Risk analysis support system and risk analysis support method

Abstract

To allow for the support of risk analysis involved in vulnerability about software products where SBOM cannot be used and source code and binary code cannot be accessed.SOLUTION: A risk analysis support system acquires data from public data on software products and vulnerability, creates a vulnerability dataset and a product dataset from the acquired data. The risk analysis support system also receives a search query, identifies vulnerability data from the vulnerability dataset concerning the search query, identifies at least one of a software product (similar software product) corresponding to product data having high similarity with product data of a software product corresponding to the vulnerability data and influenced by vulnerability and a software product having a dependence relationship with the similar software product from the product dataset, and returns information based on product data of the identified similar software product and / or a dependent software product as the search results.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates generally to risk analysis relating to vulnerabilities in software products. [Background technology]

[0002] As a technique for risk analysis relating to vulnerabilities in software products, for example, the techniques disclosed in Patent Documents 1 and 2 are known. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] US11218510 [Patent Document 2] US11522900 Summary of the Invention [Problem to be solved by the invention]

[0004] The software supply chain generally refers to the complex process of creating, delivering, and maintaining a software product throughout its lifecycle. Recently, open source software products have been integrated or embedded into main software products. Vulnerabilities can exist at any stage in the software supply chain.

[0005] A list of a software product's components and dependencies can be obtained from the Software Bill of Materials (SBOM). If an SBOM is not available, the software product's components and dependencies can be identified by analyzing the source code or binary code of the software product.

[0006] However, for software products, such as proprietary software products, access to the source code or binary code or use of the SBOM may not be available because disclosure of the source code, binary code, or SBOM may erode the vendor's competitive advantage.

[0007] Therefore, it is difficult to support vulnerability risk analysis for software products for which neither the SBOM nor access to the source code or binary code is available. [Means for solving the problem]

[0008] The risk analysis support system acquires data via a communication network from a vulnerability data source, which is a data source having public data on vulnerabilities of software products, acquires vulnerability data, which is data on vulnerabilities, from the acquired data, and stores the acquired vulnerability data in a storage device as at least a part of a vulnerability data set. The risk analysis support system acquires data via the communication network from a product data source, which is a data source having public data on the software product itself, acquires product data, which is data on the software product, from the acquired data, and stores the acquired product data in a storage device as at least a part of a product data set. The risk analysis support system receives a search query from the query source, identifies vulnerability data related to the search query from the vulnerability data set, and identifies an affected software product, which is a software product affected by a vulnerability corresponding to the vulnerability data, from the identified vulnerability data. The risk analysis support system identifies at least one of a similar software product, which is a software product corresponding to product data that is highly similar to the product data of the identified affected software product, and a dependent software product, which is a software product that has a dependency relationship with the similar software product, from the product data set, and returns information based on the product data of the identified similar software product and / or dependent software product to the query source as a search result. Effect of the Invention

[0009] According to the present invention, it is possible to support risk analysis relating to vulnerabilities for software products for which the use of SBOM and access to source code and binary code are not possible. [Brief description of the drawings]

[0010] [Figure 1] 1 illustrates an example of the configuration of a risk analysis support system according to an embodiment. [Diagram 2] 2 shows an overview of the flow of a database generation process. [Diagram 3] 1 illustrates a schematic diagram of the structure of vulnerability data. [Figure 4] An example of a part of the configuration of a vulnerability database is shown below. [Diagram 5] 1 illustrates a schematic diagram of metadata for a software product. [Figure 6] An example of a part of the configuration of a product database is shown below. [Figure 7] 1 shows an example of a portion of the configuration of a product database with embedded representations added. [Figure 8] 1 shows the flow of an embedded expression adding process. [Figure 9] The process flow of the extractor is shown below. [Figure 10] The flow of the similar product estimation process is outlined below. [Figure 11] This shows the process flow of a search engine. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] In the following description, an "interface unit" may refer to one or more interface devices. The one or more interface devices may be at least one of the following: An I / O interface apparatus which is one or more I / O (Input / Output) interface devices. The I / O (Input / Output) interface devices are interface devices to at least one of an I / O device and a remote display computer. The I / O interface device to the display computer may be a communications interface device. The at least one I / O device may be a user interface device, for example, either an input device such as a keyboard and a pointing device, or an output device such as a display device. A communication interface apparatus which is one or more communication interface devices. The one or more communication interface devices may be one or more homogeneous communication interface devices (e.g., one or more NICs (Network Interface Cards)) or two or more heterogeneous communication interface devices (e.g., a NIC and an HBA (Host Bus Adapter)).

