Component identifier estimation system and component identifier estimation method

Abstract

Estimate component identifiers with high accuracy. [Solution] The system stores component metadata, false CID information where a code indicating whether or not a false identifier is associated with each identifier, identifier information, and mismatched component information. Based on the metadata, a large number of identifiers are estimated as first identifier candidates. Based on the false identifier information, identifiers with the false identifier code attached are excluded from the first identifier candidates, and the remaining second identifier candidates are queried against a software dictionary that stores a large number of identifiers. Among the second identifier candidates, pairs of identifiers that exist in the software dictionary and the metadata that became the source of the identifier estimation are recorded in the identifier information, and pairs of identifiers that do not exist in the software dictionary and the metadata that became the source of the identifier estimation are recorded in the mismatched component information.

Description

[Technical Field]

[0001] The present invention relates to a component identifier estimation system and a component identifier estimation method. [Background Art]

[0002] A component identifier (hereinafter may be referred to as "CID") is information for uniquely identifying software, hardware, and components that are constituent elements of these. Naming rules for CIDs are defined by, for example, CPE (Common Platform Enumeration) and Purl (package URL), and such CIDs are accumulated in software dictionaries such as the Official Common Platform Enumeration Dictionary (hereinafter may be referred to as "SW dictionary") and are open to the public.

[0003] CIDs are used for purposes such as having a user investigate license-related information for a component that the user intends to use, and are particularly often used to investigate vulnerabilities. Information on component vulnerabilities is managed in databases such as, for example, NVD (National Vulnerability Database). Vulnerability investigation using CIDs is performed, for example, according to the following procedure. First, a user who intends to investigate vulnerabilities for a certain component (hereinafter may be referred to as the "investigator") estimates the CID of the target component, and confirms whether the estimated CID actually exists using the SW dictionary. Then, the investigator queries the estimated CID to the vulnerability database to obtain information related to vulnerabilities. Note that the following Patent Document 1 describes a processing device that can accurately associate CPEs (corresponding to CIDs) assigned to vulnerability information with CPEs in a predefined CPE dictionary (corresponding to SW dictionaries). [Prior Art Documents] [Patent Documents]

[0004] [Patent Document 1] International Publication No. 2023 / 062692 [Overview of the project] [Problems that the invention aims to solve]

[0005] When a user, such as an investigator, estimates the CID of a component for the purpose of vulnerability investigation, the user first estimates the CID of the component under investigation, then queries the SW dictionary with the estimated CID. If the same CID exists, the estimated CID is determined to be "true," and if it does not exist, it is determined to be "false."

[0006] However, the above method for determining truth or falsity has a first problem: even for the same component, if the estimated CID does not match the CID registered in the SW dictionary due to variations in notation, the estimated CID will be judged as "false." Furthermore, there is a second problem: the CID of a component different from the one being investigated may coincidentally match the estimated CID, leading to a judgment of "true" even though it should be "false." In other words, the naming convention for CIDs does not necessarily guarantee a unique identifier, and even if a CID is estimated according to the naming convention, it may differ from the one recorded in the SW dictionary.

[0007] The processing device described in Patent Document 1 calculates a score for associating a first CPE assigned to vulnerability information with a second CPE in a predefined CPE dictionary, based on at least one of the degree of word overlap and co-occurrence between the first and second CPEs, and the degree of similarity between the vulnerability associated with the first CPE and the vulnerability associated with the second CPE, thereby accurately associating the first and second CPEs. In other words, the processing device described in Patent Document 1 estimates a large number of CID candidates from the CID described in the CPE assigned to publicly available vulnerability information using fuzzy processing, and queries the estimated CIDs against the SW dictionary, thereby preventing a judgment result that should actually be "true" from being judged as "false".

[0008] Thus, the first problem may be solvable by estimating the CID through fuzzy processing. On the other hand, while estimating the CID through fuzzy processing is more likely to solve the first problem as the number of candidate CIDs to estimate increases, it also increases the likelihood that one of the candidate CIDs will match the CID of a component not under investigation, thus making the second problem more likely to occur. In this way, there is a trade-off between the means to solve the first problem and the occurrence of the second problem, making it difficult to solve both the first and second problems simultaneously.

[0009] Therefore, the present invention aims to provide a component identifier estimation system and a component identifier estimation method that can estimate the identifiers of components under investigation with higher accuracy. [Means for solving the problem]

[0010] One of the present inventions for achieving the above objective is: It is configured using an information processing device that includes a processor and a storage device, The system stores metadata of the component being investigated for its identifier, false identifier information where each identifier is associated with a code indicating whether it is a false identifier or not, identifier information where the identifier and metadata are associated for each component, and mismatched component information. Based on the metadata of the component under investigation, a number of identifiers are estimated as candidates for the first identifier. Based on the aforementioned false identifier information, identifiers with the false identifier code attached are excluded from the first identifier candidate, and the remaining identifiers are used as the second identifier candidate. This second identifier candidate is then queried against a software dictionary containing identifiers for numerous components. In the second candidate identifier, the identifier present in the software dictionary and the metadata that is the estimated origin of the identifier are recorded in the identifier information. In the second candidate identifier, a pair of an identifier that does not exist in the software dictionary and the metadata that is the estimated origin of that identifier is recorded in the mismatch component information. This is a component identifier estimation system.

