Vulnerability impact analysis system and vulnerability impact analysis method

Abstract

To solve a problem that a component having vulnerability cannot be specified when there are fluctuations of expression between configuration information and vulnerability information.SOLUTION: A vulnerability impact analysis system 100 includes: a first storage unit (a component product information storage unit 160) that stores first information that is component information of a management target; an input unit (a vulnerability information reception unit 110) that receives vulnerability information; a complementary information acquisition unit 123 for acquiring second information that is information for complementing the vulnerability information from external information 200 outside an own system when there is no first information corresponding to the vulnerability information; and an impact estimation unit 130 for outputting analysis results that estimates an impact of the vulnerability information by using the second information.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a vulnerability impact analysis system and a vulnerability impact analysis method for analyzing an impact from vulnerability information. [Background technology]

[0002] In recent years, with the advancement of IoT (Internet of Things) technology, all kinds of devices such as automobiles and home appliances are connected to the Internet, and vulnerability management of IoT devices has become important. Since IoT devices are equipped with various hardware and software according to their purposes, it is particularly necessary to understand the elements that are affected by vulnerabilities. For example, Patent Document 1 discloses a vulnerability information management device that manages vulnerabilities of the hardware and software installed in such IoT devices. [Prior art documents] [Patent documents]

[0003] [Patent Document 5] International Publication No. 2020 / 050355 Summary of the Invention [Problem to be solved by the invention]

[0004] In Patent Document 1, vulnerable components are identified using information (configuration information) about components such as hardware and software that constitute a product, and vulnerability information collected from an external network.

[0005] However, when there is a variation in the expression between the configuration information and the vulnerability information, there is a problem in that a vulnerable component cannot be identified, and no means for solving this problem has been disclosed.

[0006] In view of the above circumstances, there has been a demand for a method that can identify vulnerable configuration elements even when there is variation in the expression between configuration information and vulnerability information. [Means for solving the problem]

[0007] In order to solve the above problems, a vulnerability impact analysis system according to one aspect of the present invention is a vulnerability impact analysis system that analyzes the impact of vulnerability information on a managed object implemented in software and / or hardware. This vulnerability impact analysis system includes a first storage unit that stores first information that is component information of the managed object, an input unit that accepts vulnerability information, a complementary information acquisition unit that acquires second information that is information that complements the vulnerability information from external information outside the system when the first information corresponding to the vulnerability information does not exist, and an impact estimation unit that outputs an analysis result that estimates the impact of the vulnerability information using the second information. Effect of the Invention

[0008] According to at least one aspect of the present invention, even if there is a variation in expression between configuration information and vulnerability information, a configuration element having a vulnerability can be identified. Problems, configurations and effects other than those described above will become apparent from the following description of the embodiments. [Brief description of the drawings]

[0009] [Figure 1] 1 is a diagram illustrating an example of the configuration of a vulnerability impact analysis device according to the present invention. [Diagram 2] 4 is a diagram illustrating an example of a configuration of a configuration information storage unit in the embodiment of the present invention. FIG. [Diagram 3] 4 is a diagram illustrating an example of the configuration of a constituent product information storage unit in the embodiment of the present invention. FIG. [Figure 4] 11 is a flowchart illustrating an example of a procedure for vulnerability impact analysis processing according to an embodiment of the present invention. [Diagram 5] 10 is a flowchart illustrating an example of a procedure for search processing according to an embodiment of the present invention. [Figure 6] 10 is a flowchart illustrating an example of a procedure for an influence estimation process according to an embodiment of the present invention. [Figure 7]10 is a flowchart illustrating an example of a procedure for complementary information acquisition processing according to an embodiment of the present invention. [Figure 8] 10 is a flowchart showing an example of a procedure for an explanation extraction process according to an embodiment of the present invention. [Figure 9] 10 is a flowchart showing an example of a procedure for searching for a hyperlink destination in one embodiment of the present invention. [Figure 10] 11 is a flowchart illustrating an example of a procedure for configuring product information update processing according to an embodiment of the present invention. [Figure 11] FIG. 13 is a diagram showing an example of a table of importance determination rules based on a URL format in one embodiment of the present invention. [Figure 12] FIG. 13 is a diagram showing an example of an importance determination table based on the grammar of an explanatory sentence in one embodiment of the present invention. [Figure 13] FIG. 13 is a diagram showing an example of a keyword importance determination table in one embodiment of the present invention. [Figure 14] FIG. 2 is a diagram illustrating an example of a hardware configuration of a computer that realizes a vulnerability effect analysis apparatus according to an embodiment of the present invention. [Figure 15] FIG. 4 is a diagram showing an example of a GUI screen according to an embodiment of the present invention. [Figure 16] FIG. 4 is a diagram showing an example of log information according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] Hereinafter, an example of a mode for carrying out the present invention (hereinafter referred to as an "embodiment") will be described with reference to the accompanying drawings. In this specification and the accompanying drawings, identical components or components having substantially the same functions are designated by the same reference numerals, and duplicated descriptions will be omitted.

[0011] [Configuration of the vulnerability impact analysis device] First, the functional configuration of a vulnerability impact analysis apparatus according to an embodiment of the present invention will be described with reference to FIG. FIG. 1 is a diagram illustrating an example of a functional configuration of a vulnerability impact analysis apparatus according to an embodiment of the present invention.

[0012] The vulnerability impact analysis apparatus 100 includes a vulnerability information receiving unit 110 , a search processing unit 120 , an impact estimation unit 130 , an impact analysis result output unit 140 , a configuration information storage unit 150 , and a configured product information storage unit 160 .

[0013] The vulnerability information receiving unit 110 is an interface that receives vulnerability information input from the outside. As the external input is expected to be an input by a user U or an input from another device or system, the vulnerability information receiving unit 110 is connected to an input device such as a keyboard or a mouse, or to another program. Here, the input vulnerability information contains information such as the name and version of the vulnerable target device, the supplier (provider), etc., and this information is collectively referred to as the "vulnerability-holding target."

