Vulnerability analysis device, vulnerability analysis method and vulnerability analysis program

Abstract

To provide a vulnerability analysis device capable of predicting tactics of a cyber attack utilizing vulnerability.SOLUTION: A vulnerability analysis device 1 comprises: a vulnerability information acquisition part 11 which acquires information related to Mitigation of vulnerability; a vector generation part 12 which generates a first vector based upon similarities between the information and a plurality of descriptions of Mitigation in a predetermined database as elements; a Technique analysis part 13 which generates a second vector based upon similarities between the first vector and vectors representing a correspondence to a plurality of Mitigations of a plurality of Techniques; a Tactic analysis part 14 which calculates similarities between the second vector and vectors representing a correspondence to a plurality of Techniques of a plurality of Tactics; and a result output part 15 which outputs the evaluation results of Tactics corresponding to vulnerability represented by the calculated similarities.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to the collection and analysis of cyber threat information. [Background technology]

[0002] In recent years, the rapid increase in cyber attacks has led to an increased need for early prediction and detection of attacks. In addition, cyber threats require a society-wide response by sharing information, rather than individual responses. Common formats for vulnerability information, etc. have been developed, databases have been made public, and various types of information are being disseminated via corporate websites, social media, blogs, etc.

[0003] CVE (Common Vulnerabilities and Exposures) IDs, which are used to identify vulnerabilities in publicly available software, are used by many security personnel and security engineers as the first step in security measures. For example, the National Vulnerability Database (NVD) (see Non-Patent Document 1) managed by NIST compiles the CVE ID for each vulnerability along with detailed information about the vulnerability, the level of risk, related products, etc. Using this CVE ID as a key, it is possible to link blogs, social media, public databases such as CWE (Common Weakness Enumeration) (see Non-Patent Document 2) and CAPEC (Common Attack Pattern Enumeration and Classification) (see Non-Patent Document 3), and threat intelligence platforms such as OTX (Open Threat Exchange), making it possible to enrich data for each vulnerability. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] NVD, Internet,<https: / / nvd.nist.gov / > [Non-Patent Document 2] CWE, Internet,<https: / / cwe.mitre.org / > [Non-Patent Document 3] CAPEC, Internet,<https: / / capec.mitre.org / > [Non-Patent Document 4] ATT&CK, Internet,<https: / / attack.mitre.org / > [Non-Patent Document 5] Aditya Kuppa et al., "Linking CVE's to MITER ATT&CK Techniques", Proceedings of the 16th International Conference on Availability, Reliability and Security (ARES 2021). Summary of the Invention [Problem to be solved by the invention]

[0005] However, CVE IDs are not necessarily listed in all databases and documents such as blogs. In particular, ATT&CK (see Non-Patent Document 4) by MITRE is a database that compiles structured attack methods, and although it is highly useful, it does not allow links using CVE IDs as keys. There are also studies that aim to make such links; for example, Non-Patent Document 5 proposes a method for estimating the technique (technology / method) used for each vulnerability. This method aims to directly estimate the technique by using a variety of large amounts of data linked to vulnerabilities, including mitigation information, and also uses data that actually links vulnerabilities and techniques. However, most organizations do not hold large amounts of data, and it is costly just to examine the data linked to vulnerabilities.

[0006] In addition, for discovered vulnerabilities, it is desirable to correlate this information, because by predicting the techniques used to attack the vulnerability and the tactics that will be used to achieve the goals of the techniques used, it is possible to assess the urgency of responding to the vulnerability.

[0007] The present invention aims to provide a vulnerability analysis device, a vulnerability analysis method, and a vulnerability analysis program that can predict the tactics of cyber attacks that exploit vulnerabilities. [Means for solving the problem]

[0008] A first vulnerability analysis device according to the present invention comprises a vulnerability information acquisition unit that acquires information regarding mitigation of a vulnerability; a vector generation unit that generates a first vector whose elements are the similarity between the information regarding the mitigation and each of a plurality of mitigation descriptions in a specified database; a technique analysis unit that generates a second vector whose elements are the similarity between the first vector and each of vectors representing the correspondence between each of a plurality of techniques defined in the specified database and the plurality of mitigations; a tactic analysis unit that calculates the similarity between the second vector and each of vectors representing the correspondence between each of a plurality of tactics defined in the specified database and the plurality of techniques; and a result output unit that outputs an evaluation result of the tactic corresponding to the vulnerability indicated by the similarity calculated by the tactic analysis unit.

