Vulnerability information processing device, method, and, program

Abstract

To reduce contract operation of a person in charge of security.SOLUTION: A vulnerability information processing device 100 includes a software configuration database 220, a vulnerability database 210, and a sentence generation unit 120. The software configuration database stores configuration information of software to be managed. The vulnerability database stores vulnerability information of the software. The sentence generation unit calculates a measure priority 310 of the software based on the configuration information and vulnerability information, and generates a sentence 330 relating to the vulnerability of the software based on the calculated measure priority.SELECTED DRAWING: Figure 2

Description

Technical Field

[0001] The present invention relates to a vulnerability information processing apparatus, method, and program.

Background Art

[0002] In the digital society, the importance of security has been increasing. The importance has been growing not only for the cyber security of countries or companies but also for the management of the security of products provided by companies. For example, in the automotive field, the automotive cyber security regulation UN-R155 has been standardized in the discussions of the United Nations World Forum for Harmonization of Vehicle Regulations (WP.29). Furthermore, the international standard ISO / SAE 21434, which summarizes the requirements for cyber security measures, has been established, and cyber security measures of each finished vehicle manufacturer and supplier have become important.

[0003] One of the important points in cyber security measures is to timely obtain vulnerability information from various sources and take appropriate actions against the content of the vulnerability information. At present, it requires a great cost for experts who have knowledge of both security and products to realize the acquisition of such vulnerability information and appropriate actions.

[0004] In order to efficiently process such vulnerability information, the following various technologies have been proposed.

[0005] Patent Document 1 describes a method of performing a standardization process on security alarm information for a device to obtain standardized data and updating the security information of the device based on the similarity with attack data in an attack action knowledge base. In this method, the cosine similarity of the word frequency feature vector is used in the similarity calculation.

[0006] Patent Document 2 describes a method of flexibly matching network devices that can be affected by CVE using N-gram.

[0007] Patent Document 3 describes a method of presenting more accurate information to users by extracting time expressions from security-related documents through natural language processing and assigning them to the events. That is, in this method, natural language processing is used to extract time expressions.

[0008] Patent Document 4 describes a method of performing dependency analysis and registering words that modify the named entity as complementary information when extracting and structuring named entities from news articles related to cyberattacks. In this method, a system for searching for vulnerability information is constructed by natural language processing.

[0009] Patent Document 5 describes a method of creating pseudo teacher data from threat documents having descriptions related to cyberattacks, learning a noise model and a classification model based on the created teacher data, and classifying threat documents using the classification model generated by the learning. That is, in this method, a model learned from vulnerability information is used for classification.

Prior Art Documents

Patent Documents

[0010]

Patent Document 1

Patent Document 2

Patent Document 3

Patent Document 4

Patent Document 5

Summary of the Invention

Problems to be Solved by the Invention

[0011] In departments that specialize in security measures for the company's own products or services (such as PSIRT: Product Security Incident Response Team), depending on the content of the vulnerability information, communication with external organizations inside and outside the company is required. For example, when a new vulnerability is related to a module used in the company's product, the PSIRT needs to report it to the customer with specific exploitation cases. Also, when the PSIRT cannot determine whether a new vulnerability may be related to a module used in the company's product, it needs to inquire about the details from the company's internal design department, etc. The cost of such communication work has been an issue. The present invention attempts to solve this problem by introducing an apparatus using natural language processing technology.

[0012] All of the above-mentioned patent documents perform processing using natural language processing on security information. However, natural language processing is not used to generate the text for inquiries or reports. Therefore, it does not solve the problem that the present invention attempts to solve.

[0013] Therefore, the present invention has been made in view of the above problems, and its object is to provide a technology for reducing the communication work of security personnel.

Means for Solving the Problems

[0014] In order to solve the above object, the present invention includes a software configuration database that stores configuration information of software to be managed, a vulnerability database that stores vulnerability information of the software, and based on the configuration information and the vulnerability information, calculates a countermeasure priority of the software, and based on the calculated countermeasure priority, generates a text related to the vulnerability of the software, and a text generation unit.

Effects of the Invention

[0015] According to the present invention, the communication work of security personnel is reduced.

