Computer system and information processing method

Abstract

To solve the problem that it is difficult to generate information including dependency of software included in an IT system and to objectively evaluate reliability of the information.SOLUTION: A computer system is connected to an IT system, holds a plurality of pieces of reference information used to specify a dependency relation of software installed in the IT system, acquires a list of software included in the IT system as configuration information, generates structure type configuration information in which the dependency relation of the software included in the IT system is structured using the configuration information and the plurality of pieces of reference information, and calculates reliability indicating reliability of the structure type configuration information based on a type of the reference information used to generate the structure type configuration information.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a technology for generating structured information on software dependencies. [Background technology]

[0002] In recent years, the use of software configuration information has been cited as a countermeasure against security issues such as vulnerabilities. Software configuration information is structured data that describes the dependencies of software used as components in IT systems or software. By managing software configuration information in advance and comparing it with vulnerability databases on the Internet, it is possible to discover vulnerabilities quickly and without omissions.

[0003] A security management technology for IT systems that uses software configuration information is disclosed in Patent Document 1. In Patent Document 1, by creating a list of software required for the operation of an IT system in advance, it is possible to monitor the IT system to prevent other software from being installed. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Laid-Open No. 2013-251013 Summary of the Invention [Problem to be solved by the invention]

[0005] Nowadays, when software is used as a component of other software, the top-level software that is intentionally introduced by IT system builders is called primary software, and the lower-level software that is unintentionally introduced along with it is called secondary software.

[0006] The above prior art only manages the higher-level software required for the operation of an IT system, i.e., primary software, and is unable to discover security issues such as vulnerabilities in secondary software. Furthermore, the software list does not include the relationship between primary and secondary software, i.e., dependencies. Including dependency information in the configuration information helps consider countermeasures, such as applying a patch to the higher-level software, when a vulnerability is discovered in lower-level software.

[0007] One method for obtaining software composition information is to use an SCA (Software Composition Analysis) tool to create a list of the software included in an IT system, but current SCA tools often cannot obtain data that includes dependencies. Also, while there is a concept of creating complete software composition information by distributing software composition information along with the software, there are many challenges that prevent this from being realized.

[0008] Therefore, it is necessary to generate information that includes dependencies by combining multiple types of information about software. However, there is a problem in that users cannot determine how the generated information was generated or how much they can trust it.

[0009] The present invention aims to realize a technology for generating information including software dependencies using multiple types of information related to software, and further for calculating the reliability of the generated information. [Means for solving the problem]

[0010] A representative example of the invention disclosed in the present application is as follows: That is, a computer system includes a computer having an arithmetic unit, a storage device connected to the arithmetic unit, and a network interface connected to the arithmetic unit, is connected to a plurality of IT systems, holds a plurality of reference information used to identify dependencies of software installed in the IT systems, acquires a list of software included in a target IT system as configuration information, uses the configuration information and the plurality of reference information to generate structured configuration information that is information in which the dependencies of software included in the target IT system are structured, and calculates a reliability that indicates the reliability of the structured configuration information based on the type of the reference information used to generate the structured configuration information. [Effects of the Invention]

[0011] According to the present invention, an administrator can objectively evaluate the reliability of configuration information based on the reliability and use this to implement security measures.

[0012] The details of at least one implementation of the subject matter disclosed herein are set forth in the accompanying drawings and the description below. Other features, aspects, and advantages of the disclosed subject matter will become apparent from the following disclosure, drawings, and claims. [Brief explanation of the drawings]