[0014] The search processing unit 120 searches for constituent product information that corresponds to the vulnerability information received by the vulnerability information receiving unit 110. For the search, the vulnerability information may be used as is, or vulnerability holding targets may be extracted from the vulnerability information and used. In addition, supplementary information may be collected from an external information source as necessary to update the constituent product information. This makes it possible to avoid missed detections in re-collation even if there is a variation in the notation of the vulnerability information and the constituent product information, or if the constituent product information is insufficient. The internal configuration of the search processing unit 120 will be described later.

[0015] The impact estimation unit 130 estimates a list of configuration information affected by the vulnerability based on the list of configured product information related to the vulnerability information identified by the search processing unit 120 and the configuration information storage unit 150.

[0016] The impact analysis result output unit 140 is an interface that outputs the search results of the search processing unit 120 and the estimation results of the impact estimation unit 130 to the outside. The external output is expected to be a GUI (Graphical User Interface) output or to hand over these results to another device or another system. Therefore, the impact analysis result output unit 140 is connected to an output device such as a display or another program.

[0017] The configuration information storage unit 150 is a database in which functional information and product information of components for each product are registered.

[0018] The constituent product information storage unit 160 is a database that stores information sources of product information (constituent product information) about the constituent elements registered in the constituent information storage unit 150.

[0019] The information stored in the configuration information storage unit 150 and the configuration product information storage unit 160 can also be saved using a cloud environment.

[0020] [Configuration of the search processing section] The search processing unit 120 includes a vulnerability holding target extraction unit 121 , a matching processing unit 122 , a complementary information acquisition unit 123 , a configured product information update unit 124 , and a search result output unit 125 .

[0021] The vulnerability holding target extraction unit 121 extracts vulnerability holding targets from the vulnerability information received by the vulnerability information receiving unit 110.

[0022] The matching processing unit 122 checks the vulnerability holding target against the constituent product information registered in the constituent product information storage unit 160 .

[0023] When the vulnerability holding target is not matched with any of the constituent product information in the matching processing unit, the complementary information acquisition unit 123 acquires complementary information that complements the information of the vulnerability holding target from the external information 200. The complementary information acquisition unit 123 is connected to the external information source via a communication network. The communication network is a public network such as the Internet, a closed network such as a VPN (Virtual Private Network), or a dedicated line network.

[0024] Here, the external information 200 is information that is not managed as part information (component product information) of the managed object, such as the Web, a company's own database, an industry database, and a vulnerability database. As the external information 200, analysis information of vulnerability information of the managed object, similar vulnerability information, descriptions of vulnerability-holding targets, specification tables, etc. can be used.

[0025] When the complementary information acquisition unit 123 has acquired complementary information, the constituted product information update unit 124 registers the vulnerability holding target in the constituted product information storage unit 160 based on the acquired complementary information.

[0026] The search result output unit 125 outputs at least one of the search results of the matching processing unit 122, the complementary information acquisition unit 123, and the configured product information update unit 124 to the effect estimation unit 130 and the effect analysis result output unit 140.

[0027] [Configuration of configuration information storage unit] FIG. 2 is a diagram showing an example of the configuration of the configuration information storage unit 150. As shown in FIG. The configuration information storage unit 150 stores hierarchical configuration information 152 for each piece of product information 151 .

[0028] The product information 151 includes information on "product ID" and "product name."

[0029] The configuration information 152 includes configured model information 152a that stores information on a configured model that models components and their functions, and configured product information 152b that is information on a configured product (parts information) that realizes the configured model, for each product information 151. This allows the configuration information 152 to be linked to the configured product information (configured product detail information 162 in FIG. 3).

[0030] The configured model information 152a includes information on "component ID", "component name", and "function". The configured product information 152b is linked to the product information 151 via the configured model information 152a, and is assigned a "configured product ID."

[0031] [Configuration of product information storage section] FIG. 3 is a diagram showing an example of the configuration of the component product information storage unit 160. As shown in FIG. The component product information storage unit 160 stores component product classification 161 and component product detail information 162 .

[0032] The constituent product classification 161 is information that indicates a classification group of the constituent product. The constituent product classification 161 includes information on a "constituent product ID" and a "constituent product classification".

[0033] The configured product detail information 162 represents detailed information such as the name, version, supplier, and source of the configured product linked to the configured product classification. As an example, the configured product detail information 162 includes information on the "configured product name," "version," and "source." The source is an information source. The configured product detail information 162 is registered based on the software bill of materials (SBOM) of the components of the product, system information of the product registered in the registry, and update contents by the configured product information update unit 124.

[0034] The configuration information storage unit 150 and the configured product information storage unit 160 are stored in a storage area such as the storage H13 (see FIG. 14 described later).

[0035] [Vulnerability impact analysis processing] Next, the vulnerability impact analysis process executed by the vulnerability impact analysis device 100 will be described with reference to FIG.

[0036] FIG. 4 is a flowchart showing an example of the procedure of a vulnerability impact analysis process executed by the vulnerability impact analysis device 100. First, in step S110, the vulnerability information receiving unit 110 receives vulnerability information input by a user or an external program.

[0037] Next, in step S120, the search processor 120 searches for component product information that corresponds to the received vulnerability information.

[0038] Next, if corresponding configured product information is present in step S120 ((a) corresponding configured product information present), the impact estimation unit 130 estimates the components affected by the vulnerability information based on the corresponding configured product information (step S130).

[0039] Then, the influence analysis result output unit 140 outputs a list of the estimated components to a user interface or an external program interface (Step S140).

[0040] On the other hand, if there is no corresponding component product information ((b) No corresponding component product information), the impact analysis result output unit 140 outputs "No impact" to the user interface or external program interface (step S140). After the process of step S140, the vulnerability impact analysis process ends.

[0041] [Search process details] Next, the details of the search process (step S120) executed by the search processing unit 120 will be described with reference to FIG.

[0042] FIG. 5 is a flowchart showing an example of the procedure of the search process (step S120) executed by the search processor 120. First, in step S121, the vulnerability holding target extraction unit 121 extracts vulnerability holding targets from the vulnerability information received in the vulnerability information reception process in step S110.