[0012] In the following description, a "memory" refers to one or more memory devices, which are an example of one or more storage devices, and may typically be a primary storage device. At least one memory device in the memory may be a volatile memory device or a non-volatile memory device.

[0013] In the following description, a "persistent storage device" may be one or more persistent storage devices, which are an example of one or more persistent storage devices. A persistent storage device may typically be a non-volatile storage device (e.g., an auxiliary storage device), and more specifically, may be, for example, a hard disk drive (HDD), a solid state drive (SSD), a non-volatile memory express (NVME) drive, or a storage class memory (SCM).

[0014] Also, in the following description, "storage device" may be at least one of memory and persistent storage device.

[0015] Furthermore, in the following description, a "processor" may be one or more processor devices. The at least one processor device may typically be a microprocessor device such as a CPU (Central Processing Unit), but may also be other types of processor devices such as a GPU (Graphics Processing Unit). The at least one processor device may be a single-core or multi-core. The at least one processor device may be a processor core. The at least one processor device may also be a broader processor device such as a circuit that is a collection of gate arrays written in a hardware description language that performs part or all of the processing (e.g., an FPGA (Field-Programmable Gate Array), a CPLD (Complex Programmable Logic Device), or an ASIC (Application Specific Integrated Circuit)).

[0016] In the following description, functions may be described using expressions such as data collector, data handler, and search engine, but the functions may be realized by one or more computer programs being executed by a processor, or by one or more hardware circuits (e.g., FPGA or ASIC), or by a combination thereof. When a function is realized by a program being executed by a processor, the function may be at least a part of the processor, since the specified processing is performed using a storage device and / or an interface device, etc., as appropriate. Processing described with a function as the subject may be processing performed by a processor or a device having the processor. A program may be installed from a program source. The program source may be, for example, a program distribution computer or a storage medium (e.g., a non-transitory storage medium) that can be read by a computer. The description of each function is an example, and multiple functions may be combined into one function, or one function may be divided into multiple functions.

[0017] In addition, in the following description, when elements of the same type are described without distinction, common reference symbols will be used, and when elements of the same type are described with distinction, reference symbols will be used.

[0018] FIG. 1 shows an example of the configuration of a risk analysis support system according to an embodiment.

[0019] In this embodiment, the risk analysis support system 100 is a physical computer system (one or more physical computers), but may be a logical computer system (e.g., a virtual machine or a cloud computing service) based on a physical computer system (e.g., a cloud platform). The risk analysis support system 100 includes an interface device 71, a storage device 72, and a processor 73 connected to them. The risk analysis support system 100 is, for example, a server system.

[0020] The interface device 71 can communicate with one or more client computers 51, one or more external systems 52A, etc. via a communication network 30 (eg, the Internet or a Wide Area Network (WAN)).

[0021] Data and programs are stored in the storage device 72. For example, databases 103 such as a product database 103A and a vulnerability database 103B are stored in the storage device 72. In addition, computer programs for realizing functions such as a data collector 101, a data handler 102, and a search engine 104 are stored in the storage device 72.

[0022] The processor 73 executes computer programs to realize functions such as a data collector 101, a data handler 102, and a search engine 104.

[0023] The data collector 101 collects data related to the software product to be evaluated from information sources such as a client computer 51 and an external system 52. The data collector 501 has a web scraper 111, a data dump 112, and a website API (Application Programming Interface) 113. The web scraper 111 extracts data from a web page in a website, which is an example of the external system 52, via the website API 113. The data dump 112 outputs the data obtained by the web scraper 111. The output data is processed by the data handler 102.