[0013] [Figure 1] FIG. 1 is a diagram illustrating an example of an overview of a system according to a first embodiment. [Figure 2] 1 is a block diagram illustrating an example of a system configuration according to a first embodiment. [Figure 3] FIG. 1 illustrates an example of the configuration of a managed IT system according to a first embodiment. [Figure 4] FIG. 1 illustrates an example of a configuration of a configuration information management system according to a first embodiment. [Figure 5] 1 is a diagram illustrating an example of the configuration of a vulnerability management system according to a first embodiment. [Figure 6]1 is a diagram illustrating an example of the configuration of an IT system management system according to a first embodiment. [Figure 7] FIG. 2 is a diagram illustrating an example of configuration information according to the first embodiment. [Figure 8] FIG. 10 is a diagram illustrating an example of dependency relationship information according to the first embodiment. [Figure 9] FIG. 10 is a diagram illustrating an example of primary software information according to the first embodiment. [Figure 10] FIG. 10 is a diagram showing an example of structure type configuration information according to the first embodiment. [Figure 11] FIG. 10 is a diagram showing an example of structure type configuration information according to the first embodiment. [Figure 12] FIG. 10 is a diagram illustrating an example of meta information according to the first embodiment. [Figure 13] FIG. 10 is a diagram illustrating an example of software path information according to the first embodiment. [Figure 14] FIG. 10 is a diagram illustrating an example of reliability information according to the first embodiment. [Figure 15A] 10 is a flowchart illustrating an example of processing executed by a merging program according to the first embodiment. [Figure 15B] 10 is a flowchart illustrating an example of processing executed by a merging program according to the first embodiment. [Figure 16] 10 is a flowchart illustrating an example of a first association process executed by the association program according to the first embodiment. [Figure 17] 10 is a flowchart illustrating an example of processing executed by a reliability calculation program according to the first embodiment. [Figure 18A] FIG. 10 is a diagram showing an example of a screen displayed by a display program according to the first embodiment. [Figure 18B] FIG. 10 is a diagram showing an example of a screen displayed by a display program according to the first embodiment. [Figure 19] FIG. 10 is a diagram showing an example of a screen displayed by a reference value setting program according to the first embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0014] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. However, the present invention should not be construed as being limited to the description of the embodiment shown below. Those skilled in the art will readily understand that the specific configuration can be modified within the scope of the idea or intent of the present invention. In the configuration of the invention described below, the same or similar configurations or functions are designated by the same reference numerals, and redundant explanations will be omitted. In this specification, etc., designations such as "first," "second," and "third" are used to identify components and do not necessarily limit the number or order. [Example]

[0015] First, the configuration of the system of this embodiment will be described.

[0016] Fig. 1 is a diagram illustrating an example of an overview of a system according to a first embodiment. Fig. 2 is a block diagram illustrating an example of a configuration of a system according to a first embodiment.

[0017] The system is composed of a managed IT system 10, a configuration information management system 20, a vulnerability management system 30, an IT system management system 40, and a text generation system 50. Each system is connected via a network 60.

[0018] The number of each system does not have to be one, and for example, multiple managed IT systems 10 can be integrated and managed as shown in Figure 2. Furthermore, each system may be managed by a different group, organization, or company.

[0019] The managed IT system 10 is an IT system for which security measures are implemented. The managed IT system 10 executes a configuration information acquisition process 11 and transmits a list of software included in the managed IT system 10 as configuration information to the configuration information management system 20. The configuration information acquisition process 11 is executed using, for example, a known structural analysis (SCA) tool.

[0020] The configuration information management system 20 executes a configuration information integration process 21 using configuration information acquired from the managed IT systems 10 and information stored in a configuration information DB 22 to generate structured configuration information. The structured configuration information is information in which software dependencies are structured. The configuration information management system 20 also executes a reliability calculation process 23 to calculate the reliability of the structured configuration information.

[0021] The vulnerability management system 30 executes a vulnerability detection process 31 to detect vulnerabilities in software included in the managed IT system 10. In the vulnerability detection process 31, vulnerabilities in software included in the managed IT system 10 are detected by comparing the structured configuration information with a vulnerability DB 32.

[0022] The IT system management system 40 executes a vulnerability display process 41 to display the detected vulnerabilities and the reliability of the structure-type configuration information. As a result, the detected vulnerabilities are displayed together with the software dependencies. The IT system management system 40 also executes a reliability reference value setting process 42 to set a reference value to be used in the reliability calculation process 23 of the configuration information management system 20.

[0023] The text generation system 50 uses Large Language Models (LLMs) to perform natural language processing tasks.

[0024] The respective systems may be integrated into one system, and for example, the configuration information integration process 21 and the vulnerability detection process 31 may be executed by one system.

[0025] FIG. 3 is a diagram illustrating an example of the configuration of the managed IT system 10 according to the first embodiment.

[0026] The managed IT system 10 is configured from a computer having a CPU 101 , a network I / F 102 , an input / output device 103 , a storage device 104 , and a memory 105 .

[0027] The CPU 101 executes a program stored in the memory 105. The CPU 101 executes processing in accordance with the program, thereby operating as a functional unit (module) that realizes a specific function. In the following description, when processing is described with the program as the subject, this indicates that the CPU 101 is executing the program.