Brief Description of the Drawings

[0016]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Figure 11

Figure 12

Modes for Carrying Out the Invention

[0017] Hereinafter, a specific example of a vulnerability information processing device according to an embodiment of the present invention will be described with reference to the drawings. Note that the present invention is not limited by the examples, but is indicated by the scope of the claims.

[0018] FIG. 1 is a functional block diagram showing an example of the configuration of a vulnerability information processing system.

[0019] The vulnerability information processing system 10 includes a vulnerability information processing device 100. The vulnerability information processing device 100 is operated by a security staff member 1. The vulnerability information processing device 100 is communicatively connected to a network 40. The network 40 is also communicatively connected to personal computers 20 and 30 operated by a design department staff member 2 and a customer staff member 3, respectively. The vulnerability information processing device 100 and the personal computers 20 and 30 can communicate with each other via the network 40.

[0020] The vulnerability information processing device 100 assumes a personal computer equipped with software that realizes the functions described later. However, the vulnerability information processing device 100 is not limited thereto. Furthermore, the vulnerability information processing device 100 may be in the form of a cloud service where the software exists on the network and the software is utilized remotely. The hardware configuration of the personal computer that realizes the vulnerability information processing device 100 and the like will be described later with reference to FIG. 3.

[0021] The network 40 assumes the Internet email system. However, the network 40 is not limited thereto.

[0022] FIG. 2 is a functional block diagram showing an example of the configuration of the vulnerability information processing device.

[0023] The vulnerability information processing device 100 includes a vulnerability information update unit 110, a sentence generation unit 120, and a token management unit 130. The vulnerability information update unit 110 acquires vulnerability information from the outside via the network 40. The token management unit 130 transmits and receives data to and from other personal computers 20 and 30 via the network 40. These operations will be described later.

[0024] Furthermore, the vulnerability information processing apparatus 100 includes a vulnerability database 210, a software configuration database 220, a customer product database 230, a transmission / reception history database 240, and a token database 260. A token 300 is stored in the token database 260. The token 300 may include a countermeasure priority 310, a contact information 320, and a message 330. These structures will be described later.

[0025] Furthermore, the vulnerability information processing apparatus 100 includes a prompt template 250. This example will be described later.

[0026] FIG. 3 is a diagram showing an example of the hardware configuration of the vulnerability information processing apparatus.

[0027] The vulnerability information processing apparatus 100 is realized by, for example, a computer 1000 as shown in FIG. 3. The computer 1000 includes a storage device 1001, a calculation processing device 1002, a communication device 1003, and an input / output interface 1004 as an example of a "user interface".

[0028] The storage device 1001 may include, for example, a so-called main storage device composed of a semiconductor memory and a so-called auxiliary storage device composed of a large-capacity storage device such as a hard disk drive or a solid state drive. Programs and data executed by the calculation processing device 1002 are stored in the storage device 1001. The programs include a vulnerability information processing program.

[0029] The calculation processing device 1002 executes various processes according to the programs stored in the storage device 1001. By operating the calculation processing device 1002 according to the programs, various functional units are realized. For example, each function of the vulnerability information processing apparatus 100 is realized by the calculation processing device 1002 operating according to the programs stored in the storage device 1001 in the computer 1000 corresponding to the vulnerability information processing apparatus 100.

[0030] The communication device 1003 is an interface for connection to other communication networks. The input / output interface 1004 may include input devices such as at least any one of a keyboard, a mouse, and a touch panel, and output devices such as an image display device.

[0031] FIG. 4 is a diagram showing an example of the configuration of the vulnerability database.

[0032] Vulnerability information of software to be managed is stored in the vulnerability database 210. Specifically, each record in the vulnerability database 210 represents each vulnerability information and is added and updated by step 102 of FIG. 10 described later. The vulnerability database 210 stores, as item values (column values), a vulnerability ID, an acquisition date and time, content, a CVSS, and a CWE.

[0033] The vulnerability ID is assigned at the time of acquiring vulnerability information. The vulnerability ID is an identifier for uniquely identifying vulnerability information. When the vulnerability information is managed by CVE, the identifier defined by CVE can be used as the vulnerability ID. The acquisition date and time is the date and time when the vulnerability information was acquired. The content stores the description text of the vulnerability in text format. CVSS and CWE are those information included in the vulnerability information and are stored as necessary. Information other than those described here may be stored in the record.