[0024] The data handler 102 extracts useful data (e.g., metadata of software products) from the data collected by the data collector 101. The data handler 102 includes a filter 121, a database communication engine 122, an extractor 123, and an embedding generator 124. The filter 121 excludes data of low relevance or importance (e.g., data that meets a predetermined condition regarding relevance or importance) from the collected data. The database communication engine 122 is an interface to the database 103, and input and output to the database 103 are performed through the database communication engine 122. The database communication engine 122 may exist outside the data handler 102 and be used by the data collector 101, the data handler 102, and the search engine 104. The extractor 123 extracts useful data (e.g., metadata of software products) from the data from which data of low relevance or importance has been excluded. The embedding generator 124 encodes text data (e.g., text data in the extracted metadata) into an embedding representation used by the search engine 104.

[0025] Database 103 contains data collected by data collector 101 and processed by data handler 102, and is used for searches by search engine 104. Database 103 includes product database 103A in which information about software products is stored, and vulnerability database 103B in which information about vulnerabilities is stored.

[0026] The search engine 104 is an AI-powered search engine (a search engine equipped with AI (Artificial Intelligence)), and accesses the database 103 through the database communication engine 122 for search. The search engine 104 has a backend 141, a search API 142, a ranker 143, and a dependency resolver 144. The backend 141 uses an existing search engine. The "existing search engine" may be a search and data analysis platform (e.g., an open source search engine, a distributed search engine, etc.) that exists separately from the search engine 104. The search API 142 analyzes and processes the search query, accesses the database 103 via the database communication engine 122, and estimates software products similar to the software product to be evaluated. The ranker 143 ranks the search results based on a scoring metric (specifically, calculates a similarity score described later and ranks based on the similarity score). The dependency resolver 144 searches the product database 103A for information on software products that depend on the software product identified from the output of the ranker 143.

[0027] The processes performed in this embodiment include a database generation process and a similar product estimation process.

[0028] FIG. 2 shows an overview of the flow of the database generation process.

[0029] As described above, the database 103 includes the product database 103A and the vulnerability database 103B.

[0030] The product database 103A contains information about the details of software products used by users (e.g., companies or organizations). The vulnerability database 103B contains information about the details of CVE vulnerabilities. "CVE" stands for "Common Vulnerabilities and Exposures," a catalog of publicly available vulnerabilities, and each vulnerability is assigned a unique identifier (or name) called a CVE ID.

[0031] A data collector 101 collects data from an external system 52 via a communication network 30. The data collector 101 may collect (accept) data (e.g., keywords) from a user via a client computer 51. A data handler 102 filters out data that is less relevant or important from the collected data. The data handler 102 extracts software product metadata from the remaining data, converts the extracted metadata into data in a required format, and stores the format-converted data in a database 103.

[0032] The vulnerability database 103B will now be described in detail.

[0033] A data collector 101 collects available data on a specified CVE vulnerability (vulnerability corresponding to a specified CVE ID) from an external system 52 or a client computer 51. An example of a source of vulnerability data is a CVE or NVD (National Vulnerability Database) website (an example of an external system 52), which provides information in a structured format, such as JSON, CSV, or XML. Another example of a source of vulnerability data is security advisories published by security researchers or software vendors, or other community forums. These forums contain data in an unstructured format, such as primarily text.

[0034] The collected data is processed by the data handler 102. Specifically, a filter 121 removes data with low relevance or importance from the collected data. Next, an extractor 123 extracts data related to vulnerabilities from the remaining collected data. The data related to vulnerabilities is associated with a CVE ID as shown in FIG. 3, and may include at least some of the following data (3-1) to (3-5). (3-1) Data regarding severity rating (e.g., data representing a score (an example of a severity rating) provided by the Common Vulnerability Scoring System (CVSS)). For example, descriptive data such as "Severity Rating: 7.5 (CVSS 3.x Base Score)". (3-2) Data on affected software products (software products affected by the vulnerability). For example, descriptive data such as "Affected Software: Apache-Log4j Version 1.2, Fedoraproject-Fedora Version 35." (3-3) Data on vulnerability description. For example, descriptive data such as "Description: JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration." (3-4) Exploitability data. For example, descriptive data such as "Exploitability: The attacker can cause JMSAppender to perform JNDI requests that result in remote code execution." (3-5) Data about the weakness. For example, descriptive data such as "Weakness: CWE-502 Deserialization of Untrusted Data."

