Information processing apparatus, control program, and control method

Abstract

To provide an information processing device, a control program, a control method, and the like that enable an operator of a device connected to the Internet to determine vulnerability of the device without introducing a new system.SOLUTION: The information processing apparatus includes an acquisition unit that acquires pieces of code information included in predetermined information transmitted from a plurality of devices in which a specific application is installed, a storage processing unit that stores the acquired pieces of code information and acquisition dates of the pieces of code information in the storage unit in association with each other, a calculation unit that calculates a first acquired total number of pieces of the same code information for each acquisition date, and a determination unit that determines vulnerability of the device based on the first acquired total number for each acquisition date.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present disclosure relates to an information processing device, a control program, and a control method. [Background technology]

[0002] In the past, numerous cyber attacks have been committed against devices connected to the Internet, causing significant damage to companies and organizations around the world. These damages occur when attackers exploit security holes in devices (such as network control devices or servers) operated by each company or organization, and invade the networks or servers within each company or organization.

[0003] In order to fix vulnerabilities in devices connected to the Internet, vendors or developers of each device provide security patches for the applications that control the device. In order to strengthen the security of networks within each company or organization, it is important to discover the existence of devices to which patches have not been applied.

[0004] For example, Patent Document 1 discloses a redundant system in which a management device of each company or organization manages information on security patches for each device and applies security patches or detects whether the security patches have not been applied. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Patent No. 6814659 Summary of the Invention [Problem to be solved by the invention]

[0006] In the technology disclosed in Patent Document 1, device operators of each company or organization had to manage information for detecting whether security patches had been applied to their devices. As a result, it was not possible for anyone other than the device operators to identify whether the devices operated by the device operators had vulnerabilities or not and to prompt the device operators to fix the applications on the devices. Furthermore, in the technology disclosed in Patent Document 1, device operators had to implement a management system for managing information for detecting whether security patches had been applied.

[0007] The present disclosure aims to provide an information processing device, a control program, and a control method that enable operators of devices connected to the Internet to determine the vulnerabilities of the devices without having to install a new system. [Means for solving the problem]

[0008] The disclosed information processing device is an information processing device equipped with a memory unit for determining the vulnerability of devices connected to the Internet, and is characterized by having an acquisition unit that acquires code information contained in specified information sent from multiple devices on which a specific application is installed, a storage processing unit that associates each acquired code information with the acquisition date of each code information and stores them in the memory unit, a calculation unit that calculates a first total acquisition number of the same code information for each acquisition date, and a determination unit that determines the vulnerability of the device based on the first total acquisition number for each acquisition date.

[0009] Furthermore, in the disclosed information processing device, when there are multiple types of identical code information, it is preferable that the judgment unit judges whether the first total acquisition number of each type of code information acquired on the latest acquisition date is smaller than the first total acquisition number of each type of code information acquired in the past, and judges a device that sent specified information including code information of a type whose first total acquisition number has not decreased to be a device that is not vulnerable.

[0010] Furthermore, in the disclosed information processing device, when there are multiple types of identical code information, it is preferable that the judgment unit judges whether the first total acquisition number of each type of code information acquired on the latest acquisition date has increased compared to the first total acquisition number of each type of code information acquired in the past, and judges that a device that transmitted specified information including code information of a type for which the first total acquisition number has increased is a device that is not vulnerable.

[0011] In the disclosed information processing device, it is preferable that the predetermined information is information for displaying a screen for logging into the device via the Internet.

[0012] In the disclosed information processing device, it is preferable that the predetermined information is response information transmitted from the device in response to access to the device via the Internet.

[0013] Furthermore, in the disclosed information processing device, it is preferable that the specified information is information written in a markup language, and the acquisition unit stores string information corresponding to one or more types of tags included in the specified information in the memory unit as candidate information, calculates a second total acquisition count of the same candidate information for each acquisition date, and treats candidate information whose second total acquisition count increases or decreases as the acquisition date passes as coded information.

