a trained model for determining the relevance, and determine the relevance based on information for determining the relevance output from the trained model (including a score indicating the relevance). Such a trained model is generated, for example, through machine learning using a large amount of training data (for example, page information (HTML data, etc.) of a webpage, executable operations on the webpage, and functions to be inspected related to the operations). In this case, the input information for the trained model may include past operation records (operations performed before reaching the corresponding webpage). Such a configuration enables the determination of the relevance using the trained model.

[0043] Next, a specific example of one aspect of the vulnerability testing server 10 of this embodiment having such functions will be described. First, information managed by each table in this example will be described. Fig. 2 illustrates information managed by the test management table 152 in this example. The test management table 152 in this example manages information related to individual tests, and as shown in the figure, manages information such as a "top screen URL" which is the URL of the top screen (top page) that is the starting point of the test of the website to be tested, a "screen transition setting date and time" which is the setting date and time of the screen transition, and a "test execution date and time" which is the date and time of execution of the vulnerability test, in association with an "test ID" which identifies an individual test (case).

[0044] 3 illustrates information managed by the page management table 154 in this example. The page management table 154 in this example manages information about each web page (screen) included in the website to be inspected, and as illustrated, manages information such as a "screen URL" which is the URL of the screen, "screen capture information" which is information about a screen capture of the screen, "HTML data" of the screen, a "source screen ID" which identifies the source screen of the screen, a "source operation ID" which identifies the source operation of the screen (operation when transitioning to the screen), "source input information" which is information about input values ​​input to input items on the source screen, and "inspection result information" which is information about the inspection result on the screen, in association with a combination of an "inspection ID" which identifies an individual inspection and a "screen ID" which identifies an individual screen in the inspection.

[0045] 4 illustrates information managed by the operation management table 156 in this example. The operation management table 156 in this example manages information related to operations performed on each screen, and manages information such as "element information" which is information (such as label name) related to screen components corresponding to the operation, a "function ID" which identifies a function requiring examination associated with the operation, a "function relevance score" which indicates the relevance score between the operation and the function requiring examination, and an "executed flag" which indicates whether the operation has been executed, in association with a combination of an "examination ID" which identifies an individual examination, a "screen ID" which identifies an individual screen in the examination, and an "operation ID" which identifies an individual operation executed on the screen.

[0046] The information managed by each table in this example has been described above. Next, the process executed by the vulnerability check server 10 and the screens output on the user terminal 30 in this example will be described.

[0047] 5 is a flowchart illustrating the process executed by the vulnerability check server 10 when checking for vulnerability of a website in this example. As shown in the figure, the server 10 first accepts settings of a website to be checked for vulnerability (step S100). The settings are accepted via a screen displayed on the user terminal 30.

[0048] 6 illustrates a target site setting screen 50 for accepting settings of a website to be inspected, which is output on the user terminal 30. As illustrated, the screen 50 has a URL input area 52 for inputting the URL of the top screen (top page) of the website to be inspected, a login ID input area 54 for inputting a login ID used to log in to the website, a password input area 56 for inputting a password used to log in to the website, and a continue button 58 with the text "Start patrol and inspection" added. Thus, in this example, the URL of the top screen, the login ID, and the password are accepted as setting information of the website to be inspected.

[0049] The continue button 58 is an object for instructing automatic crawling and inspection of the website to be inspected. Returning to the flowchart of Fig. 5, when the continue button 58 is selected, the server 10 next automatically crawls the website to be inspected and sets the screen transition for the inspection (step S110).

[0050] 7 is a flow chart illustrating a process executed by the server 10 during automatic crawling of a website. As shown in the figure, the server 10 first accesses the top screen of the website to be inspected and adds the top screen to the screen transition (step S200). Specifically, the server 10 starts a web browser and accesses the top screen specified by the URL input via the target site setting screen 50 (obtains the corresponding web page). Also, information about the top screen is registered in the page management table 154, specifically, the inspection ID, screen ID, screen URL, screen capture information, and HTML data are set.