[0035] This data is converted into, for example, a predetermined format and added to the vulnerability database 103B via the database communication engine 122. A portion of the configuration of the vulnerability database 103B is shown, for example, in FIG. 4. The table shown in FIG. 4 may exist for each CVE ID. Unlike general CVE data records, the vulnerability database 103B may include additional data obtained from the latest security advisories published by security researchers and software product vendors. The additional data may include an updated list of affected software products, detailed vulnerability description data, and the like.

[0036] The product database 103A will now be described in detail.

[0037] Available data about the software product is collected. The available data about the software product may be received by the data collector 101 from a user as a software vendor via the client computer 51, or may be collected from a website of the software product or the software vendor (an example of an external system 52). The collected data may be structured data such as JSON or XML, or unstructured data such as text. The collected data may include, for example, the software product's manual, documentation, a Readme file, a description of the software product, etc.

[0038] The collected data is processed by the data handler 102. Specifically, a filter 121 removes data of low relevance or importance from the collected data. Next, an extractor 123 extracts metadata (software product metadata) consisting of data on several aspects of the software product from the remaining collected data. As shown in FIG. 5, the software product metadata may include at least some of the following data (5-1) to (5-5) regarding the software product. (5-1) Data regarding dependencies (e.g., data representing dependencies between the software product and another software product). (5-2) Functionality data (e.g., data that describes the functionality of or references to specific tasks that the software product is designed to perform). (5-3) Data about the domain (e.g., data describing the domain as a particular industry or application area). (5-4) Data relating to the platform (e.g., data describing the platform's requirements for an operating system and / or specific hardware). (5-5) Data regarding licenses (e.g., data expressing license terms such as EULA (End-User License Agreement)).

[0039] This metadata is converted into, for example, a predetermined format and added to the product database 103A via the database communication engine 122. A portion of the configuration of the product database 103A is as shown in, for example, Fig. 6. The table illustrated in Fig. 6 may exist for each software product.

[0040] Similarly, for each software product listed as vulnerable in vulnerability database 103B, metadata for that software product is extracted and the extracted metadata is added to product database 103A.

[0041] Also, for all (or a part of) the text-based data of the metadata, embedded representations are prepared, and the embedded representations are included in the product database 103A. For example, according to Fig. 6, the data related to functionality, the data related to domain, and the data related to platform are text-based data. Therefore, for those data, the embedding generator 124 of the data handler 102 creates embedded representations (e.g., numerical vectors), and adds the created embedded representations to the product database 103A, as shown in Fig. 7. The table illustrated in Fig. 7 may exist for each software product.

[0042] The embedding generator 124 may be configured with a model such as SBERT (described later) that is used to encode various aspects of the metadata of the software product into embeddings. Specifically, the embedding generator 124 takes text as input and outputs an embedding vector, which is a fixed-length sequence of numbers. The embedding generator 124 can use only textual data to encode it into an embedding representation. The embedding generator 124 can compare these embeddings to determine similarity by finding the cosine / Euclidean distance between them, which is expected to produce accurate and relevant matching results. The embedding vectors of several aspects of the metadata of the software product are created offline and stored in the product database 103A.

[0043] FIG. 8 shows the flow of the embedded expression adding process.

[0044] The data handler 102 refers to the product database 103A and creates a list of software products (S801).

[0045] The data handler 102 selects (902) one software product from the list created in S801, and obtains (S803) metadata of the selected software product.

[0046] The data handler 102 selects one aspect of data from the metadata acquired in S803 (S804). If the selected metadata is text data (S805: Yes), the data handler 102 creates an embedded expression (embedding vector) of the text data and stores the embedded expression in the product database 103A.

[0047] If the metadata acquired in S803 contains data on an aspect for which S804 has not yet been performed (S807: No), the process returns to S804.

