Vulnerability assessment device, vulnerability assessment method, and vulnerability assessment program

Abstract

A model generation device (1) for a vulnerability evaluation system acquires vulnerability data published from a database (10) and a published attack code and creates a calculation model for determining the probability of abuse, which indicates the probability of abuse of vulnerability according to an elapsed time from the time of publication of acquired vulnerability data, as a distribution of elapsed times from the time of publication of acquired vulnerability data to the time of publication of the attack code for abusing the vulnerability. A model evaluation device (2) for the vulnerability evaluation system receives the input of an elapsed time from the time of publication of vulnerability data to be evaluated, and determines the probability of abuse according to an inputted elapsed time on the basis of the calculation model created by the model generation device (1).

Description

[Technical field]

[0001] The present invention relates to a vulnerability assessment device, a vulnerability assessment method, and a vulnerability assessment program. [Background technology]

[0002] Security metrics are a set of evaluation measures aimed at quantifying and quantifying security. In order to implement security measures for information systems correctly and efficiently, it is essential to quantitatively and accurately evaluate the security risk of the system using security metrics.

[0003] Generally, cyber attacks are realized by chaining together multiple unit attacks (multi-step attacks). A unit attack here is an attack that exploits vulnerabilities inherent in a system to illegally obtain operating authority or access authority for a host. Therefore, in order to calculate the security risk of an entire system, it is necessary to accurately calculate the success probability of a unit attack.

[0004] Knowing the attack path (attack procedure) from an external intrusion through unauthorized access to the target asset is important in understanding security risks. For this reason, the Attack Graph (AG) is known as a graph that comprehensively describes attack paths. Each node in the AG represents the state of the system, and each edge (link between nodes) in the AG represents a unit attack. In addition, the representation format of AG is classified into State-based AG, which does not consider the weight of edges, and BAG (Bayesian AG), which assigns the "probability of success of unit attacks" to edges of State-based AG. Creating a BAG for an information system makes it possible to calculate the risk probability of the information assets being evaluated.

[0005] Non-Patent Document 1 clearly and in detail defines BAG and its analysis method. Furthermore, Non-Patent Document 1 calculates the "success probability of a unit attack" to be assigned to BAG based on the subjective opinion of experts or the Common Vulnerability Scoring System (CVSS). CVSS is a globally accepted rating scale that comprehensively evaluates vulnerabilities based on the difficulty of exploiting them, their impact on confidentiality, integrity, availability, etc., and assigns a score (real value between 0 and 10) according to their risk and severity. CVSS takes into account various rating scales (element scores) and calculates the final score using a dedicated formula. [Prior art documents] [Non-patent literature]

[0006] [Non-Patent Document 1] N. Poolsappasit, R. Dewri and I. Ray, “Dynamic Security Risk Management Using Bayesian Attack Graphs,” IEEE Transactions on Dependable and Secure Computing, vol. 9, no. 1, pp. 61-74, 2012. Summary of the Invention [Problem to be solved by the invention]

[0007] The success probability of a unit attack can also be said to be the probability that an external attacker can exploit each vulnerability inherent in the system (vulnerability exploitation probability). Therefore, in order to improve the accuracy of security risk assessment, it is necessary to improve the accuracy of the vulnerability exploitation probability used in the assessment calculation. However, conventional technologies such as Non-Patent Document 1 have not proposed a method for calculating the vulnerability exploitation probability with high accuracy. For example, Non-Patent Document 1 defines the formula for calculating the exploit probability based on CVSS as (Formula 1). Abuse probability = 2 × B_AV (access vector) × B_AC (access complexity) × B_AU (authentication) … (Formula 1)

[0008] However, (Formula 1) only roughly quantifies the system's susceptibility to attack (severity) and is not related to the probability of a vulnerability being exploited. Therefore, the accuracy of using this severity as the probability of a vulnerability being exploited is poor. In addition, as time passes since a vulnerability is discovered and made public, it becomes easier for an unspecified number of hackers to develop and publish attack tools (code or scripts) to exploit the vulnerability, and the probability of the vulnerability being exploited increases. Therefore, in order to improve the accuracy of the vulnerability exploitation probability, it is necessary to take the passage of time into account.

[0009] On the other hand, in the method where experts manually input the exploit probability for each vulnerability, the accuracy of the probability depends on the skill of the expert, and objectivity and uniqueness are lost.In addition, the human operating costs are very high to manually assign probabilities to all of the large amount of vulnerability information that is updated daily, making it unrealistic.

[0010] Therefore, a main object of the present invention is to improve the accuracy of vulnerability evaluation. [Means for solving the problem]

[0011] In order to solve the above problems, the vulnerability assessment device of the present invention has the following features. The present invention provides a vulnerability assessment device including a model generation unit and a model assessment unit, The model generation unit, Obtaining published vulnerability data and published attack codes from the database, A calculation model is created to calculate the probability of exploitation of a vulnerability according to the elapsed time from the publication of each vulnerability data obtained, as a distribution of the elapsed time from the publication of each vulnerability data to the publication of attack code for exploiting the vulnerability, and the probability of the vulnerability being exploited according to the elapsed time from the publication of each vulnerability data obtained. As a calculation model for calculating the exploitation probability, a future exploitation probability, which is the probability that the vulnerability to be evaluated will be exploited in the future, is calculated based on the distribution of elapsed time, as well as the ratio of the number of samples of all vulnerability data and the number of samples of vulnerability data that can be exploited by attack code, and The model evaluation unit, The time that has elapsed since the vulnerability data to be evaluated was made public is input, and the exploitation probability corresponding to the input time is calculated based on the calculation model created by the model generation unit. As a process, the exploitation probability, which indicates the probability that the vulnerability will be exploited, is calculated by multiplying the result of the calculation based on the input elapsed time and the distribution that the elapsed time follows and the future exploitation probability value. It is characterized by: Effect of the Invention

