Information presentation device, information presentation method, and program

Abstract

To present a method for coping with vulnerability in accordance with a configuration of a target computer system.SOLUTION: An information presentation device 10 includes: a vulnerability information extraction unit 11 that obtains, as a first similarity, a similarity between first vulnerability information indicating vulnerability of a target system and a plurality of pieces of second vulnerability information prepared in advance and indicating vulnerability of a computer system, and extracts the second vulnerability information in which the obtained first similarity falls within a set range; a system information extraction unit 12 that obtains, as a second similarity, a similarity between first system information including an index indicating performance of the target system and a plurality of pieces of second system information prepared in advance and including an index indicating performance of the computer system, and extracts the second system information in which the obtained second similarity falls within a set range; and a presentation information generation unit 13 that generates presentation information for presentation using the extracted second vulnerability information and the extracted second system information.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to an information presentation device and an information presentation method for presenting information on how to deal with vulnerabilities in computer systems, and further relates to a program for implementing these. [Background technology]

[0002] In recent years, cyber attacks targeting computer systems of companies, government agencies, etc. have caused an increase in damage such as information leaks and business interruptions. For this reason, companies, government agencies, etc. require computer systems that are robust against cyber attacks. For this reason, for example, Patent Document 1 discloses a system that supports the security design of computer systems.

[0003] The system disclosed in Patent Document 1 first compares the characteristics of vulnerabilities in a target system with a database that stores countermeasure policies against cyber attacks, and identifies vulnerabilities with similar characteristics to the vulnerability. Next, the system disclosed in Patent Document 1 identifies frequently used countermeasure policies from the countermeasure policies that are previously associated with the identified vulnerabilities, and presents the identified countermeasure policies to the system administrator, etc.

[0004] According to the system disclosed in Patent Document 1, the administrator of the target system can address the vulnerabilities of the target system and understand the countermeasures that are assumed to be optimal, thereby making the target system more robust against cyber attacks. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2016-045736 A Summary of the Invention [Problem to be solved by the invention]

[0006] However, in Patent Document 1, the countermeasures for the vulnerability of the target system are determined only by the preset correspondence and the frequency of use. In addition, a computer system is generally composed of many components, and the configuration is often changed, so the optimal countermeasures are not constant. For this reason, in the system disclosed in Patent Document 1, the countermeasures presented may not be optimal for the target system, and there is a possibility that optimal security measures cannot be presented.

[0007] An example of the objective of the present disclosure is to solve the above problem and present a method for dealing with vulnerabilities according to the configuration of a target computer system. [Means for solving the problem]

[0008] In order to achieve the above object, an information presentation device according to one aspect of the present disclosure includes: a vulnerability information extraction unit that calculates a similarity between a first vulnerability information indicating a vulnerability of a target system and a plurality of second vulnerability information indicating vulnerabilities of a computer system, the second vulnerability information being prepared in advance, as a first similarity, and extracts the second vulnerability information in which the calculated first similarity falls within a set range; a system information extraction unit that calculates a similarity between first system information including an index indicating the performance of a target system and a plurality of second system information prepared in advance including an index indicating the performance of a computer system as a second similarity, and extracts the second system information in which the calculated second similarity falls within a set range; a presentation information generation unit that generates presentation information to be presented by using the extracted second vulnerability information and the extracted second system information; Equipped with It is characterized by:

[0009] In order to achieve the above object, an information presentation method according to one aspect of the present disclosure includes: a vulnerability information extraction step of calculating a similarity between a first vulnerability information indicating a vulnerability of a target system and a plurality of second vulnerability information indicating vulnerabilities of a computer system, the second vulnerability information being prepared in advance, as a first similarity, and extracting the second vulnerability information in which the calculated first similarity falls within a set range; a system information extraction step of calculating a similarity between a first system information item including an index indicating the performance of a target system and a second system information item including an index indicating the performance of a computer system, the second system information item being prepared in advance, as a second similarity, and extracting the second system information item in which the calculated second similarity falls within a set range; a presentation information generating step of generating presentation information to be presented by using the extracted second vulnerability information and the extracted second system information; having It is characterized by:

[0010] Furthermore, in order to achieve the above object, a program according to one aspect of the present disclosure includes: On the computer, a vulnerability information extraction step of calculating a similarity between a first vulnerability information indicating a vulnerability of a target system and a plurality of second vulnerability information indicating vulnerabilities of a computer system, the second vulnerability information being prepared in advance, as a first similarity, and extracting the second vulnerability information in which the calculated first similarity falls within a set range; a system information extraction step of calculating a similarity between a first system information item including an index indicating the performance of a target system and a second system information item including an index indicating the performance of a computer system, the second system information item being prepared in advance, as a second similarity, and extracting the second system information item in which the calculated second similarity falls within a set range; a presentation information generating step of generating presentation information to be presented by using the extracted second vulnerability information and the extracted second system information; The present invention is characterized in that: Effect of the Invention

[0011] As described above, according to the present disclosure, it is possible to present a method for dealing with vulnerabilities that is suited to the configuration of a target computer system. [Brief description of the drawings]

[0012] [Figure 1] FIG. 1 is a diagram showing a schematic configuration of an example of an information presentation device. [Diagram 2] FIG. 2 is a diagram showing a specific configuration of an example of the information presentation device. [Diagram 3] FIG. 3 is a diagram illustrating an example of vulnerability information. [Figure 4] FIG. 4 is a diagram for explaining a method for calculating the similarity between the first vulnerability information and the second vulnerability information. [Diagram 5] FIG. 5 is a diagram illustrating an example of the system information. [Figure 6] FIG. 6 is a diagram illustrating a method for calculating the similarity between the first system information and the second system information. [Figure 7] FIG. 7 is a diagram illustrating an example of vulnerability handling information. [Figure 8] FIG. 8 is a diagram illustrating an example of presentation information. [Figure 9] FIG. 9 is a flow diagram illustrating an example of the operation of the information display device. [Figure 10] FIG. 10 is a block diagram illustrating an example of a computer that realizes the information presentation device. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] (Embodiment) Hereinafter, in the embodiment, an example of an information display device will be described with reference to FIGS.

[0014] [Device configuration] First, a schematic configuration of an example of an information display device will be described with reference to Fig. 1. Fig. 1 is a diagram showing a schematic configuration of an example of an information display device.

[0015] 1 is a device that presents information on how to deal with vulnerabilities in a computer system. As shown in FIG 1, the information presentation device 10 includes a vulnerability information extraction unit 11, a system information extraction unit 12, and a presentation information generation unit 13.

[0016] The vulnerability information extraction unit 11 first obtains a similarity between the first vulnerability information and the second vulnerability information as a first similarity. The first vulnerability information is information indicating the vulnerability of a computer system (hereinafter referred to as a "target system") to which information is to be presented. The second vulnerability information is information indicating the vulnerability of a computer system, of which a plurality of pieces are prepared in advance. Then, the vulnerability information extraction unit 11 extracts the second vulnerability information in which the obtained first similarity falls within a set range.

[0017] The system information extraction unit 12 first obtains a similarity between the first system information and the second system information as a second similarity. The first system information is information including an index indicating the performance of the target system. The second system information is information including an index indicating the performance of a computer system, of which a plurality of items are prepared in advance. Then, the system information extraction unit 12 extracts the second system information in which the obtained second similarity falls within a set range.

[0018] The presentation information generating unit 13 uses the second vulnerability information extracted by the vulnerability information extracting unit 11 and the second system information extracted by the system information extracting unit 12 to generate presentation information to be presented.

[0019] In this way, the information presentation device 10 extracts vulnerability information suitable for the target system from among the existing vulnerability information and system information suitable for the target system from among the existing system information, and generates information to be presented using the extracted information. Therefore, the information presentation device 10 can present a method of dealing with vulnerabilities according to the configuration of the target system.

[0020] Next, the configuration and functions of the information display device 10 will be specifically described with reference to Fig. 2 to Fig. 8. Fig. 2 is a configuration diagram showing a specific configuration of an example of the information display device.

[0021] 2, the information presentation device 10 is connected to a user's terminal device 30 via a network or the like. The information presentation device 10 is also connected to a vulnerability information database 21, a system information database 22, and a vulnerability handling information database 23 via a network or the like. Note that hereinafter, the databases are also referred to as "DBs." Each database may be constructed inside the information presentation device 10.