[0048] If there is a software product on the list created in S801 for which S802 has not yet been performed (S808: No), the process returns to S802.

[0049] When there is data on new software products used by users (e.g., companies or organizations) or when there is data on new vulnerabilities reported on a CVE site (website), such data may be collected and updated in product database 103A and vulnerability database 103B. When there is new data on existing software products, the data on existing software products in product database 103A and vulnerability database 103B may be updated based on the new data on existing software products.

[0050] FIG. 9 shows the flow of the process performed by the extractor 123.

[0051] The extractor 123 determines whether the data to be processed is structured data (S901).

[0052] If the data to be processed is unstructured data such as text data, that is, if the determination result of S901 is false (S901: No), the extractor 123 performs S902 to S906. That is, the extractor 123 performs pre-processing including cleaning the text (S902). For example, in S902, stop words, punctuation, and other noise that do not contribute to the meaning of the text are removed. Next, the extractor 123 performs text classification including identifying or filtering important sections of the text that are likely to contain important information (S903). Thereafter, the extractor 123 recognizes entities from the filtered text (S904). In S904, a statistical or machine learning based process is performed to identify and extract important entities from the classified text. The extractor 123 identifies relationships between the recognized entities (S905). The extractor 123 performs post-processing on the relationships between the entities and outputs the data in a structured format (S906).

[0053] If the data to be processed is structured data such as JSON or XML data, that is, if the judgment result of S901 is true (S901: Yes), the extractor 123 keeps only the data of the necessary fields from the structured data and discards the remaining data (S907).

[0054] The extractor 123 merges the structured data resulting from S906 with the structured data resulting from S907 (S908), and outputs the merged data. This output data is structured data such as JSON or XML.

[0055] 9 is performed to store data in the product database 103A and the vulnerability database 103B. The product database 103A stores data such as product information, for example, “Product Name: Reportlab, Dependencies: Python >=3.7, <4, Functionality: An Open Source Python library for generating PDFs and graphics, Domain: Printing, Text Processing, Markup, Platform: Not Available.” Vulnerability database 103B stores vulnerability information such as, for example, "Description": "JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration.", "Affected Software": "Apache-Log4j Version 1.2, Fedoraproject-Fedora Version 35", "Severity Rating": "7.5", "Exploitability": "The attacker can cause JMSAppender to perform JNDI requests that result in remote code execution", "Weakness": "CWE-502 Deserialization of Untrusted Data".

[0056] FIG. 10 shows an overview of the flow of the similar product estimation process.

[0057] A user (eg, a Product Security Incident Response Team (PSIRT) analyst) inputs a search query associated with a CVE ID from a client computer 51 to the risk analysis support system 100.

[0058] The search engine 104 first uses the CVE ID entered by the user to fetch (identify) all software products that are publicly reported to be vulnerable due to a CVE vulnerability from the database 103. The search engine 104 searches for software products that are highly similar to the vulnerable software product (the fetched software product) (e.g., software products with the top N similarity scores (N is a natural number)).

[0059] Additionally, the search engine 104 identifies all software products that use (e.g., have a dependency on) highly similar software products, since such software products may be indirectly affected by the vulnerability.

[0060] The search engine 104 outputs information including the following (10-1) and (10-2) as a result of a search performed in response to a search query associated with a CVE ID. (10-1) Information that indicates software products that are highly similar to software products affected by vulnerabilities corresponding to CVE IDs. (10-2) Information representing software products that use the software products in (10-1).

[0061] The search engine 104 will now be described in detail.

[0062] The search engine 104 performs semantic search, which is a search that interprets the meaning of a query and the context of the query to provide more relevant search results. Semantic search can efficiently find relationships and similarities between metadata of two software products.

