Web system for visualizing management server vulnerabilities and its construction method

Abstract

A web system for visualizing vulnerability of a management server and a method for constructing the same are provided, which can further reduce the load of constant communication and calculations and prevent the leakage of vulnerability information of the management server. [Solution] The web system 1 comprises a plurality of agents 2 and a group of servers 4, and after a user accesses a web server 6, as a visualization step S500, the agent 2 acquires software data D1 and sends it to an application server 7c, the application server 7c determines whether or not there is a vulnerability based on the software data D1 and a public vulnerability information database Db1, and sends vulnerability information data D2 as the determination result to the web server 6, and the web server 6 distributes the vulnerability information data D2 to the accessing user, and when the user releases access to the web server 6, the data used in the visualization step S500 is erased except for the metadata.

Description

[Technical Field]

[0001] The present invention relates to a web system for visualizing vulnerabilities of a management server and a method for constructing the same, and more particularly to a web system for visualizing vulnerabilities of a management server and a method for constructing the same, which can further reduce the load of constant communication and calculation and prevent the leakage of vulnerability information of the management server. [Background technology]

[0002] More than 2,500 new vulnerabilities are discovered every month in software such as operating systems and programs used by servers. Consequently, the frequency of software updates to fix these vulnerabilities is also increasing. By constantly updating server software to the latest version, vulnerabilities are fixed, which is advantageous for maintaining high security. However, there is a risk that the updated software may have a bug, causing the server to stop functioning when updated to the latest version. To maintain high security while operating servers normally, it is necessary to evaluate software vulnerabilities according to the server's specifications. However, this evaluation requires a great deal of time and effort.

[0003] The vulnerability visualization server proposed in Patent Document 1 extracts component technologies included in systems registered as assets by users, links vulnerability information with threat information, and automatically notifies users of related vulnerability information when it is discovered. This type of vulnerability visualization contributes to the efficiency of vulnerability assessment.

[0004] However, the vulnerability visualization server proposed in Patent Document 1 stores an asset database (see FIG. 8 of Patent Document 1) and an assessment history database (see FIG. 11 of Patent Document 1) in its storage unit. Therefore, if this vulnerability visualization server becomes the target of a cyberattack and these databases are leaked to the public, vulnerabilities identified in these databases could be exploited, exposing the user's system to a cyberattack. Furthermore, this vulnerability visualization server automatically notifies users of vulnerability information when an asset registered in the asset database contains a vulnerability (see claim 1, paragraph 0058 of Patent Document 1). That is, this vulnerability visualization server diagnoses vulnerabilities for all assets in real time, such as when vulnerability information is made public. Therefore, if a large number of users use this vulnerability visualization server, the vulnerability visualization server must diagnose vulnerabilities for all registered assets in real time, resulting in a massive communication and computation load. Therefore, there is room for improvement in reducing the constant communication and computation load and preventing the leakage of vulnerability information from the management server. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Application Laid-Open No. 2015-219665 Summary of the Invention [Problem to be solved by the invention]

[0006] An object of the present invention is to provide a web system for visualizing vulnerabilities in a management server, which can further reduce the load of constant communication and calculations and prevent the leakage of vulnerability information in the management server, and a method for constructing the same. [Means for solving the problem]

[0007] The present invention provides a vulnerability visualization web system for management servers that achieves the above-mentioned object, which visualizes vulnerabilities of a plurality of pieces of software that cause a management server to execute data processing for a plurality of management servers managed by a user, and includes a plurality of agents resident on each of the management servers, and a server group made up of a plurality of server computers, the server group having a web server, an application server, and a database server, and the database server stores metadata including a public vulnerability information database that accumulates vulnerability information relating to vulnerabilities in the software that are publicly available, and when a user accesses a web server, the server group and the agent perform a visualization step for each of the management servers managed by the user, and when the user accesses the web server, the server group and the agent perform a visualization step for each of the management servers managed by the user, and when the user resolves access to ... the server group and the agent perform a visualization step for each of the management servers managed by the and when the agent is removed, the remaining data excluding the metadata from the data used in the visualization process is erased. In the visualization process, the agent executes data processing to acquire software data including specifications of each piece of software in the management server where the agent resides, and data processing to transmit the software data to the application server. The application server executes data processing to determine whether or not each piece of software has a vulnerability based on the transmitted software data and the public vulnerability information database, and data processing to transmit vulnerability information data that accumulates vulnerability information of the software determined to have a vulnerability to the web server. The web server is configured to execute data processing to distribute the vulnerability information data to the users who are accessing the web server.

[0008] The method for constructing a vulnerability visualization web system for a management server of the present invention visualizes vulnerabilities of a plurality of pieces of software that cause a management server to execute data processing for a plurality of management servers managed by a user, and includes a server construction step of constructing a server group consisting of a plurality of server computers, and an agent construction step and setting step carried out for each user, wherein the server construction step constructs a web server, an application server, and a database server as the server group, and constructs metadata in the database server, the metadata including a public vulnerability information database that accumulates vulnerability information relating to vulnerabilities in the software that are publicly available, and the agent construction step ,workman and a vulnerability visualization web system is constructed in which an agent is installed in each of the management servers and made resident therein, and in the setting step, settings related to access by the user to the web server are configured, and when the user accesses the web server, a visualization step is performed for each of the management servers on which the agent associated with the user resides, and when the user releases access to the web server, data remaining from the data used in the visualization step, excluding the metadata, is erased, and in the visualization step, the agent acquires software data including specifications of each of the software in the management server on which the agent resides and transmits the software data to the application server, and the application server determines whether or not each piece of software is vulnerable based on the transmitted software data and the public vulnerability information database, and transmits vulnerability information data that accumulates vulnerability information for the software determined to be vulnerable to the web server, and the web server distributes the vulnerability information data to the user accessing the web server. [Effects of the Invention]

[0009] According to the present invention, when a user accesses a web server, a visualization step is performed as a series of data processing steps to visualize vulnerabilities. In other words, the agent and the server group do not perform the visualization step until the user accesses the web server, so that the load of constant communication and calculation between the management server in which the agent is installed and the server group can be kept low.

[0010] Furthermore, according to the present invention, when a user terminates access to a web server, all data other than metadata is deleted from the server group. The metadata remaining on the server group does not associate the user with the management server specifications (host name, system software name, software name, and vulnerability information). Therefore, even if the metadata is leaked to the outside, the user's management server will not be exposed to cyber attacks that exploit software vulnerabilities caused by the leaked metadata.

[0011] As described above, the present invention is configured to enable real-time visualization of management server vulnerabilities at a timing desired by the user, while further reducing the constant communication and calculation load on the management server or server group and preventing the leakage of management server vulnerability information. This makes it possible to provide a service that makes vulnerability assessment more efficient by visualizing management server vulnerabilities to more users, which is advantageous in reducing the considerable time and effort required to manage a large number of management servers. [Brief explanation of the drawings]

[0012] [Figure 1] FIG. 1 is an explanatory diagram illustrating an embodiment of a vulnerability visualization web system of a management server. [Figure 2] FIG. 2 is an explanatory diagram illustrating an example of a server group in FIG. [Figure 3] FIG. 10 is a flow diagram illustrating the procedure of an embodiment of a method for building a vulnerability visualization web system for a management server. [Figure 4] FIG. 10 is an explanatory diagram illustrating a public vulnerability information database. [Figure 5]FIG. 10 is an explanatory diagram illustrating an agent information database. [Figure 6] FIG. 2 is an explanatory diagram illustrating an example of a definition file database. [Figure 7] FIG. 1 is a flow diagram illustrating the steps of a vulnerability visualization method using a vulnerability visualization web system. [Figure 8] FIG. 8 is a flowchart illustrating a part of the procedure of the preparation step of FIG. 7. [Figure 9] 9 is a flow chart illustrating a part of the procedure of the preparation step, continuing from A in FIG. 8. [Figure 10] FIG. 10 is an explanatory diagram illustrating an example of list data. [Figure 11] FIG. 8 is a flow diagram illustrating the first visualization step of FIG. 7. [Figure 12] FIG. 2 is an explanatory diagram illustrating software data. [Figure 13] FIG. 10 is an explanatory diagram illustrating an example of vulnerability information data. [Figure 14] FIG. 2 is an explanatory diagram illustrating an example of a summary database. [Figure 15] FIG. 8 is a flow diagram illustrating the second visualization step of FIG. 7. [Figure 16] FIG. 8 is a flow diagram illustrating the third visualization step of FIG. 7. [Figure 17] FIG. 2 is an explanatory diagram illustrating an example of resource data. [Figure 18] FIG. 2 is an explanatory diagram illustrating an example of process data. [Figure 19] FIG. 8 is a flow diagram illustrating the fourth visualization step of FIG. 7. [Figure 20] FIG. 2 is an explanatory diagram illustrating scan data. [Figure 21] FIG. 2 is an explanatory diagram illustrating an example of an update program database; [Figure 22] FIG. 1 is a flow diagram illustrating a procedure followed by an AI agent. DETAILED DESCRIPTION OF THE INVENTION

[0013] Hereinafter, a vulnerability visualization web system for a management server and a method for constructing the system will be described based on the embodiment shown in the drawings.