[0034] As an example, the first row of the vulnerability database 210 will be described. The first row relates to the vulnerability ID "CVE-2023-0001A". In this first row, it means that the acquisition date and time is "2023 / 04 / 12", the content is "This vulnerability affects the AA Library... The condition is KK.", the CVSS is "6.9", and the CWE is "CWE-119".

[0035] FIG. 5 is a diagram showing an example of the configuration of the software configuration database 220.

[0036] The software configuration database 220 stores the configuration information of the software to be managed. Specifically, the software configuration database 220 stores information about the modules managed by the vulnerability information processing apparatus 100. The information stored in the software configuration database 220 is prepared in advance by a security officer 1 or the like, and is updated as necessary.

[0037] Each record in the software configuration database 220 represents information about a specific version of a module. The software configuration database 220 stores, as item values (column values), a module ID, a version, a module name, a child module ID, and a developer contact.

[0038] The module ID is an identifier for identifying a module. The version is a number for identifying the version of a module. The module ID and the version serve as the primary key of the software configuration database 220. The module name is the name of the module. The child module ID is an identifier of a module including each version of each module. The developer contact is a contact (e.g., an email address) to the developer of each version of each module.

[0039] As an example, the first row of the software configuration database 220 will be described. The first row relates to a module ID of "M1". In this first row, it means that the version is "1.01", the module name is "AA Software", the child module ID is "M2", and the developer contact is "@v1".

[0040] FIG. 6 is a diagram showing an example of the configuration of the customer product database.

[0041] The customer product database 230 stores customer product information of the software to be managed. Specifically, the customer product database 230 stores information regarding the products of customers to be managed by the vulnerability information processing apparatus 100. The information stored in the customer product database 230 is prepared in advance by a security officer 1 or the like, and is updated as necessary.

[0042] Each record in the customer product database 230 represents customer product information. The customer product database 230 stores, as item values (column values), a customer contact, a product ID, and a version.

[0043] The customer contact is a contact address (e.g., an email address) for each customer. The product ID is the module ID of the software configuration database 220 corresponding to the products held by each customer. The version is the version of each product held by each customer.

[0044] As an example, the first row of the customer product database 230 will be described. The first row relates to the customer contact "@c1". In this first row, it means that the product ID is "M1" and the version is "1.01".

[0045] FIG. 7 is a diagram showing an example of the configuration of the transmission / reception history database.

[0046] The transmission / reception history database 240 stores the transmission / reception history between the developer of the software to be managed and the customers. Specifically, each record in the transmission / reception history database 240 represents an inquiry response history to a specific contact, and is created in step 128 of FIG. 12 described later. The transmission / reception history database 240 stores, as item values (column values), a token ID, a contact, a date and time, and a content.

[0047] The token ID is an identifier that identifies a token, and the value of the token ID in the token database 260 is stored. The contact is a contact representing the party to be contacted when processing each token. In the contact, either the value of the developer contact in the software configuration database 220 or the value of the customer contact in the customer product database 230 is stored. The date and time indicate the date and time when the inquiry response history was updated. The content stores, in text, the text of the message sent to the contact or the response message from the contact thereto.

[0048] As an example, the first row of the transmission / reception history database 240 will be described. The first row relates to a token ID of "T1". In this first row, it means that the contact is "@v1", the date and time is "2023 / 04 / 12", and the content is "I am reporting because there is concern about the impact on the product due to the following vulnerability." Specifically, the content includes "Condition: AA Software, version 1.01, KK is valid, Risk: Countermeasure priority 5.4, Example: Examples where this vulnerability may occur in the product AA Software are shown below... Related URL: http: / / ... / ?id=CVE-2023-0001A".

[0049] Figure 8 is a diagram showing an example of a prompt template.

[0050] The prompt template 250 has placeholders. The placeholder is the part surrounded by square brackets "{}", and in step 116 of Figure 11, it is replaced with the content described within each square bracket. For example, the placeholder of "{token / contact}" is replaced with the content of the contact field of each token.

[0051] Figure 9 is a diagram showing an example of the screen of the input / output interface.