[0063] The search engine 104 performs a transformer-based semantic search. In the transformer-based semantic search, the search engine 104 uses a pre-trained transformer-based NPL (Natural Language Processing) model to encode the query text from the user (text in the search query) and the documents to be searched in response to the search query into fixed-length dense vector representations called embeddings. Such embeddings contain the meaning and context of the query and the documents to be searched, and based on the embeddings, the most relevant documents can be found. As the transformer-based NPL model, for example, models such as BERT (Bidirectional Encoder Representations from Transformers), RoBERTa (Robustly Optimized BERT Pre-training Approach), or ELECTRA (Efficiently Learning an Encoder that Classifies Token Replacements Accurately) may be employed. As the transformer-based NPL model, for example, SBERT (Sentence-BERT), a model designed to generate high-quality fixed-length vector representations of sentences called sentence embeddings that basically encode the meaning of the complete sentence, may be employed. SBERT is trained using a technique called contrastive learning, which trains the model to maximize the similarity between semantically similar sentences while minimizing the similarity between semantically dissimilar sentences.

[0064] FIG. 11 shows the flow of the process performed by the search engine 104.

[0065] The search engine 104 creates a list of software products affected by the CVE vulnerabilities corresponding to the CVE IDs associated with the input search query from the vulnerability database 103B (S1101). If data corresponding to the CVE ID does not exist in the vulnerability database 103B, data on the vulnerabilities corresponding to the CVE ID may be collected and stored in the vulnerability database 103B.

[0066] The search engine 104 selects one influencing software product from the list created in S1101 (S1102).

[0067] The search engine 104 obtains the metadata and embedded expression of the affected software product selected in S1102 from the product database 103A (S1103). The search engine 104 compares the metadata and embedded expression obtained in S1103 with the metadata and embedded expression of each software product other than the affected software product selected in S1102, and calculates a similarity score for each software product other than the affected software product. For each software product other than the affected software product, the similarity score is calculated using a distance metric such as a cosine distance between the embedded expression for the software product and the embedded expression of the affected software product, and is also calculated for each text data in the metadata. The higher the similarity score, the higher the similarity. The search engine 104 determines the average value of the similarity scores (or a statistical value other than the average value) for each software product other than the affected software product as the similarity score between the software product and the affected software product, sorts the determined similarity scores in descending order (in descending order of similarity), and outputs the software products with the top N similarity scores (S1105). Furthermore, for each of the software products having the top N similarity scores, search engine 104 searches product database 103A for software products used by that software product (S1106). Search engine 104 outputs information representing the software products found in S1105 (the software products having the top N similarity scores) and the software products found in S1106 (for example, outputting the information as a search result to client computer 51 that sent the search query for display).

[0068] If there is an affected software product for which S1102 has not yet been performed in the list created in S1101 (S1107: No), the process returns to S1102. Information as the search results may be output after S1102 to S1106 are performed for all affected software products in the list created in S1101.

[0069] Although one embodiment has been described above, this is merely an example for explaining the present invention, and the scope of the present invention is not limited to this embodiment. The present invention can be implemented in various other forms.

[0070] The above description can be summarized as follows. The following summary may include supplementary explanations and explanations of modifications of the above description.

[0071] The risk analysis support system 100 includes a data collector 101 , a data handler 102 , and a search engine 104 .

[0072] The data collector 101 acquires data via the communication network 30 from a vulnerability data source, which is a data source having public data on vulnerabilities of software products. The vulnerability data source may include either an external system 52 or a client computer 51. The vulnerability data source may be a public database such as CVE, NVD, or JVN (Japan Vulnerability Notes). The data handler 102 acquires vulnerability data, which is data on vulnerabilities, from the acquired data, and stores the acquired vulnerability data in the storage device 72 as at least a part of a vulnerability data set. An example of the vulnerability data set is the vulnerability database 103B, and an example of the vulnerability data is a table (record set) for each vulnerability in the vulnerability database 103B.

[0073] The data collector 101 acquires data via the communication network 30 from a product data source, which is a data source having public data about the software product itself. The product data source may include either an external system 52 or a client computer 51. The product data source may be, for example, a website having documentation or web pages for the product. The data handler 102 acquires product data, which is data about the software product, from the acquired data and stores the acquired product data in the storage device 72 as at least a part of a product data set. An example of a product data set is the product database 103A, and an example of product data is a table (record set) for each software product in the product database 103A. The product data may include at least metadata of the software product and an embedded representation.