[0028] The storage device 104 is an HDD (Hard Disk Drive), an SSD (Solid State Drive), or the like. The memory 105 stores programs and information executed by the CPU 101 and is also used as a work area. Specifically, the memory 105 stores an acquisition program 70, configuration information 80, dependency information 81, and primary software information 82. The acquisition program 70, configuration information 80, dependency information 81, and primary software information 82 may be stored in the storage device 104. In this case, the CPU 101 reads the programs and various information from the storage device 104 and loads them into the memory 105. The acquisition program 70 is executed by the CPU 101.

[0029] The network I / F 102 is connected to the network 60 and communicates with an external device or an external system. The input / output device 103 includes input devices such as a keyboard, a mouse, and a touch panel, and an output device such as a display.

[0030] FIG. 4 is a diagram illustrating an example of the configuration of the configuration information management system 20 according to the first embodiment.

[0031] The configuration information management system 20 is composed of a computer including a CPU 201, a network I / F 202, an input / output device 203, a storage device 204, and a memory 205. The CPU 201, the network I / F 202, the input / output device 203, the storage device 204, and the memory 205 are the same as the CPU 101, the network I / F 102, the input / output device 103, the storage device 104, and the memory 105, and therefore a description thereof will be omitted.

[0032] The memory 205 stores the combining program 71, the reliability calculation program 72, the structure type configuration information 83, the meta information 84, the software path information 85, and the reliability information 86. The combining program 71 and the reliability calculation program 72 are executed by the CPU 201.

[0033] FIG. 5 is a diagram illustrating an example of the configuration of the vulnerability management system 30 according to the first embodiment.

[0034] The vulnerability management system 30 is configured from a computer having a CPU 301, a network I / F 302, an input / output device 303, a storage device 304, and a memory 305. The CPU 301, the network I / F 302, the input / output device 303, the storage device 304, and the memory 305 are the same as the CPU 101, the network I / F 102, the input / output device 103, the storage device 104, and the memory 105, and therefore a description thereof will be omitted.

[0035] The memory 305 stores the vulnerability detection program 73 and the vulnerability information 87. The vulnerability detection program 73 is executed by the CPU 301.

[0036] FIG. 6 is a diagram illustrating an example of the configuration of an IT system management system 40 according to the first embodiment.

[0037] The IT system management system 40 is configured from a computer having a CPU 401, a network I / F 402, an input / output device 403, a storage device 404, and a memory 405. The CPU 401, the network I / F 402, the input / output device 403, the storage device 404, and the memory 405 are the same as the CPU 101, the network I / F 102, the input / output device 103, the storage device 104, and the memory 105, and therefore a description thereof will be omitted.

[0038] The memory 405 stores a display program 74 and a reference value setting program 75. The display program 74 and the reference value setting program 75 are executed by the CPU 401.

[0039] Next, the data structure of the information held by the system will be described.

[0040] FIG. 7 is a diagram illustrating an example of the configuration information 80 according to the first embodiment.

[0041] The configuration information 80 is information for managing software included in the managed IT system 10. The configuration information 80 stores records each including a software name 801 and a path 802. One record exists for each piece of software.

[0042] The software name 801 is a field for storing the identification name of the software included in the managed IT system 10 .

[0043] The path 802 is a field that stores a path on the managed IT system 10 that indicates the location where the software is stored.

[0044] The information to be included in the records stored in the configuration information 80 is acquired by the acquisition program 70. Note that the information may also be set in advance by an IT system administrator.

[0045] FIG. 8 is a diagram illustrating an example of the dependency relationship information 81 according to the first embodiment.

[0046] The dependency relationship information 81 is information for managing software dependencies such as OSS (Open Source Software). The dependency relationship information 81 stores records including a software name 811 and a component software name 812. One record exists for one dependency relationship.

[0047] The software name 811 is a field for storing the identification name of the software included in the managed IT system 10 .

[0048] The component software name 812 is a field for storing the identification name of the software corresponding to the software component corresponding to the software name 811 .

[0049] FIG. 9 is a diagram illustrating an example of the primary software information 82 according to the first embodiment.

[0050] The primary software information 82 is information for managing software (primary software) that is directly used or referenced by an IT system administrator or developer.

[0051] Here, the primary software is software that provides the functions required for the managed IT system 10, and is software that does not have any software that uses the software as a component. The primary software is one of the pieces of software included in the managed IT system 10.

[0052] The primary software information 82 stores records each including a software name 821 and a vendor 822. One record exists for each primary software.