[0014] The disclosed control program is a control program for an information processing device having a memory unit for determining the vulnerability of devices connected to the Internet, and causes the information processing device to acquire code information contained in specified information sent from multiple devices on which a specific application is installed, associate each acquired code information with the acquisition date of each code information and store it in the memory unit, calculate a first total acquisition count of the same code information for each acquisition date, and determine the vulnerability of the device based on the first total acquisition count for each acquisition date.

[0015] The disclosed control method is a control method for an information processing device having a memory unit for determining the vulnerability of devices connected to the Internet, and includes the information processing device acquiring code information contained in specified information sent from multiple devices on which a specific application is installed, storing each acquired code information in the memory unit in association with the acquisition date of each code information, calculating a first total acquisition count of the same code information for each acquisition date, and determining the vulnerability of the device based on the first total acquisition count for each acquisition date. [Effects of the Invention]

[0016] The information processing device, control program, and control method according to the present disclosure enable the operator of a device connected to the Internet to determine the vulnerability of the device without having to install a new system. [Brief explanation of the drawings]

[0017] [Figure 1] FIG. 1 is a schematic diagram illustrating an example of an overview of an information network system. [Figure 2] FIG. 1 is a diagram illustrating an example of a schematic configuration of an information processing device. [Figure 3] FIG. 10 is a diagram illustrating an example of predetermined information. [Figure 4] FIG. 10 is a diagram illustrating an example of a data structure of a code information table. [Figure 5] FIG. 10A is a diagram showing an example of the operational flow of a determination process, and FIG. 10B is a diagram showing an example of the operational flow of a vulnerability determination process. DETAILED DESCRIPTION OF THE INVENTION

[0018] Various embodiments of the present invention will be described below with reference to the drawings. However, it should be noted that the technical scope of the present invention is not limited to these embodiments, but extends to the inventions set forth in the claims and their equivalents.

[0019] (Outline of Information Network System) 1 is a diagram showing an example of a schematic configuration of an information network system 1. The information network system 1 includes an information processing device 2, a plurality of devices 3 (3a, 3b, 3c, ...) owned by each of a plurality of companies or organizations, and an external device 4. The information processing device 2, the devices 3, and the external device 4 are interconnected via the Internet 5.

[0020] Communication is performed based on a communication protocol such as Hypertext Transfer Protocol (HTTP) between the information processing device 2 and each of the plurality of devices 3. Communication is also performed based on a communication protocol such as Hypertext Transfer Protocol (HTTP) between the external device 4 and each of the plurality of devices 3.

[0021] The information processing device 2 is, for example, a personal computer (PC), or may be a notebook PC, a tablet terminal, a tablet PC, or a head mounted display (HMD).

[0022] 1, one information processing device 2 is illustrated as a component of the information network system 1, but the information processing device 2 may be a collection of multiple physically separate information processing devices 2. In this case, each of the multiple information processing devices 2 may have the same function, or may have the function of a single information processing device 2 in a distributed manner.

[0023] The device 3 is, for example, a network control device owned by an operator of a company or organization. A user belonging to the company or organization can access the operator's network by entering his or her own identification (ID) and password on a login screen sent from the network control device to his or her own PC (hereinafter sometimes referred to as a "user PC"). Once a user has accessed the operator's network, he or she can operate the user PC to connect the user PC to various devices, such as PCs and / or servers, within the operator's network. This allows the user PC to obtain data stored in the various devices and use the functions of the various devices that he or she has accessed.

[0024] Device 3 may be a file sharing server of a file sharing system established by an operator of a company or organization. Users belonging to the company or organization can access the file sharing system by entering their ID and password into a login screen sent from the file sharing server to the user's PC. Users who have access to the file sharing system can store some of the data stored in their user's PC in the file sharing system, and can also store data stored in the file sharing system in their user's PC.

