Security information derivation device and security information derivation method

Abstract

To provide a security information derivation device capable of leveling security information to be obtained.SOLUTION: URL storage means stores a preliminarily designated URL. Web page information acquisition means acquires information on a Web page specified by the URL. Text information extraction means extracts text information from the acquired information on the Web page. Security information derivation means derives security information for commercially available software used for a system to be maintained by applying the extracted entire text information to a model preliminarily generated by machine learning. Display control means causes a display device to display the security information.SELECTED DRAWING: Figure 9

Description

[Technical Field]

[0001] The present disclosure relates to a security information derivation device, a security information derivation method, and a security information derivation program. [Background technology]

[0002] Patent Document 1 describes a system that provides product information to customers. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2002-215778 Summary of the Invention [Problem to be solved by the invention]

[0004] Hereinafter, the system to be maintained will be referred to as the maintenance target system. Commercially available software is often used in maintenance target systems. This commercially available software can be called Commercial Off-The-Shelf (COTS).

[0005] In general, to reduce security risks, maintenance personnel for systems under maintenance periodically obtain security information for commercially available software used in the systems under maintenance. Then, the maintenance personnel determine the priority of the security information and perform maintenance work in accordance with the security information.

[0006] Security information includes patch information and vulnerability information.

[0007] Depending on the level of experience of the maintenance worker, there may be cases where security information cannot be sufficiently acquired (in other words, not collected sufficiently), and the security information obtained varies depending on the maintenance worker.

[0008] Therefore, an object of the present disclosure is to provide a security information derivation device, a security information derivation method, and a security information derivation program that can level the obtained security information. [Means for solving the problem]

[0009] The security information derivation device according to the present disclosure is characterized by comprising a URL storage means for storing a pre-specified URL (Uniform Resource Locator), a web page information acquisition means for acquiring information on a web page identified by the URL, a text information extraction means for extracting text information from the acquired web page information, a security information derivation means for deriving security information for commercially available software used in a system to be maintained by applying the entire extracted text information to a model generated in advance by machine learning, and a display control means for displaying the security information on a display device.

[0010] The security information derivation method disclosed herein is characterized in that a computer equipped with a URL storage means for storing a pre-specified URL (Uniform Resource Locator) acquires information on a web page identified by the URL, extracts text information from the acquired web page information, and applies the entire extracted text information to a model generated in advance by machine learning, thereby deriving security information for commercially available software used in a system to be maintained, and displaying the security information on a display device.

[0011] The security information derivation program according to the present disclosure causes a computer equipped with a URL storage means for storing a pre-specified URL (Uniform Resource Locator) to execute a web page information acquisition process for acquiring information on a web page identified by the URL, a text information extraction process for extracting text information from the acquired web page information, a security information derivation process for deriving security information for commercially available software used in a system to be maintained by applying the entire extracted text information to a model generated in advance by machine learning, and a display control process for displaying security information on a display device. [Effects of the Invention]

[0012] According to the present disclosure, the security information obtained can be leveled. [Brief explanation of the drawings]

[0013] [Figure 1] 1 is a block diagram illustrating an example of the configuration of a security information derivation device according to the present disclosure. [Figure 2] FIG. 10 is a schematic diagram illustrating an example of a GUI for accepting a URL specification. [Figure 3] FIG. 10 is a schematic diagram showing an acquisition button that is a GUI. [Figure 4] FIG. 10 is a schematic diagram showing an example of security information display. [Figure 5] 10 is a flowchart illustrating an example of a processing progress of the security information derivation device according to the present disclosure. [Figure 6] 1 is a block diagram illustrating an example of the configuration of a security information derivation device according to the present disclosure. [Figure 7] FIG. 10 is a schematic diagram showing an example of security information display. [Figure 8] 1 is a schematic block diagram illustrating an example of the configuration of a computer related to a security information derivation device of the present disclosure. [Figure 9] 1 is a block diagram showing an overview of a security information derivation device according to the present disclosure; DETAILED DESCRIPTION OF THE INVENTION

[0014] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings.

[0015] 1 is a block diagram showing an example configuration of a security information derivation device according to the present disclosure. The security information derivation device 10 includes a URL specification receiving unit 1, a URL storage unit 2, a Web page information acquisition unit 3, a text information extraction unit 4, a security information derivation unit 5, a priority determination unit 6, a display control unit 7, and a display device 8.