[0022] As shown in FIG. 2, the information presentation device 10 includes an input reception unit 14 in addition to the vulnerability information extraction unit 11, the system information extraction unit 12, and the presentation information generation unit 13 described above. The input receiving unit 14 receives an input of the first vulnerability information and the first system information.

[0023] Specifically, when a user inputs the first vulnerability information and the first system information on the terminal device 30, the terminal device 30 transmits the input first vulnerability information and first system information to the information presentation device 10. As a result, the input receiving unit 14 receives the transmitted first vulnerability information and first system information.

[0024] Both the first vulnerability information and the second vulnerability information are composed of multiple elements indicating vulnerabilities. Hereinafter, when referring to both the first vulnerability information and the second vulnerability information, they will be collectively referred to as "vulnerability information." Figure 3 is a diagram showing an example of vulnerability information.

[0025] As shown in Fig. 3, in the embodiment, the vulnerability information is information indicating vulnerabilities managed by CVE (Common Vulnerabilities and Exposures). Each piece of vulnerability information is assigned a CVE ID. The CVE IDs are assigned and registered by MITRE.

[0026] Furthermore, in the embodiment, the user can input a CVE ID as the first vulnerability information on the terminal device 30. The vulnerability information database 21 stores a large amount of vulnerability information shown in FIG.

[0027] In the embodiment, the vulnerability information extraction unit 11 first compares the CVE ID input by the user with the vulnerability information database 21, and acquires the corresponding vulnerability information as the first vulnerability information. Next, the vulnerability information extraction unit 11 treats the vulnerability information in the vulnerability information database 21 that has not been acquired as the second vulnerability information, and vectorizes each of the first vulnerability information and the second vulnerability information.

[0028] Furthermore, the vulnerability information extraction unit 11 calculates the similarity between the first vulnerability information and the second vulnerability information by using the vectorized first vulnerability information, the vectorized second vulnerability information, and a preset weight. Fig. 4 is a diagram for explaining a method of calculating the similarity between the first vulnerability information and the second vulnerability information.

[0029] Specifically, as shown in the middle part of Fig. 4, the vulnerability information extraction unit 11 digitizes all elements constituting the vulnerability information. In this case, elements originally expressed as numerical values ​​are left as they are. Elements expressed as letters such as "Yes", "N", and "L" are digitized according to a preset rule. Text is digitized using an existing vectorization technique such as Doc2Vec. The vectorization technique is not particularly limited.

[0030] Furthermore, the vulnerability information extraction unit 11 multiplies each element by a weight that is preset for each element, as shown in the lower part of Fig. 4. Then, the vulnerability information extraction unit 11 vectorizes the vulnerability information by constructing a vector made up of each element after multiplication.

[0031] Furthermore, the vulnerability information extraction unit 11 calculates the cosine similarity between the vector of the first vulnerability information and the vector of the second vulnerability information obtained in this manner as the similarity. After that, the vulnerability information extraction unit 11 extracts, for example, the second vulnerability information whose cosine similarity is equal to or greater than a threshold. Note that what is extracted as the second vulnerability information is the corresponding CVE ID. Also, a similarity other than the cosine similarity may be calculated as the similarity.

[0032] In the embodiment, the first system information and the second system information include at least an index indicating the confidentiality of the computer system, an index indicating the integrity of the computer system, and an index indicating the availability of the computer system. Hereinafter, when referring to both the first system information and the second system information, they are collectively referred to as "system information." Figure 5 is a diagram showing an example of system information.

[0033] As shown in Fig. 5, in the embodiment, system information is set for each computer system (system name). The system information includes a confidentiality level indicating the confidentiality of the computer system, an integrity level indicating the integrity of the computer system, and an availability level indicating the availability of the computer system, and indicates the performance of the computer system by these. The system information may further include information such as the presence or absence of an Internet connection, the presence or absence of personal information, the status, the number of servers, and the number of component products. The information included in the system information is not limited to the information described above.