[0009] A second vulnerability analysis device according to the present invention comprises a vulnerability information acquisition unit that acquires information regarding vulnerability detection, a vector generation unit that generates a third vector whose elements are the similarity between the information regarding detection and each of a plurality of descriptions of detections in a specified database, a technique analysis unit that generates a fourth vector whose elements are the similarity between the third vector and each of vectors representing the correspondence between each of a plurality of techniques defined in the specified database and the plurality of detections, a tactic analysis unit that calculates the similarity between the fourth vector and each of vectors representing the correspondence between each of a plurality of tactics defined in the specified database and the plurality of techniques, and a result output unit that outputs an evaluation result of the tactic corresponding to the vulnerability indicated by the similarity calculated by the tactic analysis unit.

[0010] In the first vulnerability analysis device, the vulnerability information acquisition unit further acquires information regarding Detection, the vector generation unit further generates a third vector whose elements are the similarity between the information regarding Detection and each of the descriptions of a plurality of Detections in the specified database, and the Technique analysis unit further generates a fourth vector whose elements are the similarity between the third vector and each of vectors representing the correspondence between each of a plurality of Techniques defined in the specified database and the plurality of Detections, and updates the second vector by taking a weighted average of the second vector and the fourth vector.

[0011] In the first vulnerability analysis device, the vector generation unit may further generate a fifth vector whose element is the similarity between the information regarding the mitigation and each of the descriptions of mitigation related to the multiple techniques in the specified database, and the technique analysis unit may update the second vector by taking a weighted average of the second vector, the fourth vector, and the fifth vector.

[0012] A first vulnerability analysis method of the present invention is executed by a computer, comprising the steps of: a vulnerability information acquisition step of acquiring information regarding mitigation of a vulnerability; a vector generation step of generating a first vector whose elements are the similarity between the information regarding the mitigation and each of a plurality of mitigation descriptions in a specified database; a technique analysis step of generating a second vector whose elements are the similarity between the first vector and each of vectors representing the correspondence between each of a plurality of techniques defined in the specified database and the plurality of mitigations; a tactics analysis step of calculating the similarity between the second vector and each of vectors representing the correspondence between each of a plurality of tactics defined in the specified database and the plurality of techniques; and a result output step of outputting an evaluation result of the tactic corresponding to the vulnerability indicated by the similarity calculated in the tactics analysis step.

[0013] A second vulnerability analysis method of the present invention is executed by a computer, comprising the steps of: a vulnerability information acquisition step of acquiring information regarding vulnerability detection; a vector generation step of generating a third vector whose elements are the similarity between the information regarding detection and each of a plurality of detection descriptions in a specified database; a technique analysis step of generating a fourth vector whose elements are the similarity between the third vector and each of vectors representing the correspondence between each of a plurality of techniques defined in the specified database and the plurality of detections; a tactics analysis step of calculating the similarity between the fourth vector and each of vectors representing the correspondence between each of a plurality of tactics defined in the specified database and the plurality of techniques; and a result output step of outputting an evaluation result of the tactic corresponding to the vulnerability indicated by the similarity calculated in the tactics analysis step.

[0014] A vulnerability analysis program according to the present invention is for causing a computer to function as the first or second vulnerability analysis device. Effect of the Invention

[0015] According to the present invention, it is possible to predict the tactics of cyber attacks that exploit vulnerabilities. [Brief description of the drawings]

[0016] [Figure 1] 1 is a block diagram showing a functional configuration of a vulnerability analysis device according to a first embodiment. [Diagram 2] 4 is a flowchart showing the procedure of a vulnerability analysis method in the first embodiment. [Diagram 3] 13 is a flowchart showing the procedure of a vulnerability analysis method according to a second embodiment. [Figure 4] 13 is a flowchart showing the procedure of a vulnerability analysis method according to a third embodiment. [Diagram 5] 13 is a flowchart showing the procedure of a vulnerability analysis method according to a fourth embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0017] Hereinafter, an embodiment of the present invention will be described by way of example. The vulnerability analysis method of this embodiment focuses on Mitigation or Detection, which is information that can be obtained relatively easily regarding CVE IDs, and utilizes a specified database in which the same type of information is linked to Techniques, and further, Techniques are linked to Tactics. Here, ATT&CK is used as an example of a database, but this is not limited to this and any database that stores similar information may be used.