[0011] Further issues disclosed in this application, and methods for solving them, will be made clear in the section on embodiments for carrying out the invention and in the drawings. [Effects of the Invention]

[0012] According to the present invention, the target region can be efficiently extracted from the captured image. [Brief explanation of the drawing]

[0013] [Figure 1] This figure shows an example of an information processing device used to implement a component identifier (CID) estimation system. [Figure 2] This diagram shows the functionality of the component identifier (CID) estimation system. [Figure 3] This figure shows an example of a metadata list. [Figure 4]It is a flowchart for explaining information processing by a CID estimation unit that constitutes a CID estimation system. [Figure 5] It is a diagram showing an example of fake CID information. [Figure 6] It is a diagram showing an example of CID information. [Figure 7] It is a diagram showing an example of UMC information. [Figure 8] It is a flowchart for explaining information processing by a fake CID detection unit that constitutes a CID estimation system. [Figure 9] It is a diagram showing an example of authority level information. [Figure 10] It is a diagram showing an example of classification information. [Figure 11] It is a flowchart for explaining information processing by a re-determination unit that constitutes a CID estimation system. MODE FOR CARRYING OUT THE INVENTION

[0014] Hereinafter, embodiments will be described with reference to the drawings. In the following description, the same or similar configurations may be denoted by the same reference numerals, and duplicate descriptions may be omitted. ===Embodiment=== <Configuration of Component Identifier Estimation System> A component identifier estimation system (hereinafter may be referred to as "CID estimation system 10") according to an embodiment is implemented using, for example, a single information processing apparatus such as a smartphone, a tablet, or a personal computer (desktop type or notebook type), or a virtual information processing apparatus such as a cloud server provided by a cloud system.

[0015] FIG. 1 is a diagram showing an example of an information processing apparatus 1 used for implementing the CID estimation system 10 according to the embodiment. As shown in FIG. 1, the information processing apparatus 1 includes a processor 2, a main storage device 3, an auxiliary storage device 4, an input device 5, an output device 6, and a communication device 7 as a hardware configuration.

[0016] Processor 2 includes, for example, a CPU (Central Processing Unit), MPU (Micro Processing Unit), GPU (Graphics Processing Unit), AI (Artificial Intelligence) chip, FPGA (Field Programmable Gate Array), SoC (System on Chip), ASIC (Application Specific Integrated Circuit), etc., while main memory 3 consists of ROM (Read Only Memory), RAM (Random Access Memory), non-volatile memory (NVRAM (Non-Volatile RAM)), etc.

[0017] The auxiliary storage device 4 is a device for storing programs and data, and may be, for example, an SSD (Solid State Drive), a hard disk drive, an optical storage medium (CD (Compact Disc), DVD (Digital Versatile Disc), etc.), an IC card, or an SD card. It may also be a virtual storage area provided by the cloud.

[0018] Input device 5 is a user interface that accepts user input or data input from an external source, and is, for example, a keyboard, mouse, touch panel, card reader, or voice input device (e.g., microphone).

[0019] Output device 6 is a user interface that outputs various information such as the progress and results of data processing in the CID estimation system 10. For example, it may be a display device that outputs various information as images, an audio output device that outputs it as sound, or a printing device that prints it on paper.

[0020] The communication device 7 is a device that communicates with an external device wirelessly or via a wired connection, and is a wireless or wired communication module (wireless communication module, network adapter, USB module, etc.).

[0021] Figure 2 shows the functions of a CID estimation system 10 according to one embodiment. In Figure 2, the control unit 11 is a function composed of a processor 2 and a main memory 3, and the storage unit 12 is a function composed of an auxiliary memory 4. The input unit 13, output unit 14, and communication unit 15 are the functions of an input device 5, an output device 6, and a communication device 7, respectively. The CID estimation system 10 is configured to communicate with the SW dictionary server 20 and the vulnerability detection server 30. The SW dictionary server 20 and the vulnerability detection server 30 are publicly accessible external database servers, and data communication between these database servers (20, 30) and the CID estimation system 10 is performed via a wired or wireless communication network such as the Internet, LAN (Local Area Network), WAN (Wide Area Network), or dedicated line.

[0022] The control unit 11 executes the operating system (OS) and various programs read from the storage unit 12, processes various information stored in the storage unit 12, and communicates data with the SW dictionary server 20 and the vulnerability detection server 30 via the communication unit 15, thereby realizing various functions. The control unit 11 includes a CID estimation unit 11a, an ambiguous estimation unit 11b, a false CID exclusion unit 11c, a false CID detection unit 11d, and a re-determination unit 11e, as configurations for realizing each of the various functions (hereinafter sometimes referred to as "functional configuration").

[0023] Furthermore, all or part of each functional configuration (11a to 11e) realized by the control unit 11 may be realized using virtual information processing resources provided using virtualization technology, process space isolation technology, etc., such as a virtual server provided by a cloud system, or by services provided by the cloud system via an API (Application Programming Interface), etc.