[0025] Device 3 may be a mail server for a mail system established by an operator of a company or organization. Users belonging to the company or organization can access the mail system by entering their ID and password on a login screen sent from the mail server to the user's PC. Once a user has accessed the mail system, the user's PC can receive display data for their own mail account, such as a mail reception screen, a mail sending screen, and a mail composition screen. This allows the user to view mail addressed to their own email address and to compose and send mail addressed to other email addresses (using their own email address as the sender) from their user's PC.

[0026] The external device 4 is a server device that provides a patch program for a specific application installed in each device 3. If the device 3 is a network control device, the specific application is a network control application. If the device 3 is a file sharing server, the specific application is a file sharing application. If the device 3 is a mail server, the specific application is a mail application.

[0027] The external device 4 transmits a correction program to each device 3 via the Internet 5 at a predetermined timing (date and time). When each device 3 receives the correction program from the external device 4, the device 3 executes a process of correcting a specific application installed in the device 3 by reading the correction program either manually by the operator of the device 3 or automatically.

[0028] (Information processing device 2) 2 is a diagram illustrating an example of a schematic configuration of the information processing device 2. The information processing device 2 connects to a device 3 via the Internet 5, communicates with the device 3, and determines vulnerabilities of the device 3.

[0029] For example, the information processing device 2 acquires coded information 61 included in the predetermined information 6 transmitted from the device 3, and stores the acquired coded information 61 in association with the acquisition date of the coded information 61. Then, the information processing device 2 calculates the total number of acquisitions of the same coded information 61 for each acquisition date, and determines the vulnerability of the device 3 based on the total number of acquisitions for each acquisition date. To realize such a function, the information processing device 2 includes a communication unit 21, a storage unit 22, a display unit 23, an input unit 24, and a processing unit 25.

[0030] The communication unit 21 is hardware, communication software such as a TCP / IP (Transmission Control Protocol / Internet Protocol) driver, or a combination of these. The information processing device 2 can transmit data to the device 3 and receive data from the device 3 via the communication unit 21. The communication unit 21 may include a network controller for interfacing with a communication network. The network controller may also be compliant with wireless communication standards such as Bluetooth (registered trademark), Near Field Communication (NFC), or infrared.

[0031] The storage unit 22 is, for example, a semiconductor memory device such as a ROM (Read Only Memory) or a RAM (Random Access Memory). The storage unit 22 stores an operating system program, a driver program, a control program, data, and the like used for processing in the processing unit 25. The driver programs stored in the storage unit 22 include an output device driver program that controls the display unit 23 and an input device driver program that controls the input unit 24. The control programs stored in the storage unit 22 are, for example, application programs that realize various functions for determining the vulnerability of the device 3.

[0032] The display unit 23 is a liquid crystal display. However, the display unit 23 may be an organic EL (Electro-Luminescence) display or the like. The display unit 23 displays, on a display screen, moving images corresponding to the moving image data and / or still images corresponding to the still image data supplied from the processing unit 25.

[0033] The input unit 24 is an input key or the like. A user can use the input unit 24 to input letters, numbers, and symbols, or a position on the display screen of the display unit 23, etc. The input unit 24 may also be a pointing device such as a touch panel. When operated by a user, the input unit 24 generates a signal corresponding to the operation. The input unit 24 then supplies the generated signal to the processing unit 25 as an instruction from the user.

[0034] The processing unit 25 is a processor that loads the operating system program, driver program, and control program stored in the storage unit 22 into memory and executes instructions contained in the loaded programs. The processing unit 25 is, for example, an electronic circuit such as a CPU (Central Processing Unit). Although the processing unit 25 is illustrated as a single component in FIG. 2, the processing unit 25 may be a collection of multiple physically separate processors. For example, multiple processors that operate cooperatively in parallel to execute instructions may be implemented.

[0035] By executing instructions included in the control program, the processing unit 25 functions as a transmitting / receiving unit 251, a storage processing unit 252, an acquisition unit 253, a calculation unit 254, and a determination unit 255. The functions of the transmitting / receiving unit 251, the storage processing unit 252, the acquisition unit 253, the calculation unit 254, and the determination unit 255 will be described in detail later.