[0012] According to the present invention, it is possible to improve the accuracy of vulnerability assessment. [Brief description of the drawings]

[0013] [Figure 1] FIG. 1 is a configuration diagram of a model generating device according to an embodiment of the present invention. [Diagram 2] FIG. 2 is a detailed configuration diagram of a computational model construction unit according to the present embodiment. [Diagram 3] FIG. 1 is a configuration diagram of a model evaluation device according to an embodiment of the present invention. [Figure 4] FIG. 1 is a configuration diagram of a compromise assessment device according to an embodiment of the present invention. [Diagram 5] FIG. 2 is a hardware configuration diagram of each device in the vulnerability assessment system according to the present embodiment. [Figure 6] FIG. 11 is a Venn diagram showing the relationship of a sample set stored in a database according to the present embodiment. [Figure 7] 7 is a table generated by a data processing unit from each sample in FIG. 6 according to this embodiment. [Figure 8] 11 is a graph showing an example of a calculation result of a probability distribution constructing unit according to the present embodiment. [Figure 9] 9 is a table showing descriptive statistics of the graph of FIG. 8 for the present embodiment. [Figure 10] 1 is a graph for explaining a Weibull distribution according to the present embodiment. [Figure 11] 1 is a graph for explaining approximation using a Weibull distribution according to the present embodiment; [Figure 12] 1 is a graph for explaining approximation by Weibull distribution F+ according to the present embodiment. [Figure 13] 1 is a graph for explaining approximation by Weibull distribution F− according to the present embodiment. [Figure 14] 11 is a graph showing the results of an experiment for comparing a conventional method with the method of the present embodiment. [Figure 15] 11 is a graph showing the results of an experiment for comparing a conventional method with the method of the present embodiment. [Figure 16] 11 is a graph showing the results of evaluating the compromise assessment device according to the present embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. The vulnerability assessment system of this embodiment includes a model generating device 1 of Fig. 1, a model evaluating device 2 of Fig. 3, and a compromise evaluating device 3 of Fig. 4. These devices of the vulnerability assessment system may be housed in the same housing called a vulnerability assessment device. The vulnerability assessment device includes some or all of a model generating unit having the functions of the model generating device 1, a model evaluating unit having the functions of the model evaluating device 2, and a compromise evaluating unit having the functions of the compromise assessment device 3.

[0015] FIG. 1 is a configuration diagram of the model generating device 1. The model generating device 1 includes a database 10, a data processing unit 13, a computational model constructing unit 14, and a computational model output unit 15. The database 10 stores samples (hereinafter, DB (Data Base) samples) collected from the Internet or the like in a vulnerability data storage unit 11 and an attack code storage unit 12.

[0016] The model generation device 1 generates a model using DB samples (real data) of an existing database 10. Therefore, if DB samples are not available, it is necessary to collect them yourself and store them in the vulnerability data storage unit 11 and the attack code storage unit 12. Also, it is desirable to have as many DB samples as possible as the number of samples that are the material for the model. It is also possible to arbitrarily limit the number and range of vulnerability data from the DB samples in Database 10. For example, to "limit to only those vulnerabilities that were disclosed after 2017 in order to analyze recent trends."

[0017] The vulnerability data storage unit 11 stores a set of vulnerabilities "V." A "vulnerability" is a flaw in information security. Hereinafter, a certain vulnerability is designated as "v," and the set of vulnerabilities including those "v"s is designated as "V" (v∈V). In order to fix the vulnerability, it is necessary to update the OS or apply a dedicated security patch. The vulnerability data storage unit 11 is constructed as, for example, a National Vulnerability Database (NVD). Major vulnerabilities discovered are assigned a Common Vulnerabilities and Exposures-ID (CVE-ID), which is a globally unique identifier, and registered as samples in the NVD. As of August 28, 2021, 169,371 vulnerabilities are registered in the NVD.

[0018] The attack code storage unit 12 stores a set of attack codes "ε". "Attack code" is code or a tool for attacking vulnerabilities. In the following, a certain attack code is referred to as "e", and the set of attack codes that contain that "e" is referred to as "ε" (e∈ε). Attackers use attack codes to "exploit" vulnerabilities. Both "exploitation" and the attack code used for that exploitation are also called "exploits". The attack code storage unit 12 is constructed, for example, as an exploit database (EDB). As of August 28, 2021, 44,448 pieces of attack code are registered in the EDB. As will be described later with reference to FIG. 7, the data processing unit 13 formats the DB samples of the database 10 into a data format that is easy for the computational model construction unit 14 to statistically process.

[0019] The "exploitation time Tv" of an exploit is the time that elapses from the time when a certain vulnerability v is disclosed in the vulnerability data storage unit 11 to the time when the vulnerability is exploited. The "exploitation time T" is a generalization of the exploitation time Tv to any vulnerability. It is assumed that an attacker will exploit the attack code immediately on the publication date of the attack code in the attack code storage unit 12. Therefore, in this embodiment, the "time Tv from the publication of the vulnerability v to the publication of the attack code e capable of exploiting the vulnerability v" is regarded as the exploitation time Tv. If a vulnerability v does not have an attack code, the exploitation time Tv is not defined. If a vulnerability v has multiple attack codes, a representative value such as the minimum value is selected as the exploitation time Tv.