[0024] The memory unit 12 stores the operating system (OS) and programs executed by the control unit 11 to realize the above-described functional configurations, as well as data generated or referenced by the above-described functional configurations. In this embodiment, it stores the metadata list 12a, ambiguous estimation information 12b, false CID information 12c, CID information 12d, unmatched component information 12e (hereinafter sometimes referred to as "UMC information 12e"), authority level information 12f, and classification information 12g. The details of the information processing by each functional configuration (11a to 11e) provided by the CID estimation system 10, and the details of each piece of information (12a to 12g) stored in the memory unit 12 will be described later. <Database Server> As described above, the CID estimation system 10 communicates with an external database server, the SW dictionary server 20, and the vulnerability detection server 30. The SW dictionary server 20 contains the SW dictionary 21, which is a database where CIDs assigned to components are stored. The SW dictionary server 20 receives a CID input from the CID estimation system 10, searches the SW dictionary 21, and outputs a result to the CID estimation system 10 indicating "exists" if a CID that exactly matches the input CID exists, or "does not exist" otherwise. When the administrator of the SW dictionary 21 recognizes that a new component has been released, they name that component with a CID and add that CID to the SW dictionary. In this way, the SW dictionary is updated sequentially.

[0025] The vulnerability detection server 30 includes a database (hereinafter sometimes referred to as the "Vulnerability Information DB31") that stores information linking the CID of a component with information about vulnerabilities found in that component (hereinafter sometimes referred to as "Vulnerability Information"). When the vulnerability detection server 30 receives a CID from the CID estimation system 10, it queries the Vulnerability Information DB31 for that CID, and if there is vulnerability information corresponding to that CID, it outputs that vulnerability information to the CID estimation system 10. Vulnerability information includes, for example, the title, description, and classification of the vulnerability. In the Vulnerability Information DB31, vulnerabilities are classified based on, for example, the well-known CWE (Common Weakness Enumeration). <Regarding the first and second challenges> The CID estimation system 10 is an information processing device or computer system operated by users such as researchers (hereinafter sometimes referred to as "users"), which accurately estimates CID and solves both the first and second problems described above.

[0026] To give a concrete example of the first problem, even if the component that the user is investigating is recorded in the SW dictionary 21 as "cpe: / o:redhat:enterprise_linux:4" according to the naming convention based on CPE, the user might estimate the CID of the component under investigation to be "cpe: / o:redhat:enterprise_linux:4.0" and send this estimated CID to the SW dictionary server 20, which will then determine that the component "does not exist". Therefore, if vulnerability information for "cpe: / o:redhat:enterprise_linux:4" exists in the vulnerability information DB 31, the user will be unable to obtain the necessary vulnerability information.

[0027] As a specific example of the second problem, although the CID of JBoss Enterprise Application 7, the component to be investigated, is recorded in the SW dictionary 21 as "cpe: / a:redhat:jboss_enterprise_application_platform:7", the user estimates its CID as "cpe: / o:redhat:enterprise_linux:7", which results in obtaining vulnerabilities of "cpe: / o:redhat:enterprise_linux:7" that differ from the component to be investigated. Possible causes of the second problem include, in addition to the CID estimation by the aforementioned fuzzy processing, for example, a case where the AI that estimates the CID of a component from the component's metadata mainly uses a model trained with OS CIDs.

[0028] In the following description, when the original CID of the component to be investigated is estimated as an incorrect CID due to the second problem, and a CID matching the incorrect CID exists in the SW dictionary 21, this incorrectly estimated CID is referred to as a "fake CID". <CID estimation processing> The CID estimation system 10 of the present embodiment is used, for example, by a user in charge of a system in an enterprise or the like for the purpose of investigating vulnerabilities included in the system composed of hardware and programs that the user is responsible for. In the CID estimation system 10 according to the present embodiment, the CID estimation unit 11a cooperates with the fuzzy estimation unit 11b and the fake CID exclusion unit 11c to accurately estimate the CID of a component that is the target of information investigation based on the metadata of the component.

[0029] In general, the CID estimation unit 11a reads metadata from a metadata list that lists metadata for the components under investigation and estimates a CID candidate containing multiple CIDs (hereinafter sometimes referred to as the "first CID candidate"). Then, the false CID exclusion unit 11c excludes false CIDs from the first CID candidate by referring to the false CID information 12c. The CID estimation unit 11a outputs CID information 12c that associates the CIDs that remain after the false CIDs have been excluded from the first CID candidate (hereinafter sometimes referred to as the "second CID candidate") with the metadata used to estimate those CIDs, based on the CIDs that exist in the SW dictionary 21.

[0030] Figure 2 shows an example of a metadata list 12a. In the example shown in Figure 2, metadata list 12a is a list that associates the information necessary for estimating the CID contained in the metadata with each of the multiple components under investigation, in numerical order. As shown in Figure 2, each component is associated with data such as component type (part), manufacturer (vendor), name, version, update (edition), and language (lang) as information necessary for estimating the CID. This data is written so that the CID can be estimated in a format that conforms to the CPE. For example, the value of component type (part) is "h" for hardware, "a" for an application, and "o" for an OS.

[0031] The metadata list 12a is prepared in advance by the user of the CID estimation system 10 and stored in the storage unit 12. The metadata list 12a may be manually created by the user using spreadsheet software or the like and stored in the storage unit 12, or it may be automatically created and stored. To automatically create the metadata list 12a, for example, a tool can be used to obtain metadata for each component from a system (OS, application, etc.) composed of components that are to be targeted for vulnerability detection. Then, the necessary information for the metadata list 12a can be further obtained from the metadata obtained by that tool and the metadata list 12a can be created in an appropriate format (for example, CSV format). In the following, each component in the metadata list 12a will be referred to as an "estimation element".