[0016] The URL designation receiving unit 1 displays a GUI (Graphical User Interface) for receiving the designation of a URL (Uniform Resource Locator) on the display device 8. FIG. 2 is a schematic diagram showing an example of a GUI for receiving the designation of a URL. The GUI illustrated in FIG. 2 includes a URL input field 51 and a save button 52. The input field 51 is an input field into which a URL is input. For example, an experienced maintenance worker may input a URL to be designated into the input field 51. The input of a URL into the input field 51 means that the URL has been designated by the maintenance worker. In the GUI illustrated in FIG. 2, the number of input fields 51 may be increased or decreased by a user interface (not shown). The security information derivation device 10 is provided with input devices such as a keyboard and a mouse (not shown in FIG. 1) for inputting a URL into the input field 51.

[0017] When the save button 52 is clicked, the URL designation receiving unit 1 stores the URLs entered in the individual input fields 51 in the URL storage unit 2. The URL storage unit 2 is a storage device that stores URLs designated in advance using the GUI shown in Fig. 2. When multiple URLs are designated using the GUI shown in Fig. 2, the URL storage unit 2 stores the multiple URLs.

[0018] The URL entered in input field 51 and stored in URL storage unit 2 is the URL of the web page of the manufacturer of the commercially available software used in the system to be maintained, which describes security information for that software. It is likely that the system to be maintained uses multiple pieces of software sold by multiple manufacturers. In this case, multiple URLs are specified, and URL storage unit 2 stores those multiple URLs.

[0019] Security information includes patch information and vulnerability information. Patch information includes the name of the patch, an explanation of how to apply the patch, and an explanation about the patch. Vulnerability information includes an explanation of the vulnerability and an explanation of how to resolve the vulnerability.

[0020] Furthermore, in principle, the maintenance worker does not need to change the URL stored in the URL storage unit 2.

[0021] The web page information acquisition unit 3 displays an acquisition button as a GUI on the display device 8. FIG. 3 is a schematic diagram showing the acquisition button, which is a GUI. When the acquisition button 53 is clicked, the security information derivation device 10 performs a series of processes up to the display of security information. When the acquisition button 53 is clicked, the web page information acquisition unit 3 acquires, via the Internet 90, information on each web page identified by each URL stored in the URL storage unit 2. The web page information is, for example, information written in HTML (Hyper Text Markup Language).

[0022] The text information extraction unit 4 extracts text information from the information of each individual web page acquired by the web page information acquisition unit 3. This text information is written in a natural language.

[0023] The security information derivation unit 5 derives security information (patch information and vulnerability information) for commercially available software used in the maintenance target system by applying the entire text information extracted by the text information extraction unit 4 to a model previously generated by machine learning. There are multiple types of security information to be derived.

[0024] This model is generated in advance by machine learning using training data consisting of pairs of text information extracted from web page information collected by humans and the security information contained in that text information. For example, an experienced maintenance worker collects information on various web pages that contain security information for commercially available software, and extracts text information from the collected web page information. The maintenance worker then extracts security information from the text information. The pairs of the entire text information and each piece of extracted security information become the training data used in machine learning.

[0025] The priority determination unit 6 determines the priority of the security information based on the keywords contained in the security information. The priority determination unit 6 performs this operation for each piece of derived security information.

[0026] For example, if the security information includes a first predetermined keyword, the priority determination unit 6 sets the priority of the security information to "high." An example of the first predetermined keyword is "must be dealt with immediately," but the first predetermined keyword is not limited to this example. Furthermore, multiple first predetermined keywords may be defined. In this case, if the security information includes at least one first predetermined keyword, the priority determination unit 6 sets the priority of the security information to "high."

[0027] Furthermore, for example, if the security information includes a second predetermined keyword, the priority determination unit 6 sets the priority of the security information to "medium." An example of the second predetermined keyword is "recommended to take action," but the second predetermined keyword is not limited to this example. Furthermore, multiple second predetermined keywords may be defined. In this case, if the security information includes at least one second predetermined keyword, the priority determination unit 6 sets the priority of the security information to "medium." However, if the security information includes both the first predetermined keyword and the second predetermined keyword, the priority determination unit 6 sets the priority of the security information to "high."

[0028] Furthermore, for example, if the security information does not include either the first predetermined keyword or the second predetermined keyword, the priority determination unit 6 determines the priority of the security information to be "low."