[0034] 5, the confidentiality level, the integrity level, and the availability level are each set by an administrator of the computer system, etc., in accordance with a preset standard. Also, a user can input the system name of the target system as the first system information on the terminal device 30. The system information database 22 stores a large amount of system information shown in FIG.

[0035] In the embodiment, the system information extraction unit 12 first compares the system name input by the user with the system information database 22, and acquires the corresponding system information as the first system information. Next, the system information extraction unit 12 treats the system information in the system information database 22 that has not been acquired as the second system information, and vectorizes each of the first system information and the second system information.

[0036] Furthermore, the system information extraction unit 12 uses the vectorized first system information, the vectorized second system information, and a preset weight to calculate the similarity between the first system information and the second system information. Figure 6 is a diagram explaining a method of calculating the similarity between the first system information and the second system information.

[0037] Specifically, the system information extraction unit 12 quantifies all elements constituting the system information, as shown in the middle part of Fig. 6. In this case, too, elements originally expressed as numbers are left as they are. Elements expressed as text, such as "Yes", "No", and "In operation", are quantified according to preset rules.

[0038] Furthermore, the system information extraction unit 12 multiplies each element by a weighting factor that is preset for each element, as shown in the lower part of Fig. 6. Then, the system information extraction unit 12 vectorizes the system information by constructing a vector made up of each element after multiplication.

[0039] Furthermore, the system information extraction unit 12 calculates the cosine similarity between the vector of the first system information and the vector of the second system obtained in this way as the similarity. After that, the system information extraction unit 12 extracts, for example, the second system information whose cosine similarity is equal to or greater than a threshold. Note that a similarity other than the cosine similarity may be calculated as the similarity.

[0040] In the embodiment, the presentation information generation unit 13 first identifies a computer system corresponding to the second system information extracted by the vulnerability information extraction unit 11. Furthermore, the presentation information generation unit 13 identifies a first countermeasure method for the vulnerability indicated by the first vulnerability information and a second countermeasure method for the vulnerability indicated by the extracted second vulnerability information in the identified computer system. Then, the presentation information generation unit 13 generates presentation information using the identified first and second countermeasure methods.

[0041] Specifically, the presentation information generator 12 identifies the first and second countermeasure methods by using vulnerability countermeasure information stored in the vulnerability countermeasure information database 23. Fig. 7 is a diagram showing an example of vulnerability countermeasure information.

[0042] 7, the vulnerability countermeasure information database 23 stores vulnerability countermeasure information for each combination of a computer system and a CVE ID. The vulnerability countermeasure information is composed of information such as the computer system name, CVE ID, whether there is an impact, the reason for determining the impact, the countermeasure method, and the countermeasure details. In addition, the vulnerability countermeasure information is created by the administrator of the computer system from information about countermeasures taken in the past.

[0043] Also, as shown in the upper part of Fig. 8, for example, it is assumed that the CVE ID input by the user as the first vulnerability information is "CVE-yyyy-yyyy" (see Fig. 3) and the target system is "System A" (see Fig. 5). Then, it is assumed that the vulnerability information extraction unit 11 extracts "CVE-xxxx-xxxx" as the second vulnerability information for which the first similarity falls within the set range. Furthermore, it is assumed that the system information extraction unit 12 extracts system information of "System B" and "System C" as the second system information for which the second similarity falls within the set range.

[0044] In this case, the presentation information generator 12 first obtains vulnerability countermeasure information for "CVE-yyyy-yyyy" for "System B" and "System C" from the vulnerability countermeasure information database 23. In the example of Fig. 8, vulnerability countermeasure information for "System C" is obtained (see Fig. 7).

[0045] Furthermore, the presentation information generation unit 12 also acquires vulnerability addressing information for "CVE-xxxx-xxxx" for "System B" and "System C" from the vulnerability addressing information database 23. In the example of Fig. 8, vulnerability addressing information for "System B" is acquired (see Fig. 7). Also, if similar vulnerability addressing information for "CVE-xxxx-xxxx" is stored in the vulnerability addressing information database 23 for the target system, "System A," the presentation information generation unit 12 can also acquire this vulnerability addressing information.