[0020] Below, we define a parameter Ev that indicates whether or not a vulnerability v has an attack code e. If Ev=1, the vulnerability v has an attack code e, and if Ev=0, the vulnerability v does not have an attack code e. In addition, we generalize the parameter Ev, which indicates whether vulnerability v has attack code e, to a parameter E, which indicates the possibility of exploiting any vulnerability. If E=1, there is a possibility that any vulnerability will be exploited at some point in the future, and if E=0, there is no possibility.

[0021] Hereinafter, the model generation device 1 generates a model that generalizes the statistical characteristics of the exploitation time Tv of an individual vulnerability v from DB entries registered in the database 10. This model is a model for calculating the exploitation probability p(t) of any currently existing vulnerability. "Exploitation probability p(t)" is the probability that an attacker can exploit a given vulnerability to be evaluated at a certain time t from the disclosure date. The unit of time t (e.g., days, hours, minutes, seconds) can be determined by the user, but it must be at a granularity that can be obtained from the original data.

[0022] In addition, even if vulnerabilities v1, v2, v3 . . . are disclosed in the vulnerability data storage unit 11 on the same day, the exploitation times of those vulnerabilities v1, v2, v3 . For example, suppose that attack code e1 attacking vulnerability v1 is published in the attack code storage unit 12 one day after the publication date of vulnerability v1. Then, attack code e2 for vulnerability v2 is published three days later, and attack code e3 for vulnerability v3 is published five days later. In this case, the exploitation time is shortest for v1, followed by v2 and v3 in that order.

[0023] FIG. 2 is a detailed configuration diagram of the computational model construction unit 14. The computational model construction unit 14 of the model generation device 1 performs statistical processing on DB samples in the database 10 to model the misuse probability p(t) as the following two elements (1) and (2).

[0024] (1) The future exploitation probability calculation unit 14A calculates the future exploitation probability pL based on the number of DB samples in the database 10, as described later in Fig. 6. The future exploitation probability pL is the probability that a vulnerability currently to be evaluated will eventually (in the future) become a vulnerability that can be exploited by an unspecified number of hackers developing and releasing attack code (E = 1).

[0025] (2) The probability distribution construction unit 14B calculates the cumulative distribution function F(t) of the probability distribution that the past exploitation time T (actual measured value) follows, as described later in Fig. 8, and stores the result in the probability distribution calculation unit 22B in Fig. 3. The cumulative distribution function F(t) represents the conditional probability that a vulnerability that the future exploitation probability calculation unit 14A has determined to be exploitable (E=1) will be exploited from disclosure to time t.

[0026] That is, the probability distribution construction unit 14B acquires each of the disclosed vulnerability data and the disclosed attack code from the database 10. Then, the probability distribution construction unit 14B creates a computation model for determining an exploitation probability indicating the probability that a vulnerability will be exploited according to the elapsed time from the disclosure of each of the acquired vulnerability data, as a distribution of the elapsed time from the disclosure of each of the acquired vulnerability data to the disclosure of the attack code for exploiting the vulnerability. Then, the future exploitation probability calculation unit 14A calculates the future exploitation probability, which is the probability that the vulnerability to be evaluated will be exploited in the future, based on the distribution of exploitation times created by the probability distribution construction unit 14B, as well as the ratio between the number of all vulnerability data samples and the number of vulnerability data samples that can be exploited by attack code, as a calculation model for determining the exploitation probability.

[0027] FIG. 3 is a configuration diagram of the model evaluation device 2. The model evaluation device 2 receives an input of the time elapsed since the publication of vulnerability data to be evaluated, and calculates the exploitation probability corresponding to the input elapsed time, based on the calculation model created by the model generation device 1. To this end, the model evaluation device 2 has an elapsed time input unit 21, a future exploitation probability storage unit 22A, a probability distribution calculation unit 22B, an accumulator 23, and an exploitation probability output unit 24.

[0028] The elapsed time input unit 21 receives an input of the elapsed time t, and notifies the probability distribution calculation unit 22B. The future abuse probability storage unit 22A stores the future abuse probability pL calculated by the future abuse probability calculation unit 14A. The probability distribution calculation unit 22B stores the cumulative distribution function F(t) of the probability distribution to which the past exploitation time Tv (actual measurement value) calculated by the probability distribution construction unit 14B conforms. Then, the probability distribution calculation unit 22B receives an input of the elapsed time t from the disclosure date of the vulnerability to be evaluated to today, and calculates F(t) of the vulnerability to be evaluated by substituting the elapsed time t into the cumulative distribution function F(t).

[0029] The accumulator 23 calculates the product of the future abuse probability pL (read from the future abuse probability storage 22A) and the cumulative distribution function F(t) (read from the probability distribution calculator 22B) to obtain the abuse probability p(t). In other words, the model evaluation device 2 calculates the exploitation probability p(t), which indicates the probability that a vulnerability will be exploited, by multiplying the value of the cumulative distribution function F(t), which is the result of calculation using the input elapsed time t and the distribution that the elapsed time follows (such as the probability distribution F), and the value of the future exploitation probability pL. The abuse probability output unit 24 outputs the abuse probability p(t) calculated by the accumulator 23 .