[0043] Next, in step S122, the matching processing unit 122 executes a process of acquiring a record (constituted product information) whose value in the constituted product information storage unit 160 matches the vulnerability holding target, and determines whether or not the corresponding record has been acquired.

[0044] When the corresponding component product information can be acquired (YES in step S122), the search result output unit 125 outputs a "list of corresponding component product information" to the influence analysis result output unit 140 (step S125a). On the other hand, if the corresponding constituent product information does not exist and cannot be acquired (NO in step S122), the process proceeds to step S123. The values ​​of the constituent product information storage unit 160 are the values ​​of the constituent product classification 161 and the constituent product detail information 162.

[0045] In step S123, the complementary information acquisition unit 123 searches external information sources such as the Web, an industry database, or a proprietary database for complementary information on the vulnerability holding target, and acquires the complementary information. When the complementary information acquisition unit 123 is able to acquire one or more pieces of complementary information for the vulnerability holding target ((b) Acquisition possible), the process proceeds to the constituent product information update process of step S124. On the other hand, when the complementary information acquisition unit 123 is unable to acquire the complementary information ((a) Acquisition impossible), the search result output unit 125 outputs "No corresponding constituent product information" to the impact analysis result output unit 140 (step S125b).

[0046] In step S124, the constituted product information update unit 124 determines whether or not to register the vulnerability holding target in the constituted product detail information 162 based on the content of the complementary information acquired in the complementary information acquisition process in step S123. When the configured product information update unit 124 determines that the vulnerability holding target is to be registered ((a) Acquisition Possible), the matching processing unit 122 performs the judgment process of step S122 again. On the other hand, when the configured product information update unit 124 determines that the vulnerability holding target is not to be registered ((b) Update Not Possible), the search result output unit 125 outputs "No Corresponding Configured Product Information" to the impact analysis result output unit 140 (step S125b).

[0047] However, when the determination process of step S122 is performed again after step S124, the vulnerability information is registered in the constituted product information, so that only the process of step S122 is performed if the corresponding constituted product information can be obtained.

[0048] After the process of step S125a or S125b, this search process ends.

[0049] [Details of impact estimation process] Next, details of the effect estimation process (step S130) executed by the effect estimation unit 130 will be described with reference to FIG.

[0050] FIG. 6 is a flowchart showing an example of the procedure of the influence estimation process (step S130) executed by the influence estimation unit 130. First, in step S131, the impact estimation unit 130 searches for components in which the constituent product information is registered for each record in the list of constituent product information corresponding to the vulnerability information output by the search process in step S120. Then, the impact estimation unit 130 determines from the search result whether or not there is a component in which the constituent product information is registered.

[0051] If a corresponding component exists (YES determination in step S131), the influence estimation unit 130 adds the corresponding component to the "list of corresponding components" (step S132). On the other hand, if a corresponding component does not exist (NO determination in step S131), the influence estimation unit 130 performs the process of step S131 on the next record.

[0052] When the effects of all the configuration product information corresponding to the vulnerability information have been estimated, this effect estimation process ends.

[0053] The vulnerability impact analysis device 100 according to this embodiment includes a second storage unit (configuration information storage unit 150) that stores first information (configuration product information) corresponding to vulnerability information and information on the function of the configuration item to be managed in association with each other. When the first information stored in the first storage unit (configuration product information storage unit 160) corresponds to vulnerability information, the impact estimation unit assumes that the function associated with the first information is affected, and estimates that the configuration item having the same function is affected.

[0054] As a result, in this embodiment, when it is detected that the first information corresponds to vulnerability information, it is possible to identify that a component having the same function is affected.

[0055] [Details of supplementary information acquisition process] Next, details of the complementary information acquisition process (step S123 in FIG. 5) executed by the complementary information acquisition unit 123 of the search processing unit 120 will be described with reference to FIG.

[0056] Fig. 7 is a flowchart showing an example of the procedure of the complementary information acquisition process (step S123) executed by the complementary information acquisition unit 123. The example shown in Fig. 7 is an example of the complementary information acquisition process executed by the complementary information acquisition unit 123 when the external information source is the Web and the complementary information to be acquired is the description of the vulnerability holding target.

[0057] First, in step S1231, the complementary information acquisition unit 123 requests the search server to acquire N sites related to the vulnerability holding target.

[0058] Next, in step S1232, the complementary information acquisition unit 123 receives a response to the request and creates a URL list of N sites related to the vulnerability target. A URL (Uniform Resource Locator) is one of the formats for describing location information of resources on a network such as the Web.

[0059] Next, the complementary information acquisition unit 123 performs the process of steps S1233 to S1236 for each URL in the above URL list. After performing the process of steps S1233 to S1236 for all URLs, the complementary information acquisition unit 123 performs the process of step S1237.

[0060] In step S1233, the complementary information acquisition unit 123 sends a request to the URL and acquires a response including the content of the Web page.

[0061] Next, in step S1234, the complementary information acquisition unit 123 analyzes the content and extracts explanatory text related to the vulnerability-holding target. If explanatory text can be extracted ((b) Extractable), the complementary information acquisition unit 123 adds all the extracted explanatory text to a list of complementary information (step S1236). On the other hand, if the explanatory text cannot be extracted ((a) Extraction not possible), the complementary information acquiring unit 123 performs the process of step S1235.

[0062] In step S1235, the supplementary information acquisition unit 123 extracts an explanatory text about the vulnerability target from the content of the hyperlink destination included in the content. This is reference information to other information resources embedded in an information resource such as document data. In a Web page, a hyperlink can be provided from a component in the page to an information resource on the Internet, such as another Web page, according to the HTML notation used for structuring documents.

[0063] If an explanatory sentence can be extracted in step S1235 ((b) Extraction Possible), the supplementary information acquiring unit 123 adds all the corresponding sentences to a list of supplementary information (step S1236). On the other hand, if the explanatory text cannot be extracted ((a) Extraction not possible), the complementary information acquisition unit 123 performs the processes of steps S1233 to S1236 on the next URL in the URL list. After referencing all the URLs in the URL list, the process proceeds to the determination process of step S1237.