[0074] The search engine 104 receives a search query from a query source (e.g., the client computer 51), identifies vulnerability data related to the search query from the vulnerability dataset, and identifies an affected software product, which is a software product affected by a vulnerability corresponding to the vulnerability data, from the identified vulnerability data. The search engine 104 identifies at least one of a similar software product, which is a software product corresponding to product data having high similarity to the product data of the identified affected software product, and a dependent software product, which is a software product having a dependency relationship with the similar software product, from the product dataset, and returns information based on the product data of the identified similar software product and / or dependent software product (e.g., information representing the similar software product and / or the dependent software product) to the query source as a search result. The dependent software product is, for example, a software product that is used by or uses the similar software product. The dependent software product may be identified from the product data of the similar software product (e.g., data related to dependency among the product data).

[0075] This enables risk analysis related to vulnerabilities in software products for which the use of SBOM and access to source code or binary code is not possible. Specifically, for example, a user may be a PSIRT team of multiple companies. Even if the use of SBOM and source code / binary code is not possible, the user can help the PSIRT team to perform risk analysis of the software supply chain.

[0076] The search engine 104 may convert the text data in the data associated with the search query and the text data in the vulnerability data set into embedded representations (e.g., numeric vectors, fixed-length vector representations) using a machine learning-based language processing model (e.g., a converter-based NPL model), and compare the converted embedded representation for the search query with the embedded representation for each vulnerability data to identify vulnerability data for which an embedded representation similar to the converted embedded representation for the search query has been obtained. Vulnerability data can be identified from the search query by such a semantic search.

[0077] Furthermore, the search engine 104 may convert the text data in the product data of the affecting software product and the text data in the product data of software products other than the affecting software product into embedded expressions using a machine learning-based language processing model, and compare the product data having the embedded expressions after conversion for the affecting software product with the product data having the embedded expressions after conversion for software products other than the affecting software product, thereby identifying product data that is highly similar to the product data of the affecting software product. By such a semantic search, it is possible to identify software products similar to the affecting software product.

[0078] The data handler 102 may convert, for each software product, text data in the product data of the software product into an embedded expression using a machine learning-based language processing model, and add the embedded expression to the product data. The search engine 104 may identify product data that is highly similar to the product data of the affected software product by comparing product data having the converted embedded expression for the affected software product with product data having the converted embedded expression for software products other than the affected software product.

[0079] The data handler 102 may associate the obtained vulnerability data with a vulnerability ID (e.g., a CVE ID) and store the data in the storage device 72 as at least a part of a vulnerability data set. The search engine 104 may identify vulnerability data from the vulnerability data set that is associated with a vulnerability ID that matches a vulnerability ID associated with the search query.

[0080] The search engine 104 may compare product data having embedded expressions after conversion of text data related to the affected software product with product data having embedded expressions after conversion of text data related to software products other than the affected software product, to calculate a similarity score of the product data of the software product other than the affected software product to the product data of the affected software product for each software product other than the affected software product. Each software product having a similarity score in the top N ranks (N is a natural number) may be a similar software product. [Explanation of symbols]

[0081] 100: Risk analysis support system

Claims

1. A data collector, a data handler and a search engine. The data collector acquires data via a communication network from a vulnerability data source, the vulnerability data source being a data source having public data regarding vulnerabilities in software products; The data handler obtains vulnerability data from the obtained data, the vulnerability data being data related to vulnerabilities, and stores the obtained vulnerability data in a storage device as at least a part of a vulnerability data set; the data collector obtains data over the communications network from a product data source, the product data source being a data source having publicly available data about the software product itself; the data handler retrieves product data from the retrieved data, the product data being data relating to the software product; and stores the retrieved product data in the storage device as at least a part of a product data set; The search engine Receive a search query from a query source; identifying vulnerability data from the vulnerability dataset related to the search query; Identifying affected software products, which are software products affected by the vulnerabilities corresponding to the vulnerability data, from the identified vulnerability data; Identifying at least one of a similar software product, which is a software product corresponding to product data having a high similarity to the product data of the identified affected software product, and a dependent software product, which is a software product having a dependency relationship with the similar software product, from the product data set; returning information based on the product data of the identified similar software products and / or dependent software products as search results to the query source; Risk analysis support system.