[0030] An example of calculation by the model evaluation device 2 will be shown below. For example, assume that today is September 13, 2021. Suppose that a vulnerability detection tool is applied to an information system and the following vulnerabilities (A), (B), and (C) are discovered. Suppose that the CVE-ID and publication date of each vulnerability are registered in the vulnerability data storage unit 11 (NVD) as follows: (A) CVE-ID=CVE-2021-40524 (NVD released on September 5, 2021) (B) CVE-ID=CVE-2021-39181 (NVD released on September 1, 2021) (C)CVE-ID=CVE-2017-18877(2020 / 6 / 19 NVD released)

[0031] At this time, the elapsed time input unit 21 accepts inputs of (A) 7 days, (B) 12 days, and (C) 451 days as the elapsed times t from the disclosure of the vulnerability as of September 13. Then, the probability distribution calculation unit 22B substitutes these elapsed times t into F(t), and obtains the probability F(t) as follows: (A)F(7)=P{Tv≦7|Ev=1}=0.891833 (B)F(12)=P{Tv≦12|Ev=1}=0.911164 (C)F(451)=P{Tv≦451|Ev=1}=0.983493

[0032] The accumulator 23 reads the future abuse probability pL=0.268334 calculated in advance from the future abuse probability storage unit 22A, and calculates the product of this with F(t) for each of (A) to (C) calculated by the probability distribution calculator 22B to obtain the abuse probability p(t). (A)p(7)=pL×F(7)=0.268334×0.891833=0.239309 (B)p(12)=pL×F(12)=0.268334×0.911164=0.244496 (C)p(451)=pL×F(451)=0.268334×0.983493=0.263905 The abuse probability output unit 24 outputs the abuse probability p(t) calculated by the accumulator 23.

[0033] FIG. 4 is a configuration diagram of the compromise assessment device 3. The compromise assessment device 3 improves the accuracy of security risk analysis using BAG by using the computation model (future exploitation probability pL, cumulative distribution function F(t)) output by the computation model output unit 15 of the model generation device 1 as elemental technology. Therefore, the compromise assessment device 3 calculates the compromise probability of the target asset by calculation using BAG, using the computation model output by the computation model output unit 15. "Compromise" means that the attacker's final goal inputted is achieved, such as the root authority of the asset being stolen.

[0034] That is, the compromise assessment device 3 calculates the exploitation probability of each vulnerability included in a network model (BAG) including dependency relationships between multiple vulnerabilities by applying the computational model for determining the exploitation probability of the vulnerability created by the model generation device 1. From the calculation result of the exploitation probability, the compromise assessment device 3 calculates the compromise probability, which is the probability that the input final goal of the attacker will be achieved. For this reason, the compromise assessment device 3 includes a system inspection unit 31 , a BAG generation unit 32 , and a BAG analysis unit 33 .

[0035] The procedure for an analyst to analyze a system compromise using the compromise assessment device 3 will be described below. (Step 1) The system inspection unit 31 acquires configuration management information and vulnerability information of the system to be analyzed from the analyst. For this reason, the analyst defines the "system scope" and "target (final goal of the attacker)" when actually performing the analysis using BAG, as shown in the following examples. The probability that the root privileges of the administrator's device will be compromised is calculated as the compromise probability. The probability that the user authority of a user terminal will be stolen is calculated as the compromise probability. The system inspection unit 31 outputs system information (eg, network information, vulnerability information) required for BAG generation to the BAG generation unit 32.

[0036] (Step 2) The BAG generation unit 32 uses the calculation model output by the calculation model output unit 15 to generate a BAG of the system to be analyzed, and outputs the BAG to the BAG analysis unit 33. (Step 3) The BAG analysis unit 33 calculates the compromise probability (e.g., the probability of root privilege being stolen) of the target asset (e.g., the administrator terminal) by calculation using the BAG. Here, the BAG generated by the BAG generation unit 32 includes a calculation model that calculates the exploitation probability of vulnerabilities present in the system with high accuracy, so the accuracy of the compromise probability can also be improved. The exploitation probability of a vulnerability in the BAG is, for example, the probability of breaking through a node that represents a vulnerability.

[0037] FIG. 5 is a diagram showing the hardware configuration of each device in the vulnerability assessment system. Each device of the vulnerability assessment system (model generation device 1, model assessment device 2, and vulnerability assessment device 3) is configured as a computer 900 having a CPU 901, a RAM 902, a ROM 903, a HDD 904, a communication I / F 905, an input / output I / F 906, and a media I / F 907. The communication I / F 905 is connected to an external communication device 915. The input / output I / F 906 is connected to an input / output device 916. The media I / F 907 reads and writes data from a recording medium 917. Furthermore, the CPU 901 controls each processing unit by executing a program (also called an application or its abbreviation, an app) loaded into the RAM 902. This program can be distributed via a communication line, or can be recorded on a recording medium 917 such as a CD-ROM and distributed.

[0038] FIG. 6 is a Venn diagram showing the relationships between the sample sets stored in the database 10. The future abuse probability calculation unit 14A calculates the future abuse probability pL based on the number of past DB entries in the database 10, as shown below. A set 101 indicates a set of samples stored in the vulnerability data storage unit 11. A set 102 indicates a set of samples stored in the attack code storage unit 12. A set 103 indicates the intersection of the sets 101 and 102. The samples in set 101 are classified into samples belonging to set 103 (vulnerable samples that have attack code) and samples not belonging to set 103 (vulnerable samples that do not have attack code). The samples in set 102 are classified into samples belonging to set 103 (attack codes that target vulnerable samples) and samples not belonging to set 103 (attack codes that do not target vulnerable samples).