[0051] Next, the server 10 determines a target function (function requiring inspection) of the vulnerability inspection (step S210). In this example, the target function is determined using a trained model. Specifically, when HTML data of a corresponding screen (here, a top screen) is input to the trained model, an inspection necessity score indicating the possibility that inspection is required for each of a plurality of predetermined functions is output from the trained model, and the function with the largest value of the score is determined as the target function. Such a trained model is generated through machine learning using a large amount of training data (data in which information specifying the functions requiring inspection is added to HTML data, etc.). The plurality of predetermined functions are set by a provider of a vulnerability inspection service, and include, for example, "new user registration," "login," "product purchase," "inquiry," etc.

[0052] Next, the server 10 identifies executable operations (step S220). Specifically, one or more executable operations are identified based on the HTML data of the corresponding screen (here, the top screen). The executable operation is identified as an operation of clicking a screen component (such as a button, an image, or text) to which a link or a script is set.

[0053] Next, the server 10 determines a functional relevance score indicating the relevance between the specified executable operation and the target function (step S230). Specifically, the functional relevance score is acquired using a trained model. In this example, the trained model is configured as a large-scale language model, and is configured to output the score when information instructing the presentation of the functional relevance score between the executable operation and the target function is input together with HTML data of the corresponding screen. For example, GPT-4 provided by OpenAI, Inc. of the United States may be applied as such a large-scale language model.

[0054] 8 shows an example of input and output information in a large-scale language model. Such input information is automatically generated by the server 10.

[0055] Returning to the flowchart of FIG. 7, the server 10 then registers the operation whose functional relevance score is equal to or greater than the threshold (step S235). Specifically, in the operation management table 156, the examination ID, screen ID, operation ID, element information, function ID, and functional relevance score are set. In the element information, information (such as a label name) that identifies the screen component to be clicked is set. In this example, an operation whose functional relevance score with respect to the target function is equal to or greater than the threshold (high relevance with the target function) is associated with the target function and registered in the operation management table 156.

[0056] Fig. 9 shows an example of the contents of the operation management table 156 at this point in time. As shown in the figure, in the example of Fig. 9, among the executable operations on the screen (top screen) with the screen ID "S01", two operations (with operation IDs "O01" and "O02") whose functional relevance to the target function (with function ID "F01") is equal to or greater than a threshold value are registered in association with the target function.

[0057] Returning to the flowchart of FIG. 7, next, if there is an unexecuted operation among the registered operations (YES in step S240), the server 10 determines and executes the operation to be executed (step S250). Specifically, among the unexecuted registered operations (identified by referring to the executed flags in the operation management table 156), the operation identified according to a predetermined rule (e.g., the operation with the highest functional relevance score) is determined as the operation to be executed. Note that, if an input item (e.g., an inputtable form element) exists on the corresponding screen, an input value is set for the input item before the operation is executed. The input value is automatically set according to the predetermined rule.

[0058] Next, the server 10 adds a transition to a destination screen according to the execution of the operation to the screen transition (step S260). Specifically, information about the destination screen is registered in the page management table 154, that is, the examination ID, screen ID, screen URL, screen capture information, HTML data, source screen ID, source operation ID, and source input information are set. The source operation ID is set to a value that identifies the operation executed immediately before. Also, the source input information is set to a combination of an input item and an input value.

[0059] Here, if the transition destination screen is not a target screen for addition to the screen transition, it may not be added to the screen transition. For example, a screen of a site outside the website to be inspected, a screen that overlaps with a screen already included in the screen transition (for example, determined based on the similarity of the screen), etc. are determined not to be a target screen for addition to the screen transition.

[0060] Next, the server 10 returns to step S210, and for the destination screen, sets the target function (step S210), identifies executable operations (step S220), determines the functional relevance score of each operation (step S230), and registers operations whose functional relevance score is equal to or greater than the threshold (step S235).