[0036] (Prescribed information 6) FIG. 3 is a diagram illustrating an example of the predetermined information 6. The predetermined information 6 illustrated in FIG. 3 is information for displaying a login screen transmitted from the device 3 via the Internet 5 when the device 3 is a network control device. The predetermined information 6 is information written in a markup language such as HTML (Hyper Text Markup Language). The device 3 transmitting the information for displaying the login screen may be a file sharing server or a mail server. The device 3 transmitting the information for displaying the login screen may be any device 3 that uses a login screen. The predetermined information 6 may be response information transmitted from the device 3 in response to access to the device 3 via the Internet 5. For example, the response information is a so-called server response. The predetermined information 6 transmitted from the device 3 can be acquired via the Internet 5 using a known Internet of Things (IoT) device search engine or crawl service.

[0037] The predetermined information 6 includes code information 61. The code information 61 is information expressed by a character string corresponding to predetermined tag information. In the example shown in FIG. 3, the code information 61 is character string information in " " located to the right of "value=" following "input type="hidden" name="hash"".

[0038] The code information 61 is information that changes depending on the version of the patch program for a specific application installed in the device 3 that transmitted the predetermined information 6 containing the code information 61. In other words, the code information 61 contained in the predetermined information 6 transmitted from multiple devices 3 to which the same version of the patch program has been applied is identical. Furthermore, the code information 61 contained in the predetermined information 6 transmitted from multiple devices 3 to which different versions of the patch program have been applied is not identical. In this way, even someone other than the operator of the device 3 can check the version of the patch program applied to the device 3 using the code information 61 contained in the predetermined information 6, and thus determine the vulnerability of the device 3.

[0039] (Code information table T) 4 is a diagram showing an example of the data structure of the code information table T. The code information table T is a table stored in the storage unit 22. The code information table T stores numerical information indicating the total number of acquired pieces of code information 61 contained in the predetermined information 6 transmitted from each of the multiple devices 3, which are acquired on each acquisition date via the Internet 5. Hereinafter, the total number of acquisitions indicated by the numerical information stored in the code information table T may be referred to as the first total number of acquisitions.

[0040] 4, the predetermined information 6 including the code information 61 "a3be511ebfe3376c8b55730851e9c4177441d6172c7e0cec6fdad2039dbe3856" was not acquired from any device 3 on the acquisition date of January 11, 2024, and therefore numerical information indicating "0" is stored. In this way, numerical information indicating "0" is stored in the code information table T in association with the code information 61 and the date (acquisition date) on which the code information 61 or the predetermined information 6 including the code information 61 was not acquired from any device 3.

[0041] 4, the code information 61 "a3be511ebfe3376c8b55730851e9c4177441d6172c7e0cec6fdad2039dbe3856" was acquired from two devices 3 on the acquisition date of January 31, 2024, and therefore, numerical information indicating "2" is stored. In this manner, numerical information indicating "N" is stored in the code information table T in association with the code information 61 and the date (acquisition date) on which the code information 61 or the predetermined information 6 including the code information 61 was acquired from "N" devices 3 (N is an integer equal to or greater than 0).

[0042] Similarly, the code information 61 "ef6df43919375db91ba3c0e66eeb37a9bdbdac31785ac7032da355f42e0ba916" was acquired from 5656 devices 3 on the acquisition date of February 6, 2024, and therefore numerical information indicating "5656" is stored. Furthermore, the code information 61 "23e01f5b43994ab0980373c1c12a18d072e6396a4aa44cfc2978bc7db58a7270" was acquired from 22 devices 3 on the acquisition date of February 2, 2024, and therefore numerical information indicating "22" is stored.

[0043] (Determination process) 5(a) is a diagram showing an example of an operation flow of the determination process. This operation flow is executed mainly by the processing unit 25 in cooperation with each element of the information processing device 2, based on a control program stored in advance in the storage unit 22.