[0032] Figure 3 is a flowchart illustrating the information processing performed by the CID estimation unit 11a. When the user instructs the CID estimation system 10 to perform information processing by the CID estimation unit 11a via the input unit, the information processing by the CID estimation unit 11a begins (s1), and the CID estimation unit 11a reads the metadata list 12a (s2). Next, the CID estimation unit 11a obtains the metadata of the first estimation element in the metadata list 12a and performs the following processing (s2~s12: hereinafter sometimes referred to as "CID estimation processing") for the CID of that estimation element. Once the CID has been estimated for one estimation element, the CID is estimated for the next estimation element in the metadata list 12a. This CID estimation processing is repeated until all estimation elements in the metadata list 12a have been completed (s2~s12).

[0033] In the above iterative process (s2~s12), first, the CID estimation unit 11a inputs the acquired metadata to the ambiguous estimation unit 11b, causing the ambiguous estimation unit 11b to estimate a first CID candidate (s3). As a method for estimating the first CID candidate by the ambiguous estimation unit 11b, for example, an artificial intelligence model can be used that has been trained to learn pairs of metadata of estimation elements and CIDs recorded in the SW dictionary 21, and is configured to estimate CIDs for given metadata. In the ambiguous estimation information 12b, such an artificial intelligence model is defined as a rule for estimating a first CID candidate based on metadata.

[0034] Furthermore, the artificial intelligence model pre-configured to issue instructions for estimating CID for given metadata may, for example, be one that "increases the temperature parameter of the artificial intelligence in increments of 0.1 in the range of 0 to 1, and estimates the CID for each temperature." The technology described in Patent Document 1 above can also be used. In any case, the method of estimating CID candidates by the ambiguous estimation unit 11b is not particularly limited. The rule defined by the ambiguous estimation information 12b may be any rule that is defined to estimate multiple CIDs as first CID candidates for a single piece of metadata.

[0035] If the ambiguous estimation unit 11b has estimated a first CID candidate, the CID estimation unit 11a instructs the false CID exclusion unit 11c to execute a false CID exclusion process (s4) to exclude false CIDs from the first CID candidate estimated by the ambiguous estimation unit 11b. The false CID exclusion unit 11c refers to the false CID information 12c to determine whether each CID included in the first CID candidate is a false CID and outputs a second CID candidate.

[0036] Figure 4 shows an example of false CID information 12c. As shown in Figure 4, false CID information 12c includes at least CID, metadata, and false CID flag data. The CID included in false CID information 12c is a CID that exists in the SW dictionary 21 among the CIDs included in the second CID candidate. The metadata is the metadata from which the CID was estimated. The false CID flag is either "True" or "False," and is initially set to "False." The CID estimation unit 11a recognizes that the CID estimated from the metadata from which the estimation originated is correct if the false CID flag in the false CID information is "False," and recognizes that the CID estimated from that metadata is incorrect if it is "True." In other words, in false CID information 12c, a CID associated with a "True" false CID flag is a false CID that is registered in the SW dictionary 21 but matches a component different from the component being investigated.

[0037] Furthermore, in this embodiment, the false CID information 12c includes the estimation count and the sum of the user privilege levels. The estimation count is the number of times the same CID has been estimated from the same metadata, and the sum of the reporter's privilege levels is the cumulative value of the user levels that have reported that the notified vulnerability does not relate to the component under investigation. This false CID information 12c is shared among the users of the CID estimation system 10. The false CID detection unit 11d is a functional configuration in the CID estimation system 10 that sets the false CID flag in the false CID information 12c from its initial value of "False" to "True". The estimation count, user levels, and the operation of the false CID detection unit 11d in the false CID information 12c will be described later. Returning to Figure 3, in the false CID exclusion process (s4), each CID included in the first CID candidate is compared with the CID recorded in the false CID information 12c, and the metadata used to estimate the CID candidate is compared with the metadata recorded in the false CID information. If an element with a perfect match exists, the false CID flag recorded in the false CID information 12c is referenced, and if it is "True", that CID is excluded from the first CID candidate. This operation is repeated for all CIDs included in the second CID candidate, and all CIDs that remain without being excluded are determined to be the second CID candidate to be passed on to subsequent processing.

[0038] Next, the CID estimation unit 11a sends the CIDs included in the second CID candidate to the SW dictionary server 20 (s5), and obtains a determination result from the SW dictionary server 20 indicating whether the CID "exists" or "does not exist". If the SW dictionary server 20 returns a determination result of "exists" (s6: YES), the CID estimation unit 11a records the CIDs from the second CID candidate that were determined to "exist" and the metadata used to estimate that CID in the false CID information 12c. At this time, if the same CID already exists in the false CID information, 1 is added to the estimation count of that CID (s8→s9), and if it does not exist, it is recorded in the false CID information as a new CID and the estimation count is set to 1 (s8→s10). Furthermore, the CID estimation unit 11a records in the CID information 12d the CIDs that were determined to "exist" among the second CID candidates sent to the SW dictionary server 20, along with the metadata used to estimate those CIDs.