[0061] Here, when determining the function relevance score for the second or subsequent times, in addition to the target function determined based on the HTML data of the corresponding screen (target function based on the current screen), the target function registered in association with the most recently executed operation in the operation management table 156 (target function highly related to the most recently executed operation) is subject to determination. In other words, when these two target functions are different, two function relevance scores between the two target functions are determined for one executable operation. Then, when both of the two function relevance scores are equal to or greater than a threshold, one target function selected according to a predetermined rule is associated when registering the operation.

[0062] 10 shows an example of input / output information in the large-scale language model when the functional relevance score is determined for the second time. In this case, as shown in the figure, information on the operation performed immediately before is set as the past operation in the input information in the large-scale language model, and information on the past screen (top screen) is set as the URL and HTML of the page reached by the past operation. Such information is automatically generated by the server 10 based on the information managed in the page management table 154 and the operation management table 156.

[0063] Fig. 11 shows an example of the contents of operation management table 156 at this point in time. As shown in the figure, in the example of Fig. 11, an operation with an operation ID of "O01" on a screen (top screen) with a screen ID of "S01" is being executed (executed flag is "1"), and among executable operations on a screen with a transition destination screen ID of "S02", an operation with an operation ID of "O01" is registered in association with a target function with a function ID of "F01", and further, an operation with an operation ID of "O02" is registered in association with a target function with a function ID of "F02" (a target function based on the transition destination screen).

[0064] Returning to the flowchart of Fig. 7, an operation specified according to a predetermined rule among the registered operations that have not been executed at that time is determined as an operation to be executed and executed (step S250), and a transition to a transition destination screen corresponding to the execution of the operation is newly added to the screen transition (step S260). These processes are repeated until there are no registered operations that have not been executed (NO in step S240).

[0065] Returning to the flowchart of FIG. 5, once the screen transitions are set in this way, the server 10 then executes vulnerability testing in accordance with the set screen transitions (step S120). Specifically, a web browser is started, and each screen included in the screen transition is visited in order in accordance with the information managed in the page management table 154, and testing is performed for predetermined vulnerability testing items. The vulnerability testing items include, for example, items defined in OWASP Top 10. The testing results are registered in the testing result information in the page management table 154. Note that testing for testing items may be performed on each screen during automatic crawling of the website (i.e., during setting of the screen transitions).

[0066] 12 illustrates an inspection result confirmation screen 60 for confirming the inspection results, which is output on the user terminal 30. As shown in the figure, the screen 60 has a list display area 62 that displays a list of vulnerability inspection results. The area 62 displays a list of vulnerability inspection results (severity, vulnerability name, detected location, vulnerable location, etc.) for each screen. This information is managed in the inspection result information of the page management table 154.

[0067] In the above example, when setting the target functions (functions requiring inspection) of vulnerability inspection, a trained model is used that outputs the inspection necessity score for each function when the HTML data of the corresponding screen is input, but the target functions may be set using a large-scale language model. FIG. 13 shows an example of input / output information in a large-scale language model when setting a target function. In this case, as shown in the figure, in addition to the HTML data of the current screen, the HTML data of another screen (such as a transition source screen) may be set as input information. Furthermore, such target function setting may be realized by a rule-based method.

[0068] In the above-mentioned example, when a functional relevance score is obtained using a large-scale language model, a basis for the score may be obtained in addition to the score. Fig. 14 shows an example of input / output information in the large-scale language model in this case. Such basis information may be managed, for example, in the operation management table 156, and may be used to verify the validity of the score and as part of the operation history. In addition, such a determination of functional relevance may be realized by a rule-based method.

[0069] The vulnerability testing server 10 according to the present embodiment described above, when automatically crawling the website 22, determines functions that require testing for vulnerabilities, determines the degree of association between each of a plurality of executable operations that can be executed on a web page and the functions that require testing, and executes an operation that is identified based on the degree of association among the plurality of executable operations, thereby making it possible to execute an operation that is identified based on the degree of association with the functions that require testing, and thus promoting crawling of web pages that correspond to important functions. In other words, the vulnerability testing server 10 suppresses overlooking of testing important functions in vulnerability testing of websites.