[0053] The software name 821 is a field that stores the identification name of the primary software.

[0054] Vendor 822 is a field that stores information about the vendor company that provides the primary software (for example, the name of the vendor company).

[0055] 10 and 11 are diagrams showing an example of the structure type configuration information 83 according to the first embodiment.

[0056] The structure type configuration information 83 is information in which software dependency relationships are structured. The structure type configuration information 83 stores records including software names 831 and components 832. One record exists for each serial software dependency relationship starting from the primary software.

[0057] The software name 831 is a field that stores the identification name of the primary software.

[0058] The component 832 is a group of fields for storing information indicating the dependency relationship of software that is a component of the primary software. The component 832 stores a pair of a rationale 833 and a component software name 834 for each layer.

[0059] The basis 833 is a field for storing the type of information used as the basis for associating with higher-level software. The component software name 834 is a field for storing the identification name of the software corresponding to the component.

[0060] When the software dependency relationship starting from the primary software has a multi-layer structure, pairs of rationale 833 and component software name 834 are added to the right side of the record of the component 832 for the number of layers.

[0061] In this embodiment, if the information used is structural configuration information 83, basis "A" is set; if the information used is dependency information 81, basis "B" is set; if the information used is information on a path included in configuration information 80, basis "C" is set; and if the information used is information on the Internet, basis "D" is set.

[0062] Note that instead of managing software dependencies using one piece of structure-type configuration information 83 as shown in Fig. 10, software dependencies may be managed by associating structure-type configuration information 83 with a data structure as shown in Fig. 11. In this management method, one piece of structure-type configuration information 83 exists for one piece of software.

[0063] 11 stores records including a software name 835, a rationale 836, and a configuration information ID 837. The structure configuration information 83 includes as many records as there are software components of the software managed by the structure configuration information 83.

[0064] The software name 835 is a field that stores the identification name of the software managed by the structure type configuration information 83. The basis 836 is the same field as the basis 833. The configuration information ID 837 is a field that stores the identifier of the structure type configuration information 83 of the software that is a component of the software managed by the structure type configuration information 83. The software dependency can be managed by associating it with other structure type configuration information 83 using the configuration information ID 837.

[0065] FIG. 12 is a diagram illustrating an example of the meta information 84 according to the first embodiment.

[0066] The meta information 84 is information for managing the reliability of the structure-type configuration information 83. The meta information 84 includes a configuration information ID 841 and a reliability 842.

[0067] The configuration information ID 841 is a field for storing the identifier of the structure type configuration information 83 .

[0068] The reliability 842 is a field for storing the reliability calculated by the reliability calculation program 72 .

[0069] FIG. 13 is a diagram illustrating an example of the software path information 85 according to the first embodiment.

[0070] The software path information 85 stores information about the paths of software that may be used in the IT system 10. The software path information 85 stores records including a software name 851, a vendor 852, and path information 853. One record exists for one piece of software.

[0071] The software name 851 is a field for storing the identification name of software that may be used in the IT system 10 .

[0072] Vendor 852 is a field for storing information about the vendor company that provides the software (for example, the name of the vendor company).

[0073] The path information 853 is a field for storing a character string included in a path that indicates the location (directory or folder) where the software is installed in the IT system 10.

[0074] FIG. 14 is a diagram illustrating an example of the reliability information 86 according to the first embodiment.

[0075] The reliability information 86 is information for managing the reliability (numerical value) corresponding to the basis of association. The reliability information 86 stores a record including a basis 861 and a reliability 862. One record exists for one basis of association.

[0076] The basis 861 is the same field as the basis 833 .

[0077] The reliability 862 is a field for storing the reliability (score) corresponding to the basis for association with the software.

[0078] The reliability information 86 is set by the IT system administrator by executing the reference value setting program 75 .

[0079] The configuration information DB 22 stores configuration information 80, dependency information 81, primary software information 82, structural configuration information 83, meta information 84, software path information 85, and reliability information 86. The configuration information 80, dependency information 81, primary software information 82, structural configuration information 83, and software path information 85 are information referenced to generate the structural configuration information 83.

[0080] Next, the details of the process will be described.

[0081] 15A and 15B are flowcharts showing an example of processing executed by the merging program 71 of the first embodiment.

[0082] The integration program 71 executes the following process when it acquires the configuration information 80, dependency information 81, and primary software information 82 from the managed IT system 10. Here, the process of generating structure type configuration information 83 shown in FIG. 10 will be described.