[0039] Hereinafter, methods by which the future abuse probability calculation unit 14A calculates the future abuse probability pL will be exemplified as (Method 1) to (Method 3). [Method 1] Symbol 100A is a case where part of set 101 belongs to set 103, and part of set 102 belongs to set 103. The ratio of all vulnerable samples (set 101) that have attack code (set 103) is defined as the future exploitation probability pL (Equation 2).

[0040]

number

[0041] [Method 2] Reference numeral 100B indicates a case where part of set 101 belongs to set 103, and all of set 102 belongs to set 103. The ratio of the number of all attack code samples (set 102) to the number of all vulnerability samples (set 101) is defined as the future exploitation probability pL (Equation 3). This is a more pessimistic estimate than method 1, and can prevent the risk assessment from becoming too optimistic.

[0042]

number

[0043] [Method 3] Symbol 100C is the case where sets 101, 102, and 103 are the same set. It is assumed that all vulnerabilities will be exploited eventually (Equation 4). This is a more pessimistic estimate than Method 2. In other words, Method 3 has the exploitation probability p(t)=cumulative distribution function F(t), so that the future exploitation probability calculation unit 14A of the model generation device 1 and the future exploitation probability storage unit 22A and accumulator 23 of the model evaluation device 2 can be omitted. pL=P{E=1}=1 …(Formula 4)

[0044] For example, if set 101=169,371 samples, set 102=45,448 samples, and set 103=9207 samples, the future abuse probability calculation unit 14A calculates the future abuse probability pL as follows. [Method 1] pL=9207 / 169,371=0.0544 [Method 2] pL=45,448 / 169,371=0.268 [Method 3] pL=1

[0045] FIG. 7 is a table generated by the data processing unit 13 from each sample in FIG. The data processing unit 13 organizes and formats the data so that it can be easily processed by the computational model construction unit 14. Specifically, the data processing unit 13 acquires the publication date and time of vulnerability v for each sample in the vulnerability data storage unit 11. In addition, the data processing unit 13 acquires the publication date and time of attack code e for each sample in the attack code storage unit 12.

[0046] Then, for samples of vulnerability v having attack code e (set 103 in Fig. 6), the data processing unit 13 calculates exploitation time Tv based on the publication date and time information of the DB sample, and adds it as a new attribute (item) of the table in Fig. 7. Exploitation time Tv is the time from the publication date and time of vulnerability v to the publication date and time of attack code e for vulnerability v (date and time considered to have been exploited by publication), and if the vulnerability had already been exploited before it was disclosed, exploitation time Tv will be a negative number. Note that there may be a discrepancy between the publication date and time of the attack code and the development date and time when the attack code was actually developed. If the actual development date and time are available, the data processing unit 13 may use the development date and time to obtain a more accurate "exploitation time."

[0047] Here, the process of associating the vulnerability v with the attack code e will be described. If the vulnerability sample in the NVD has a corresponding attack code in the EDB, the vulnerability sample in the NVD has a reference link to the EDB. Therefore, when the NVD and the EDB are used as sources, the data processing unit 13 can integrate the data using, for example, a reference link from the NVD to the EDB. In other words, among vulnerabilities published in the NVD, those that have a reference link to the EDB are assumed to be vulnerabilities for which exploit code is available (has been exploited). In addition, if multiple exploit codes are referenced, the one with the earliest publication date is used. On the other hand, when vulnerability information and attack code information are obtained from separate sources, the data processing unit 13 needs attributes for integrating these data (e.g., a reference link from one to the other, an identifier common to both) in addition to the attributes mentioned above.

[0048] Based on the above, the entries in the table in FIG. 7 are classified into the following three types. (1) Vulnerability samples without exploit code (2) Attack code samples for which the vulnerabilities they address are unknown (3) Vulnerability samples with attack code (corresponding to set 103 in Figure 6, and all of Figure 7 are in this category) The probability distribution construction unit 14B obtains the probability distribution of the exploitation time Tv for the vulnerability sample of (3), and generalizes the result as the probability distribution F of the exploitation time for an arbitrary vulnerability.

[0049] FIG. 8 is a graph showing an example of the calculation result of the probability distribution constructing unit 14B. FIG. 9 is a table showing descriptive statistics for graph 112 of FIG. Graph 111 shows f(t), which is the Probability Mass Function (PMF) of the probability distribution F. Graph 112 shows F(t), which is the cumulative distribution function (CDF) of the probability distribution F. Probability distribution constructing unit 14B calculates f(t) using (Equation 5), and calculates F(t) using (Equation 6).

[0050]

number

[0051] As described above in the description up to Fig. 9, the probability distribution constructing unit 14B created a calculation model (probability distribution F) as a model (measurement model) created based on the actual measurement values ​​of DB samples. This measurement model can be calculated with high accuracy if a sufficient number of DB samples can be acquired.

[0052] On the other hand, in an actual measurement model when the number of DB samples is insufficient, the PMF oscillates and the CDF F(t) is not smooth, which may result in insufficient accuracy of the probability distribution F. In other words, when the number of DB samples is insufficient, it may be possible to perform more accurate (reasonable) probability calculations by using an approximation model based on an arbitrary probability distribution. Therefore, instead of using an actual measurement model of the probability distribution F, the probability distribution constructing unit 14B may approximate the probability distribution F with an arbitrary probability distribution and use the CDF of the approximate model instead of F(t). Below, an example will be described in which the probability distribution constructing unit 14B uses a Weibull distribution as an approximate model and creates G(t), which is the CDF of the Weibull distribution.