[0039] Figure 5 shows an example of CID information 12d. As shown in Figure 5, CID information 12d is information that associates each of multiple components with a CID that was determined to "exist" in the SW dictionary mentioned above, and the metadata that was the estimated origin of this CID. Note that the metadata in CID information 12d is the same as the metadata associated with each component in metadata list 12a.

[0040] On the other hand, if the SW dictionary server 20 returns a result indicating that the CID does not exist (s5:NO), the CID estimation unit 11a adds the metadata used to estimate the CID to the UMC information 12e (s7). An example of UMC information 12e is shown in Figure 6. As shown in Figure 6, the UMC information 12e has information associated with each piece of metadata that allows the CID to be identified in CPE format, similar to the metadata list 12a shown in Figure 2.

[0041] In this way, the CID estimation process (s2~s12) is performed for one estimation element in the metadata list 12a. Then, the CID estimation unit 11a performs the CID estimation process for the next estimation element in the metadata list 12b, and when the CID estimation process for the last estimation element in the metadata list 12c is completed, the CID estimation process is terminated (s13).

[0042] Thus, the CID estimation system according to this embodiment estimates more CIDs for the components under investigation through fuzzy estimation. This solves the first problem. Furthermore, the CID estimation system excludes false CIDs from the first CID candidates obtained through fuzzy estimation in order to suppress the possibility that the estimated CID of a component other than the component under investigation may match the estimated CID. In other words, the CID estimation system according to this embodiment can solve both the first and second problems. <Detection of fake CIDs> As described above, in order to exclude false CIDs from the first CID candidates obtained by ambiguous estimation, it is necessary to check whether the CID determined to exist in the SW dictionary 21 during the above CID estimation process is a false CID. The CID estimation system 10 according to the embodiment includes a false CID detection unit 11d that detects false CIDs from the CIDs recorded in the CID information 12d. The false CID detection unit 11d detects false CIDs from the CIDs recorded in the CID information 12d and executes a false CID detection process that changes the false CID determination flag for that CID in the false CID information from the initial value "False" to "True".

[0043] Figure 7 shows a flowchart illustrating the information processing by the fake CID detection unit 11d. As shown in Figure 7, the fake CID detection unit 11d is activated when a user inputs an instruction to execute the fake CID detection process along with their user information through the input unit 13 of the CID estimation system 10 (s21). The fake CID detection unit 11d then first refers to the authority level information 12f and obtains the authority level of the user who input the instruction to execute the fake CID detection process (s22).

[0044] Figure 8 shows an example of permission level information 12f. Permission level information 12f is, for example, information that associates permission levels with user information. User information includes the user's email address, a username arbitrarily set by the user, and an employee ID assigned to an employee of a company operating the CID estimation system. In any case, user information only needs to be able to uniquely identify a user of the CID estimation system 10. Alternatively, information combining an email address, username, or employee ID with a password may also be used as user information.

[0045] The permission level included in permission level information 12f is, for example, a value indicating the user's proficiency level, and is a value that is pre-set for each user. The permission level can be set according to the user's job title, for example. For example, in a company, a general employee might have a value of "1," and a security administrator might have a value of "2." Of course, instead of setting permission levels according to job title, the same permission level value could be set uniformly when user information is first registered in permission level information 12f, and then, if a user performs a fake CID detection process and the CID investigated is actually a fake CID, the user's permission level could be increased by 0.1, and the permission level could be updated as needed based on the history of reporting fake CIDs. In any case, it is sufficient that an permission level is set for each user, and the value of the permission level for each user's information can be set as appropriate.

[0046] Returning to Figure 7, the fake CID detection unit 11d selects the component to which vulnerability information should be distributed to users from the CID information shown in Figure 4. The component selected by the fake CID detection unit 11d may be, for example, a CID registered in the CID information 12d by the user who input the instruction for the fake CID detection process. In such cases, when the user instructs the execution of the CID estimation process, they should also input their own user information, and when the user adds a CID to the CID information, the user information should be associated with the added CID. Alternatively, it may be possible to set which users should receive information for each CID information 12d.

[0047] The fake CID detection unit 11d selects one pair from the CID information 12d consisting of the CID of the component to be distributed and the metadata from which the CID was estimated to originate (hereinafter sometimes referred to as the "detection target element"), and performs the following information processing (s24~s40: hereinafter sometimes referred to as the "fake CID detection process") for this detection target element. The same fake CID detection process is repeated until the processing for the last detection target element is completed (s24~s40).

[0048] In the fake CID detection process, the fake CID detection unit 11d first sends the CID of the selected target element to the vulnerability detection server 30 (s25). If the vulnerability detection server 30 replies that no vulnerability information regarding the component identified by the sent CID does not exist in the vulnerability information DB 31, the unit selects the next target element and starts the fake CID detection process from the beginning (s26 → s24 ~ s40).

[0049] If vulnerability information regarding the component of the transmitted CID exists in the vulnerability information DB31 (s26:YES), the fake CID detection unit 11d retrieves the vulnerability information returned from the vulnerability detection server 30 and calculates the similarity between the vulnerability description contained in the vulnerability information and the metadata of the detected element (s27). The method for calculating the similarity is not particularly limited, but for example, the calculated similarity can be the cosine similarity or Dice coefficient between the description and the metadata, or the number of words in the description that are included in the metadata. If the similarity is to be the number of words included in the metadata, the default value can be set to "1", etc.