[0018] In ATT&CK, Link from Mitigation to Technique, Link from Tactic to Technique, Link from Detection to Technique, Link from Technique to Mitigation, Link from Technique to Detection, is provided and the correspondence is described.

[0019] [First embodiment] The vulnerability analysis device 1 of the first embodiment estimates the Technique from the similarity between the mitigation information acquired about the vulnerability and the mitigation description in the database (ATT&CK), and then determines the Tactics, making it possible to evaluate the urgency of taking measures against the vulnerability.

[0020] FIG. 1 is a block diagram showing a functional configuration of a vulnerability analysis device 1 in this embodiment. The vulnerability analysis device 1 is an information processing device including a control unit 10, a storage unit 20, and various input / output interfaces.

[0021] The control unit 10 is a part that controls the entire vulnerability analysis device 1, and realizes each function in this embodiment by appropriately reading and executing various programs stored in the storage unit 20. The control unit 10 may be a CPU.

[0022] The storage unit 20 is a storage area for various programs for causing the hardware group to function as the vulnerability analysis device 1, various data, and the like, and may be a ROM, a RAM, a flash memory, a hard disk drive (HDD), or the like.

[0023] The control unit 10 executes software (vulnerability analysis program) stored in the memory unit 20 to function as a vulnerability information acquisition unit 11, a vector generation unit 12, a technique analysis unit 13, a tactics analysis unit 14, and a result output unit 15.

[0024] The vulnerability information acquisition unit 11 acquires a description regarding mitigation of a vulnerability. Information on vulnerability mitigation may be extracted from documents such as blogs or various SNS, but it can also be extracted from public databases, such as CWE ID information included in the NVD, or Advisory information.

[0025] The vector generation unit 12 determines the similarity between the information on mitigation regarding vulnerabilities acquired by the vulnerability information acquisition unit 11 and the mitigation description in a predetermined database (ATT&CK), and represents each vulnerability with a first vector.

[0026] Similarity determination can be achieved using common natural language processing such as Word2vec, Doc2vec, and BERT. This allows us to obtain mitigation information c for vulnerability i. i Each mitigation description in ATT&CK j (p types) and the first vector with the similarity as elements CVE i Mit =(d1(c i ,m1),…,d1(c i ,m p )) =(mit i1 ,…,mit ip ) We can express vulnerability i as In addition, d num (·) represents an appropriate distance function, such as Euclidean distance or cosine distance, which is normalized to a value (probability) between 0 and 1.

[0027] The technique analysis unit 13 generates a second vector whose elements are the similarity between the first vector representing the vulnerability generated by the vector generation unit 12 and each of the vectors representing the correspondence between each of the multiple techniques defined in the database (ATT&CK) and multiple mitigations.

[0028] Here, multiple mitigations described in ATT&CK are linked to the corresponding Techniques (q types), and the jth Technique is Tech j Mit =(tm j1 ,…,tm jp )∈{0,1} p ,(j=1,…,q) can be expressed as one-hot coding. For example, for the jth technique, if the 1st, 2nd, and 4th mitigations are effective, then the technique j Mit =(1,1,0,1,0,…,0). This allows vulnerabilities and techniques to be expressed as vectors in the same space via mitigation.

[0029] Therefore, the technique analysis unit 13 calculates the CVE for each i and j. i Mit andTec j Mit Similarity to d2 (CVE i Mit ,Tech j Mit ) to obtain the second vector CVE i Tec =(d2(CVE i Mit ,Tec1 Mit ),…,d2(CVE i Mit ,Tech q Mit ))=(tec i1 ,…,tec iq ) Calculate.