[0052] On the screen of the input / output interface 1004, the content of the token 300 stored in the token database 260 and the actions operated by the security officer 1 are displayed. For example, the actions are "save the text" and "send the text".

[0053] Each record in the token database 260 represents a token 300 and is created in step 115 of FIG. 11. The token database 260 stores, as item values (column values), a token ID, a countermeasure priority 310, a module ID, a contact 320, and a text 330.

[0054] The token ID is an identifier that identifies the token 300. The countermeasure priority 310 is the countermeasure priority of each token 300 (software). The module ID is the module ID to which each token 300 is related. The product ID is the product ID to which each token 300 is related. The contact is a contact representing the party to be contacted when processing each token 300. The contact 320 stores either the value of the developer contact in the software configuration database 220 or the customer contact in the customer product database 230. The text 330 indicates the text related to the vulnerability of the software sent to the contact 320 or the text received from the contact 320. The text 330 to be sent is an inquiry text to the developer or a report text to the customer.

[0055] FIG. 10 is a flowchart showing an example of the vulnerability information update process.

[0056] The vulnerability information update process starts immediately after the startup of the vulnerability information processing device 100.

[0057] First, the vulnerability information update unit 110 searches for vulnerability update information via the network 40 and determines whether there is vulnerability update information (S101). If the determination result in S101 is true (S101: YES), the vulnerability information update unit 110 acquires the vulnerability information, adds or updates it in the vulnerability database 210, and performs a search again (S102). If the determination result in S101 is false (S101: NO), the vulnerability information update unit 110 performs a search again.

[0058] The search method of the vulnerability information update unit 110 is to search in vulnerability databases publicly available on the Internet such as CVE, NVD, JVN, or to specify the module name of the software configuration database 220 in a general search engine. Thereby, the vulnerability information in the vulnerability database 220 can be kept up-to-date.

[0059] FIG. 11 is a flowchart showing an example of the text generation process.

[0060] The text generation process is started when either the vulnerability database 210 or the software configuration database 220 is updated.

[0061] First, the text generation unit 120 acquires vulnerability information X from the vulnerability database 210 (S111).

[0062] Next, the text generation unit 120 acquires the software configuration information Y from the software configuration database 220 (S112).

[0063] Next, the text generation unit 120 calculates the countermeasure priority 310 of the vulnerability information X in the configuration information Y (S113). For example, the text generation unit 120 calculates the relevance of whether the vulnerability information X mentions the module name or version of the configuration information Y using the TF / IDF score based on the content of the module name of the configuration information Y and the vulnerability information X. Then, the text generation unit 120 multiplies the calculated relevance by the severity score of the CVSS of the vulnerability information X to calculate the countermeasure priority 310.

[0064] The calculation of the countermeasure priority 310 is not limited to the method described above, and any method can be used. For example, a machine learning model that takes the content of the vulnerability information X, the module name of the configuration information Y, and the version as inputs and outputs the countermeasure priority 310 can also be used after being pre-trained.

[0065] Furthermore, the text generation unit 120 may calculate the countermeasure priority 310 based on the configuration information Y, the vulnerability information X, and the transmission / reception history, or may calculate the countermeasure priority 310 based on the configuration information Y, the vulnerability information X, the transmission / reception history, and the customer product information. Thereby, the accuracy of the priority order for generating the text 330 can be improved.

[0066] Next, the text generation unit 120 determines whether the countermeasure priority 310 is equal to or greater than a predetermined threshold (S114). When the determination result of S114 is true (S114: YES), the text generation unit 120 newly creates a token 300, sets the countermeasure priority 310 and the contact information 320 (S115), creates a prompt, generates the text 330, and sets the generated text 330 (S116).

[0067] Here, the contact information 320 is the contact information of the source of the configuration information Y and the customer contact information of the record including the configuration information Y in the customer information database 230. The record including the configuration information Y starts from the record of the software configuration database 220 having a module ID that matches the product ID, and determines whether one or more of all reachable descendant modules obtained by recursively searching the fields of the child modules are the configuration information Y.