[0014] The embodiment of a vulnerability visualization web system 1 (hereinafter referred to as web system 1) illustrated in FIG. 1 visualizes software vulnerabilities in a management server 30 managed by a user who accesses the system via a web browser on the user computer 20. The web system 1 comprises a plurality (m) of agents 2 and a server group 4 consisting of a plurality (i) of server computers 3. The web system 1 further comprises an update server 5. The update server 5 can be provided as an option.

[0015] The server group 4 illustrated in FIG. 2 includes a web server 6, application servers 7a to 7d, and a database server 8. The server group 4 uses a domain name system server 9 and an authentication server 10. The domain name system server 9 and the authentication server 10 are external servers available via the Internet, but the server group 4 may have its own domain name system server 9 and authentication server 10. The server group 4 also includes load balancers (load distribution devices) 11a and 11b. The load balancers 11a and 11b can be provided as desired depending on the communication and calculation loads. The load balancers 11a and 11b may be software as in this embodiment, or may be hardware.

[0016] This web system 1 is constructed by carrying out an embodiment of a construction method for a vulnerability visualization web system for a management server, as shown in Fig. 3. This construction method includes a server group construction step S100, an agent construction step S200, and a setting step S300. In the server group construction step S100, a manufacturer constructs a server group 4, including a web server 6, application servers 7a-7c, and a database server 8 (S110), and constructs a public vulnerability information database Db1 in the database server 8 (S120). The agent construction step S200 is performed for each user. In the agent construction step S200, an agent 2 is installed in each management server 30 (S210), and each agent 2 is made resident (S220). The setting step S300 is performed by the manufacturer using a manufacturer computer 40. In the setting process S300, user access is set (S310), and an agent information database Db2 and a definition file database Db3 are constructed (S320). This allows the user to use the web system 1, and when the user accesses the web server 6, a visualization process (visualization processes S500 to S800 in Figure 7, which will be described later) is performed as a series of data processing steps to visualize vulnerabilities, and when the user releases access to the web server 6, a web system 1 is constructed that erases the remaining data, excluding metadata, from the data used in the visualization process.

[0017] 7 is implemented using the constructed web system 1, and vulnerabilities of multiple pieces of software in the management server 30 are visualized. In the procedure of this method, a preparation step S400 is implemented, and after the preparation step S400 is completed, visualization steps S500, S600, S700, and S800 are implemented in which a series of data processes for visualizing vulnerabilities are executed. Finally, when the user releases access to the web server 6, the data used in each visualization step is erased except for the metadata (S900).

[0018] First, the web system 1, the agent 2, and the server group 4 will be described in detail.

[0019] 1, a server group 4 is communicably connected to a user computer 20, a management server 30 on which an agent 2 resides, and a manufacturer computer 40 via a network. For example, the network connecting the server group 4 and the manufacturer computer 40 is a local area network (LAN) or a virtual private network (VPN), and the other network is the Internet. In addition, the server group 4 collects software vulnerability information from a public website 50 via the Internet.

[0020] The user computer 20 is a computer that a user uses when using the web system 1. A user refers to an individual or a corporation that has signed a contract with the manufacturer to use the web system 1. The user computer 20 can be any computer that can connect to the Internet and can run various known web browsers, and various known computers can be used.

[0021] The management server 30 is a server computer managed by a user. The management server 30 can be any of various known servers, such as a database server, application server, web server, or mail server, and the system software (operating system) used is not particularly limited. The management server 30 is not limited to a physical server, but also includes a virtual server. When multiple virtual servers are configured on one server computer, each virtual server becomes a management server 30. The number of management servers 30 managed by one user is not particularly limited. Furthermore, different system software may be used for each management server 30 managed by one user.

[0022] The manufacturer computer 40 is a computer used by the manufacturer that provides or operates the web system 1. The manufacturer computer 40 may be any computer that can connect to the server group 4 via a local area network or VPN and that can run various known web browsers, and various known computers may be used.

[0023] The public website 50 is a corporate website or a service site where vulnerability information regarding software vulnerabilities is made public. The public website 50 can be selected from any website publicly available on the Internet. "Public" means that vulnerability information regarding the software vulnerabilities is disclosed to software users via the Internet. The vulnerability information includes Common Vulnerabilities and Exposures (CVE-ID), software name, version, Common Vulnerability Scoring System (CVSS) version and score (rating), severity, etc. The public website 50 includes websites made public by vendors of software for the management server 30. Vendors include vendors of system software (such as operating systems) for the management server 30 and vendors of application software (such as package software). The public website 50 also includes websites made public by parties other than vendors, such as websites that make public Common Vulnerabilities and Exposures or identifiers certified as compatible with them (such as identifiers used in the Japan Information-Technology Promotion Agency's vulnerability countermeasure information database: JVN iPedia) and websites that make public Common Vulnerabilities and Exposures System (CVSS) scores and severity levels for each Common Vulnerability and Exposure.

[0024] The software to be visualized for vulnerabilities includes system software (operating system) that controls the operation of the management server 30, programs (application software, utilities) that cause the management server 30 to execute specified data processing, modules and libraries used to execute those programs, and specified data used in that data processing. The software is managed software that is managed by the package management system (package manager) of the management server 30. The software to be visualized by the web system 1 can be selected arbitrarily and may be different for each management server 30. It is desirable that the software to be visualized include all managed software that is managed by the package management system.

[0025] The agent 2 is resident on the management server 30 into which it is introduced. "Resident" means that it resides in the main storage unit (memory) of the management server 30 and operates in the background even while the management server 30 is executing other programs. In other words, the agent 2 is a software agent that functions constantly on the management server 30. The agent 2 is preferably an installer type that is installed directly on the management server 30, but it may also be a portable type that does not require installation.

[0026] The server group 4 consists of multiple (i) server computers 3. The number of server computers 3 can be selected arbitrarily and can be changed appropriately depending on the number of users n and the number of management servers 30 m. The server computer 3 is composed of a computer, and various data is input and stored, and data processing is performed using this data. Various known computers can be used as the server computer 3. The server computer 3 has a processing unit (CPU) 12, a main storage unit (memory) 13, and an auxiliary storage unit (e.g., HDD) 14. The multiple server computers 3 may have the same specifications, or may have different specifications.

[0027] 2 may be configured such that each server is configured as an individual server computer 3. Alternatively, some of the servers in the server group 4 may be configured as virtual servers on a common server computer 3.

[0028] The web server 6 provides websites to the web browsers of the user computers 20 in accordance with HTTP (Hypertext Transfer Protocol). A streaming server can be used instead of the web server 6. However, the web system 1 uses the web server 6 because it only needs to deliver static data such as text, rather than large amounts of data with time axis information such as video and audio. While a single web server 6 is sufficient, the greater the number of users n, the more web servers are recommended. Installing multiple web servers 6 in parallel and connecting them to the Internet via a load balancer 11a is advantageous in reducing communication and computational loads and ensuring availability and reliability against server downtime or failure due to overload. Each web server 6 may have different server computer 3 specifications, but the same program runs and provides the same service. The load balancer 11a distributes communications (traffic) from multiple user computers 20 to each web server 6 according to resource and URL.

[0029] The application servers 7a to 7d execute data processing using a predetermined program in response to requests from the web server 6 and requests between application servers, and return the processing results. Each of the application servers 7a to 7d is preferably configured with a separate server computer 3 according to its function. The number of server computers 3 constituting each of the application servers 7a to 7d can be selected arbitrarily. The number of application servers 7c should be increased as the number m of management servers 30 on which agents 2 reside increases. Installing multiple application servers 7c in parallel and connecting them to the Internet via a load balancer 11b is advantageous for reducing communication and computational loads and ensuring availability and reliability against server downtime or failure due to overload. The load balancer 11b distributes communications (traffic) from multiple management servers 30 (agents 2) to each of the application servers 7c according to resources and URLs.