[0064] In step S1237, the complementary information acquisition unit 123 determines whether or not one or more pieces of explanatory data are present in the list of complementary information. If explanatory data are present (YES in step S1237), the complementary information acquisition unit 123 outputs the list of complementary information (step S1238b).

[0065] On the other hand, if there is no explanatory text data (NO verdict in step S1237), the complementary information acquiring unit 123 outputs "no complementary information" (step S1238a).

[0066] After the process of step S1238a or S1238b, this complementary information acquisition process ends.

[0067] Thus, in this embodiment, the complementary information acquisition unit 123 acquires information related to vulnerability information (e.g., relevant explanatory text) as external information from an external information source (e.g., the content of a URL, the content of a hyperlink within the content), and extracts the desired complementary information (an example of second information) from the acquired information on the vulnerability information.

[0068] As a result, in this embodiment, complementary information, which is the second information, can be extracted from an external information source outside the vulnerability effect analysis apparatus 100 (outside the own system).

[0069] In addition, in this embodiment, the complementary information acquisition unit 123 extracts second information (complementary information) regarding the vulnerability-holding target that holds the vulnerability from the input vulnerability information, and acquires the second information regarding the vulnerability-holding target from an external information source in place of the vulnerability information.

[0070] In this manner, in this embodiment, second information (complementary information) regarding a vulnerability target described in the vulnerability information can be acquired from external information.

[0071] [Details of description extraction process] Next, the explanatory sentence extraction process of step S1234 in the complementary information acquisition process (step S123 in FIG. 7) executed by the complementary information acquisition unit 123 is a process of judging whether each sentence in the content is explanatory sentence or not, and outputting the sentence judged to be explanatory sentence. Methods of judging explanatory sentence include a method of judging based on a predefined writing style or keyword, and a method of judging using explanatory sentence judgment AI (Artificial Intelligence). Details of the explanatory sentence extraction process (step S1234) will be described below with reference to FIG. 8.

[0072] Fig. 8 is a flowchart showing an example of the procedure of the explanatory sentence extraction process (step S1234) executed by the complementary information acquisition unit 123. The example shown in Fig. 8 is an example in which an explanatory sentence determination AI (not shown) is implemented in the complementary information acquisition unit 123 to determine the explanatory sentence.

[0073] First, in step S12341, complementary information acquisition section 123 analyzes the content acquired in step S1233 of Fig. 7 and extracts only the text. For example, in the case of a page in HTML format, HTML tags are removed and the text is extracted.

[0074] Next, in step S12342, the supplementary information acquiring unit 123 divides the extracted text into sentences, for example, by dividing the text at periods and line breaks.

[0075] Furthermore, in steps S12343 to S12345, the supplementary information acquisition unit 123 determines whether or not each sentence divided in step S12342 is an explanatory sentence. In step S12343, the supplementary information acquisition unit 123 inputs the sentence to the explanatory sentence determination AI. Next, in step S12344, the supplementary information acquisition unit 123 determines whether or not the determination result of the explanatory sentence determination AI is an explanatory sentence.

[0076] If the judgment result is an explanatory sentence (YES judgment in step S12344), the complementary information acquisition unit 123 adds the sentence to the primary list (step S12345). On the other hand, if the judgment result is not an explanatory sentence (NO judgment in step S12344), the complementary information acquisition unit 123 performs the processes of steps S12343 to S12345 on the next sentence. After judging all sentences, the process proceeds to the judgment process of step S12346.

[0077] In step S12346, the complementary information acquisition unit 123 judges whether or not one or more pieces of one-sentence data are present in the primary list. If one piece of one-sentence data is present (YES judgment in step S12346), the complementary information acquisition unit 123 outputs the primary list (step S12347b). The primary list is added to the list of complementary information in step S1236 (FIG. 7).

[0078] On the other hand, if there is no data of one sentence, the complementary information acquiring unit 123 outputs a message indicating that there is no explanatory text (step S12347a).

[0079] After processing step S12347a or S12347b, this description extraction process ends.

[0080] Here, the explanatory text judgment AI is a judgment AI that uses a trained model constructed by learning explanatory text such as "XX is XX". When an explanatory text judgment AI receives a sentence, it outputs a binary value indicating whether the sentence is an explanatory text or not. In the field of vulnerability impact analysis such as the present invention, a judgment AI is sometimes used to analyze vulnerability information, but it is not common to use a judgment AI on external information 200 to improve the accuracy of impact analysis.

[0081] [Details of hyperlink search process] Next, details of the hyperlink destination search process (step S1235) in the complementary information acquisition process (step S123 in FIG. 7) executed by the complementary information acquisition unit 123 will be described with reference to FIG.

[0082] FIG. 9 is a flowchart showing an example of the procedure of the hyperlink destination search process (step S1235) executed by the complementary information acquisition unit 123. First, in step S12351, the complementary information acquiring unit 123 analyzes the content acquired in step S1233 of FIG. 7, and acquires a list of hyperlinks.

[0083] Next, in step S12352, the complementary information acquisition unit 123 sets access priorities for the list of hyperlinks. By setting access priorities, it is expected that the load on the accessed server and the search time can be reduced. There are several methods for setting access priorities, such as a method of prioritizing links that meet the conditions of the URL format of a predefined explanation page, a method of prioritizing links that are hierarchically close to the currently viewed Web page, and a method of prioritizing links in the vicinity where targets having vulnerabilities frequently appear.

[0084] Furthermore, the complementary information acquisition unit 123 performs the processes of steps S1233 and S1234 for N hyperlinks with high priority (N is a preset natural number) to extract explanatory text. In step S1233, the complementary information acquisition unit 123 transmits a request to the hyperlink and acquires a response including the content of the explanatory page.

[0085] Next, in step S1234, the complementary information acquisition unit 123 analyzes the content and extracts the explanatory text of the vulnerability holding target. If the explanatory text can be extracted ((b) Extractable), the complementary information acquisition unit 123 outputs the extracted explanatory text (primary list) (step S12353b).