[0083] The merging program 71 acquires the configuration information 80 and the dependency relationship information 81 of the managed IT system 10 (step S100).

[0084] Next, the combined program 71 starts a loop process of the software (step S101). Here, the combined program 71 selects one record (software) from the configuration information 80. Note that software saved with the reason "None" in step S112, which will be described later, is excluded. In the following description, the selected software is referred to as target software.

[0085] Next, the merging program 71 refers to the configuration information DB 22 and determines whether or not there is any structure-type configuration information 83 including the target software among the structure-type configuration information 83 of the other IT systems 10 (step S102).

[0086] If there is structure-type configuration information 83 including the target software, the merging program 71 acquires information on the software (higher-level software) that includes the target software as a component from the structure-type configuration information 83 including the target software, and stores the information in the work area (step S103). After that, the merging program 71 proceeds to step S113.

[0087] At this time, the combining program 71 regards this as a highly accurate basis for the association and saves data associating the target software name, the upper software name, and the basis "A" in the work area. Note that if the software obtained from the structure type configuration information 83 is not included in the configuration information 80, the data may not be saved.

[0088] If it is determined in step S102 that structural configuration information 83 including the target software does not exist, the merge program 71 refers to the dependency information 81 of the managed IT system 10 and determines whether or not a record exists in which the target software is set in the component software name 812 (step S104).

[0089] If a record that satisfies the conditions exists in the dependency information 81, the combined program 71 obtains the name of the upper level software from the record and stores it in the work area (step S105).Then, the combined program 71 proceeds to step S113.

[0090] At this time, the integration program 71 regards the dependency information 81 obtained from the managed IT system 10 as the basis information, and saves data associating the name of the target software, the name of the higher-level software, and the basis "B" in the work area.

[0091] If it is determined that there is no record that satisfies the conditions in the dependency information 81, the merging program 71 executes a first association process based on the path information of the target software (step S106). Furthermore, the merging program 71 determines whether or not there is higher-level software that uses the target software as a component based on the result of the process (step S107). In other words, it determines whether or not the first association process was successful. Details of the first association process will be described later.

[0092] If there is higher-level software that uses the target software as a component, the combined program 71 saves the primary software in the work area (step S108), after which the combined program 71 proceeds to step S113.

[0093] At this time, the combined program 71 stores data associating the name of the target software, the name of the primary software, and the basis "C" in the work area.

[0094] If it is determined that there is no higher-level software that uses the selected software as a component, the merging program 71 executes a second association process based on the Internet information (step S109).The merging program 71 also determines whether there is any higher-level software that uses the target software as a component based on the result of the second association process (step S110).

[0095] In the second association process, the merging program 71 queries the text generation system 50 for higher-level software of the target software. The text generation system 50 infers the higher-level software based on knowledge learned using Internet information and outputs the inference result. The merging program 71 receives the inference result as information obtained from the Internet. Based on the information, the merging program 71 determines whether there is higher-level software that uses the target software as a component.

[0096] If higher-level software than the target software exists, the combined program 71 saves the higher-level software of the target software in the work area (step S111), after which the combined program 71 proceeds to step S113.

[0097] At this time, the combined program 71 stores data associating the name of the target software, the name of the upper level software, and the basis "D" in the work area.

[0098] If it is determined that there is no higher-level software than the target software, the combined program 71 saves data associating the name of the target software with the basis "None" in the work area (step S112). After that, the combined program 71 proceeds to step S114. As a result of executing the loop process, only the primary software remains in the configuration information 80.

[0099] In step S113, the merged program 71 deletes the selected software from the configuration information 80 (step S113). After that, the merged program 71 proceeds to step S114.

[0100] Next, the merged program 71 determines whether only primary software is registered in the configuration information 80 (step S114). Specifically, the merged program 71 determines whether only software with the reason "None" assigned is registered in the configuration information 80.

[0101] If software other than the primary software is registered in the configuration information 80, the integration program 71 returns to step S101 and selects new software.

[0102] If only primary software is registered in the configuration information 80, the combined program 71 generates the structure type configuration information 83 using the data saved in the work area in the loop processing (step S115).

[0103] For example, the merging program 71 generates data representing software dependencies starting from the primary software by merging data containing the same software name. Based on the data, the merging program 71 generates the structure-type configuration information 83 by setting serial dependencies as one record.