[0068] Furthermore, here, the text generation unit 120 uses a prompt template 250 to create a prompt. The prompt template 250 has placeholders at some positions in the instruction text input to the text generation module. By substituting values that can be obtained from various databases 210 and 220 related to the vulnerability information X and the configuration information Y into the placeholder part, an instruction text is generated, and by inputting it into the text generation module, a text 330 related to the vulnerability information X and the configuration information Y is obtained. Here, the text generation module can use a generation model based on the existing technology Transformer (for example, the GPT model). The generation model may use an existing one pre-trained with a large number of arbitrary texts (for example, GPT-3), or a model fine-tuned with a dataset that collects input and output data related to this task may also be used.

[0069] Furthermore, the text generation unit 120 may also use a method of directly generating the text 330 by substituting values into the placeholders in the text template without using a prompt and a generation model. The text generation unit 120 may create a prompt based on at least any one of the configuration information, vulnerability information, transmission / reception history, customer product information, or countermeasure priority input to the placeholder. Thereby, the generation accuracy of the text 330 can be improved.

[0070] Next, the text generation unit 120 determines whether it is possible to obtain the following software configuration information from the software configuration database 220 (S117). If the determination result is true (S117: YES), it returns to S112. If the determination result is false (S117: NO), it proceeds to S118.

[0071] Next, the text generation unit 120 determines whether it is possible to obtain the following vulnerability information from the vulnerability database 210 (S118). If the determination result is true (S118: YES), it returns to S111. If the determination result is false (S118: NO), it ends.

[0072] Through the above processing, the countermeasure priority 310, contact information 320, and text 330 for the updated vulnerability database 210 or software configuration database 220 can be reflected in the token database 260.

[0073] Figure 12 is a flowchart showing an example of token management and display processing.

[0074] The token management and display processing starts immediately after the vulnerability information processing device 100 is started. In that case, the token management and display processing starts from S122.

[0075] First, the token management unit 130 determines whether the content of the token database 260 has changed (S121). If the determination result is true (S121: YES), the screen display of the input / output interface 1004 is updated (S122).

[0076] Next, the token management unit 130 determines whether the update operation of the text 330 has been performed by the security officer 1 (S123). If the determination result is true (S123: YES), the text 330 of the token 300 in the token database 260 is updated (S124).

[0077] Next, the token management unit 130 determines whether the transmission operation of the text 330 has been performed by the security officer 1 (S125). If the determination result is true (S125: YES), the text 330 of the token 300 in the token database 260 is transmitted to the contact information 320 of the token 300 via the network 40 (S126).

[0078] Next, the token management unit 130 determines whether a response has been received from the network 40 (S127). If the determination result is true (S127: YES), the token management unit 130 adds the contact 320, text 330, and response content of the token 300 to the transmission / reception history database 240 (S128). Further, the token management unit 130 analyzes the response content and updates the software configuration database 220 and the customer product database 230 (S128).

[0079] The analysis of the response content determines whether the response content includes details of the software configuration information or details of the customer product, for example, by using intent understanding, which is one of natural language processing, and slot filling technology.

[0080] According to this configuration, the vulnerability information processing device 100 includes a software configuration database 220, a vulnerability database 210, and a text generation unit 120. The software configuration database 220 stores the configuration information of the software to be managed. The vulnerability database 210 stores the vulnerability information of the software. The text generation unit 120 calculates the countermeasure priority 310 of the software based on the configuration information and the vulnerability information, and generates a text 330 regarding the vulnerability of the software based on the calculated countermeasure priority 310.

[0081] Thereby, based on the countermeasure priority calculated from the configuration information and the vulnerability information, a text 330 regarding the vulnerability of the software is generated. This can reduce the contact work of the security staff.

[0082] The text generation unit 120 generates the text 330 for the developer or customer whose countermeasure priority 310 exceeds the threshold. Thereby, developers or customers with a low countermeasure priority 310 can be triaged and the text 330 can be generated.

[0083] The text 330 is at least one of an inquiry sentence for the developer and a report sentence for the customer. Thereby, any text 330 for the developer or the customer can be generated.

[0084] It includes a prompt template 250 having a placeholder, and the text generation unit 120 creates a prompt based on at least one of the configuration information or vulnerability information input into the placeholder, and inputs the created prompt into a machine learning model to generate text 330. Thereby, the created prompt can be learned to generate text 330.