[0086] On the other hand, if the explanatory text cannot be extracted ((a) Extraction not possible), the supplementary information acquisition unit 123 performs the processes of steps S1233 and S1234 for the next hyperlink destination. The supplementary information acquisition unit 123 performs the processes of steps S1233 and S1234 until all the N hyperlinks with the highest priority have been referenced.

[0087] If an explanation cannot be obtained from all the N hyperlinks, the supplementary information acquiring unit 123 outputs a message indicating that there is no explanation (step S12353a).

[0088] After processing in step S12353a or S12353b, the search process for the hyperlink destination ends.

[0089] [Configuration product information update process] Next, details of the constituent product information update process (step S124 in FIG. 5) executed by the constituent product information update section 124 of the search processing section 120 will be described with reference to FIG.

[0090] Fig. 10 is a flowchart showing an example of the procedure of the constituted product information update process (step S124) executed by the constituted product information update unit 124. The example shown in Fig. 10 is an example of the constituted product information update process executed by the constituted product information update unit 124 when an explanatory text of a vulnerability holding target is acquired as complementary information in the complementary information acquisition process (step S123 in Fig. 7).

[0091] First, in step S1241, the constituent product information update unit 124 picks up important keywords from the list of complementary information acquired in the complementary information acquisition process (step S123). Criteria for selecting important keywords include, for example, (1) a keyword with the highest importance value in the complementary information (description), and (2) a keyword with an importance value higher than a predetermined threshold. The number of selected keywords may be two or more.

[0092] By picking out keywords with high importance, it is expected that only the main keywords will be reflected in the component product information storage unit 160 (FIG. 3), and unnecessary keywords will be eliminated. Methods for determining importance include a method based on appearance frequency, a method based on grammar, and a method based on source URL format.

[0093] Next, in steps S1242 and S1243, the constituent product information is updated based on each keyword picked up in step S1241. In step S1242, the constituent product information update unit 124 searches for a constituent product classification column (record) whose value of the constituent product classification 161 matches the keyword picked up above, and determines whether or not a corresponding record exists.

[0094] If the record does not exist (NO in step S1242), the constituent product information update unit 124 performs the processes in steps S1242 and S1243 on the next keyword. On the other hand, if one or more records exist (YES in step S1242), the configured product information update unit 124 registers the vulnerability holding target as the value of the configured product details information 162 of all of the records and sets an update flag (step S1243). Once the processes in steps S1242 and S1243 have been performed for all picked up keywords, the process proceeds to the determination process in step S1244.

[0095] In step S1244, the constituent product information update unit 124 determines whether an update flag is set in the record of the constituent product information. If the update flag is set (YES in step S1244), the constituent product information update unit 124 outputs "constituted product information updated" (step S1245a). On the other hand, if the update flag is not set, the constituted product information update unit 124 outputs "constituted product information update unnecessary" (step S1245b).

[0096] After step S1245a or S1245b is completed, the configured product information update process ends.

[0097] [How to determine the importance of keywords] Next, a method for determining the importance of a keyword will be described with reference to Figures 11 to 13. Figures 11 to 13 show a specific example of step S1241 in Figure 10, which determines the importance of a keyword included in the complementary information (explanation) acquired in the complementary information acquisition process (step S123 in Figure 5) based on the source URL format and grammar.

[0098] FIG. 11 is a diagram showing an example of a table of importance determination rules based on a URL format. FIG. 12 is a diagram showing an example of an importance determination table based on the grammar of an explanatory sentence. FIG. 13 is a diagram showing an example of a keyword importance determination table.

[0099] 13, in keyword importance determination table 1300, "(B) grammatical importance" is calculated based on the description, and "(A) URL format importance" is calculated based on the source URL. In keyword importance determination table 1300, the sum of the products of (A) grammatical importance and (B) URL format importance is calculated for each keyword included in the description to determine the importance of the keyword.

[0100] (Importance based on URL format) Here, the importance of the (A) URL format in the keyword importance determination table 1300 is determined based on the URL format-based importance determination rule table 1100 shown in Fig. 11. The importance determination rule table 1100 has items of "Condition" and "Importance of (A) URL format".

[0101] The "condition" is a condition for assigning importance, and in this case is information about a character string (word) included in the URL. "(A) Importance of URL format" stores the importance value assigned for each condition. For example, the importance is set based on the information contained in the domain (vendor name, product name, etc.) and the location where that information is contained (domain, path, etc.). In this example, if the URL contains a product name, a high importance value is set.

[0102] In the URL format based importance determination rule table 1100, if the source URL of the description matches the "conditions," the "(A) URL format importance" is added. For example, if the source URL is "https: / / www.ABCD.com / local communication product B1.html," the condition "product name in path" is met, so the importance is "0.8."

[0103] (Importance based on grammar of the description) Moreover, the (B) grammatical importance in the keyword importance determination table 1300 is determined as in the importance determination table 1200 based on the grammar of the explanatory sentence shown in Fig. 12. The importance determination table 1200 has the items of "explanatory sentence", "syntax analysis", "layer", and "(B) grammatical importance".

[0104] In the "explanation" field, information on the explanation in the list of complementary information acquired by the complementary information acquisition unit 123 in step S123 is stored. The "syntax analysis" field stores the results of syntactically analyzing the explanatory text. "Layer" stores hierarchical information in the results of syntax analysis. "(B) Grammatical importance" stores the importance value calculated based on the results of syntax analysis and the layer.

[0105] In the importance determination table 1200 based on the grammar of the explanatory text, the explanatory text is parsed to create a syntax tree. That is, this table shows the results of breaking down the explanatory text into words and syntactically analyzing their structure and function. In the importance determination table 1200, importance is assigned to the layer in which the noun phrase containing the keyword is located. For example, "short-distance communication protocol B" included in the "explanation text" in the first row is located in the second layer (layer "1") of the total four layers of the syntax tree, so when normalized by taking the difference from the total number of layers, which is 4, the importance becomes "0.75". 0.75 = (4-1)÷4.