[0030] Tactic analysis part 14 is a second vector CVE that represents a vulnerability generated by Technique analysis part 13. i Tec The similarity between each of the vectors that represent the correspondence between each of the multiple Tactics defined in the database (ATT&CK) and each of the multiple Techniques is calculated.

[0031] Here, multiple Techniques described in ATT&CK are linked to corresponding Tactics (r types), and the h-th Tactic is, Tac h Tec =(tt h1 ,…,tt hq )∈{0,1} q ,(h=1,…,r),which can be expressed as one-hot coding. This allows vulnerabilities and tactics to be expressed as vectors in the same space via techniques.

[0032] Therefore, the tactic analysis unit 14 calculates the CVE for each i and h. i Tec and Tac h Tec Similarity to d3 (CVE i Tec ,Tac h Tec ) and CVE i Tac =(d3(CVE i Tec ,Tac1 Tec ),…,d3(CVE i Tec ,Tac r Tec )) Calculate. Generated Vector CVE i Tac The elements of represent the similarity (distance) between vulnerability i and each Tactic, which allows us to evaluate which Tactic each vulnerability can be exploited by.

[0033] The result output unit 15 outputs the evaluation result of the tactics corresponding to the vulnerability indicated by the similarity calculated by the tactics analysis unit 14.

[0034] FIG. 2 is a flowchart showing the procedure of the vulnerability analysis method according to this embodiment. In step S1, the vulnerability information acquisition unit 11 acquires information on mitigation for a vulnerability (CVE) to be analyzed.

[0035] In step S2, the vector generation unit 12 generates a first vector (CVE Mit ∈R p )

[0036] In step S3, the technique analysis unit 13 performs a Mit ) and q one-hot vectors (Techniques) that represent q Techniques as Mitigations based on the link structure in ATT&CK. Mit ∈{0,1} p ) based on the similarity to each of them, the second vector (CVE Tec ∈R q )

[0037] In step S4, the Tactic analysis unit 14 calculates the second vector (CVE Tec ) and r one-hot vectors (Tac Tec ∈{0,1} q ) based on the similarity to each vulnerability (CVE), a vector (CVE Tac ∈R r )

[0038] In step S5, the result output unit 15 outputs the vector (CVE Tac ) is output as an evaluation value that is the result of estimating which tactic the vulnerability (CVE) will be exploited by.

[0039] [Second embodiment] In the first embodiment, a method for estimating Tactics based on information regarding Mitigation for each vulnerability is described. In the second embodiment, however, Detection is used instead of Mitigation. That is, the vulnerability analysis device 1 estimates the Technique from the similarity between the information about the Detection acquired about the vulnerability and the Detection description in the database (ATT&CK), and further determines the Tactics.

[0040] Specifically, the configuration of the vulnerability analysis device 1 is the same as that of the first embodiment, but the functions of the vulnerability information acquisition unit 11, vector generation unit 12, and technique analysis unit 13 are different, with "Mitigation" being replaced with "Detection."

[0041] In other words, the vulnerability information acquisition unit 11 acquires information regarding Detection for each vulnerability, and the vector generation unit 12 generates a third vector using the similarity between this information and the descriptions of each of the multiple Detections defined in ATT&CK as elements. Furthermore, the technique analysis unit 13 generates a fourth vector using as elements the similarities between the third vector and each of the vectors representing the associations between each of the techniques defined in ATT&CK and a plurality of detections.

[0042] This fourth vector is the second vector CVE in the first embodiment. i Tec The Tactic analysis unit 14 performs CVE analysis in the same manner as in the first embodiment. i Tac is generated, and the result output unit 15 outputs the evaluation result.

[0043] FIG. 3 is a flowchart showing the procedure of the vulnerability analysis method according to this embodiment. In step S11, the vulnerability information acquisition unit 11 acquires information on Detection for the vulnerability (CVE) to be analyzed.