[0053] FIG. 10 is a graph for explaining the Weibull distribution. The Weibull distribution is generally known as the distribution that the failure time of products (i.e., product life) follows. The intensity function of the Weibull distribution (Equation 7) indicates the (momentary) failure rate at time t. This failure rate does not represent the probability of failure occurring, but the frequency of failures occurring per unit time. Depending on the value of the Weibull coefficient m, the behavior of the failure rate λ(t) changes as follows: The Weibull distribution is determined by two Weibull parameters "m, η" shown in (Equation 7). m is the Weibull coefficient (shape parameter), and η is the scale parameter.

[0054]

number

[0055] In graph 121 when the Weibull coefficient m<1, the failure rate decreases over time, as shown at the left end of the bathtub curve. This graph 121 is used for modeling early failures (failures due to initial defects), etc. In graph 122, when the Weibull coefficient m=1 (at this time, the Weibull distribution is equivalent to the exponential distribution), the failure rate is constant regardless of the passage of time, like the middle part of the bathtub curve. This graph 122 is used for modeling accidental failures such as failures due to disasters or accidents. In graph 123 where the Weibull coefficient m>1, the failure rate increases over time, as shown at the right end of the bathtub curve. This graph 123 is used to model wear-out failures, such as failures due to aging.

[0056] In the approximation model of the Weibull distribution, we first consider the probability distribution F divided into the region where the vulnerability exploitation time T>0 and the region where T<0. First, for the probability distribution F+ where the exploitation time T>0, its PMF f+(t) is shown in (Formula 8), and its CDF F+(t) is shown in (Formula 9).

[0057]

number

[0058] Next, for the probability distribution F- where the abuse time T<0, its PMF f-(t) is shown in (Formula 10), and its CDF F-(t) is shown in (Formula 11). Note that the probability distribution F- is the distribution of the absolute value of T, and its domain is positive numbers.

[0059]

number

[0060] The PMF of the Weibull distribution using the Weibull parameters, h(t), is shown in (Formula 12), and its CDF, H(t), is shown in (Formula 13).

[0061]

number

[0062] The probability distribution constructing unit 14B specifies the Weibull parameters "m, η" that are most suitable for the actual measured values ​​by calculating a Weibull plot. The calculation formula for the Weibull plot will be explained below. First, for the CDF, (Formula 14), "Y = mX-m ln η" holds. Then, a linear approximation is performed on Y, which is calculated from the actual measured value, and the parameter m can be determined from the slope of the line. Then, by substituting m into (Formula 15), the parameter η can be determined.

[0063]

number

[0064] FIG. 11 is a graph for explaining approximation by the Weibull distribution. Graph 131 is the result of performing a Weibull plot on DB samples belonging to the positive region Tv>0. Graph 132 is the result of performing a Weibull plot on DB samples that belong to the negative region Tv<0. Table 133 shows the Weibull parameters “m, η” obtained from graph 131 and graph 132, respectively.

[0065] FIG. 12 is a graph for explaining the approximation of the probability distribution F+ by the Weibull distribution G+. Graph 141 shows an approximation line (PDF) based on the Weibull distribution G+, and the actual measured values ​​(PMF) used to calculate the approximation line. Graph 142 shows the CDF of the Weibull distribution G+.

[0066] FIG. 13 is a graph for explaining the approximation of the probability distribution F− by the Weibull distribution G−. Graph 143 shows an approximation line (PDF) based on the Weibull distribution G-, and the actual measured values ​​(PMF) used to calculate the approximation line. Graph 144 shows the CDF of the Weibull distribution G-.

[0067] The probability distribution construction unit 14B uses the Weibull plot to determine the optimal Weibull parameters "m+, η+" of the Weibull distribution that approximates the distribution F+. Similarly, the Weibull plot to determine the optimal Weibull parameters "m-, η-" of the Weibull distribution that approximates the distribution F-. As a result, the optimal Weibull distribution G+ that approximates the distribution F+ is obtained by (Formula 16). Also, the optimal Weibull distribution G- that approximates the distribution F- is obtained by (Formula 17).

[0068]

number

[0069] At this time, the probability distribution constructing unit 14B calculates G(t) replacing F(t) by (Formula 18).

[0070]

number

[0071] Here, p-, p0, and p+ in (Equation 18) respectively indicate the probability that the abuse time will be a negative number, 0, and a positive number (Equation 19).

[0072]

number

[0073] The vulnerability assessment system of this embodiment has been described above with reference to Fig. 13. The following describes the results of an experiment evaluating the effectiveness of the vulnerability assessment system.

[0074] 14 and 15 are graphs showing the experimental results. First, the experimental environment is as follows. Using the test network of Non-Patent Document 1, we assumed that each host in the network shown in Fig. 1 of Non-Patent Document 1 has various vulnerabilities described in Tab. 1 of Non-Patent Document 1. However, since no information was found about the vulnerability "CA 1996-83", we have substituted CVE-2006-4958 here. We also cited the BAG for the test network in Non-Patent Document 1. If we transcribe the test network in Non-Patent Document 1 into a BAG, it will look like Fig. 2 in Non-Patent Document 1. The condition for compromising the test network was set as the attacker's ultimate goal: to gain root privileges on the Admin Machine (10.0.0.128). We calculated the probability of compromising the Admin Machine assuming that an attacker exists. For each vulnerability, we calculated the exploitation probability for every three months from 2000 to 2010. In graphs 201 to 205 of the experiment results, the horizontal axis represents the days, and the vertical axis represents the exploitation probability calculated by the system.