[0046] Thereafter, the presentation information generator 12 generates presentation information using the acquired vulnerability addressing information, and transmits the generated presentation information to the terminal device 30. As a result, the presentation information shown in Fig. 8 is displayed on the screen of the terminal device 30. Fig. 8 is a diagram showing an example of the presentation information.

[0047] [Device operation] Next, the operation of the information presentation device 10 will be described with reference to FIG. 9. FIG. 9 is a flow diagram showing an example of the operation of the information presentation device. In the following description, FIGS. 1 to 8 will be referred to as appropriate. In the embodiment, an information presentation method is implemented by operating the information presentation device 10. Therefore, the description of the information presentation method will be replaced with the following description of the operation of the information presentation device 10.

[0048] First, as a premise, a user inputs a CVE ID as the first vulnerability information and a system name as the first system information on the terminal device 30. As a result, the terminal device 30 transmits the input first vulnerability information and first system information to the information presentation device 10.

[0049] Then, as shown in FIG. 9, the input receiving unit 14 receives an input of the first vulnerability information and the first system information (step A1).

[0050] Next, the vulnerability information extraction unit 11 calculates the similarity between the first vulnerability information inputted and accepted in step A1 and the second vulnerability information stored in the vulnerability information database 21 (step A2).

[0051] Next, the vulnerability information extraction unit 11 extracts second vulnerability information whose similarity calculated in step A2 is equal to or greater than a threshold value (step A3).

[0052] Next, the system information extraction unit 12 calculates the similarity between the first system information whose input has been accepted in step A1 and the second system information stored in the system information database 22 as a second similarity (step A4).

[0053] Next, the system information extraction unit 12 extracts second system information whose similarity calculated in step A4 is equal to or greater than a threshold value (step A5).

[0054] Note that steps A4 and A5 may be performed before steps A2 and A3, or steps A4 and A5 may be performed simultaneously with steps A2 and A3.

[0055] Next, the presentation information generator 13 uses the second vulnerability information extracted in step A3 and the second system information extracted in step A5 to identify vulnerability countermeasure information corresponding to the countermeasure method for the target system from the vulnerability countermeasure information database 23. Then, the presentation information generator 13 generates presentation information using the identified vulnerability countermeasure information (step A6).

[0056] Thereafter, the presentation information generating unit 13 transmits the presentation information generated in step A6 to the terminal device 30, which then presents the presentation information (step A7).

[0057] As described above, in the embodiment, the information presentation device 10 extracts vulnerabilities similar to a vulnerability specified for a target system. The information presentation device 10 also extracts computer systems similar to the target system. Then, using the extracted vulnerabilities and computer systems as clues, the information presentation device 10 identifies optimal vulnerability countermeasure information from among vulnerability countermeasure information prepared in advance and presents the identified information. Therefore, the information presentation device 10 can present a method of countering a vulnerability according to the configuration of the target system.

[0058] In the embodiment, the confidentiality level, integrity level, and availability level of the system are used as indices for determining the similarity between the target system and other computer systems, so that the similarity can be determined with high accuracy.

[0059] [program] In the embodiment, the program may be a program that causes a computer to execute steps A1 to A7 shown in Fig. 9. By installing and executing this program in a computer, the information presentation device 10 and the information presentation method in the embodiment can be realized. In this case, the processor of the computer functions as a vulnerability information extraction unit 11, a system information extraction unit 12, a presentation information generation unit 13, and an input reception unit 14 to perform processing. Examples of the computer include a general-purpose PC, a smartphone, and a tablet terminal device.

[0060] In the embodiment, the program may be executed by a computer system constructed by a plurality of computers. In this case, for example, each computer may function as any one of the vulnerability information extractor 11, the system information extractor 12, the presentation information generator 13, and the input receiver 14.

[0061] [Physical configuration] A computer that realizes the information display device 10 by executing a program in the embodiment will now be described with reference to Fig. 10. Fig. 10 is a block diagram showing an example of a computer that realizes the information display device.

[0062] 10, a computer 110 includes a CPU (Central Processing Unit) 111, a main memory 112, a storage device 113, an input interface 114, a display controller 115, a data reader / writer 116, and a communication interface 117. These components are connected to each other via a bus 121 so as to be able to communicate data with each other.