[0104] To generate the structure type configuration information 83 of the data structure in FIG. 11, the following process can be performed. The merging program 71 generates the structure type configuration information 83 by merging data with the same upper software. Specifically, the software of the components included in the data is registered as a record. In this case, one structure type configuration information 83 is generated for one upper software. At this point, the configuration information ID 837 is blank. The merging program 71 generates an ID for the structure type configuration information 83 and generates a list that associates the name of the upper software with the ID. Based on the list, the merging program 71 sets an ID to the configuration information ID 837 of each record of the structure type configuration information 83.

[0105] As described above, the linking program 71 can structure the dependencies of the software registered in the configuration information 80 based on various information, and generate the structured configuration information 83.

[0106] The merging program 71 may execute processing based on only a portion of the information, or may accept user input and treat it as information on the basis of the information.

[0107] FIG. 16 is a flowchart showing an example of the first association process executed by the combining program 71 of the first embodiment.

[0108] The integration program 71 acquires the primary software information 82 and the software path information 85 of the managed IT system 10 (step S200).

[0109] The combined program 71 starts loop processing of the primary software (step S201). Here, the combined program 71 selects one record (primary software) from the primary software information 82.

[0110] The merging program 71 determines whether the path of the target software contains a character string corresponding to the name of the primary software (step S202).

[0111] Specifically, the merging program 71 obtains a path from the path 802 of the record corresponding to the target software. The merging program 71 determines whether the path contains the character string stored in the software name 821 of the selected record. Note that uppercase and lowercase letters are treated as the same character.

[0112] If the path of the target software contains a character string corresponding to the name of the primary software, the merging program 71 considers the target software to be a component of the selected primary software from the directory structure. In this case, the merging program 71 generates data associating the name of the target software, the name of the primary software, and the basis "C" (step S204). Thereafter, the merging program 71 exits the loop processing and ends the first association processing.

[0113] If it is determined that the path of the target software does not include a character string corresponding to the name of the primary software, the merging program 71 determines whether the path includes a character string corresponding to the path information of the primary software (step S203).

[0114] Specifically, the merging program 71 obtains the character string stored in the path information 853 of the record corresponding to the primary software from the software path information 85. The merging program 71 obtains a path from the path 802 of the record corresponding to the target software, and determines whether the obtained character string (the character string corresponding to the primary software) is included in the path.

[0115] If the path of the target software contains a character string corresponding to the primary software, the merging program 71 considers the target software to be a component of the selected primary software from the directory structure. In this case, the merging program 71 generates data associating the name of the target software, the name of the primary software, and the basis "C" (step S204). Thereafter, the merging program 71 exits the loop processing and ends the first association processing.

[0116] Depending on the software, the name of the directory in which the software is stored may differ from the name of the software. To deal with this, software path information 85 is prepared in advance.

[0117] If the path of the target software does not include a character string corresponding to the primary software, the merging program 71 determines whether or not the processing has been completed for all primary software registered in the primary software information 82 (step S205).

[0118] If it is determined that the processing has not been completed for all primary software registered in the primary software information 82, the combined program 71 returns to step S201 and selects a new primary program.

[0119] When the process has been completed for all primary software registered in the primary software information 82, the association program 71 generates data indicating that the association has failed (step S206), and ends the first association process.

[0120] FIG. 17 is a flowchart illustrating an example of processing executed by the reliability calculation program 72 according to the first embodiment.

[0121] The reliability calculation program 72 executes the process described below after the structure type configuration information 83 is generated by the combining program 71. Here, the process will be described taking as an example a case where the structure type configuration information 83 shown in FIG. 10 is received.

[0122] The reliability calculation program 72 acquires the structure type configuration information 83 and the reliability information 86 (step S300).

[0123] The reliability calculation program 72 calculates the reliability of the structure-type configuration information 83 based on the basis 833 of the structure-type configuration information 83 (step S301).

[0124] Specifically, the reliability calculation program 72 converts the basis 833 of each association of each record into a numerical value based on the reliability 862, and calculates the value obtained by dividing the sum of the numerical values ​​of all records by the number of basis values ​​as the reliability of the structure type configuration information 83. Note that the above calculation method is an example and is not limited to this. For example, a weight may be set for each software in advance and calculation may be performed using a weighted average or other method. Note that the reliability may also be calculated for each primary software.

[0125] The reliability calculation program 72 generates the meta information 84 and ends the process (step S302).