[0075] Graphs 201 to 205 in Fig. 14 and graphs 211 to 215 in Fig. 15 each target a different vulnerability. For example, graph 201 shows the results of an experiment on a vulnerability with CVE-ID=CVE-2006-4958. Graphs 201 to 205 and graphs 211 to 215 each include lines showing the following three types of experimental results: A prior art method uses a formula (Formula 1) for calculating the probability of exploitation based on CVSS, as shown in Non-Patent Document 1. A first method of this embodiment is a method in which the probability distribution constructing unit 14B uses F(t), which is the CDF of the probability distribution of the actual measured values. A second method of the present embodiment is a method in which the probability distribution constructing unit 14B uses an approximation line, that is, G(t) which is the CDF of the Weibull distribution.

[0076] Below, we list some points that can be read from the graphs in Figures 14 and 15. Unlike the prior art method of Non-Patent Document 1, the actual measured values ​​and the approximation line of this embodiment both show that the probability of abuse increases over time. In other words, the actual measured values ​​and the approximation line of this embodiment take into account changes over time. The approximation line of this embodiment closely approximates the model based on the actual measured values. In graph 203, for example, the prior art method calculates the exploit probability more optimistically (at a lower value) than the proposed method.

[0077] Incidentally, the CVSS used in Non-Patent Document 1 is a metric for evaluating the severity of vulnerabilities, and is not intended to reflect probability. Therefore, the value obtained by (Formula 1) in Non-Patent Document 1 is a value that "looks like a probability" in the range of 0 to 1, and has no basis in probability statistics. On the other hand, in this embodiment, an actual probability distribution F is obtained from a huge number of samples in the database 10, and the misuse probability p(t) is calculated based on the probability distribution F. Therefore, it is possible to calculate a misuse probability p(t) that is closer to the true probability (more accurate) than the method of Non-Patent Document 1. In addition, vulnerabilities that have been disclosed for some time are more likely to be exploited than vulnerabilities that have been disclosed recently, due to the longer development time required for attack code. However, the method in Non-Patent Document 1 calculates the exploitability probability from CVSS, so it always calculates a constant value without taking into account the time that has passed until the evaluation.

[0078] FIG. 16 is a graph showing the results of evaluation of the compromise assessment device 3. This graph shows the results of calculating the compromise probability for Admin Machine every three months from 2000 to 2010. As with the graphs in Fig. 14 and Fig. 15, the actual measured values ​​and approximation lines in the graph in Fig. 16 take into account changes over time, unlike the prior art of Non-Patent Document 1. Furthermore, in the graph in Fig. 16, the approximation line in this embodiment closely approximates the model based on the actual measured values.

[0079] [effect] The vulnerability assessment system of the present invention includes a model generation device 1 and a model assessment device 2, A model generating device 1 We obtain publicly available vulnerability data and publicly available attack codes from Database 10, A computational model is created to calculate an exploitation probability, which indicates the probability that a vulnerability will be exploited according to the elapsed time from the disclosure of each vulnerability data obtained, as a distribution of the elapsed time from the disclosure of each vulnerability data obtained to the disclosure of attack code for exploiting the vulnerability, and The model evaluation device 2 A feature of this method is that it receives an input of the time that has elapsed since the vulnerability data to be evaluated was made public, and calculates the exploitation probability corresponding to the input time based on the calculation model created by the model generating device 1.

[0080] As a result, the model generation device 1 creates a calculation model that can statistically calculate the probability that an attacker can exploit vulnerabilities inherent in software or hardware based on the information in the database 10. Therefore, the model evaluation device 2 can obtain a highly accurate exploitation probability at the time of evaluation, taking into account the increase in the exploitation probability that occurs over time since the vulnerability was made public. Furthermore, compared to a method in which an expert manually inputs an evaluation value based on their own experience, the calculation can be performed automatically and mechanically, which can reduce the necessary human operating costs.

[0081] In the present invention, the model generating device 1 calculates a future exploitation probability, which is the probability that a vulnerability to be evaluated will be exploited in the future, based on the ratio of the number of samples of all vulnerability data and the number of samples of vulnerability data that can be exploited by an attack code, in addition to the distribution of elapsed time, as a calculation model for calculating the exploitation probability, The model evaluation device 2 calculates the exploitation probability, which indicates the probability that the vulnerability will be exploited, by multiplying the value calculated using the input elapsed time and the distribution that the elapsed time follows, and the value of the future exploitation probability.

[0082] In this way, the rough tendency of the probability of future misuse is reflected in the calculation model by referring to the actual number of samples in the database 10. Therefore, a true (highly accurate) probability of misuse with guaranteed objectivity and uniqueness can be obtained.

[0083] In the present invention, the model generating device 1 creates a calculation model in which the distribution of elapsed time is approximated by a Weibull distribution, The model evaluation device 2 determines the misuse probability corresponding to the input elapsed time based on a calculation model that is approximated by a Weibull distribution instead of the distribution of elapsed time.

[0084] As a result, by approximating the distribution of abuse times obtained from the actual data in the database 10 by the Weibull distribution, which is a general probability distribution, it is possible to construct a valid calculation model even if the number of samples in the database 10 is small.

[0085] The present invention further provides a vulnerability assessment system including a compromise assessment device 3, The compromise assessment device 3 By applying a computational model for calculating the exploitation probability of vulnerabilities created by the model generation device 1 to a network model that includes dependencies between multiple vulnerabilities, the exploitation probability of each vulnerability included in the network model is calculated, and from the calculation results, the compromise probability, which is the probability that the input attacker's final goal will be achieved, is calculated.