[0063] Furthermore, the computer 110 may include a GPU (Graphics Processing Unit) or an FPGA (Field-Programmable Gate Array) in addition to or instead of the CPU 111. In this embodiment, the GPU or FPGA can execute the programs in the embodiments.

[0064] The CPU 111 loads a program in the embodiment, which is composed of a group of codes and is stored in the storage device 113, into the main memory 112, and executes each code in a predetermined order to perform various calculations. The main memory 112 is typically a volatile storage device such as a DRAM (Dynamic Random Access Memory).

[0065] Moreover, the program in the embodiment is provided in a state stored in a computer-readable recording medium 120. The program in the embodiment may be distributed on the Internet connected via the communication interface 117.

[0066] Specific examples of the storage device 113 include a hard disk drive and a semiconductor storage device such as a flash memory. The input interface 114 mediates data transmission between the CPU 111 and input devices 118 such as a keyboard and a mouse. The display controller 115 is connected to a display device 119 and controls the display on the display device 119.

[0067] Data reader / writer 116 mediates data transmission between CPU 111 and recording medium 120, reads programs from recording medium 120, and writes processing results in computer 110 to recording medium 120. Communication interface 117 mediates data transmission between CPU 111 and other computers.

[0068] Specific examples of the recording medium 120 include general-purpose semiconductor storage devices such as CF (Compact Flash (registered trademark)) and SD (Secure Digital), magnetic recording media such as a flexible disk, or optical recording media such as a CD-ROM (Compact Disk Read Only Memory).

[0069] The information display device 10 can be realized not by a computer with a program installed, but by hardware corresponding to each part, for example, an electronic circuit. Furthermore, the information display device 10 may be partially realized by a program and the remaining part by hardware. In the embodiment, the computer is not limited to the computer shown in FIG.

[0070] A part or all of the above-described embodiment can be expressed by (Addendum 1) to (Addendum 18) described below, but is not limited to the following description.

[0071] (Appendix 1) a vulnerability information extraction unit that calculates a similarity between a first vulnerability information indicating a vulnerability of a target system and a plurality of second vulnerability information indicating vulnerabilities of a computer system, the second vulnerability information being prepared in advance, as a first similarity, and extracts the second vulnerability information in which the calculated first similarity falls within a set range; a system information extraction unit that calculates a similarity between first system information including an index indicating the performance of a target system and a plurality of second system information prepared in advance including an index indicating the performance of a computer system as a second similarity, and extracts the second system information in which the calculated second similarity falls within a set range; a presentation information generation unit that generates presentation information to be presented by using the extracted second vulnerability information and the extracted second system information; Equipped with An information presentation device comprising:

[0072] (Appendix 2) the first system information and the second system information include at least an indicator of confidentiality of a computer system, an indicator of integrity of a computer system, and an indicator of availability of a computer system; 2. An information presentation device according to claim 1.

[0073] (Appendix 3) The system information extraction unit vectorizes the first system information and the second system information, and obtains a similarity between the first system information and the second system information using the vectorized first system information, the vectorized second system information, and a preset weight. 3. An information presentation device according to claim 2.

[0074] (Appendix 4) the first vulnerability information and the second vulnerability information are both composed of a plurality of elements indicating vulnerabilities, the vulnerability information extraction unit vectorizes the first vulnerability information and the second vulnerability information, and obtains a similarity between the first vulnerability information and the second vulnerability information by using the vectorized first vulnerability information, the vectorized second vulnerability information, and a preset weight; 2. An information presentation device according to claim 1.

[0075] (Appendix 5) the presentation information generation unit identifies a computer system corresponding to the extracted second system information, and further identifies, in the identified computer system, a first countermeasure method for the vulnerability indicated by the first vulnerability information and a second countermeasure method for the vulnerability indicated by the extracted second vulnerability information, and generates the presentation information using the identified first countermeasure method and second countermeasure method. 2. An information presentation device according to claim 1.

[0076] (Appendix 6) an input information receiving unit that receives an input of the first vulnerability information and the first system information, 2. An information presentation device according to claim 1.