[0106] (Keyword importance) The keyword importance determination table 1300 in FIG. 13 has the items “Keyword,” “Description,” “Source URL,” “(A) Importance of URL format,” “(B) Grammatical importance,” and “(C) Importance Σ(A×B).”

[0107] "Keywords" stores information about keywords contained in the description. In the "explanation", information on the "explanation" in the importance determination table 1200 based on the grammar of the explanation is stored. "Source URL" stores information about the URL of the content, including the description, that is the hyperlink destination.

[0108] In "(A) Importance of URL format", the value of "(A) Importance of URL format" in the URL format-based importance determination rule table 1100 is stored according to the condition that the keyword matches. In "(B) Grammatical Importance", the value of "(B) Grammatical Importance" in the grammar-based importance determination table 1200 for the description sentence is stored according to the layer in which the noun phrase containing the keyword is located.

[0109] "(C) Importance Σ(A×B)" stores the sum of the products of "(A) URL format importance" and "(B) grammatical importance" for each keyword. For example, for "short-distance communication protocol B" included in "keywords" on the first line, two descriptions are extracted from "description." Therefore, "(C) Importance Σ(A×B)" for "short-distance communication protocol B" is (0.8×0.75)+(0.1×0.5)=0.65.

[0110] The importance determination rule table 1100 based on the above-mentioned URL format is stored in a non-volatile storage unit such as a storage H13 shown in Fig. 14, which will be described later. Also, the importance determination table 1200 based on the grammar of the description sentence and the keyword importance determination table 1300 are stored in a memory H12 or storage H13 shown in Fig. 14, which will be described later.

[0111] The importance determination rule table 1100 and the importance determination tables 1200 and 1300 shown in Fig. 11 to Fig. 13 may be configured so that the user can check them on a display device. Also, the importance of "(A) URL format importance" in the importance determination rule table 1100 in Fig. 11 may be configured so that the user can edit the importance.

[0112] [Hardware configuration of the vulnerability impact analysis device] Each functional unit of the vulnerability impact analysis device 100 is realized by hardware such as a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), or a complex programmable logic device (CPLD). Alternatively, it may be realized by a combination of hardware and software, such as a program executed by a CPU. Below, a case where the vulnerability impact analysis device 100 is realized by a combination of hardware and software will be described.

[0113] FIG. 14 is a diagram illustrating an example of the hardware configuration of a computer H1 that realizes the vulnerability effect analysis device 100. As shown in FIG. 14, a computer H1 includes a processor H11, a memory H12, a storage H13, a bus H14, a network interface H15, and an input / output interface H16.

[0114] The processor H11 is a control device that controls the entire computer H1 and executes processing programs, and is, for example, a CPU (Central Processing Unit). The processor H11 reads program code of software from the storage H13, loads it into the memory H12, and executes it.

[0115] The memory H12 is a volatile memory used as a work memory for the processor H11, and is, for example, a RAM (Random Access Memory).

[0116] The storage H13 is a large-capacity non-volatile storage device used to hold various processing programs and data for a long period of time, such as an HDD, a solid state drive (SSD), or a flash memory. For example, the configuration information storage unit 150 and the configured product information storage unit 160 shown in Fig. 1 are realized using the storage H3. The processor H11 executes program code read from the storage H13 or a read only memory (ROM) (not shown), thereby realizing the functions of the vulnerability impact analysis device 100.

[0117] The bus H14 is a data transmission path for transmitting and receiving data among the processor H11, memory H12, storage H13, network interface H15, and input / output interface H16. However, the means for realizing the data transmission path is not limited to a bus.

[0118] The network interface H15 is an interface for connecting to an external network such as the external information 200 or other computers, and is, for example, a NIC (Network Interface Card) for a wired LAN (Local Area Network) or a wireless LAN.

[0119] The input / output interface H16 is an interface for connecting the computer H1 to various input / output devices. For example, the input device is a keyboard or a mouse, and the output device is a display or a speaker. The input device (touch sensor) and the output device (display) may be integrated into a touch panel.

[0120] [Example of vulnerability impact analysis results output] Next, an example of an output result of vulnerability impact analysis by the vulnerability impact analysis device 100 will be described with reference to FIGS. Fig. 15 is a diagram showing an example of a GUI screen in this embodiment. The example in Fig. 15 is an image of a GUI output D1 that displays the result of vulnerability impact analysis. The GUI output D1 is a GUI screen connected to the vulnerability information receiving unit 110 and the impact analysis result output unit 140 (FIG. 1). The GUI screen is displayed on a display connected to the computer H1 of the vulnerability impact analysis apparatus 100, a user terminal, or the like.

[0121] The GUI output D1 has an input area D11 for vulnerability information, an analysis result display area D12, and a log information display area D13.

[0122] (Vulnerability information input area) The vulnerability information input area D11 has a vulnerability information text input form D111a, a vulnerability information file input button D111b, and a send button D112. The user can freely input the vulnerability information text (sentences, words, etc.) into the text input form D111a by operating a keyboard or the like. In addition, when the user presses the file input button D111b, the file structure is displayed hierarchically, and the user can select a file related to the desired vulnerability information. In FIG. 15, "vulnerability_information_20210205.txt" is shown as the selected file.

[0123] The input area D11 imports vulnerability information using a text input form D111a or a file input button D111b. The input area D11 transmits the vulnerability information to the vulnerability information receiving unit 110 by pressing a send button D112.

[0124] (Analysis results display area) The analysis result display area D12 is roughly divided into two sections: "Vulnerability information content" and "Impact analysis results." In the "Vulnerability Information Content" field, the content of the vulnerability information entered in the vulnerability information input area D11 is displayed. In Fig. 15, the vulnerability information displayed is "A vulnerability called CCC exists in version 2.3.4 or earlier of short-range communication product B1 manufactured by company X."