[0050] Next, the fake CID detection unit 11d compares the calculated similarity with a pre-set default value. If the similarity is lower than the default value, it sets the fake CID flag associated with the CID sent to the vulnerability detection server 30 to "True" in the fake CID information 12c (s28→s37). On the other hand, if the similarity is equal to or greater than the default value, it queries the classification information 12g for vulnerability information. Figure 9 shows an example of the classification information 12g. In this embodiment, the classification information 12g is stored in the memory unit in advance by the administrator of the CID estimation system 10, and includes the classification of vulnerabilities based on CWE, etc., and the correspondence with the component type (part).

[0051] Furthermore, in this embodiment, the vulnerability classification included in the classification information 12g is a code indicating the vulnerability classification based on CWE, and is also included in the vulnerability information transmitted from the vulnerability detection server 30. The component type is based on the CPE format, with "a" for applications, "o" for operating systems, and "h" for hardware. For example, if the vulnerability classification is CWE-79, the vulnerability is classified as "cross-site scripting," and this vulnerability can generally only be detected by applications. Therefore, in the classification information 12g, "a" is associated with the vulnerability classification CWE-79.

[0052] The fake CID detection unit 11d queries the classification information 12g mentioned above for the classification included in the vulnerability information sent from the vulnerability detection server 30, and identifies the type (let's call it Type A) associated with that classification. The fake CID detection unit 11d also identifies the type (let's call it Type B) included in the metadata of the detected element. The fake CID detection unit 11d then compares Type A and Type B (s29) to determine if they match. If they do not match, it sets the fake CID flag associated with the CID of the detected element sent to the vulnerability detection server 30 to "True" in the fake CID information 12c (s30→s37). If they match, it notifies the user of the vulnerability information via the output unit 14 (s30→s31). In other words, the fake CID detection unit 11d notifies the user that vulnerability information corresponding to the CID of the detected element exists in the vulnerability information DB 31, and prompts the user to determine whether or not there is a vulnerability in the component corresponding to the detected element in the CID information.

[0053] If the user determines that the notified vulnerability information is related to a component of the CID of the detected element that was previously sent to the vulnerability detection server, the user inputs this information into the CID estimation system via the input unit (s32: YES). Upon receiving this input, the false CID detection unit 11d executes the false CID detection process for the next detected element (s40 → s24).

[0054] On the other hand, if a user determines that the notified vulnerability information is not related to the component of the CID previously sent to the vulnerability detection server 30, and inputs this to the CID estimation system 10 via the input unit 13, the false CID detection unit 11d adds the user's authority level to the sum of authority levels associated with the CID of the detected element in the false CID information 12c (s32→s33).

[0055] Next, the fake CID detection unit 11d compares the estimated number of occurrences included in the fake CID information 12c with a predetermined number of occurrences (for example, 3 times). If the estimated number of occurrences is less than the predetermined number of occurrences, it terminates the fake CID detection process for the currently processed target element (s34→s40) and starts the fake CID detection process for the next CID (s24~s40). If the estimated number of occurrences is equal to or greater than the predetermined number of occurrences, it calculates the reporting level (s34→s35). The reporting level is not particularly limited, but for example, it can be calculated by dividing the sum of the authority levels associated with the CID of the currently processed target element in the fake CID information 12c by the estimated number of occurrences.

[0056] Furthermore, the false CID detection unit 11d compares the calculated reporting level with a pre-set threshold. The threshold value is not particularly limited, but if the reporting level is calculated by dividing the sum of the reporter's authority levels by the estimated number of times, then for example, the threshold can be set to 0.8. If the reporting level is below the threshold, the false CID detection process for the next target element is started (s36→s40→s24). If the reporting level is above the threshold (s36:NO), the false positive flag for the component corresponding to the currently processed target element in the false CID information is set to "True" (s37). The metadata of the component is also recorded in the UMC information (s38), the component is deleted from the CID information 12d, and the false CID detection process for the next target element is started (s39, s40→s24). Then, once the false CID detection unit 11d has finished the false CID detection process for all the elements to be detected in the CID information, it terminates its own information processing (s41).

[0057] As described above, in the embodiment of the CID estimation system 1, if the false CID detection unit 11d has vulnerability information corresponding to the CID of the detected element in the false CID detection process described above, it determines whether the CID in the SW dictionary 21 is a false CID belonging to a different component from the component from which the estimation originated, based on two determination processes (s28, s30): the similarity between the content of the vulnerability information and the metadata of the detected element, and the type of component.

[0058] Furthermore, if the two judgment processes described above (s28, s30) fail to identify a fake CID, the system prompts the user to confirm whether or not there is a connection to the vulnerability via notification, and allows the user to review the vulnerability information obtained from the vulnerability detection server 30. If the result of this review is not "connected," the system then determines whether or not the CID of the detected element is a fake CID based on two criteria: the number of times the same CID estimation process has been performed on the same detected element in the past, and the reporting level, which is based on the number of estimations and the user's level of proficiency.