[0077] (Appendix 7) a vulnerability information extraction step of calculating a similarity between a first vulnerability information indicating a vulnerability of a target system and a plurality of second vulnerability information indicating vulnerabilities of a computer system, the second vulnerability information being prepared in advance, as a first similarity, and extracting the second vulnerability information in which the calculated first similarity falls within a set range; a system information extraction step of calculating a similarity between a first system information item including an index indicating the performance of a target system and a second system information item including an index indicating the performance of a computer system, the second system information item being prepared in advance, as a second similarity, and extracting the second system information item in which the calculated second similarity falls within a set range; a presentation information generating step of generating presentation information to be presented by using the extracted second vulnerability information and the extracted second system information; having 13. An information presentation method comprising:

[0078] (Appendix 8) the first system information and the second system information include at least an indicator of confidentiality of a computer system, an indicator of integrity of a computer system, and an indicator of availability of a computer system; The method of presenting information as described in Appendix 7.

[0079] (Appendix 9) In the system information extraction step, the first system information and the second system information are vectorized, and a similarity between the first system information and the second system information is obtained using the vectorized first system information, the vectorized second system information, and a preset weight. The method of presenting information described in Appendix 8.

[0080] (Appendix 10) the first vulnerability information and the second vulnerability information are both composed of a plurality of elements indicating vulnerabilities, in the vulnerability information extraction step, the first vulnerability information and the second vulnerability information are vectorized, and a similarity between the first vulnerability information and the second vulnerability information is calculated using the vectorized first vulnerability information, the vectorized second vulnerability information, and a preset weight; The method of presenting information as described in Appendix 7.

[0081] (Appendix 11) In the presentation information generating step, a computer system corresponding to the extracted second system information is identified, and further, a first countermeasure method for the vulnerability indicated by the first vulnerability information and a second countermeasure method for the vulnerability indicated by the extracted second vulnerability information in the identified computer system are identified, and the presentation information is generated using the identified first countermeasure method and second countermeasure method. The method of presenting information as described in Appendix 7.

[0082] (Appendix 12) The method further includes an input information receiving step of receiving an input of the first vulnerability information and the first system information. The method of presenting information as described in Appendix 7.

[0083] (Appendix 13) On the computer, a vulnerability information extraction step of calculating a similarity between a first vulnerability information indicating a vulnerability of a target system and a plurality of second vulnerability information indicating vulnerabilities of a computer system, the second vulnerability information being prepared in advance, as a first similarity, and extracting the second vulnerability information in which the calculated first similarity falls within a set range; a system information extraction step of calculating a similarity between a first system information item including an index indicating the performance of a target system and a second system information item including an index indicating the performance of a computer system, the second system information item being prepared in advance, as a second similarity, and extracting the second system information item in which the calculated second similarity falls within a set range; a presentation information generating step of generating presentation information to be presented by using the extracted second vulnerability information and the extracted second system information; A program to execute.

[0084] (Appendix 14) the first system information and the second system information include at least an indicator of confidentiality of a computer system, an indicator of integrity of a computer system, and an indicator of availability of a computer system; 14. The program according to claim 13.

[0085] (Appendix 15) In the system information extraction step, the first system information and the second system information are vectorized, and a similarity between the first system information and the second system information is obtained using the vectorized first system information, the vectorized second system information, and a preset weight. 15. The program according to claim 14.

[0086] (Appendix 16) the first vulnerability information and the second vulnerability information are both composed of a plurality of elements indicating vulnerabilities, in the vulnerability information extraction step, the first vulnerability information and the second vulnerability information are vectorized, and a similarity between the first vulnerability information and the second vulnerability information is calculated using the vectorized first vulnerability information, the vectorized second vulnerability information, and a preset weight; 14. The program according to claim 13.

[0087] (Appendix 17) In the presentation information generating step, a computer system corresponding to the extracted second system information is identified, and further, a first countermeasure method for the vulnerability indicated by the first vulnerability information and a second countermeasure method for the vulnerability indicated by the extracted second vulnerability information in the identified computer system are identified, and the presentation information is generated using the identified first countermeasure method and second countermeasure method. 14. The program according to claim 13.