[0125] The "impact analysis result" has a list D121 of configured product information related to the vulnerability, and a list D122 of configuration information affected by the vulnerability. The display area D12 displays the search results of the search processing unit 120 received from the impact analysis result output unit 140 in the list D121 of configured product information related to the vulnerability. The display area D12 also displays the estimation results of the impact estimation unit 130 in the list D122 of configuration information affected by the vulnerability.

[0126] -List of component product information- The list of constituent product information D121 has the items of "display selection check section", "related constituent product classification", and "related constituent product detail information".

[0127] In the "related component product classification" field, a component product classification related to the vulnerability is displayed among the component product classifications 161 in the component product information storage unit 160 shown in FIG. "Related constituent product detail information" displays the constituent product detail information related to the vulnerability from among the constituent product detail information 162 in the constituent product information storage unit 160. As the constituent product detail information, "constituent product name", "version", ..., and "source" are displayed. In the "Display Selection Check Section", you can select the rows of "Configuration Product Information Related to Vulnerabilities" that you want to display by checking or unchecking the checkboxes.

[0128] A list D121 of component product information in FIG. 15 displays "short-distance communication protocol B" as the related component product classification, "short-distance communication product B1" as the component product name, and "updated based on Web information" as the source.

[0129] -List of configuration information affected by the vulnerability- The list of configuration information affected by vulnerabilities D122 has the items of “Affected products,” “Affected configuration elements,” and “Affected functions.” The results of counting the number of cases for each item are also displayed.

[0130] "Affected products" displays information about affected products from among the product information 151 in the configuration information storage unit 150 shown in Fig. 2. As an example, Fig. 15 displays a product name "Product A" with a product ID "D0000". This "Affected products" information is linked to information displayed in the list D121 of constituted product information related to vulnerabilities by the constituted product ID, which is the "constituted product information".

[0131] In the "affected components", the affected components (in this example, names) among the configuration model information 152a of the configuration information 152 in the configuration information storage unit 150 are displayed.

[0132] In the "affected functions", functions that are affected among the configured model information 152a of the configuration information 152 in the configuration information storage unit 150 are displayed.

[0133] 15, the configuration information list D122 affected by the vulnerability displays "Product A" as the affected product, "Navigation module A" as the affected component, and "Short-range communication function" as the affected function. Furthermore, the configuration information list D122 affected by the vulnerability displays "Product A, Door AA, Short-range communication function" and "Product C, Navigation module C, Short-range communication function" as configuration information that is not listed in the configuration information storage unit 150 in FIG. 2.

[0134] (Log information display area) The log information display area D13 has a display button D131. When the display button D131 is pressed, the log information display area D13 displays log information accumulated in the process of vulnerability impact analysis as shown in FIG.

[0135] [Example of log information] FIG. 16 is a diagram showing an example of log information in this embodiment. The log information L1 includes a log L11 in which constituent product information corresponding to the vulnerability information was detected during the matching process (step S122 in Figure 5), and a log L12 in which corresponding constituent product information was not detected and a constituent product information update process was performed.

[0136] Log L11 includes a log that assigns an ID to the information received by the vulnerability information receiving unit 110, a log in which component product information corresponding to the vulnerability-holding target was detected in the matching process (step S122), and a log related to the execution of impact estimation (step S130).

[0137] The log L12 includes a log in which an ID is assigned to the vulnerability information received by the vulnerability information receiving unit 110, and a log in the case where constituent product information corresponding to the vulnerability holding target is not detected in the matching process (step S122) (determination of NO). The log L12 also includes a log in which complementary information is searched for from an external information source in the complementary information acquisition process (step S123), and a log related to the presence or absence of an update in the constituent product information update process (step S124). The log L12 also includes a log in which constituent product information corresponding to the vulnerability holding target is detected in the matching process (step S122) (determination of YES), and a log related to the execution of the impact estimation process (step S130 in FIG. 4).

[0138] However, logs relating to step S124 and steps S125a and S125b may not be generated depending on the results of the previous processing.

[0139] In this embodiment, when the complementary information acquisition unit acquires the second information (complementary information), the fact that the second information for the vulnerability information has been acquired is recorded in the output log (log L1). Also, when the impact estimation unit estimates the impact of the vulnerability information using the second information, external information indicating the acquisition source is recorded on the output screen (list D121 of constituent product information in FIG. 14) as the source of the first information (constituent product information) corresponding to the vulnerability information.

[0140] As a result, in this embodiment, the user can confirm that the vulnerability impact analysis device 100 has acquired second information for the vulnerability information. In addition, the user can confirm external information (external information source) indicating the source of the first information (component product information) corresponding to the vulnerability information.

[0141] As described above, the vulnerability impact analysis device 100 according to this embodiment is an example of a vulnerability impact analysis system that analyzes the impact of vulnerability information on a managed object implemented in software and / or hardware. The vulnerability impact analysis device 100 comprises a first memory unit (constituent product information memory unit 160) that stores first information (constituent product information), which is information on the components to be managed, an input unit (vulnerability information receiving unit 110) that accepts vulnerability information, a complementary information acquisition unit that acquires second information (complementary information), which is information that complements the vulnerability information, from external information outside the system when no first information corresponding to the vulnerability information exists, and an impact estimation unit that outputs an analysis result that estimates the impact of the vulnerability information using the second information.

[0142] In addition, the vulnerability impact analysis device 100 of this embodiment is equipped with an information update unit (constituent product information update unit 124) that, when first information different from the first information stored in the first memory unit (constituent product information memory unit 160) which corresponds to second information (complementary information) for the vulnerability information is present in the external information, links the vulnerability information to the first information in the external information and stores the said first information.

[0143] [Effects of this embodiment] The vulnerability impact analysis device 100 according to the above-described embodiment acquires complementary information (explanatory text) about a vulnerability-holding target from an external information source when constituent product information corresponding to vulnerability information is not detected from the constituent product information in a vulnerability impact analysis using hierarchical constituted product information (product information of constituent elements). Then, in the vulnerability impact analysis device 100, an information update unit updates the constituted product information based on the complementary information.