[0086] As a result, the BAG network model calculates the final compromise probability by taking into account the dependencies between multiple vulnerabilities. Therefore, by improving the accuracy of the exploitation probability of each vulnerability, the accuracy of the compromise probability can also be improved. [Explanation of symbols]

[0087] 1. Model generation device (model generation unit) 2. Model evaluation device (model evaluation section) 3 Compromise evaluation device (compromise evaluation unit) 10 Database 11 Vulnerability Data Storage 12. Attack code storage section 13 Data Processing Section 14. Computational Model Construction Department 14A Future Abuse Probability Calculation Unit 14B Probability distribution construction section 15 Calculation model output section 21 Elapsed time input section 22A Future Abuse Probability Storage Unit 22B Probability distribution calculation section 23 Integration Section 24 Abuse Probability Output Unit 31 System Inspection Department 32 BAG generation section 33 BAG analysis department

Claims

1. The vulnerability assessment device includes a model generation unit and a model assessment unit, The model generation unit Obtaining published vulnerability data and published attack codes from the database, A calculation model is created to calculate the probability of exploitation of a vulnerability according to the elapsed time from the publication of each vulnerability data obtained, as a distribution of the elapsed time from the publication of each vulnerability data to the publication of attack code for exploiting the vulnerability, and the probability of the vulnerability being exploited according to the elapsed time from the publication of each vulnerability data obtained. As a calculation model for calculating the exploitation probability, a future exploitation probability, which is the probability that the vulnerability to be evaluated will be exploited in the future, is calculated based on the distribution of elapsed time, as well as the ratio of the number of samples of all vulnerability data and the number of samples of vulnerability data that can be exploited by attack code, and The model evaluation unit includes: The method is characterized in that, in the process of receiving an input of the elapsed time from the time of disclosure of vulnerability data to be evaluated and calculating an exploitation probability corresponding to the input elapsed time based on the calculation model created by the model generation unit, an exploitation probability indicating the probability that the vulnerability will be exploited is calculated by multiplying the result of calculation based on the input elapsed time and the distribution that the elapsed time follows and the value of the future exploitation probability. Vulnerability assessment device.

2. The vulnerability assessment device includes a model generation unit and a model assessment unit, The model generation unit Obtaining published vulnerability data and published attack codes from the database, A calculation model is created that approximates the distribution of the elapsed time from the time each vulnerability data obtained is made public to the time an attack code for exploiting the vulnerability is made public using a Weibull distribution, and determines the probability of exploitation of the vulnerability according to the elapsed time from the time each vulnerability data obtained is made public; The model evaluation unit includes: The method is characterized in that the method receives an input of the time elapsed since the publication of vulnerability data to be evaluated, and calculates the exploitation probability corresponding to the input elapsed time based on the calculation model created by the model generation unit. Vulnerability assessment device.

3. The vulnerability assessment device further includes a compromise assessment unit, The compromise assessment unit: The method is characterized in that the exploitation probability of each vulnerability included in the network model is calculated by applying the computation model for determining the exploitation probability created by the model generation unit to a network model including dependencies between multiple vulnerabilities, and the exploitation probability of each vulnerability included in the network model is calculated from the computation result, and a compromise probability, which is the probability that the input final goal of the attacker will be achieved, is calculated. The vulnerability assessment device according to claim 1 or 2.

4. The vulnerability assessment device includes a model generation unit and a model assessment unit, The model generation unit Obtaining published vulnerability data and published attack codes from the database, A computational model is created to calculate an exploitation probability, which indicates the probability that a vulnerability will be exploited according to the elapsed time from the disclosure of each vulnerability data obtained, as a distribution of the elapsed time from the disclosure of each vulnerability data obtained to the disclosure of attack code for exploiting the vulnerability, and As a calculation model for calculating the exploitation probability, a future exploitation probability, which is the probability that the vulnerability to be evaluated will be exploited in the future, is calculated based on the distribution of elapsed time, as well as the ratio of the number of samples of all vulnerability data and the number of samples of vulnerability data that can be exploited by attack code, and The model evaluation unit includes: The method is characterized in that, in the process of receiving an input of the elapsed time from the time of disclosure of vulnerability data to be evaluated and calculating an exploitation probability corresponding to the input elapsed time based on the calculation model created by the model generation unit, an exploitation probability indicating the probability that the vulnerability will be exploited is calculated by multiplying the result of calculation based on the input elapsed time and the distribution that the elapsed time follows and the value of the future exploitation probability. Vulnerability assessment methods.

5. The vulnerability assessment device includes a model generation unit and a model assessment unit, The model generation unit Obtaining published vulnerability data and published attack codes from the database, A calculation model is created by approximating the distribution of the elapsed time from the time of disclosure of each vulnerability data obtained to the time of disclosure of the attack code for exploiting the vulnerability using a Weibull distribution, and calculating the exploitation probability indicating the probability that the vulnerability will be exploited according to the elapsed time from the time of disclosure of each vulnerability data obtained, The model evaluation unit includes: The method is characterized in that the method receives an input of the time elapsed since the publication of vulnerability data to be evaluated, and calculates the exploitation probability corresponding to the input elapsed time based on the calculation model created by the model generation unit. Vulnerability assessment methods.

6. A vulnerability assessment program for causing a computer to function as the vulnerability assessment device according to any one of claims 1 to 3.

Images