[0044] In step S12, the vector generation unit 12 generates a third vector (CVE Det ∈R s )

[0045] In step S13, the technique analysis unit 13 calculates the third vector (CVE Det ) and q one-hot vectors (Techniques) that represent q Techniques as Detections based on the link structure in ATT&CK. Det ∈{0,1} s ) based on the similarity to each of them, the fourth vector (CVE Tec ∈R q )

[0046] In step S14, the Tactic analysis unit 14 calculates the fourth vector (CVE Tec ) and r one-hot vectors (Tac Tec ∈{0,1} q ) based on the similarity to each vulnerability (CVE), a vector (CVE Tac ∈R r )

[0047] In step S15, the result output unit 15 outputs the vector (CVE Tac ) is output as an evaluation value that is the result of estimating which tactic the vulnerability (CVE) will be exploited by.

[0048] [Third embodiment] In the third embodiment, each of the vulnerability information acquisition unit 11, the vector generation unit 12, and the technique analysis unit 13 has the functions of both the first and second embodiments. That is, based on the description of Mitigation and Detection for each vulnerability, a second vector and a fourth vector in which the vulnerability (CVE) is expressed by Technique are generated by the procedures of the first and second embodiments, respectively.

[0049] Furthermore, the technique analysis unit 13 updates the second vector by taking a weighted average or a simple average of the second vector and the fourth vector. The tactic analysis unit 14 performs the same procedure as in the first embodiment to obtain the updated second vector CVE i Tec and one-hot vector Tac h Tec CVE based on similarity to i Tac is generated, and the result output unit 15 outputs the evaluation result.

[0050] FIG. 4 is a flowchart showing the procedure of the vulnerability analysis method according to this embodiment. In step S21, the vulnerability information acquisition unit 11 acquires information on mitigation for the vulnerability to be analyzed. In step S22, the vulnerability information acquisition unit 11 acquires information on Detection for the vulnerability to be analyzed.

[0051] In step S23, the vector generation unit 12 generates a first vector (CVE Mit ∈R p ) In step S24, the vector generation unit 12 generates a third vector (CVE Det ∈R s )

[0052] In step S25, the technique analysis unit 13 calculates the first vector (CVE Mit ) and a one-hot vector of q Techniques based on the link structure in ATT&CK (Technique Mit ∈{0,1} p ) from the similarity with the second vector (CVE Tec ∈R q ) In step S26, the technique analysis unit 13 calculates the third vector (CVE Det ) and a one-hot vector of q Techniques (Tec Det ∈{0,1} s ) from the similarity with each of the 4th vector (CVE Tec ∈R q )

[0053] In step S27, the technique analysis unit 13 normalizes the second vector generated in step S25 and the fourth vector generated in step S26, and then updates the second vector by taking a weighted average or a simple average.

[0054] In step S28, the Tactic analysis unit 14 calculates the second vector (CVE Tec ) and r one-hot vectors based on the link structure in ATT&CK (Tac Tec ∈{0,1} q ) from the similarity with each vector (CVE Tac ∈R r )

[0055] In step S29, the result output unit 15 outputs the vector (CVE Tac ∈R r ) is output as an evaluation value that estimates which tactic the vulnerability (CVE) will be exploited in.

[0056] [Fourth embodiment] In ATT&CK, an overview of mitigation is provided for each p number of mitigations, and a detailed explanation is provided for each q number of techniques. Therefore, the vulnerability analysis device 1 of the fourth embodiment directly infers a technique from a vulnerability by using a mitigation description written for each technique.

[0057] That is, the vector generation unit 12 generates a fifth vector CVE using the similarity between the information on mitigation acquired by the vulnerability information acquisition unit 11 and each of the descriptions of mitigation related to q techniques in a predetermined database (ATT&CK) as elements. Tec ∈R q Further generate:

[0058] This fifth vector (CVE Tec ) can be treated in the same way as the second and fourth vectors described above, so the technique analysis unit 13 updates the second vector by taking a weighted average or simply averaging the second, fourth, and fifth vectors.

[0059] The tactic analysis unit 14 calculates the updated second vector CVE in the same manner as in the first to third embodiments. i Tec and one-hot vector Tac h Tec CVE based on similarity to i Tac is generated, and the result output unit 15 outputs the evaluation result.