[0059] Furthermore, the fake CID detection process may perform at least one of the two judgment processes described above, or it may detect fake CIDs using only the judgment criterion based on the estimated number of occurrences, which is one of the two judgment criteria based on the user's input of the verification results. It may also detect fake CIDs based solely on the user's input regarding the presence or absence of relevance.

[0060] However, the CID estimation system 1 according to the embodiment improves the accuracy of the false CID flag in the false CID information 12c by detecting false CIDs based on the results of judgments made using multiple judgment processes and multiple judgment criteria. In other words, the CID estimation system 10 can estimate the component's CID with extremely high accuracy by using the highly accurate false CID information 12c to estimate the component's CID. In any case, the judgment processes and judgment criteria should be appropriately selected considering the accuracy of CID estimation and the load and time required for information processing in the CID estimation system. <Re-evaluation process> There is a time lag between when a new component is released and when its CID is recorded in the SW dictionary 21. Therefore, due to this time lag, the CID of a component that actually exists may not be present in the SW dictionary 21 when the CID estimation process is executed, and that CID may be recorded in the UMC information 12e. To address this, the CID estimation system 10 according to this embodiment includes a re-determination unit 11e that periodically checks whether the CID recorded in the UMC information 12e actually exists.

[0061] Figure 10 shows a flowchart illustrating the information processing performed by the re-evaluation unit 11e. The re-evaluation unit 11e periodically starts its own information processing according to a schedule set in advance by the user (s51). For example, the schedule could be set to 12:00 a.m. every Sunday. Of course, it can also be set to a predetermined time on a predetermined day every other week, or a predetermined time every day, etc., as appropriate.

[0062] When the re-determination unit 11e performs information processing, it reads the UMC information 12e (s52). Then, it selects a pair of CID and metadata (hereinafter sometimes referred to as a "re-determination element") from the read UMC information 12e and performs a process (s53~s62: hereinafter sometimes referred to as a "re-determination process") to determine whether or not the CID of the re-determination element is recorded in the SW dictionary 21.

[0063] In the re-evaluation process, first, the above-mentioned ambiguous estimation process is performed based on the metadata of the selected re-evaluation element (S54), and then a false CID exclusion process is performed on the numerous CIDs estimated by the ambiguous estimation process (hereinafter sometimes referred to as "first CID candidate for re-evaluation") (S55). Next, the CIDs included in the identifier obtained by excluding false CIDs from the first CID candidate for re-evaluation (hereinafter sometimes referred to as "second CID candidate for re-evaluation") are sent to the SW dictionary server 20 (S56).

[0064] Next, the re-determination unit 11e performs a re-determination process (s57→s62→s53) for the next re-determination element in the UMC information for any CIDs among the second CID candidates for re-determination that are determined to "not exist" in the SW dictionary 21 from the SW dictionary server 20. On the other hand, for any CIDs among the second CID candidates for re-determination that are determined to "exist" in the SW dictionary 21 from the SW dictionary server 30, it checks whether a pair of CID and metadata corresponding to the re-determination element exists in the false CID information 12c, and if it does, it adds 1 to the estimated count associated with that pair (s58→s59). If the pair does not exist in the false CID information 12c, it adds it to the false CID information 12c as a new pair, sets the estimated count of that pair to 1 (s58→s60), and deletes the re-determination element currently being processed from the UMC information 12e (s61). Then, it selects the next re-determination element in the UMC information 12e. Once the re-evaluation process has been performed on all metadata in the UMC information 12e in this manner, the re-evaluation process is terminated (s62→s63).

[0065] ===Other Embodiments=== The CID estimation system 10 described above is one embodiment of the present invention and is an example used to clearly explain the present invention. Therefore, the technical scope of the present invention is not limited to the embodiments described above. That is, the concept of the present invention includes various modifications and applications of the above embodiments. It is also possible to replace parts of the configuration of the above embodiments with the configuration of other embodiments, or to add configurations from other embodiments to the configuration of one embodiment. Furthermore, it is possible to add, delete, or replace parts of the configuration of each embodiment with other configurations.

[0066] For example, in the fake CID detection process, depending on the user's proficiency, it may be unnecessary to compare the privilege level or estimated number of attempts with default values. The fake CID flag can simply be set to "True" when the user determines that it is not related.

[0067] The CID estimation system 10 can be used for various purposes of estimating the CID of components, not limited to vulnerability assessment.

[0068] The CID estimation system 10 may also have an SW dictionary 21 and a vulnerability information DB 31, for example, by periodically downloading CIDs and vulnerability information from the SW dictionary server 20 and the vulnerability detection server 30 to the storage unit 12. In any case, the CID estimation system 10 only needs to be configured to query the SW dictionary 21 and the vulnerability information DB 31 for CIDs and obtain query results and relevant information.