[0030] The database server 8 centrally manages the metadata handled by the web system 1, and stores, updates, and backs up the metadata. There may be one database server 8, or multiple database servers 8. Metadata refers to data for explaining, defining, and controlling (processing) the data used in the visualization steps S500 to S800, which will be described later. In this embodiment, the metadata is further defined as data that does not associate the user with the specifications of the management server 30 (host name, IP address, system software name, software name, and vulnerability information thereof). In other words, even if the metadata is leaked from the web system 1 to the outside, it will not generally affect the security of the management server 30 managed by the user.

[0031] Next, the procedure of an embodiment of a method for constructing the web system 1 will be described.

[0032] 3, the construction method includes a server group construction step S100, an agent construction step S200, and a setting step S300. The contents of each step (S100: S110, S120, S200: S210, S220, S300: S310, S320) will be explained below.

[0033] The server group construction process S100 is performed by the manufacturer. By performing the server group construction process S100, the server group 4 becomes operational. Once this process has been performed, the server group construction process S100 does not need to be performed again unless there is a change in the hardware, such as adding a new server computer 3 to the server group 4 or replacing an existing server computer 3 with a new server computer 3.

[0034] In step S110, the web server 6, application servers 7a to 7d, and database server 8 are constructed. Constructing each server means installing predetermined software (such as an operating system and various programs) into multiple server computers 3, and making each server capable of executing predetermined data processing.

[0035] Building the web server 6 includes creating an HTML document (such as a website). The HTML document is created using various known frameworks and libraries. In this embodiment, the HTML document of the web server 6 uses, for example, Next.js as the framework and React as the library.

[0036] The construction of the application server 7a includes the creation of a program that can be executed on the web browser of the manufacturer computer 40. For example, TypeScript is used as a programming language to create this program. The application server 7a is constructed to receive requests sent via the web browser of the manufacturer computer 40 and execute data processing based on the requests.

[0037] The construction of the application server 7b includes the creation of a program that is executed periodically. For example, Rust is used as a programming language for creating this program. The application server 7b is constructed so that the program executes data processing periodically. This program may be implemented with a periodic execution function that sequentially acquires the time and date and executes data processing at a preset time or at preset intervals, or may be executed periodically by a standard job management tool included in the system software of the application server 7b.

[0038] The construction of the application server 7c includes the creation of a program that executes data processing in response to a processing request sent from the web server 6. This program uses, for example, Rust as a programming language. The application server 7c is constructed to execute data processing that transmits the results of data processing in response to the registered request R to the web server 6 and the application server 7d.

[0039] The construction of the application server 7d includes the creation of a program that executes data processing on the data transmitted from the application server 7c. For example, Rust is used as the programming language for this program. The application server 7d is constructed to receive the data transmitted from the application server 7c and execute data processing to transmit the processing results for the data to the web server 6.

[0040] Each of the application servers 7a to 7d includes an application programming interface (API) used for transmitting and receiving data between the servers. Furthermore, the application server 7c may be configured with a plurality of application servers that individually execute each step in the visualization method illustrated in Fig. 7, which will be described later. For example, the application server 7c may be configured with an application server that executes data processing in the preparation step S400 and an application server that executes each of the visualization steps S500 to S800.

[0041] Various known relational database management systems (RDBMS) are used to construct the database server 8. For example, PostgreSQL is used as the relational database management system for the database server 8. Note that the database server 8 may also be constructed using a non-relational database management system other than a relational database management system.

[0042] In step S120, a public vulnerability information database Db1 is constructed and stored as metadata in the database server 8. Specifically, the public vulnerability information database Db1 is constructed by the application server 7b periodically collecting vulnerability information of software published on the public website 50, and is stored in the database server 8.

[0043] 4 is created and updated by the application server 7b and stored in the database server 8. Specifically, the application server 7b periodically visits each public website 50, collects vulnerability information published on each public website 50, creates and updates the public vulnerability information database Db1 using the collected vulnerability information, and executes data processing to store the public vulnerability information database Db1 in the database server 8. The public vulnerability information database Db1 accumulates vulnerability information related to software vulnerabilities published on each public website 50. The frequency with which the application server 7b visits each public website 50 can be selected arbitrarily, for example, about every hour.

[0044] More specifically, the public vulnerability information database Db1 accumulates vulnerability information such as software name, version, Common Vulnerability Scoring System (CVSS) version and score (rating), and severity for each Common Vulnerability and Exposure Identifier (CVE-ID) in the leftmost column of the table. The public vulnerability information database Db1 may also optionally include, as vulnerability information, more detailed vulnerability information, the URL of the public website 50 where the vulnerability information is published, the binary name, binary version, source name, source version, architecture, size, provider vendor, and the URL of the website where the patch file is provided. Because the public vulnerability information database Db1 merely accumulates vulnerability information published on the public website 50, it is treated as metadata. Software names may be converted to CPE names according to the naming convention defined by the Common Platform Expansion (CPE).

[0045] The agent construction process S200 is performed for each user. That is, after the web system 1 is constructed by this construction method, the agent construction process S200 is performed when a new user starts using the web system 1 or when an existing user adds a new management server 30.

[0046] In step S210, agent 2 is installed in management server 30. Agent 2 may be installed in management server 30 by the manufacturer or by the user. When installed by the user, agent 2 is distributed to the user on a storage medium such as a CD-ROM, DVD-ROM, or USB memory, or in a package that can be downloaded from a product website. A unique agent identifier is assigned to agent 2. These agent identifiers are managed by the manufacturer.

[0047] In step S220, the agent 2 installed in the management server 30 is made resident. Specifically, the agent 2 installed in the management server 30 is made resident by starting the agent 2. The resident agent 2 is automatically executed when the management server 30 is started, and continues to operate in the background.

[0048] The setting process S300 is performed by the manufacturer using the manufacturer computer 40. In the setting process S300, settings are made regarding user access to the web system 1. As with the agent construction process S200, the setting process S300 is performed when a new user starts using the web system 1 or when an existing user adds a new management server 30 after the web system 1 has been constructed by this construction method.

[0049] In step S310, the manufacturer computer 40 registers the user in the authentication server 10, and a user identifier for the registered user is created by the authentication server 10. Also in step S310, a login ID, password, etc. associated with the user identifier are issued by the authentication server 10. The issued login ID and password are then distributed to the user.

[0050] In step S320, an agent information database Db2 and a definition file database Db3 are constructed and stored in the database server 8. The agent information database Db2 and the definition file database Db3 are constructed by the manufacturer by operating the web browser of the manufacturer computer 40, and are stored in the database server 8 via the application server 7a.

[0051] The agent information database Db2 shown in Fig. 5 is created and updated by the manufacturer and stored in the database server 8. Specifically, the manufacturer issues a request to the application server 7a via the web browser of the manufacturer computer 40 to create and update the agent information database Db2. The application server 7a then creates and updates the agent information database Db2 based on the request and executes data processing to store it in the database server 8. In the agent information database Db2, a unique agent identifier (A1, A2,..., Aj, B1,...) for each agent 2 is associated with a unique user identifier (U1, U2,...). In other words, the agent information database Db2 associates the agents 2 with the users.

[0052] More specifically, in the agent information database Db2, for each user (A, B, . . .) in the leftmost column of the table, an agent identifier (A1, . . . , Aj, B1, . . . ) and a user identifier (U1, U2, . . . ) are associated. The procedure for creating the agent information database Db2 is as follows: first, a user is created. Then, the user identifier created by the authentication server 10 is registered. Next, the agent identifier managed by the manufacturer is registered. The agent information database Db2 may additionally include any information that satisfies the constraint that the specifications of the management server 30 managed by the user (such as the host name, IP address, type of system software, and name of the program being executed) are not specified. Examples of such information include the expiration date of the agent 2, the date of data registration, and the date of data update. In the agent information database Db2, users, user identifiers, and agent identifiers are associated, but users are not associated with the specifications of the management server 30 (such as the host name, system software name, software name, and vulnerability information thereof). Therefore, the agent information database Db2 is treated as metadata.