[0070] In other embodiments of the present invention, some or all of the functions of the vulnerability checking server 10 in the above-described embodiments may be realized by cooperation between the vulnerability checking server 10 and the user terminal 30, or may be realized by the user terminal 30.

[0071] The processes and procedures described herein may be realized by software, hardware, or any combination thereof, other than those explicitly described. For example, the processes and procedures described herein may be realized by implementing logic corresponding to the processes and procedures in a medium such as an integrated circuit, a volatile memory, a non-volatile memory, or a magnetic disk. In addition, the processes and procedures described herein may be implemented as a computer program corresponding to the processes and procedures, and executed by various computers.

[0072] Although processes and procedures described herein are described as being performed by a single device, software, component, or module, such processes or procedures may be performed by multiple devices, software, components, and / or modules. Also, the software and hardware elements described herein may be realized by combining them into fewer components or breaking them down into more components.

[0073] In this specification, even if a component of the invention is described as either singular or plural, or described without limitation to either singular or plural, the component may be either singular or plural unless the context requires otherwise. [Explanation of symbols]

[0074] 10 Vulnerability testing server 11. Computer Processors 112 Management function control section 114 Automatic patrol control unit 116 Inspection Control Unit 15. Storage 152 Inspection Management Table 154 Page Management Table 156 Operation Management Table 30 User terminals 40 Server-side programs 42 Terminal side program 50 Target site setting screen 60 Test result confirmation screen

Claims

1. 1. A system for testing a website for vulnerability involving automatic crawling of the website, the system comprising one or more computer processors, the one or more computer processors comprising: obtaining a first web page included in the website; determining a function that needs to be tested for vulnerabilities based on first page information about the first web page; identifying a plurality of executable actions that are executable on the first web page; determining a degree of association between each of the plurality of executable operations and the function requiring inspection; executing a first operation identified based on the relevance level among the plurality of executable operations; acquiring a second web page in response to the execution of the first operation; system.

2. The first operation is identified by giving priority to an executable operation having a high degree of association among the plurality of executable operations. The system of claim 1.

3. The step of determining the function requiring inspection includes inputting first input information including the first page information into a first trained model, and determining the function requiring inspection based on first output information for identifying the function requiring inspection output from the first trained model. The system of claim 1.

4. The first output information includes information identifying the function requiring inspection. The system of claim 3.

5. the first output information includes possibility information indicating a possibility that a vulnerability test is required for each of a plurality of predetermined functions; The step of determining the functions to be inspected determines the functions to be inspected such that a function that is highly likely to require vulnerability inspection is given priority among the plurality of predetermined functions. The system of claim 3.

6. The one or more computer processors further perform a step of determining the function to be inspected again based on second page information related to the second web page in addition to the first page information. The system of claim 1.

7. The step of determining the degree of association includes inputting the first page information and second input information including a combination of each of the plurality of executable operations and the function to be inspected into a second trained model, and determining the degree of association based on second output information for determining the degree of association output from the second trained model. The system of claim 1.

8. The second output information includes the relevance. The system of claim 7.

9. The step of acquiring the first web page includes acquiring the first web page in response to execution of a second operation; The second input information further includes information identifying the second operation. The system of claim 7.

10. 1. A method, executed by one or more computers, for automatically crawling a website and testing the website for vulnerabilities, comprising: obtaining a first web page included in the website; determining a function that needs to be tested for vulnerabilities based on first page information about the first web page; identifying a plurality of executable actions that are executable on the first web page; determining a degree of association between each of the plurality of executable operations and the function requiring inspection; executing a first operation identified based on the relevance level among the plurality of executable operations; and acquiring a second web page in response to execution of the first operation. method.

11. A program for automatically crawling a website and inspecting the vulnerability of the website, the program comprising: obtaining a first web page included in the website; determining a function that needs to be tested for vulnerabilities based on first page information about the first web page; identifying a plurality of executable actions that are executable on the first web page; determining a degree of association between each of the plurality of executable operations and the function requiring inspection; executing a first operation identified based on the relevance level among the plurality of executable operations; acquiring a second web page in response to the execution of the first operation; program.

Images