[0044] First, the transmitting / receiving unit 251 of the information processing device 2 receives, via the communication unit 21, predetermined information 6 transmitted via the Internet 5 from multiple devices 3 on which a specific application is installed (S101). For example, the transmitting / receiving unit 251 receives, from the Internet 5, a uniform resource locator (URL) of the predetermined information 6 provided by a known IoT device search engine or crawl service, and receives the predetermined information 6 identified by the URL. Alternatively, if the transmitting / receiving unit 251 has a crawler function, it may crawl multiple devices 3 connected to the Internet 5 to acquire the predetermined information 6. Next, the storage processing unit 252 of the information processing device 2 stores the received predetermined information 6 in the storage unit 22.

[0045] Next, the acquisition unit 253 of the information processing device 2 acquires the code information 61 included in the predetermined information 6 received by the transmission / reception unit 251. For example, the acquisition unit 253 acquires information represented by a character string corresponding to predetermined tag information as the code information 61. Next, the storage processing unit 252 of the information processing device 2 associates the code information 61 acquired by the acquisition unit 253 with the acquisition date indicating the current day and stores them in the storage unit 22 (S102).

[0046] Next, the calculation unit 254 of the information processing device 2 calculates the first total acquisition number of the same code information 61 for each acquisition date (S103). Then, the calculation unit 254 stores the first total acquisition number of each code information 61 calculated for each acquisition date in the code information table T in association with the acquisition date and each code information 61.

[0047] Then, the determination unit 255 of the information processing device 2 determines the vulnerability of the device 3 based on the first acquisition total number for each acquisition date stored in the code information table T (S104), and the determination process ends. Details of the vulnerability determination process will be described later.

[0048] (Vulnerability detection process) Fig. 5(b) is a diagram showing an example of an operational flow of vulnerability determination processing by the determination unit 255 of the information processing device 2. The vulnerability determination processing shown in Fig. 5(b) is executed in S104 of Fig. 5(a).

[0049] First, the judgment unit 255 judges whether the first total number of acquired code information 61 of each type acquired on the latest acquisition date is smaller than the first total number of acquired code information 61 of each type acquired in the past (S201).

[0050] If the first total acquisition count on the latest acquisition date is lower than the first total acquisition count on at least one of the past acquisition dates (S201-Yes), the determination unit 255 identifies the type of code information 61 for which the first total acquisition count is lower than in the past. Then, the determination unit 255 determines that the device 3 that transmitted the predetermined information 6 including the identified code information 61 has a vulnerable version of the specific application installed (S202), and the vulnerability determination process ends. Note that information for identifying the device 3 determined to have a vulnerable version of the specific application installed may be output as identification information for the vulnerable device 3.

[0051] If the first acquisition total count on the latest acquisition date is not decreased compared to the past first acquisition total count (S201-No), the determination unit 255 identifies the type of code information 61 whose first acquisition total count is not decreased compared to the past. Then, the determination unit 255 determines that the device 3 that transmitted the predetermined information 6 including the identified code information 61 has a vulnerability-free version of the specific application installed (S203), and the vulnerability determination process ends. Note that information for identifying the device 3 determined to have a vulnerability-free version of the specific application installed may be output as identification information for the device 3 without vulnerability.

[0052] In the processing procedure shown in Figure 5, it is possible to omit some of the steps constituting the processing procedure, add steps not explicitly stated as constituting the processing procedure, and / or change the order of the steps. Processing procedures in which such omissions, additions, or changes in order have been made to the processing procedure shown in Figure 5 are also included within the scope of the present invention as long as they do not deviate from the spirit of the present invention. In each information processing other than the processing procedures described above, it is possible to omit some of the steps constituting the information processing, add steps not explicitly stated as constituting the information processing, and / or change the order of the steps constituting the information processing. Information processing in which such omissions, additions, or changes in order have been made is also included within the scope of the present invention as long as they do not deviate from the spirit of the present invention.