[0069] Each of the above configurations and functions may be implemented, in whole or in part, by hardware using integrated circuits, for example, or by software that executes programs to implement each configuration and function and processes predetermined data. [Explanation of symbols]

[0070] 1. Information processing unit, 2. Processor, 3. Main memory, 4. Auxiliary memory, 5 Input device, 6 Output device, 7 Communication device, 10 Component Identifier (CID) Estimation System, 11 Control Unit, 11a CID estimation unit, 11b Ambiguous estimation unit, 11c False CID exclusion unit, 11d False CID detection unit, 11e Re-determination unit, 12 Storage unit, 12a Meta information list, 12b Ambiguous estimation information, 12c False CID information, 12d CID information, 12e UMC (Mismatched Component) information, 12f Permission level information, 12g Classification information, 13 Input section, 14 Output section, 15 Communications Department, 20 Software (SW) Dictionary Server, 21 SW Dictionary, 30. Vulnerability detection server, 31. Vulnerability information database (DB)

Claims

1. It is configured using an information processing device that includes a processor and a storage device, The system stores metadata of the component being investigated for its identifier, false identifier information where each identifier is associated with a code indicating whether it is a false identifier or not, identifier information where the identifier and metadata are associated for each component, and mismatched component information. Based on the metadata of the component under investigation, a number of identifiers are estimated as candidates for the first identifier. Based on the aforementioned false identifier information, identifiers with the false identifier code attached are excluded from the first identifier candidate, and the remaining identifiers are designated as second identifier candidates. These second identifier candidates are then queried against a software dictionary containing identifiers for numerous components. In the second candidate identifier, the identifier present in the software dictionary and the metadata that served as the estimated origin of the identifier are recorded in the identifier information. In the second candidate identifier, a pair of an identifier that does not exist in the software dictionary and the metadata that is the estimated origin of the identifier is recorded in the mismatch component information. Component identifier estimation system.

2. The identifier included in the aforementioned identifier information is queried against a database storing vulnerability information, and if corresponding vulnerability information exists, the similarity between the vulnerability information and the metadata from which the identifier was estimated to originate is calculated. A determination process is performed to compare the aforementioned similarity with a predetermined value. If the similarity is less than a specified value as a result of the determination process, the identifier queried from the database is used as the false identifier in the false identifier information. The component identifier estimation system according to claim 1.

3. It stores classification information that associates vulnerability classifications with component types. The identifier included in the identifier information is queried against a database storing vulnerability information, and if the corresponding vulnerability information exists, a determination process is executed that compares the type A, which is associated with the classification included in the vulnerability information in the classification information, with the type B, which is included in the metadata associated with the identifier in the identifier information. If, as a result of the determination process, type A and type B do not match, the identifier queried from the database is used as the false identifier in the false identifier information. The component identifier estimation system according to claim 1.

4. In the aforementioned false identifier information, each estimated identifier is associated with an estimated number of occurrences. In the false identifier information, among the second identifier candidates queried from the software dictionary, 1 is added to the estimation count corresponding to an identifier that exists in the software dictionary. If the determination process fails to identify the identifier as a false identifier in the false identifier information, the vulnerability information is output to the user. When the user inputs that the vulnerability information is not related to the component corresponding to the identifier, the estimated number of times is compared with a predetermined number of times, and if the estimated number of times is equal to or greater than the predetermined number of times, the identifier queried from the database is used as the false identifier in the false identifier information. The component identifier estimation system according to claim 2 or 3.

5. User information that identifies a user is associated with an authority level, and the authority level information is stored. In the aforementioned false identifier information, each estimated identifier is associated with the sum of the estimated number of occurrences and the authority level. It receives user information and obtains the corresponding permission level. In the false identifier information, among the second identifier candidates queried from the software dictionary, 1 is added to the estimation count corresponding to an identifier that exists in the software dictionary. If the determination process fails to identify the identifier as a false identifier in the false identifier information, the vulnerability information is output to the user who entered the user information. When the user inputs that the vulnerability information is not related to the component corresponding to the identifier, the user's privilege level is added to the sum of privilege levels associated with the identifier in the false identifier information, and a reporting level is calculated based on the sum of privilege levels after the addition and the estimated number of occurrences. If the reporting level is above a predetermined threshold, the identifier queried from the database is used as the false identifier in the false identifier information. The component identifier estimation system according to claim 2 or 3.

6. Regularly, For each identifier included in the aforementioned mismatched component information, a number of identifiers are estimated as candidates for the first identifier for re-determination based on the corresponding metadata. Based on the false identifier information, the identifiers to which the false identifier code is attached are excluded from the first candidate identifier for re-evaluation, and the remaining identifiers are used as the second candidate identifier for re-evaluation. The second candidate identifier for re-evaluation is then queried against the software dictionary. In the aforementioned second identifier candidate for re-determination, the pair of an identifier present in the software dictionary and the metadata that served as the estimated origin of the identifier is deleted from the mismatch component information. The component identifier estimation system according to claim 1.

7. An information processing device comprising a processor and a storage device, The system stores metadata of the component being investigated for its identifier, false identifier information where each identifier is associated with a code indicating whether it is a false identifier or not, identifier information where the identifier and metadata are associated for each component, and mismatched component information. Based on the metadata of the component under investigation, a number of identifiers are estimated as candidates for the first identifier. Based on the aforementioned false identifier information, identifiers with the false identifier code attached are excluded from the first identifier candidate, and the remaining identifiers are designated as second identifier candidates. These second identifier candidates are then queried against a software dictionary that stores identifiers for a large number of components. In the second candidate identifier, the identifier present in the software dictionary and the metadata that served as the estimated origin of the identifier are recorded in the identifier information. In the second candidate identifier, a pair of an identifier that does not exist in the software dictionary and the metadata that is the estimated origin of the identifier is recorded in the mismatch component information. Component identifier estimation method.

Images