[0053] The definition file database Db3 illustrated in FIG. 6 is created and updated by the manufacturer and stored in the database server 8. Specifically, the manufacturer issues a request to the application server 7a via a web browser on the manufacturer computer 40 to create and update the definition file database Db3. The application server 7a then creates and updates the definition file database Db3 based on the request and executes data processing to store the definition file database Db3 in the database server 8. The definition file database Db3 accumulates search conditions for multiple pieces of unmanaged software as definition files. Unmanaged software differs depending on the specifications of the management server 30. Therefore, the definition file database Db3 is created when a new user is added and the management server 30 managed by the new user uses unmanaged software. The definition file database Db3 is also updated when an existing user installs new unmanaged software on the management server 30. Some users may not create a definition file database Db3.

[0054] More specifically, the definition file database Db3 accumulates definition file identifiers, search strings, search paths, and the like as definition files. The definition file database Db3 may also accumulate exclusion paths, hash values, whether or not a definition file is publicly set, hierarchy (compressed file), search commands, vulnerability details, severity levels, threat levels, more detailed vulnerability details, the URL of a public website 50 where vulnerability information is published, and the URL of a website where patch files are provided. The definition files represent the rows in the table in FIG. 6. The definition file identifier is a unique identifier that is assigned to each definition file when the definition file is added. It is sufficient to construct a single definition file database Db3 that is common to all users of the web system 1. The definition file database Db3 merely accumulates information about unmanaged software, and is therefore treated as metadata.

[0055] By carrying out the above-described server group construction step S100, agent construction step S200, and setting step S300, a web system 1 is constructed. Specifically, when a user accesses the web server 6, each of the visualization steps S500 to S800 is performed for each management server 30 on which an agent 2 associated with the user resides, and when the user releases access to the web server 6, a web system 1 is constructed that erases all data used in each of the visualization steps S500 to S800 except for metadata.

[0056] Next, an example of the procedure of the vulnerability visualization method using the constructed web system 1 will be described.

[0057] In the vulnerability visualization method illustrated in FIG. 7, a preparation step S400 and visualization steps S500 to S800 are performed for each user in this order. In the preparation step S400, a user who accesses the web server 6 selects an agent 2 installed in the management server 30 as a target for vulnerability visualization, and preparations are made to start each visualization step. In each visualization step, a series of data processes are performed to visualize software vulnerabilities in the management server 30, and the processing results are distributed to the user via the web server 6. Finally, when the user releases access to the web server 6, the remaining data, excluding metadata, from the various data used in each visualization step S500 to S800 is deleted (S900). The contents of each step of the preparation step S400, the visualization steps S500 to S800, and step S900 are described below.

[0058] The preparation step S400 illustrated in Figures 8 and 9 is performed in a preparation stage before each visualization step is performed. This preparation step S400 is performed each time a user accesses the web system 1. Therefore, if multiple users access the web server 6 at the same time, multiple preparation steps S400 are performed simultaneously. In one example of the preparation step S400, an authentication step (S411 to S413 in Figure 8), a display step (S421 to S426 in Figure 8, S427 and S428 in Figure 9), a request registration step (S431 and S432 in Figure 9), a request confirmation step (S441 and S442 in Figure 9), and an update step (S451 to S454 in Figure 9) are performed in this order.

[0059] In the authentication process (S411 to S413), a user who has accessed the web system 1 is authenticated. In the authentication process, various known authentication methods can be used. The authentication method may be session-based authentication, but token-based authentication is preferable. Token-based authentication is stateless and reduces the computational load when the number of users increases compared to session-based authentication, making it suitable for a more scalable system. The authentication method in this embodiment is JWT (JSON Web Token) authentication using OIDC (OpenID Connect).

[0060] In step S411, when an unauthenticated user accesses the web server 6 from the user computer 20, the web server 6 executes data processing to redirect the access to the authentication server 10. At this time, the web server 6 also executes data processing to request the authentication server 10 to issue a user identifier (ID token) and an access token. Access to the web server 6 is achieved by entering the URL of a website provided by the web server 6 into the web browser of the user computer 20.

[0061] In step S412, the authentication server 10 executes data processing to request the user to authenticate using OIDC. Specifically, an authentication website provided by the authentication server 10 is displayed on the web browser of the user computer 20, and authentication (login) is performed by the user's operation. This authentication may use a login identification number and password associated with a user identifier, or may use two-step authentication using email, SMS, or the like. FIDO authentication using biometric information such as a fingerprint or iris may be used instead of a login identification number and password.

[0062] In step S413, if the OIDC authentication is successful, the authentication server 10 issues a JWT and executes data processing to send the JWT to the web server 6. The JWT contains a user identifier and an access token. When the web server 6 receives the JWT sent from the authentication server 10, user authentication is completed and the user becomes able to use the web system 1. This JWT is stored until the target user logs out, that is, until the target user releases access to the web server 6, and is deleted or invalidated when the target user logs out.

[0063] In the display step (S421 to S428), all agents 2 associated with the user are displayed on the website. Specifically, in the display step, list data T1 for the agents 2 associated with the user is created and displayed on the website provided by the web server 6. For example, it is preferable to incorporate a dashboard into the website and aggregate the list data T1 in the dashboard. The list data T1 will be described later.

[0064] In step S421, the web server 6 executes data processing to extract an access token from the JWT sent from the authentication server 10 and send the access token to the application server 7c. Next, in step S422, the application server 7c executes data processing to send the access token to the authentication server 10. Next, in step S423, the authentication server 10 executes data processing to verify the access token, and if the verification is successful, to create a JWT and send the JWT to the application server 7c.

[0065] In step S424, the application server 7c executes data processing to acquire a user identifier from the JWT. Next, in step S425, the application server 7c executes data processing to acquire all agent identifiers associated with the user identifier by referencing the agent information database Db2 stored in the database server 8.

[0066] Next, in step S426, the application server 7c executes data processing to acquire aggregated data associated with the agent identifier by referring to an aggregated database Db4 (an example of which is shown in FIG. 14, which will be described later) stored in the data server 8. The aggregated data is data obtained by aggregating the results of the previous visualization step S500 performed by the same user (e.g., the number of software programs determined to have vulnerabilities). The aggregated database Db4 and the aggregated data will be described later. Note that if there is no aggregated data associated with the agent identifier, such as when logging in for the first time or when a new agent 2 is added, blank data (letters, numbers, symbols, etc., indicating that no data exists) is acquired as the aggregated data.

[0067] Next, in step S427, the application server 7c executes data processing to transmit the acquired aggregated data to the web server 6. Next, in step S428, the web server 6 executes data processing to display list data T1 incorporating the aggregated data on a website.

[0068] In the request registration steps (S431, S432), the user selects a desired agent 2 from the agents 2 displayed on the web browser of the user computer 20, and a request R for visualizing vulnerabilities of each software of the management server 30 on which the selected desired agent 2 resides is registered in the application server 7c. The application server 7c, for which the request R has been registered in the request registration step, enters a standby state until data is sent from the agent 2.

[0069] In step S431, the web server 6 executes data processing to transmit the agent identifiers of the desired agents 2 selected from the list data T1. The number of agents 2 to be selected may be one or more, or may be all of the agents 2 present in the list data T1.

[0070] In step S432, the application server 7c executes data processing to create and register a request R for visualizing vulnerabilities for the selected agent 2 based on the received agent identifier. Registering the request R means that the request R is stored in a valid state in the main memory unit 13 or the auxiliary memory unit 14 of the application server 7c. By registering the request R in the application server 7c, the request R is always maintained in a valid state while the user is logged in to the web system 1. A request R is created for each selected agent 2. For example, if j agents 2 are selected, j requests R are created.

[0071] In the request confirmation process (S441, S442), the agent 2 confirms the request R registered in the application server 7c. The request confirmation process is constantly executed by the agent 2. That is, the request confirmation process is repeatedly executed at a predetermined interval after the agent 2 is introduced into the management server 30 and made resident.

[0072] In step S441, the agent 2 repeatedly executes data processing at a predetermined cycle to check whether a request R for itself has been registered with the application server 7c. The predetermined cycle can be selected arbitrarily, for example, about one second. The communication load and calculation load caused by the repeated data processing at the predetermined cycle are about the same as the "ping" command executed in the Windows (registered trademark) command prompt or the Linux (registered trademark) or macOS (registered trademark) terminal. In other words, the agent 2 only executes this data processing, which has a relatively small communication load and calculation load, until the request R is registered with the application server 7c, which is advantageous in minimizing the impact on the management server 30 caused by the agent 2 being resident.

[0073] In step S442, the agent 2 executes data processing to confirm that the request R has been registered in the application server 7c. Until step S442 is executed, that is, until the desired agent 2 is selected by the user who has accessed the web server 6 and the request R for the desired agent 2 is registered in the application server 7c (S432), the agent 2 repeatedly executes step S441 at a predetermined cycle.