[0029] The method for determining the priority of security information by the priority determination unit 6 is not limited to the above example. For example, in the above example, the priority of security information is divided into three levels: "high," "medium," and "low," but the priority of security information may be divided into two levels, or may be divided into four or more levels.

[0030] The display control unit 7 displays each piece of security information derived by the security information derivation unit 5 on the display device 8. At this time, the display control unit 7 displays each piece of security information on the display device 8 in a manner according to the priority.

[0031] FIG. 4 is a schematic diagram showing an example of security information display. In FIG. 4, colors are represented by patterns. Specifically, a diagonal line pattern represents a red background. A dotted pattern represents a yellow background. A solid color represents a blue background. In this example, the display control unit 7 displays security information with a "high" priority against a red background. The display control unit 7 also displays security information with a "medium" priority against a yellow background. The display control unit 7 also displays security information with a "low" priority against a blue background (see FIG. 4).

[0032] However, the method of displaying security information according to priority is not limited to the above example. For example, the display control unit 7 may display item names such as "Priority: High," "Priority: Medium," and "Priority: Low." Then, the display control unit 7 may display security information of a priority according to each item name after each item name. For example, the display control unit 7 may display security information with a "high" priority after an item name "Priority: High." Similarly, the display control unit 7 may display security information with a "medium" priority after an item name "Priority: Medium." Similarly, the display control unit 7 may display security information with a "low" priority after an item name "Priority: Low."

[0033] The maintenance worker visually checks the displayed security information and performs maintenance on the target system based on that security information. For example, the maintenance worker applies a patch according to the patch application method indicated in the patch information, or performs an operation according to the operation method for resolving the vulnerability indicated in the vulnerability information.

[0034] The URL designation acceptance unit 1, the web page information acquisition unit 3, the text information extraction unit 4, the security information derivation unit 5, the priority determination unit 6, and the display control unit 7 are realized, for example, by a central processing unit (CPU) of a computer that operates according to a security information derivation program. In this case, the CPU reads the security information derivation program from a program recording medium such as a program storage device of the computer, and operates as the URL designation acceptance unit 1, the web page information acquisition unit 3, the text information extraction unit 4, the security information derivation unit 5, the priority determination unit 6, and the display control unit 7 according to the security information derivation program.

[0035] The URL storage unit 2 is realized by, for example, a storage device provided in the computer.

[0036] Next, the process flow will be described. Fig. 5 is a flowchart showing an example of the process flow of the security information derivation device according to the present disclosure. Detailed description of matters that have already been explained will be omitted. It is assumed that a plurality of URLs are stored in the URL storage unit 2 in advance.

[0037] Web page information acquisition unit 3 displays acquisition button 53 as a GUI on display device 8. When the maintenance worker clicks acquisition button 53 (step S1), Web page information acquisition unit 3 acquires information on each Web page identified by each URL stored in URL storage unit 2 via Internet 90 (step S2).

[0038] Next, the text information extraction unit 4 extracts text information from the information of each of the acquired web pages (step S3).

[0039] Next, the security information derivation unit 5 applies the entire extracted text information to a model generated in advance by machine learning, thereby deriving security information for commercially available software used in the maintenance target system (step S4).

[0040] Next, the priority determination unit 6 determines the priority of the security information based on the keywords included in the security information (step S5). The priority determination unit 6 performs this operation for each piece of derived security information.

[0041] Next, the display control unit 7 displays each piece of security information on the display device 8 in a manner according to the priority (step S6).

[0042] The maintenance worker visually checks the security information displayed in step S6, and performs maintenance on the system to be maintained based on the security information.

[0043] According to this embodiment, security information is derived using a model previously generated by machine learning based on information about a web page identified by a predetermined URL (a URL stored in the URL storage unit 2). Therefore, the security information obtained can be standardized. That is, after the URL is stored in the URL storage unit 2, similar security information can be obtained regardless of the maintenance worker.

[0044] Furthermore, even if there are many pieces of commercially available software used in the maintenance target system, once the URLs are stored in the URL storage unit 2, security information for each piece of software can be easily obtained.

[0045] Next, a modification of the above embodiment will be described. Fig. 6 is a block diagram showing an example configuration of a security information derivation device according to the present disclosure. In this modification, a security information derivation device 10 includes a URL designation receiving unit 1, a URL storage unit 2, a Web page information acquisition unit 3, a text information extraction unit 4, a security information derivation unit 5, a priority determination unit 6, a display control unit 7, a display device 8, and a file storage unit 9.