[0053] As described above in detail, the information processing device 2 of this embodiment enables the operator of a device 3 connected to the Internet 5 to determine the vulnerability of the device 3 based on the specified information 6 transmitted from the device 3 without having to install a new system.

[0054] (Variation 1) The present invention is not limited to the present embodiment. For example, in S201 of the vulnerability determination process, the first total number of acquired code information 61 acquired on the latest acquisition date may be compared with the first total number of acquired code information 61 acquired on the immediately preceding acquisition date.

[0055] Furthermore, in S201 of the vulnerability determination process, if the first total acquisition count of the code information 61 acquired on the latest acquisition date is the same as the first total acquisition count of the code information 61 acquired on the immediately preceding acquisition date, it may be determined that there is a vulnerability in S202. That is, if the first total acquisition count on the latest acquisition date is higher than the previous first total acquisition count, the determination unit 255 identifies the type of code information 61 with the higher first total acquisition count. Then, the determination unit 255 determines that the device 3 that transmitted the specified information 6 including the identified code information 61 has a non-vulnerable version of the specific application installed. Furthermore, if the first total acquisition count on the latest acquisition date is not higher than the previous first total acquisition count, the determination unit 255 identifies the type of code information 61 with the lower first total acquisition count. Then, the determination unit 255 determines that the device 3 that transmitted the specified information 6 including the identified code information 61 has a vulnerable version of the specific application installed.

[0056] Furthermore, in S201 of the vulnerability determination process, the determination unit 255 may employ two types of determination conditions. For example, the two types of determination conditions are a first condition that the first acquisition total number on the latest acquisition date is smaller than the first acquisition total number on at least one of the past acquisition dates, and a second condition that the first acquisition total number on the latest acquisition date is the same as the first acquisition total number on the immediately preceding acquisition date.

[0057] For example, the determination unit 255 may determine in S202 that there is a vulnerability when either the first condition or the second condition is satisfied. Furthermore, for example, the determination unit 255 may determine in S202 that there is a vulnerability when the first condition is satisfied, and may determine in S202 that there is a vulnerability when the second condition is satisfied even if the first condition is not satisfied.

[0058] In this way, by changing the determination criteria of the determining unit 255 of the information processing device 2 so as to match the actual application status of the patch program, it is possible to realize highly accurate vulnerability determination.

[0059] (Variation 2) Furthermore, the acquisition unit 253 of the information processing device 2 may automatically determine the code information 61 included in the predetermined information 6. For example, the acquisition unit 253 stores character string information corresponding to one or more types of tags included in the predetermined information 6 in the storage unit 22 as candidate information. Next, the acquisition unit 253 calculates the total number of acquisitions of the same candidate information for each acquisition date as the second acquisition total number. Then, the acquisition unit 253 automatically determines, as code information 61, the candidate information for which the second acquisition total number is increasing or decreasing as the acquisition date passes.

[0060] In this way, the information processing device 2 is configured to automatically determine the code information 61, and thus can determine the vulnerability of the corresponding specific application even for unknown predetermined information 6.

[0061] In the above description of the embodiments, the "total number of patents acquired" is described as a "first" total number acquired and a "second" total number acquired, but these terms "first" and "second" do not indicate an order. The "first" total number acquired described in the description of the embodiments may be referred to by other names in the claims (e.g., a "second" total number acquired, a "second" number acquired, a "second" number, etc.). Similarly, the "second" total number acquired described in the description of the embodiments may be referred to by other names in the claims (e.g., a "first" total number acquired, a "first" number acquired, a "first" number, etc.). Thus, the "first" total number acquired described in the claims should not be interpreted as being limited to the "first" total number acquired in the description of the embodiments, but should be understood by reasonably interpreting the claims, the specification, and the drawings. Similarly, the "second" total number acquired described in the claims should not be interpreted as being limited to the "second" total number acquired in the description of the embodiments, but should be understood by reasonably interpreting the claims, the specification, and the drawings.