[0060] FIG. 5 is a flowchart showing the procedure of the vulnerability analysis method according to this embodiment. Steps S31 to S36 are the same as those in the third embodiment (FIG. 4).

[0061] In step S37, the vector generation unit 12 generates a fifth vector (CVE Tec ∈R q )

[0062] In step S38, the technique analysis unit 13 normalizes the second vector generated in step S35, the fourth vector generated in step S36, and the fifth vector generated in step S37, and then updates the second vector by taking a weighted average or a simple averaging.

[0063] In step S39, the Tactic analysis unit 14 calculates the second vector (CVE Tec ) and r one-hot vectors based on the link structure in ATT&CK (Tac Tec ∈{0,1} q ) from the similarity with each vector (CVE Tac ∈R r )

[0064] In step S40, the result output unit 15 outputs the vector (CVE Tac ∈R r ) is output as an evaluation value that estimates which tactic the vulnerability (CVE) will be exploited in.

[0065] In the above first to fourth embodiments, the processing for the i-th vulnerability (CVE) has been described, but multiple vulnerabilities can also be processed simultaneously using a determinant as follows: Here, a procedure for processing k vulnerabilities based on information related to mitigation is illustrated.

[0066] First, in ATT&CK, p mitigations, q techniques, and r tactics are linked to each other, and from this link structure, we can derive the following matrix (1) in which mitigations are represented by techniques, matrix (2) in which techniques are represented by mitigations, and matrix (3) in which tactics are represented by techniques.

number

[0067] Here, k vulnerabilities (CVEs) are expressed in the following matrix based on the probability based on the similarity with each of the p mitigation descriptions in ATT&CK.

number

[0068] A matrix showing vulnerabilities (CVEs) by technique based on the similarity between (2) and (4).

number

number

[0069] According to the above embodiment, the vulnerability analysis device 1 generates a vector having similarity as an element by comparing the Mitigation or Detection information for each vulnerability with the description in a predetermined database (ATT&CK). Then, the vulnerability analysis device 1 generates a vector representing vulnerabilities in terms of Techniques, using the similarity between this vector and the one-hot vector of each Technique obtained from the link structure in the database as an element, and further generates a vector representing vulnerabilities in terms of Tactics, using the similarity between each Tactic and the one-hot vector as an element. This allows the vulnerability analysis device 1 to predict the tactics of a cyber attack that exploits a vulnerability, and as a result, to evaluate the urgency of responding to the vulnerability.

[0070] Furthermore, the vulnerability analysis device 1 can predict Tactics comprehensively using information on both Mitigation and Detection. As the amount of information for similarity calculation increases, it is expected that the prediction accuracy will improve.

[0071] Furthermore, in a given database (ATT&CK), if a mitigation is described for each technique, the vulnerability analysis device 1 can directly estimate the technique from the vulnerability based on the similarity of the mitigation. This increases the amount of estimated information, which is expected to further improve prediction accuracy.

[0072] This will enable, for example, an appropriate assessment of the urgency of taking measures against discovered vulnerabilities, which will contribute to Goal 9 of the United Nations-led Sustainable Development Goals (SDGs), which is to "build resilient infrastructure, promote sustainable industrialization and foster innovation."

[0073] Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Furthermore, the effects described in the above-described embodiments are merely a list of the most preferable effects resulting from the present invention, and the effects of the present invention are not limited to those described in the embodiments.

[0074] The vulnerability analysis method by the vulnerability analysis device 1 is realized by software. When realized by software, a program constituting this software is installed in an information processing device (computer). These programs may be recorded on a removable medium such as a CD-ROM and distributed to users, or may be distributed by being downloaded to the user's computer via a network. Furthermore, these programs may be provided to the user's computer as a Web service via a network without being downloaded. [Explanation of symbols]

[0075] 1 Vulnerability analysis device 10 Control section 11 Vulnerability information acquisition department 12 Vector Generation Unit 13 Technique Analysis Department 14 Tactic Analysis Department 15 Result output section 20 Memory section