[0074] In the update process (S451 to S454), the agent 2 acquires server data related to the management server 30 and updates the website to add the server data. The update process can be omitted, but displaying the server data related to the management server 30 on the website is advantageous for identifying each management server 30 more specifically. This update process is performed asynchronously, i.e., it is performed at different times for each selected and desired agent 2.

[0075] In step S451, the agent 2 executes data processing to acquire server data using standard commands executable by the system software (operating system) of the management server 30. The server data is data that can identify the specifications of the management server 30 and can be selected arbitrarily. Examples of the server data include a host name, an IP address, and a type of system software. When the system software is Linux (registered trademark), for example, a hostname command is used as a standard command.

[0076] In step S452, the agent 2 executes data processing to transmit the acquired server data to the application server 7c. Next, in step S453, the application server 7c executes data processing to transmit the server data transmitted from the agent 2 to the web server 6.

[0077] In step S454, the web server 6 executes data processing to add server data to the list data T1, update the list data T1, and display the updated list data T1 on the website.

[0078] List data T1 shown in Figure 10 is created by application server 7c, transmitted to web server 6, and displayed on the website. One example of list data T1 is a collection of agent identifiers (A1,...,Aj) associated with user identifier U1 of the logged-in user. List data T1 includes an item to be checked in the request registration process, and a check mark is placed on agent 2 selected by the user.

[0079] More specifically, the list data T1 accumulates aggregated data and server data for each agent identifier (A1, . . . , Aj) in the leftmost column of the table. The aggregated data and server data can be selected arbitrarily and can be omitted. The aggregated data is acquired in the display process and is based on the aggregated database Db4 in FIG. 14, which will be described later. The aggregated data accumulates the aggregation results for each last update date and time, which indicates the previous date and time when the visualization process S500, which will be described later, was performed and the date and time when the user accessed the web server 6. Details of the aggregated data will be described later. The server data is acquired in the update process and accumulates data related to the management server 30 on which the agent 2 resides. The server data includes data related to the management server 30, such as the host name, IP address, and type of system software of the management server 30.

[0080] This list data T1 associates the user with the agent 2, and is not treated as metadata because it allows the number of management servers 30 managed by the user to be determined even if the list data T1 does not have aggregate data or server data. In particular, if the list data T1 has server data, it allows detailed information about the management servers 30 managed by the user to be determined. Therefore, the list data T1 is deleted from the server group 4 when the user releases access to the web server 6.

[0081] After the update process is performed, the website may be configured to display the host name of the management server 30 instead of the agent identifier. That is, the update process is performed sequentially for each agent 2, and the host name is reflected sequentially in the agent identifier column.

[0082] After the preparation step S400 is completed, the visualization steps S500 to S800 are performed. By performing each visualization step, a series of data processing steps is performed to visualize software vulnerabilities of the management server 30. Each visualization step is performed by individually executing stream processing. Stream processing is data processing that collects data in real time, converts and analyzes the collected data, and distributes the results. That is, in the visualization step of this embodiment, after the visualization step starts, a series of data processing steps is performed in which various data are acquired by the agent 2, treated as streaming data, processed in real time by the application servers 7c and 7d, and the processing results are distributed by the web server 6.

[0083] 11, a series of data processing steps (S510 to S570) for visualizing software vulnerabilities is performed by stream processing. Of the data used in the visualization step S500, the public vulnerability information database Db1 and the agent information database Db2 are treated as metadata, and the software data D1 and vulnerability information data D2 are targeted for deletion.

[0084] In step S510, the agent 2 executes data processing using the package management system of the management server 30 to acquire software data D1 including specifications of the managed software managed by the package management system. The package management system is included as standard in the system software (operating system) of the management server 30. In addition to the package management systems included as standard in the system software, package management systems that manage programming language source code, modules, and libraries (e.g., Cargo for Rust) and package management systems used to build programming language frameworks and runtimes (execution environments) (e.g., npm and yarn for Node.js) can also be used. Furthermore, a third-party package management system (provided by a vendor other than the system software vendor) (e.g., Chocolatey for Windows (registered trademark)) can also be used. When the system software is Linux (registered trademark), for example, Yum is used as the package management system.

[0085] The software data D1 illustrated in FIG. 12 is acquired using the package management system of the management server 30. The software data D1 is data related to the specifications of the managed software managed by the package management system of the management server 30. The specifications of the managed software include, for example, the software name and version. The software name may be converted into a CPE name that conforms to the naming rules defined by the Common Platform Enumeration (CPE).

[0086] In step S520, the agent 2 executes data processing to transmit the acquired software data D1 to the application server 7c by streaming. Various well-known protocols, such as the HTTP Live Streaming (HLS) protocol, are used for transmitting streaming data.

[0087] In step S530, the application server 7c executes data processing to receive the software data D1. When receiving the software data D1, the application server 7c preferably executes data processing to determine the authenticity of the agent 2 that transmitted the software data D1. Specifically, the application server 7c executes data processing to confirm the association between the agent identifier of the agent 2 that transmitted the software data D1 and the registered user identifier of the user that issued the request R, by referring to the agent information database Db2 illustrated in FIG. 5. The agent identifier used when registering the request R may be used instead of the user identifier of the user that issued the request R. The software data D1 for which the association is confirmed is received, while data for which the association cannot be confirmed is not received but is removed (deleted). In this way, determining the authenticity of the agent 2 that transmitted the software data D1 effectively prevents the reception of counterfeit software data transmitted from an external source other than the agent 2, which is advantageous to improving the security of the web system 1. In step S540, the application server 7c executes data processing to transmit the software data D1 to the application server 7d.

[0088] In step S550, the application server 7d executes data processing to determine whether or not each piece of software has a vulnerability based on the software data D1 and the public vulnerability information database Db1 stored in the database server 8. In this data processing, for example, the software name and version of the software data D1 are compared with the software name and version in the public vulnerability information database Db1, and software that matches is determined to have a vulnerability. As a result of this data processing, vulnerability information data D2 is obtained, which is an accumulation of vulnerability information for software determined to have a vulnerability.

[0089] The vulnerability information data D2 illustrated in FIG. 13 represents the determination result of step S550 based on the software data D1 acquired by the agent 2 with the agent identifier A1. The vulnerability information data D2 accumulates vulnerability information related to vulnerabilities in software determined to be vulnerable. The vulnerability information in the vulnerability information data D2 can be arbitrarily selected from information stored in the public vulnerability information database Db1. The vulnerability information data D2 accumulates, as vulnerability information, Common Vulnerabilities and Exposures (CVE-ID), Common Vulnerability Scoring System (CVSS) version and score, severity, and the like. The vulnerability information data D2 can further include, as more detailed vulnerability information, the software name (CPE name) of the software determined to be vulnerable, more detailed information about the vulnerability, the URL of the public website 50 where the vulnerability information is published, the binary name, binary version, source name, source version, architecture, size, provider vendor, and the URL of the website where a patch file is provided. The vulnerability information data D2 is created for each agent 2.

[0090] In step S550, it is preferable that the application server 7d executes data processing based on the obtained vulnerability information data D2 to create a summary database Db4 that accumulates the number of software programs determined to have vulnerabilities and the dates and times when the vulnerability information data D2 was obtained for each agent 2, and stores the resulting database Db4 as metadata in the database server 8. The number of software programs determined to have vulnerabilities may be tallied separately for each severity level.

[0091] 14 is created and updated in step S550 and stored in the database server 8. The aggregation database Db4 accumulates, as aggregation data for the agent 2, the number of software programs determined to have vulnerabilities as a result of the determination in step S550 and the date and time when the vulnerability information data D2 was obtained.

[0092] More specifically, the aggregation database Db4 accumulates, as aggregation data, the date and time (yyyy / mm / dd HH:MM:SS) when step S550 was performed and the total number of software applications determined to be vulnerable for each agent identifier (A1, . . . , Aj) in the leftmost column of the table. The aggregation database Db4 also accumulates the number of software applications determined to be vulnerable by severity level. The aggregation database Db4 may accumulate aggregation results from the time a user begins using the web system 1, but it may also accumulate aggregation results for a period of about one month, or for the number of times step S550 has been performed about five to ten times. This aggregation database Db4 accumulates only the number of software applications determined to be vulnerable, and does not accumulate the specifications of the vulnerabilities (e.g., CVE-ID). Therefore, the aggregation database Db4 is treated as metadata.