[0046] The URL designation acceptance unit 1, URL storage unit 2, Web page information acquisition unit 3, text information extraction unit 4, security information derivation unit 5, priority determination unit 6, display control unit 7, and display device 8 are similar to the URL designation acceptance unit 1, URL storage unit 2, Web page information acquisition unit 3, text information extraction unit 4, security information derivation unit 5, priority determination unit 6, display control unit 7, and display device 8 in the above embodiment (see Figure 1), and detailed description thereof will be omitted.

[0047] In this modification, when displaying security information, the display control unit 7 also displays a GUI for specifying a file format and a save button. Fig. 7 is a schematic diagram showing an example of how security information is displayed. In the example shown in Fig. 7, a radio button 61 that can specify either Excel (registered trademark) format or Word format is displayed as the GUI for specifying the file format. A save button 62 is also displayed.

[0048] When the maintenance worker specifies a file format using radio button 61 and clicks save button 62, file saving unit 9 saves the displayed security information in the file format specified by the maintenance worker.

[0049] For example, when the Word format is designated as the file format in the radio button 61 and the save button 62 is clicked, the file saving unit 9 saves the displayed security information as a Word file.

[0050] Also, for example, when Excel format is designated as the file format in the radio button 61 and the save button 62 is clicked, the file saving unit 9 saves the displayed security information as a file in Excel format.

[0051] The file storage unit 9 is realized, for example, by the CPU of a computer that operates according to a security information derivation program, similar to the URL specification acceptance unit 1, the web page information acquisition unit 3, the text information extraction unit 4, the security information derivation unit 5, the priority determination unit 6, and the display control unit 7.

[0052] In this modification, the same effects as those of the above embodiment can be obtained. Furthermore, security information can be saved in a file format desired by the maintenance worker.

[0053] 8 is a schematic block diagram showing an example configuration of a computer related to the security information derivation device of the present disclosure. The computer 2000 includes, for example, a CPU 2001, a main memory device 2002, an auxiliary memory device 2003, an interface 2004, a display device 2005, an input device 2006, and a communication interface 2007. The communication interface 2007 is an interface with the Internet 90.

[0054] The security information derivation device 10 according to the embodiment and its modified examples of the present disclosure is realized by, for example, a computer 2000. The operation of the security information derivation device 10 is stored in the form of a program (security information derivation program) in an auxiliary storage device 2003. A CPU 2001 reads the program from the auxiliary storage device 2003, loads the program into a main storage device 2002, and executes the processing described in the above embodiment and its modified examples in accordance with the program.

[0055] The auxiliary storage device 2003 is an example of a non-transitory tangible medium. Other examples of non-transitory tangible media include a magnetic disk, a magneto-optical disk, a CD-ROM (Compact Disk Read Only Memory), a DVD-ROM (Digital Versatile Disk Read Only Memory), and a semiconductor memory connected via the interface 2004.

[0056] Next, an overview of the security information derivation device according to the present disclosure will be described. Fig. 9 is a block diagram showing an overview of the security information derivation device according to the present disclosure. The security information derivation device includes a URL storage means 72, a Web page information acquisition means 73, a text information extraction means 74, a security information derivation means 75, and a display control means 77.

[0057] The URL storage means 72 (for example, the URL storage unit 2) stores a pre-specified URL.

[0058] Web page information acquisition means 73 (for example, Web page information acquisition unit 3) acquires information about the Web page specified by the URL.

[0059] The text information extraction means 74 (for example, the text information extraction unit 4) extracts text information from the acquired web page information.

[0060] The security information derivation means 75 (e.g., the security information derivation unit 5) derives security information for commercially available software used in the system to be maintained by applying the entire extracted text information to a model previously generated by machine learning.

[0061] The display control means 77 (for example, the display control unit 7) displays the security information on a display device.

[0062] Such a configuration allows the security information obtained to be standardized.

[0063] The above embodiment and its modifications can also be described as follows, but are not limited to the following:

[0064] (Appendix 1) a URL storage means for storing a pre-specified URL (Uniform Resource Locator); a web page information acquisition means for acquiring information on the web page specified by the URL; a text information extraction means for extracting text information from the acquired web page information; a security information derivation means for deriving security information of commercially available software used in the maintenance target system by applying the entire extracted text information to a model previously generated by machine learning; a display control means for displaying the security information on a display device. A security information derivation device characterized by:

[0065] (Appendix 2) The URL is the URL of a web page of the manufacturer of the commercially available software used in the maintenance target system, which describes security information for the software. 2. The security information derivation device according to claim 1.