[0126] As described above, the reliability calculation program 72 can calculate the reliability of the structure-type configuration information 83 based on the type of information used to associate software. The IT system administrator can objectively grasp the reliability of the structure-type configuration information 83 based on the quantitative evaluation value.

[0127] Next, the screens displayed to the IT system administrator etc. will be described.

[0128] 18A and 18B are diagrams showing examples of screens displayed by the display program 74 of the first embodiment.

[0129] The display program 74 displays a screen 1800 in a window of a web browser or the like via the input / output device 403 of the IT system management system 40 .

[0130] 18A displays structure-type configuration information 83 in which the basis has been converted into reliability. Software Y is software in which a vulnerability has been discovered by vulnerability detection program 73. In this way, software in which a vulnerability has been discovered is displayed in an emphasized manner on screen 1800.

[0131] IT system administrators can quickly discover vulnerabilities contained in the managed IT system 10. Displaying the information as structured configuration information 83 makes it easier to consider countermeasures, such as waiting for the release of a patch from the vendor of software B in the example shown in the figure. Vendor information can be obtained from primary software information 82 or software path information 85. In addition, the reliability of software associations is also displayed, allowing administrators to understand how reliable the associations are.

[0132] 18B shows a graph in which software is represented as a node and software associations are represented as edges. The nodes are assigned the name of the software and the reliability of the association between that software and higher-level software. The node corresponding to the primary software displays an average value calculated from the reliability of each layer.

[0133] FIG. 19 is a diagram showing an example of a screen displayed by the reference value setting program 75 of the first embodiment.

[0134] The reference value setting program 75 displays a screen 1900 in a window of a web browser or the like via the input / output device 403 of the IT system management system 40 .

[0135] Screen 1900 displays, as setting fields, a field 1901 for selecting a basis, a field 1902 for inputting reliability, and a set button 1903. The IT system administrator selects a basis from field 1901, enters a numerical value representing the reliability in field 1902, and presses set button 1903. Note that it may be possible to set the reliability of multiple basis at once.

[0136] When the setting button 1903 is pressed, the reference value setting program 75 acquires the basis and reliability input via the screen 1900 and stores them in the reliability information 86 of the configuration information management system 20 .

[0137] Although the above input items only list the reference values ​​for the linking basis as an example, the present invention is not limited to this and may include exceptional criteria, such as a uniform reliability of 5 for certain software. Furthermore, buttons for adding or deleting linking basis may be added.

[0138] According to the configuration of this embodiment described above, the configuration information management system 20 can generate and manage structured configuration information 83 that structures the dependencies of software included in the managed IT system 10, based on multiple pieces of software-related information. Furthermore, the configuration information management system 20 can present the reliability of the structured configuration information 83 along with the information, thereby enabling the IT system administrator to implement security measures based on the dependencies of software.

[0139] The present invention is not limited to the above-described embodiments and includes various modifications. For example, the present invention can be applied to any data that is structured through distribution, such as carbon footprint (CFP), which is data indicating the amount of CO2 emitted in the manufacture of a product distributed in a supply chain, or information on the origin of products such as food. The above-described embodiments have been described in detail to clearly explain the present invention, and the present invention is not necessarily limited to those that include all of the described configurations. Furthermore, some of the configurations of the above-described embodiments can be applied alone or in combination with other configurations by adding, deleting, or replacing them.

[0140] Furthermore, the above-described configurations, functions, processing units, and processing means may be partially or entirely implemented in hardware, for example, by designing them as integrated circuits. The above-described configurations and functions may also be implemented in software, with a CPU interpreting and executing programs that implement the respective functions. Information such as programs, tables, and files that implement the respective functions may be stored in a memory, a recording device such as a hard disk or SSD (Solid State Drive), or a recording medium such as an IC card, SD card, or DVD.