[0093] In step S560, the application server 7d executes data processing to transmit vulnerability information data D2 to the web server 6 as the determination result. The determination result may be only the vulnerability information data D2 illustrated in FIG. 13, but preferably includes both the vulnerability information data D2 and the aggregated data in the aggregation database Db4 updated based on the vulnerability information data D2. When transmitting the aggregated data to the web server 6, it is preferable to obtain the aggregated data associated with the agent identifier and transmit the aggregated data, similar to the display steps illustrated in FIGS. 8 and 9.

[0094] In step S570, the web server 6 executes data processing to distribute the determination results to the user. The determination results are distributed via a website provided by the web server 6. For example, a dashboard may be incorporated into the website, and the vulnerability information data D2 and the aggregated data may be aggregated in the dashboard. The aggregated data may also be aggregated into list data T1. By aggregating each data item in the dashboard, the vulnerability information data D2 may be displayed as a list, or the time series of the aggregation results in the aggregated data may be displayed as a line graph or bar graph. This makes it possible to visually represent the vulnerabilities of the software in the management server 30, which is advantageous for accurately evaluating the vulnerabilities of the management server 30.

[0095] The visualization step S500 is performed for each agent 2. Therefore, the multiple determination results obtained in the visualization step S500 performed for each agent 2 are distributed by the web server 6 in the order in which the visualization step S500 is completed.

[0096] In the visualization step S500, all of the software data D1 acquired by the agent 2 can be sent to the application server 7c at once, but it is preferable to divide the software data D1 into pieces of a predetermined data size and send them to the application server 7c. This allows the data processing of steps S520 to S570 to be performed sequentially for each piece of divided software data D1, acquiring the data asynchronously. The predetermined data size in this visualization step S500 is, for example, about 10 kilobytes. Data processing of the divided software data D1 can reduce the communication load and calculation load, which is advantageous for reducing the latency of data processing.

[0097] In the visualization step S600 illustrated in FIG. 15, a series of data processes (S610-S650, S710-S750) are performed by stream processing to visualize resource data D3 of the management server 30. In the visualization step S700 illustrated in FIG. 16, a series of data processes are performed by stream processing to visualize process data D4 of the management server 30. Of the data used in the visualization steps S600 and S700, resource data D3 and process data D4 are subject to deletion. These visualization steps S600 and S700 differ from the visualization step S500 illustrated in FIG. 11 above in that steps S550 and S560 are omitted and data is sent directly from the application server 7c to the web server 6. However, the other steps are generally similar in content, except for the data handled. Therefore, detailed descriptions of each step of these visualization steps S600 and S700 will be omitted, and only the differences from the visualization step S500 will be described.

[0098] In step S610 illustrated in FIG. 15, the agent 2 executes data processing to acquire resource data D3 of the management server 30 using standard commands executable by the system software (operating system) of the management server 30. If the system software is Linux (registered trademark), for example, a TOP command, a vmstat command, an uptime command, etc. are used. Also, in this step S610, the agent 2 may execute data processing to acquire resource data D3 using the file system, system calls, standard libraries, etc. of the system software. If the system software is Linux (registered trademark), the file system is, for example, stat or meminfo under / proc. If the system software is Windows, the system call is, for example, Win32 API. If the system software is Linux (registered trademark), the standard library is, for example, libc.

[0099] 16, the agent 2 executes a data process to acquire process data D4 of the management server 30 using a command executable by the system software (operating system) of the management server 30. When the system software is Linux (registered trademark), for example, <pid>Subordinate cmdline, environ, etc. are used. <pid>The process ID managed by the system software corresponds to the process ID managed by the system software. As with the resource data D3, data processing may be performed to acquire the process data D4 using a system call or a standard library of the system software.

[0100] Unlike the software data D1, the resource data D3 and the process data D4 are constantly changing. Therefore, the visualization steps S600 and S700 may be repeatedly performed at predetermined intervals while the request R is registered in the application server 7c. The predetermined interval in these visualization steps S600 and S700 may be, for example, about one second.

[0101] 17, any index can be selected to indicate the operating status of the management server 30. The resource data D3 includes, for example, the overall CPU usage rate (%), the CPU usage rate (%) of the user process, the free space of physical memory (KB), the amount of memory swapped in per second (KB / S), the amount of memory swapped out per second (KB / S), and the overall system load (load average) for one minute.

[0102] 18 represents a program currently being executed on the management server 30. The process data D4, for example, accumulates child processes for each parent process. The process data D4 also accumulates, for example, the command (executable file name) of the child process, the date and time the process was started, the size of the data segment, the peak value of the page size existing in the real memory, the size of the shared library code, etc.

[0103] Like the determination results, the resource data D3 and the process data D4 are distributed via a website provided by the web server 6. For example, it is preferable to incorporate a dashboard into the website and aggregate the resource data D3 and the process data D4 in the dashboard.

[0104] By performing the visualization steps S600 and S700, it becomes possible to grasp the resources and processes of the management server 30 in real time. This makes it possible to grasp the status of the management server 30 more accurately. Understanding whether the status of the management server 30 is good or bad is advantageous for checking whether there has been a cyber attack exploiting a vulnerability in the management server 30, or whether any problems have occurred in the countermeasures for the visualized vulnerabilities.

[0105] In the visualization process S800 illustrated in FIG. 19, a series of data processes (S810 to S870) for visualizing unmanaged software not managed by the package management system of the management server 30 is performed by stream processing. Specifically, scan data D5 of the unmanaged software is visualized. Of the data used in the visualization process S800, the definition file database Db3 is treated as metadata, and scan data D5 is subject to deletion. This visualization process S800 differs from the visualization process S500 illustrated in FIG. 11 above in that steps S550 and S560 are omitted, and stream data is sent directly from the application server 7c to the web server 6, and steps S810 and S820 are added, and scan data D5 is acquired as stream data. However, the content of each of the other steps is generally similar, except for the data handled. Therefore, detailed description of each step of this visualization process S800 will be omitted, and only the differences from the visualization process S500 will be described.

[0106] In step S810, the application server 7c executes data processing to send the definition file database Db3 stored in the database server 8 to the agent 2. The definition file database Db3 may not be sent depending on the agent 2. In other words, the definition file database Db3 is not sent to an agent 2 that resides on a management server 30 that does not use unmanaged software.

[0107] In step S810, it is preferable that the application server 7c executes data processing to transmit a desired definition file selected from the plurality of definition files present in the definition file database Db3 illustrated in Fig. 6 to the agent 2. The desired definition file is not limited to a plurality of files, and may be one. Also, a different definition file may be selected for each management server 30 for one user.

[0108] More specifically, when a user accesses the web server 6, the application server 7c executes data processing to obtain a list of definition files from the definition file database Db3 and transmit the obtained list to the web server 6. The web server 6 then executes data processing to display the list on the web browser of the user computer 20. The user computer 20 then selects a desired definition file from the list, via the web server 6, that matches the specifications of the management server 30 managed by the user. The definition file identifier of the selected desired definition file is then saved in the web browser of the user computer 20. The definition file identifier is saved in the web browser using, for example, a cookie or local storage. The web server 6 then executes data processing to transmit the definition file identifier of the selected desired definition file to the application server 7c. The application server 7c then executes data processing to obtain the corresponding definition file based on the received definition file identifier and the definition file database Db3 and transmit the obtained definition file to the agent 2. After the definition file identifier is saved in the web browser of the user computer 20, the series of data processing steps from obtaining the list of definition files to saving the definition file identifier can be omitted, and the data processing starts with the web server 6 sending the definition file identifier saved in the web browser of the user computer 20 to the application server 7c.

[0109] Because each user uses different unmanaged software, the definition file database Db3 contains a larger number of definition files, i.e., a larger amount of data, as the number of users n and the number of unmanaged software increase. Therefore, in step S810, using a desired definition file selected by the user instead of the definition file database Db3 is advantageous in reducing communication and computational loads. Furthermore, more appropriate scan data D5 can be obtained as a result of step S820, described below, enabling more accurate vulnerability assessment. Furthermore, by storing the definition file identifier in the web browser of the user computer 20, it is not necessary to associate the definition file database Db3 with a user identifier or agent identifier, and the definition file database Db3 can be treated as metadata. The series of data processing steps leading up to storing the definition file identifier of the desired definition file in the web browser of the user computer 20 may be performed in the preparation step S400.