[0144] Thereby, even if there is a variation in expression between the configured product information and the vulnerability information, the vulnerability impact analysis device 100 can correct the variation in expression between the configured product information and the vulnerability information. Therefore, the vulnerability impact analysis device 100 can identify the corresponding configured product information from the updated configured product information and estimate the impact of the vulnerability. In this way, by updating the configuration information, it is possible to more accurately estimate the configuration elements in the IoT product that are affected by the vulnerability.

[0145] [Variations] The components of the vulnerability impact analysis device 100 according to the embodiment described above may be implemented in any hardware as long as the respective hardware can transmit and receive information to each other via a network. Furthermore, the process performed by a certain processing unit may be realized by a single piece of hardware, or may be realized by distributed processing using multiple pieces of hardware.

[0146] For example, the search processing unit 120 and the impact estimation unit 130 may be arranged in a device or a cloud environment (e.g., an external server) external to the vulnerability impact analysis device 100. In this case, the configuration information storage unit 150 and the configured product information storage unit 160 may also be arranged in a device external to the vulnerability impact analysis device 100.

[0147] When a user inputs vulnerability information into the user terminal that the user is using, the vulnerability information in the cloud environment is transferred from the vulnerability information receiving unit 110 to the search processing unit 120 via a communication network. Then, in the cloud environment, processing is performed on the vulnerability information by the search processing unit 120 and the impact estimation unit 130, and an impact analysis result based on the impact estimation result is returned to the user terminal. The user terminal outputs the impact analysis result for the input vulnerability information to a display by the impact analysis result output unit 140. This allows the user to check the impact analysis result for the input vulnerability information. For example, a desktop PC (Personal Computer) or a tablet PC may be used as the user terminal.

[0148] Furthermore, the present invention is not limited to the above-described embodiment, and various other applications and modifications are possible without departing from the gist of the present invention described in the claims. For example, the above-described embodiment is a detailed and specific description of the configuration in order to easily explain the present invention, and is not necessarily limited to a configuration having all of the components described. In addition, it is also possible to add, replace, or delete other components to a part of the configuration of the embodiment.

[0149] In the above-described embodiment, the control lines and information lines are those that are considered necessary for the explanation, and not all control lines and information lines in the product are necessarily shown. In reality, it may be considered that almost all components are connected to each other.

[0150] In this specification, the processing steps describing chronological processing include not only processing performed chronologically according to the order described, but also processing that is not necessarily performed chronologically but is performed in parallel or individually (for example, processing by objects). Furthermore, the processing order of the processing steps describing chronological processing may be changed as long as it does not affect the processing result. [Explanation of symbols]

[0151] 100... vulnerability impact analysis device, 110... vulnerability information receiving unit, 120... search processing unit, 121... vulnerability holding target extraction unit, 122... matching processing unit, 123... complementary information acquisition unit, 124... constituent product information update unit, 125... search result output unit, 130... impact estimation unit, 140... impact analysis result output unit, 150... configuration information storage unit, 151... product information, 152... configuration information, 152a... configuration model information, 152b... constituent product information, 160... constituent product information storage unit, 161... constituent product classification, 162... constituent product detailed information, 200... external information, 1100... importance determination rule table, 1200... importance determination table, 1300... importance determination table, D1... GUI output, D11... input area, D111a... text input form, D111b...File input button, D112...Send button, D12...Display area, D121...List, D122...Configuration information list, D13...Display area, D131...Display button

Claims

1. A vulnerability impact analysis system for analyzing an impact of vulnerability information on a managed object implemented in software and / or hardware, comprising: a first storage unit for storing first information which is information on a part to be managed; an input unit for accepting vulnerability information; a complementary information acquisition unit that acquires second information, which is information that complements the vulnerability information, from external information outside the system when the first information corresponding to the vulnerability information does not exist; an impact estimation unit that outputs an analysis result obtained by estimating an impact of the vulnerability information by using the second information; Vulnerability Impact Analysis System.

2. The complementary information acquisition unit acquiring information on the vulnerability information as the external information from an external information source; Extracting the second information of interest from the acquired vulnerability information. The vulnerability impact analysis system according to claim 1 .

3. The complementary information acquisition unit extracting the second information on a vulnerability target having a vulnerability from the vulnerability information; The second information on the vulnerability-holding target is acquired from the external information source in place of the vulnerability information. The vulnerability impact analysis system according to claim 2 .

4. an information updating unit that, when first information corresponding to the second information for the vulnerability information and different from the first information stored in the first storage unit is present in the external information, associates the vulnerability information with the first information in the external information and stores the vulnerability information. The vulnerability impact analysis system according to claim 1 .

5. a second storage unit that stores the first information corresponding to the vulnerability information and information on a function of the configuration item to be managed in association with each other, The influence estimation unit is When the first information stored in the first storage unit corresponds to the vulnerability information, it is assumed that a function linked to the first information is affected, and a configuration element having the same function is affected. The vulnerability impact analysis system according to claim 1 .

6. The second storage unit is Information on a configuration model that models components and functions of the management target; The first information is part information for implementing the configured model. The vulnerability impact analysis system according to claim 5 .

7. when the second information is acquired by the complementary information acquisition unit, a message indicating that the second information for the vulnerability information has been acquired is written in an output log; When the influence estimation unit estimates the influence of the vulnerability information by using the second information, external information indicating an acquisition source is displayed on an output screen as a source of the first information corresponding to the vulnerability information. The vulnerability impact analysis system according to claim 1 .

8. The external information is information that is not managed as part information of the managed object, and is analysis information of vulnerability information of the managed object, information of similar vulnerability, description of vulnerability-holding target, or specification table. The vulnerability impact analysis system according to claim 1 .

9. A vulnerability impact analysis method using a vulnerability impact analysis system that analyzes an impact of vulnerability information on a managed object implemented in software and / or hardware, comprising: A process for accepting vulnerability information; a process of acquiring second information, which is information that complements the vulnerability information, from external information outside the system when the first information corresponding to the vulnerability information does not exist in a first storage unit that stores first information, which is information on components to be managed; and outputting an analysis result in which an impact of the vulnerability information is estimated using the second information. Vulnerability impact analysis method.

Images