[0141] In addition, the control lines and information lines shown are those that are considered necessary for the explanation, and do not necessarily show all the control lines and information lines in the product. In reality, it can be assumed that almost all components are interconnected. [Explanation of symbols]

[0142] 10. IT Systems 20 Configuration Information Management System 22 Configuration Information DB 30 Vulnerability Management System 32 Vulnerability DB 40 IT System Management System 50 Text Generation System 60 Network 70 Acquisition Program 71 Combined Program 72 Reliability calculation program 73 Vulnerability detection program 74 Display Program 75 Reference Value Setting Program 80 Configuration Information 81 Dependency Information 82 Primary Software Information 83 Structural type configuration information 84 Meta Information 85 Software path information 86 Reliability Information 87 Vulnerability information 101, 201, 301, 401 CPUs 102, 202, 302, 402 Network I / F 103, 203, 303, 403 I / O devices 104, 204, 304, 404 storage device 105, 205, 305, 405 memory

Claims

1. 1. A computer system comprising: a computer having an arithmetic unit, a storage device connected to the arithmetic unit, and a network interface connected to the arithmetic unit; Connecting to multiple IT systems maintaining a plurality of reference information used to identify dependencies of software installed on the IT system; Obtain a list of software included in the target IT system as configuration information, generating structured configuration information, which is information in which dependencies of software included in the target IT system are structured, using the configuration information and the plurality of reference information; A computer system characterized by calculating a reliability indicating the reliability of the structure type configuration information based on the type of the reference information used to generate the structure type configuration information.

2. 2. The computer system of claim 1, repeatedly executing a specification process including a process of selecting target software, a process of specifying software that uses one piece of reference information as a component of the target software, and a process of generating data that associates the name of the target software, the name of the specified software, and the type of reference information used; A computer system that generates the structure-type configuration information by merging the data.

3. 3. The computer system according to claim 2, A computer system characterized by storing as the reference information the structural configuration information of an IT system different from the target IT system, dependency information indicating the dependency of some software obtained from the target IT system, and path information for managing character strings contained in a path indicating the location where primary software that is not a component of other software is installed.

4. 4. The computer system according to claim 3, The configuration information stores a record including a name and a path of the software; A computer system characterized in that, when the path in which the target software is installed contains the name of the primary software or a string registered in the path information, the computer system generates data that corresponds the name of the target software, the name of the primary software, and identification information of the configuration information.

5. 3. The computer system according to claim 2, interfaced with a text generation system having a large-scale language model that performs natural language processing tasks; The computer system is characterized in that the identification process includes a process of querying the text generation system about software that has the target software as a component, and when a response regarding software that has the target software as a component is received, a process of generating the data that corresponds the name of the target software, the name of the identified software, and the response.

6. 3. The computer system according to claim 2, Maintain vulnerability information regarding software vulnerabilities; Detecting software having vulnerabilities using the vulnerability information and the structural configuration information; A computer system that provides an interface that displays the dependency relationships of software related to the vulnerable software and the reliability of the software.

7. 3. The computer system according to claim 2, converting the type of the configuration information included in the structural type configuration information into a score; A computer system that calculates the reliability using the score included in the structure type configuration information.

8. 8. The computer system of claim 7, A computer system characterized by holding reliability information that manages the correspondence between the type of configuration information and the score.

9. 9. The computer system of claim 8, A computer system that provides an interface for setting the reliability information.

10. An information processing method executed by a computer system, comprising: The computer system a computer including an arithmetic unit, a storage device connected to the arithmetic unit, and a network interface connected to the arithmetic unit; Connecting to multiple IT systems maintaining a plurality of reference information used to identify dependencies of software installed on the IT system; The information processing method includes: a first step in which the computer system acquires a list of software included in the target IT system as configuration information; a second step in which the computer system generates structured configuration information, which is information in which dependencies of software included in the target IT system are structured, using the configuration information and the plurality of pieces of reference information; An information processing method characterized in that the computer system includes a third step of calculating a reliability representing the reliability of the structural configuration information based on the type of reference information used to generate the structural configuration information.

11. 11. The information processing method according to claim 10, The second step includes: a step in which the computer system repeatedly executes an identification process including a process of selecting target software, a process of specifying software that uses the target software as a component using one piece of reference information, and a process of generating data that associates the name of the target software, the name of the specified software, and the type of the reference information used; and a step in which the computer system generates the structure-type configuration information by merging the data.

12. 12. The information processing method according to claim 11, An information processing method characterized in that the computer system holds as the reference information the structural configuration information of an IT system different from the target IT system, dependency information indicating the dependency of some software obtained from the target IT system, and path information for managing character strings contained in a path indicating the location where primary software that is not a component of other software is installed.

13. 12. The information processing method according to claim 11, the computer system is connected to a text generation system having a large-scale language model for performing natural language processing tasks; The information processing method characterized in that the identification process includes a process of querying the text generation system about software that has the target software as a component, and when a response regarding software that has the target software as a component is received, a process of generating the data that corresponds the name of the target software, the name of the identified software, and the response.

Images