[0110] In step S820, the agent 2 executes data processing to perform a directory scan of the management server 30 using the definition file database Db3. In one example of a directory scan, the agent 2 uses a standard command executable by the system software (operating system) of the management server 30, and performs a directory scan of the management server 30 using each item in the definition file database Db3 as an option for that command. If the operating system is Linux (registered trademark), for example, an ls command is used. In another example of a directory scan, the agent 2 executes a search command set in the definition file database Db3, and if the execution result matches a search string in the definition file database Db3, the matching file and its directory are identified. If the operating system is Linux (registered trademark), for example, openssl version is used as the search command, and which openssl is used for identification. Furthermore, similar to the visualization steps S600 and S700 illustrated in FIGS. 15 and 16 above, the agent 2 may perform a directory scan using a system call or standard library of the system software.

[0111] The scan data D5 illustrated in FIG. 20 represents a file that matches a file defined in the definition file database Db3. The scan data D5 accumulates data on items arbitrarily selected from the items in the definition file database Db3 as a result of a directory scan. The scan data D5 may, for example, accumulate a detected path as a result of the directory scan, and detailed vulnerability information and threat levels as items selected from the definition file database Db3. The scan data D5 may also accumulate, for example, file names, extensions, file sizes, inodes, and last access times as results of the directory scan. The scan data D5 may also accumulate, for example, URLs of public websites 50 where vulnerability information is published and URLs of websites where patch files are provided as items selected from the definition file database Db3.

[0112] By performing the visualization process S800, it is possible to search for character strings and hash values ​​of vulnerable unmanaged software to check for any matches, thereby confirming whether or not the unmanaged software has vulnerabilities. This is advantageous for more accurately identifying vulnerabilities in unmanaged software. Furthermore, by using the scan data D5, it is possible to identify bloated files by checking file size, determine the extent of inode depletion by checking inodes, and identify files that have not been used for a long time by checking the last access time. This is advantageous for the normal operation of the management server 30.

[0113] Similar to the determination results, the scan data D5 is distributed on a website provided by the web server 6. For example, it is advisable to incorporate a dashboard into the website and aggregate the scan data D5.

[0114] In the visualization step S800, similar to the visualization step S500 described above, all of the scan data D5 acquired by the agent 2 can be sent to the application server 7c at once. However, similar to the software data D1, it is preferable to divide the scan data D5 into pieces of a predetermined data size and send the divided scan data D5 to the application server 7c at predetermined intervals. The predetermined data size in this visualization step S800 is, for example, about 10 kilobytes. Data processing of the divided scan data D5 can reduce the communication load and calculation load, which is advantageous for reducing the latency of data processing.

[0115] In the visualization step S800, the application server 7c may perform data processing to transmit the scan data D5 to the application server 7d, and the application server 7d may perform data processing to determine vulnerabilities in the unmanaged software based on the scan data D5 and the public vulnerability information database Db1. In this case, in the visualization step S800, vulnerability information data on the unmanaged software is distributed via a website as the determination result, similar to the visualization step S500. In addition, in the visualization step S800, the results of the directory scan may be accumulated in the aggregation database Db4. For example, the number of files detected as a result of the directory scan may be regarded as the number of software items determined to be vulnerable in the aggregation database Db4, and the date and time when the directory scan was performed may be regarded as the date and time when the vulnerability information data D2 was obtained. When the results of the directory scan are accumulated in the aggregation database Db4, it is preferable that managed software and unmanaged software be distinguished.

[0116] When the data acquired by the agent 2 (software data D1, resource data D3, process data D4, and scan data D5) is transmitted from the agent 2 to the application server 7c, each piece of data may be transmitted at the same time, but it is preferable that the timing of transmission for each piece of data differ. Specifically, the visualization steps S500 to S800 are adjusted so that each piece of data acquired by the agent 2 is treated as a single piece of streaming data. This allows each piece of data to be transmitted to the application server 7c sequentially at predetermined intervals, thereby preventing excessive communication load on the management server 30 and reducing the communication and computation load on the application server 7c. Furthermore, since the web server 6 can transmit data to users as it becomes available for distribution, this is advantageous in shortening the waiting time until data is distributed.

[0117] The visualization steps S500 and S800 may be repeatedly performed at predetermined intervals, similar to the visualization steps S600 and S700, but the vulnerability information data D2 and scan data D5 are static data that do not change in the short term. Therefore, once all of the vulnerability information data D2 and scan data D5 have been collected in the management server 30, the visualization steps S500 and S800 do not need to be repeated and can be terminated at any time from the user computer 20 via the software server 6.

[0118] Ultimately, the dashboard of the website provided by the web server 6 aggregates the list data T1 (including aggregated data and server data), vulnerability information data D2, resource data D3, process data D4, and scan data D5 for each of the agents 2 selected by the accessing user. The user operates the web browser of the user computer 20 to display each piece of data aggregated on the dashboard, thereby visualizing the software vulnerabilities for each management server 30.

[0119] In step S900 shown in FIG. 7, when a user releases access to the web server 6, the data used in each of the visualization steps S500 to S800 is erased, excluding metadata. Access may be released when the user logs out of the web system 1 or when a predetermined time has passed since the user closed a website provided by the web server 6. The data used in each of the visualization steps S500 to S800 also includes data used in the preparation step S400. The predetermined time in step S900 is, for example, approximately 15 minutes. The data to be erased includes a JWT (including a user identifier and an access token), an agent identifier, server data, a request R, list data T1, software data D1, vulnerability information data D2, resource data D3, process data D4, and scan data D5. Note that data erasure is performed by the web server 6 and application servers 7c and 7d, where the data to be erased resides.

[0120] The web system 1 may be configured to allow all data displayed on the web browser of the user computer 20 to be exported in various known data formats, such as PDF or CSV. For example, a check box or toggle switch may be provided for each item displayed on the web browser (vulnerability information data D2, resource data D3, process data D4, scan data D5, etc.), allowing export to be enabled or disabled. The selected item may then be output by an output device such as a printer, stored on a storage medium such as a CD-ROM, DVD-ROM, or USB memory, or downloaded from a website to the user computer.

[0121] As described above, according to this embodiment, the visualization steps S500 to S800, which are a series of data processes for visualizing vulnerabilities, are performed only when a user is accessing the web server 6. In other words, the agent 2 and the server group 4 do not perform the visualization steps S500 to S800 for a user until the user accesses the web server 6. This makes it possible to keep the constant communication load and calculation load between the management server 30 in which the agent 2 is installed and the server group 4 low.

[0122] More specifically, as a preparation step S400, the agent 2 repeats data processing (S441) at a predetermined interval to check whether the request R has been registered with the application server 7c until the request R is registered with the application server 7c by the user who accessed the web server 6. This data processing (S441) has a small communication load and a small calculation load, and is therefore advantageous for keeping the communication load and calculation load of the management server 30 on which the agent 2 resides low.

[0123] Furthermore, in the server group 4, the application server 7b periodically visits the public website 50 regardless of whether or not a user is accessing the web server 6, and if there is any new information, performs data processing to update the public vulnerability information database Db1. In other words, when no user is accessing the web server 6, the application server 7b in the server group 4 performs only this data processing. This data processing has a small communication load and a small calculation load, which is advantageous for keeping the communication load and calculation load of the server group 4 low.

[0124] The application server 7b may further be configured to store a timestamp at the time of updating the public vulnerability information database Db1. This allows the application server 7b to compare the timestamp at which the public vulnerability information to be collected was created or updated with the pre-stored timestamp when updating the public vulnerability information database Db1. If the timestamp at which the public vulnerability information was created or updated is older than the stored timestamp, the public vulnerability information can be prevented from being acquired or updated, which is advantageous for keeping the communication load and calculation load on the server group 4 low.

[0125] Furthermore, according to this embodiment, when a user releases access to the web server 6, all data other than the metadata is deleted from the server group 4, leaving only the public vulnerability information database Db1, agent information database Db2, definition file database Db3, and aggregation database Db4 as metadata in the server group 4. These metadata do not associate the specifications of the user and the management server 30 (such as host name, IP address, system software name, and software vulnerability information). Therefore, even if the metadata were to leak to the outside, the user's management server 30 would not be exposed to cyberattacks that exploit software vulnerabilities resulting from the leak.

[0126] Therefore, this embodiment is configured to be able to visualize the vulnerabilities of the management server 30 in real time at a timing desired by the user, while further reducing the constant communication and calculation load on the management server 30 and the server group 4 and preventing the leakage of vulnerability information. This makes it possible to provide a service that visualizes the vulnerabilities of the management server 30 to more users and makes vulnerability assessment more efficient, which is advantageous in reducing the considerable time and effort required to manage a large number of management servers 30.