[0066] (Appendix 3) The model is a model that has been generated in advance by machine learning using a set of text information extracted from web page information and security information included in the text information as training data. 2. The security information derivation device according to claim 1.

[0067] (Appendix 4) A file storage means is provided to save the displayed security information in a file format specified by the maintenance worker. 2. The security information derivation device according to claim 1.

[0068] (Appendix 5) a priority determination means for determining the priority of the security information based on a keyword included in the security information; The display control means The security information is displayed on the display device in a manner according to the priority. 5. The security information derivation device according to claim 1.

[0069] (Appendix 6) A computer having a URL storage means for storing a pre-specified URL (Uniform Resource Locator), Obtaining information about a web page identified by the URL; Extract text information from the retrieved web page information, The entire extracted text information is applied to a model previously generated by machine learning to derive security information for commercially available software used in the system to be maintained. Displaying the security information on a display device A security information deriving method comprising:

[0070] (Appendix 7) A computer having a URL storage means for storing a pre-specified URL (Uniform Resource Locator), a web page information acquisition process for acquiring information on a web page identified by the URL; A text information extraction process for extracting text information from the acquired web page information; a security information derivation process for deriving security information for commercially available software used in the maintenance target system by applying the entire extracted text information to a model previously generated by machine learning; and Display control process for displaying the security information on a display device A security information extraction program for executing the above.

[0071] Some or all of the configurations described in Supplementary Notes 2 to 5, which are dependent on Supplementary Note 1, may also be dependent on Supplementary Notes 6 and 7 in the same dependent relationship as Supplementary Notes 2 to 5. Furthermore, not limited to Supplementary Notes 1, 6, and 7, some or all of the configurations described as Supplements may be made dependent on various hardware, software, various recording means for recording software, or systems, within the scope of the above-described embodiment.

[0072] Although the present disclosure has been described above with reference to the embodiments, the present disclosure is not limited to the above-described embodiments. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present disclosure within the scope of the present disclosure. [Industrial Applicability]

[0073] The present disclosure is suitably applied to deriving security information for commercially available software. [Explanation of symbols]

[0074] 1 URL specification reception section 2 URL storage section 3 Web page information acquisition section 4. Text information extraction section 5. Security information derivation part 6 Priority judgment section 7 Display control section 8 Display Devices 9 File Storage 10. Security information derivation device

Claims

1. a URL storage means for storing a pre-specified URL (Uniform Resource Locator); a web page information acquisition means for acquiring information on the web page specified by the URL; a text information extraction means for extracting text information from the acquired web page information; a security information derivation means for deriving security information of commercially available software used in the maintenance target system by applying the entire extracted text information to a model previously generated by machine learning; a display control means for displaying the security information on a display device. A security information derivation device characterized by:

2. The URL is the URL of the web page of the manufacturer of the commercially available software used in the maintenance target system, on which security information of the commercially available software is described. The security information deriving device according to claim 1 .

3. The model is a model that has been generated in advance by machine learning using a set of text information extracted from web page information and security information included in the text information as training data. The security information deriving device according to claim 1 .

4. A file storage means is provided to save the displayed security information in a file format specified by the maintenance worker. The security information deriving device according to claim 1 .

5. a priority determination means for determining the priority of the security information based on a keyword included in the security information; The display control means The security information is displayed on the display device in a manner according to the priority. The security information deriving device according to any one of claims 1 to 4.

6. A computer having a URL storage means for storing a pre-specified URL (Uniform Resource Locator), Obtaining information about the web page identified by the URL; Extracting text information from the acquired web page information; The entire extracted text information is applied to a model previously generated by machine learning to derive security information for commercially available software used in the system to be maintained. Displaying the security information on a display device A security information deriving method comprising:

7. A computer having a URL storage means for storing a pre-specified URL (Uniform Resource Locator), a web page information acquisition process for acquiring information on the web page specified by the URL; a text information extraction process for extracting text information from the acquired web page information; a security information derivation process for deriving security information for commercially available software used in the maintenance target system by applying the entire extracted text information to a model previously generated by machine learning; and Display control process for displaying the security information on a display device A security information extraction program for executing the above.

Images