[0088] (Appendix 18) The method further includes an input information receiving step of receiving an input of the first vulnerability information and the first system information. 14. The program according to claim 13. [Industrial Applicability]

[0089] As described above, according to the present disclosure, it is possible to present a method for dealing with vulnerabilities in accordance with the configuration of a target computer system. The present disclosure is useful in the field of security design of computer systems. [Explanation of symbols]

[0090] 10 Information presentation device 11 Vulnerability information extraction part 12 System Information Extraction Unit 13 Presentation information generation section 14 Input reception section 21 Vulnerability Information Database 22 System Information Database 23 Vulnerability Information Database 30 Terminal Equipment 110 Computer 111 CPU 112 Main memory 113 Storage device 114 Input Interface 115 Display Controller 116 Data Reader / Writer 117 Communication Interface 118 Input Devices 119 Display device 120 Recording media 121 Bus

Claims

1. a vulnerability information extraction unit that calculates a similarity between a first vulnerability information indicating a vulnerability of a target system and a plurality of second vulnerability information indicating vulnerabilities of a computer system, the second vulnerability information being prepared in advance, as a first similarity, and extracts the second vulnerability information within a set range of the calculated first similarity; a system information extraction unit that calculates a similarity between first system information including an index indicating the performance of a target system and a plurality of second system information prepared in advance including an index indicating the performance of a computer system as a second similarity, and extracts the second system information in which the calculated second similarity falls within a set range; a presentation information generation unit that generates presentation information to be presented by using the extracted second vulnerability information and the extracted second system information; Equipped with An information presentation device comprising:

2. the first system information and the second system information include at least an indicator of confidentiality of a computer system, an indicator of integrity of a computer system, and an indicator of availability of a computer system; The information presentation device according to claim 1 .

3. The system information extraction unit vectorizes the first system information and the second system information, and obtains a similarity between the first system information and the second system information by using the vectorized first system information, the vectorized second system information, and a preset weight. The information presentation device according to claim 2 .

4. the first vulnerability information and the second vulnerability information are both composed of a plurality of elements indicating vulnerabilities, the vulnerability information extraction unit vectorizes the first vulnerability information and the second vulnerability information, and obtains a similarity between the first vulnerability information and the second vulnerability information by using the vectorized first vulnerability information, the vectorized second vulnerability information, and a preset weight; The information presentation device according to claim 1 .

5. the presentation information generation unit identifies a computer system corresponding to the extracted second system information, and further identifies, in the identified computer system, a first countermeasure method for the vulnerability indicated by the first vulnerability information and a second countermeasure method for the vulnerability indicated by the extracted second vulnerability information, and generates the presentation information using the identified first countermeasure method and second countermeasure method. The information presentation device according to claim 1 .

6. an input information receiving unit that receives an input of the first vulnerability information and the first system information, The information presentation device according to claim 1 .

7. a vulnerability information extraction step of calculating a similarity between a first vulnerability information indicating a vulnerability of a target system and a plurality of second vulnerability information indicating vulnerabilities of a computer system, the second vulnerability information being prepared in advance, as a first similarity, and extracting the second vulnerability information in which the calculated first similarity falls within a set range; a system information extraction step of calculating a similarity between a first system information item including an index indicating the performance of a target system and a second system information item including an index indicating the performance of a computer system, the second system information item being prepared in advance, as a second similarity, and extracting the second system information item within a set range of the calculated second similarity; a presentation information generating step of generating presentation information to be presented by using the extracted second vulnerability information and the extracted second system information; having 13. An information presentation method comprising:

8. On the computer, a vulnerability information extraction step of calculating a similarity between a first vulnerability information indicating a vulnerability of a target system and a plurality of second vulnerability information indicating vulnerabilities of a computer system, the second vulnerability information being prepared in advance, as a first similarity, and extracting the second vulnerability information in which the calculated first similarity falls within a set range; a system information extraction step of calculating a similarity between a first system information item including an index indicating the performance of a target system and a second system information item including an index indicating the performance of a computer system, the second system information item being prepared in advance, as a second similarity, and extracting the second system information item within a set range of the calculated second similarity; a presentation information generating step of generating presentation information to be presented by using the extracted second vulnerability information and the extracted second system information; A program to execute.

Images