Claims

1. A vulnerability information acquisition unit that acquires information regarding mitigation of a vulnerability; a vector generation unit that generates a first vector having elements each representing a degree of similarity between the information on the mitigation and each of a plurality of descriptions of the mitigation in a predetermined database; a technique analysis unit that generates a second vector having elements each representing a degree of similarity between the first vector and each of vectors that represent correspondences between each of a plurality of techniques defined in the predetermined database and the plurality of mitigations; A tactic analysis unit that calculates a similarity between the second vector and each of vectors that represent correspondence between each of a plurality of tactics defined in the predetermined database and the plurality of techniques; A vulnerability analysis device comprising: a result output unit that outputs an evaluation result of a tactic corresponding to the vulnerability indicated by the similarity calculated by the tactic analysis unit.

2. a vulnerability information acquisition unit that acquires information related to vulnerability detection; a vector generating unit that generates a third vector having elements each representing a degree of similarity between the information about the Detection and each of a plurality of descriptions of the Detection in a predetermined database; a Technique analysis unit that generates a fourth vector having elements each representing a similarity between the third vector and each of vectors representing a correspondence between each of the plurality of Techniques defined in the predetermined database and the plurality of Detections; A tactic analysis unit that calculates a similarity between the fourth vector and each of vectors that represent correspondence between each of a plurality of tactics defined in the predetermined database and the plurality of techniques; A vulnerability analysis device comprising: a result output unit that outputs an evaluation result of a tactic corresponding to the vulnerability indicated by the similarity calculated by the tactic analysis unit.

3. The vulnerability information acquisition unit further acquires information related to Detection, The vector generation unit further generates a third vector having elements each representing a similarity between the information about the Detection and each of the descriptions of the Detection in the predetermined database; The Technique analysis unit includes: Further generating a fourth vector having elements each representing a similarity between the third vector and each of the vectors representing the correspondence between each of the plurality of Detections of each of the plurality of Techniques defined in the predetermined database; The vulnerability analysis device according to claim 1 , wherein the second vector is updated by taking a weighted average of the second vector and the fourth vector.

4. The vector generation unit further generates a fifth vector having elements each representing a degree of similarity between the information on the Mitigation and each of the descriptions of the Mitigation related to the plurality of Techniques in the predetermined database; The vulnerability analysis device according to claim 3 , wherein the technique analysis unit updates the second vector by calculating a weighted average of the second vector, the fourth vector, and the fifth vector.

5. A vulnerability information acquisition step of acquiring information regarding mitigation of a vulnerability; a vector generation step of generating a first vector having elements each representing a degree of similarity between the information on the mitigation and each of a plurality of descriptions of the mitigation in a predetermined database; a technique analysis step of generating a second vector having as elements a degree of similarity between the first vector and each of vectors representing correspondence between each of a plurality of techniques defined in the predetermined database and the plurality of mitigations; A tactic analysis step of calculating a similarity between the second vector and each of vectors representing a correspondence between each of a plurality of tactics defined in the predetermined database and the plurality of techniques; A vulnerability analysis method executed by a computer, comprising: a result output step of outputting an evaluation result of a Tactic corresponding to the vulnerability indicated by the similarity calculated in the Tactic analysis step.

6. a vulnerability information acquisition step of acquiring information related to vulnerability detection; a vector generation step of generating a third vector having elements each representing a degree of similarity between the information related to the Detection and each of a plurality of descriptions of the Detection in a predetermined database; a Technique analysis step of generating a fourth vector having elements each representing a similarity between the third vector and each of vectors representing a correspondence between each of the plurality of Techniques defined in the predetermined database and the plurality of Detections; A tactic analysis step of calculating a similarity between the fourth vector and each of vectors representing a correspondence between each of a plurality of tactics defined in the predetermined database and the plurality of techniques; A vulnerability analysis method executed by a computer, comprising: a result output step of outputting an evaluation result of a Tactic corresponding to the vulnerability indicated by the similarity calculated in the Tactic analysis step.

7. A vulnerability analysis program for causing a computer to function as the vulnerability analysis device according to any one of claims 1 to 4.

Images