[0085] It includes a token management unit 130 that stores the text 330 sent to the contact 320 of the developer or customer determined by the text generation unit 120 and the response received from the contact 320 in the transmission / reception history database 240. Thereby, the text 330 sent to the contact 320 and the response received from the contact 320 can be appropriately obtained.

[0086] It includes an input / output interface 1004 that displays the text 330 and the contact 320 to the security person 1 of the software, and an instruction is input from the security person 1. Thereby, processing reflecting the intention of the security person 1 can be executed via the input / output interface 1004.

[0087] The text generation unit 120 updates the software configuration database 220 or the customer product database 230 based on the content of the response. Thereby, the configuration information of the software configuration database 220 and the customer product information of the customer product database 230 can be updated.

[0088] Note that the present invention is not limited to the above-described embodiments, and various modifications are included. For example, the above-described embodiments have been described in detail for easy understanding of the present invention, and are not necessarily limited to those having all the configurations described. Also, a part of the configuration of one embodiment can be replaced with the configuration of another embodiment, and the configuration of another embodiment can be added to the configuration of one embodiment. Also, for a part of the configuration of each embodiment, addition, deletion, or replacement with other configurations is possible.

Explanation of Reference Numerals

[0089] 1…Security officer, 10…Vulnerable information processing system, 100…Vulnerable information processing device, 120…Text generation unit, 130…Token management unit, 210…Vulnerability database, 220…Software configuration database, 230…Customer product database, 250…Prompt template, 310…Countermeasure priority, 320…Contact information, 330…Text, 1004…Input / output interface

Claims

1. a software configuration database for storing configuration information of managed software; a vulnerability database that stores vulnerability information of the software; A vulnerability information processing device comprising: a sentence generation unit that calculates a countermeasure priority for the software based on the configuration information and the vulnerability information, and generates a sentence regarding the vulnerability of the software based on the calculated countermeasure priority.

2. a transmission / reception history database for storing a transmission / reception history between the developer of the software and the customer; the sentence generation unit calculates the countermeasure priority based on the configuration information, the vulnerability information, and the transmission / reception history; The vulnerability information processing device according to claim 1 .

3. the sentence generation unit generates the sentence for the developer or the customer whose countermeasure priority exceeds a threshold. The vulnerability information processing device according to claim 2 .

4. a customer product database for storing customer product information of the software; the document generation unit calculates the countermeasure priority based on the configuration information, the vulnerability information, the transmission / reception history, and the customer product information; The vulnerability information processing device according to claim 2 .

5. The text is at least one of an inquiry to the developer and a report to the customer. The vulnerability information processing device according to claim 2 .

6. a prompt template having a placeholder; the sentence generation unit generates a prompt based on at least one of the configuration information and the vulnerability information input into the placeholder, and inputs the generated prompt into a machine learning model to generate the sentence. The vulnerability information processing device according to claim 4 .

7. the sentence generation unit creates the prompt based on at least one of the configuration information, the vulnerability information, the transmission / reception history, the customer product information, and the countermeasure priority level input into the placeholder. The vulnerability information processing device according to claim 6 .

8. a token management unit that stores the sentence sent to the contact point of the developer or the customer determined by the sentence generation unit and a response received from the contact point in the transmission / reception history database; The vulnerability information processing device according to claim 4 .

9. a user interface that displays the text and the contact information to a security officer of the software and through which instructions are input by the security officer; The vulnerability information processing device according to claim 8 .

10. the sentence generation unit updates the software configuration database or the customer product database based on the content of the response. The vulnerability information processing device according to claim 8 .

11. A vulnerability information processing method by a vulnerability information processing device, The vulnerability information processing device includes: Calculating a countermeasure priority for the software based on configuration information of the software to be managed and vulnerability information of the software; A vulnerability information processing method comprising: a sentence generation unit that generates a sentence regarding the vulnerability of the software based on the calculated countermeasure priority.

12. A vulnerability information processing program to be executed by a vulnerability information processing device, The vulnerability information processing device includes: calculating a countermeasure priority for the software based on configuration information of the software to be managed and vulnerability information of the software; and generating a statement regarding the vulnerability of the software based on the calculated countermeasure priority.

Images