[0062] Similarly, the terms "first," "second," "third," etc. described elsewhere in the claims do not indicate an order. The term "first" described in the embodiments may be referred to by other names (e.g., "second," "third," etc.) in the claims. The term "second" described in the embodiments may be referred to by other names (e.g., "first," "third," etc.) in the claims. The terms "third," "fourth," etc. described in the embodiments may also be referred to by other names in the claims.

[0063] Although the present embodiment and its modifications have been described in detail above, the present invention is not limited to the specific embodiment, and various changes, substitutions, and modifications can be made to the present invention without departing from the scope of the present invention. [Explanation of symbols]

[0064] 1. Information Network System 2. Information processing equipment 21 Communications Department 22 Memory section 23 Display section 24 Input section 25 Processing section 251 Transmitter / Receiver 252 Memory Processing Unit 253 Acquisition Department 254 Calculation Unit 255 Judgment section 3(3a, 3b, 3c,...) equipment 4 External device 5. Internet 6. Prescribed Information 61 Code information

Claims

1. An information processing device for determining vulnerabilities of devices connected to the Internet, the information processing device comprising: an acquisition unit that acquires coded information included in predetermined information transmitted from the plurality of devices on which a specific application is installed; a storage processing unit that stores each of the acquired code information and an acquisition date of the code information in the storage unit in association with each other; a calculation unit that calculates a first total number of acquired pieces of the same code information for each acquisition date; a determination unit that determines vulnerability of the device based on the first total number of acquisitions for each acquisition date; An information processing device comprising:

2. The determination unit If there are a plurality of types of the same code information, it is determined whether the first total number of acquired code information of each type acquired on the latest acquisition date is smaller than the first total number of acquired code information of each type acquired in the past; The information processing apparatus according to claim 1 , wherein the device that has transmitted the predetermined information including the coded information of a type for which the first total number of acquisitions has not decreased is determined to be the device that is not vulnerable.

3. The determination unit If there are a plurality of types of the same code information, it is determined whether the first total number of acquired code information of each type acquired on the latest acquisition date is greater than the first total number of acquired code information of each type acquired in the past; The information processing apparatus according to claim 1 , wherein the device that has transmitted the predetermined information including the coded information of a type for which the first total number of acquisitions is increasing is determined to be the device that is not vulnerable.

4. 4. The information processing device according to claim 1, wherein the predetermined information is information for displaying a screen for logging in to the device via the Internet.

5. 4. The information processing device according to claim 1, wherein the predetermined information is response information transmitted from the device in response to access to the device via the Internet.

6. the predetermined information is information written in a markup language, The acquisition unit storing character string information corresponding to one or more types of tags included in the predetermined information as candidate information in the storage unit; calculating a second total number of acquisitions of the same candidate information for each acquisition date; 4. The information processing apparatus according to claim 1, wherein the candidate information for which the second total number of acquisitions increases or decreases as the acquisition date elapses is set as the coded information.

7. A control program for an information processing device, comprising: a storage unit; and determining vulnerability of a device connected to the Internet, The information processing device includes: Acquires coded information included in predetermined information transmitted from a plurality of devices on which a specific application is installed; storing each piece of acquired code information in the storage unit in association with the acquisition date of each piece of code information; Calculating a first total number of acquisitions of the same code information for each acquisition date; determining the vulnerability of the device based on the first total number of acquisitions for each acquisition date; A control program for executing the above.

8. A control method for an information processing device that includes a storage unit and that determines vulnerabilities of devices connected to the Internet, the method comprising: The information processing device, Acquires coded information included in predetermined information transmitted from a plurality of devices on which a specific application is installed; storing each piece of acquired code information in the storage unit in association with the acquisition date of each piece of code information; Calculating a first total number of acquisitions of the same code information for each acquisition date; determining the vulnerability of the device based on the first total number of acquisitions for each acquisition date; A control method comprising:

Images