2. The search engine converting text data in the data associated with the search query and text data in the vulnerability data set into embedded representations using a machine learning based language processing model; comparing the transformed embedded expression for the search query with an embedded expression for each vulnerability data, thereby identifying vulnerability data for which an embedded expression similar to the transformed embedded expression for the search query has been obtained; 2. The risk analysis support system according to claim 1.

3. The search engine converting text data in the product data of the affected software product and text data in the product data of software products other than the affected software product into embedded representations using a machine learning based language processing model; identifying product data having a high similarity to the product data of the affected software product by comparing product data having an embedded expression after conversion for the affected software product with product data having an embedded expression after conversion for a software product other than the affected software product; 2. The risk analysis support system according to claim 1.

4. the data handler converts, for each software product, text data in product data of the software product into an embedded expression using a machine learning based language processing model, and adds the embedded expression to the product data; the search engine identifies product data having a high similarity to the product data of the affected software product by comparing product data having an embedded expression after conversion for the affected software product with product data having an embedded expression after conversion for software products other than the affected software product; 2. The risk analysis support system according to claim 1.

5. the data handler stores the acquired vulnerability data in a storage device as at least a part of a vulnerability data set in association with a vulnerability ID; The search engine identifies vulnerability data from the vulnerability dataset that is associated with a vulnerability ID that matches a vulnerability ID associated with the search query.

5. The risk analysis support system according to claim 4.

6. the search engine compares product data having embedded expressions after conversion of text data related to the affected software product with product data having embedded expressions after conversion of text data related to software products other than the affected software product, thereby calculating, for each software product other than the affected software product, a similarity score between the product data of the software product and the product data of the affected software product; Each of the software products having a similarity score in the top N rankings (N is a natural number) is the similar software product.

2. The risk analysis support system according to claim 1.

7. acquiring data via a communications network from a vulnerability data source, the vulnerability data source being a data source having publicly available data regarding vulnerabilities in the software product; obtaining vulnerability data from the obtained data, the vulnerability data being data related to vulnerabilities, and storing the obtained vulnerability data in a storage device as at least a part of a vulnerability data set; obtaining data over the communications network from a product data source, the product data source being a data source having public data about the software product itself; obtaining product data from the obtained data, the product data being data relating to the software product, and storing the obtained product data in the storage device as at least a part of a product data set; Receive a search query from a query source; identifying vulnerability data from the vulnerability dataset related to the search query; Identifying affected software products, which are software products affected by the vulnerabilities corresponding to the vulnerability data, from the identified vulnerability data; Identifying at least one of a similar software product, which is a software product corresponding to product data having a high similarity to the product data of the identified affected software product, and a dependent software product, which is a software product having a dependency relationship with the similar software product, from the product data set; returning information based on the product data of the identified similar software products and / or dependent software products as search results to the query source; A risk analysis support method that uses a computer to perform the above steps.

8. acquiring data via a communications network from a vulnerability data source, the vulnerability data source being a data source having publicly available data regarding vulnerabilities in the software product; obtaining vulnerability data from the obtained data, the vulnerability data being data related to vulnerabilities, and storing the obtained vulnerability data in a storage device as at least a part of a vulnerability data set; obtaining data over the communications network from a product data source, the product data source being a data source having public data about the software product itself; obtaining product data from the obtained data, the product data being data relating to the software product, and storing the obtained product data in the storage device as at least a part of a product data set; Receive a search query from a query source; identifying vulnerability data from the vulnerability dataset related to the search query; Identifying affected software products, which are software products affected by the vulnerabilities corresponding to the vulnerability data, from the identified vulnerability data; Identifying at least one of a similar software product, which is a software product corresponding to product data having a high similarity to the product data of the identified affected software product, and a dependent software product, which is a software product having a dependency relationship with the similar software product, from the product data set; returning information based on the product data of the identified similar software products and / or dependent software products as search results to the query source; A computer program that causes a computer to do something.

Images