[0127] The web system 1 may be configured to perform only the visualization step S500, but is preferably configured to perform the visualization step S600 and / or the visualization step S700. By displaying the resource data D3 and the process data D4, it becomes possible to accurately grasp the operating status of the management server 30, and vulnerability assessment can be performed with higher accuracy. It is more preferable that the web system 1 is further configured to perform the visualization step S800. Displaying the scan data D5 is advantageous for assessing vulnerabilities in unmanaged software that are difficult to detect using vulnerability visualization methods of the prior art and are potential vulnerabilities.

[0128] In this embodiment, the visualization steps S500 to S800 are performed using stream processing. However, they may also be performed using batch processing or ad hoc processing. However, in batch processing or ad hoc processing, the vulnerability information data D2, resource data D3, process data D4, and scan data D5 are displayed on a website provided by the web server 6 as soon as they are collected. In other words, the more agents 2 selected by the user and the greater the amount of data processed in a series of data processing, the longer the wait time until all data can be displayed in batch processing or ad hoc processing. On the other hand, in stream processing, any of the vulnerability information data D2, resource data D3, process data D4, and scan data D5, or partial data of any of these data, is displayed on the website as soon as it is received by the web server 6. In other words, in stream processing, the wait time until data can be displayed is generally the same regardless of the amount of data. Therefore, the user does not find the wait time unpleasant.

[0129] The total amount of data handled by the web system 1 increases as the number m of management servers 30 managed by the user increases and as the number n of users simultaneously accessing the system increases. Furthermore, users use the web system 1 at various times. Therefore, if the visualization process is performed using batch processing or ad hoc processing, various types of stored data are processed in bulk, potentially resulting in a temporary excessive communication and computation load. On the other hand, if the visualization process is performed using stream processing, various types of data are treated as streaming data, enabling a small amount of flow data to be processed sequentially in real time. This effectively reduces the communication and computation load on the server group 4 and also reduces latency in data processing.

[0130] Even when the visualization steps S500 to S800 are executed by batch processing or ad hoc processing, data other than the metadata used in the visualization steps S500 to S800 is erased when the user releases access to the web server 6. Therefore, it is preferable to store the data to be erased as a cache. Cache refers to data that is temporarily stored in the main memory unit 13 or the auxiliary memory unit 14, is associated with data processing, and is erased when the associated data processing is completed. Therefore, storing the data to be erased as a cache is advantageous in that it allows for easier erasure of the data to be erased.

[0131] In addition, by transmitting the data acquired by the agent 2 to the application server 7c in a streaming manner, each piece of data is segmented and the encrypted segments are transmitted, thereby ensuring higher security than update methods using a file transfer protocol.

[0132] The agent 2 is configured to execute data processing to compare the type and version of its own system software with the type and version of the system software of the management server 30 on which it resides, and, if they do not match, to send a request to the application server 7c to have the web server 6 display a warning. This data processing is preferably executed in the preparation step S400. Even for the same software, variations (variations) may occur in file notation between different versions of the same type of system software. If variations in file notation occur, the software name and its version cannot be properly determined from the software data D1 acquired by the agent 2. Therefore, if there is a possibility of variations in file notation, the web server 6 displays a warning in response to a request from the agent 2, thereby visualizing to the user the possibility that the agent 2 has acquired incorrect software data D1.

[0133] The agent 2 is configured to periodically repeat data processing, separate from the visualization steps S500 to S800, in which the agent 2 accesses the update server 5 to check the version of the update program, and, if the version of the update program is newer than the agent 2's own version, executes data processing to update the agent 2's own version using the update program. This data processing is executed by the agent 2 for which the request R has not been registered with the application server 7c. That is, the agent 2 repeats the data processing of step S441 described above and the data processing to check the version of the update program at a predetermined interval until the request R is registered with the application server 7c. The update server 5 may be a database server built by the manufacturer, or may use an external object storage service.

[0134] The update program database Db5 shown in FIG. 21 is created by the manufacturer and stored in the update server 5. The update program database Db5 stores multiple update programs of different versions. The version of an update program is based on the type and version of the system software. In other words, when a new version of the system software is provided by the vendor, a new update program based on that new version is added to the update program database Db5.

[0135] More specifically, the update program database Db5 has a directory structure. Child folders are arranged under a parent folder in the update program database Db5, and each child folder stores multiple update programs (executable files). The parent folder is given the product name of Web System 1, "XXX." The child folders are given the product stage, such as production (prod), verification (test), or development (dev), as their folder names. Update programs are given file names with the format {product name "XXX"}-{version}-{architecture}-{system software type (software name, version)}. The update program database Db5 has a directory structure, and folder classification can be freely selected as long as it is possible to identify the type and version of system software that each update program corresponds to.

[0136] The agent 2 can access the update program database Db5 via HTTP. Specifically, when a request R is not registered in the application server 7c, the agent 2 executes data processing to request a data search from the update server 5 using query parameters. The query parameters include the type and version of the system software supported by the agent 2. The update server 5 then executes data processing to return search results to the agent 2 using various well-known data formats, such as XML and JSON. If the search results include an update program that is the same as the type of system software selected by the query parameters but is newer than the selected version, the update program is detected. The agent 2 then executes data processing to download the update program detected as the search result to the management server 30. The agent 2 then executes data processing to replace its own binary with the downloaded update program and execute it as a new process. The agent 2 then executes data processing to delete itself. This allows the agent 2 to always maintain its version up to date. Furthermore, by preparing updates for each type and version of system software, the optimal update program can be identified by a data search using query parameters. The update program database Db5 simply stores the correspondence between update programs and system software, and can be considered as metadata.

[0137] The more management servers 30 a user manages and the more definition files exist in the definition file database Db3, the more time and effort it takes for manufacturers to build the definition file database Db3 and select individual definition file databases. Therefore, the web server 6 is equipped with an AI agent that interacts with the user to execute data processing for building the definition file database Db3 and selecting individual definition files tailored to the specifications of the user and the management server 30. The AI ​​agent can use various publicly known large-scale language models (LLMs). The AI ​​agent is a computer program that builds the definition file database Db3 and selects desired definition files tailored to the specifications of the management server 30 based on answers to questions posed to the user via the web browser of the user computer 20. The AI ​​agent is trained using supervised machine learning, with the type of management server 30 (e.g., web server, application server, database server, etc.) and the type of programming language used by the management server 30 (e.g., Java, etc.) as explanatory variables and the unmanaged software as a target variable. The AI ​​agent is trained using supervised machine learning with unmanaged software as an explanatory variable and publicly available vulnerability information for unmanaged software as a target variable.The AI ​​agent is trained using supervised machine learning with unmanaged software as an explanatory variable and definition files as a target variable.

[0138] 22 shows an example of the procedure for constructing a definition file database Db3 by an AI agent. For example, when a predetermined button on a website is clicked, the AI ​​agent executes the following steps S910 to S950. Each of steps S910 to S950 will be described in detail below.

[0139] In step S910, the AI ​​agent poses a question about the specifications of the management server 30, and the user answers the question. The specifications of the management server 30 are acquired. In step S910, the AI ​​agent executes data processing to display a question, such as "What is the role of the management server?", on the web browser of the user computer 20, that can identify the type of management server 30. The user responds to the question by entering a response, such as "It's an application server," into the web browser, thereby acquiring the type of management server 30. The user's response can be provided using various known input devices, such as voice input via a microphone or text input via a keyboard. The AI ​​agent also executes data processing to display a question, such as "What programming language is used?", on the web browser of the user computer 20, that can identify the programming language used by the management server 30. The user responds to the question by entering a response, such as "Java," into the web browser, thereby acquiring the programming language used by the management server 30. In step S910, other information, such as the type of system software used by the management server 30, may also be acquired.

[0140] In step S920, the AI ​​agent executes data processing to identify unmanaged software based on the acquired specifications of management server 30. In this step S920, the identified unmanaged software is displayed in the web browser of user computer 20, and it is possible to confirm and correct whether the identified unmanaged software is actually being used by management server 30 or whether the identified unmanaged software is not being used by management server 30.

[0141] Instead of steps S910 and S920, the user may have the AI ​​agent identify the type of management server 30 and the unmanaged software. Specifically, a file containing a list of modules, libraries, and the like included in the software (e.g., package.json for JavaScript) is sent (uploaded) to the AI ​​agent via the web browser of the user computer 20. The AI ​​agent then performs data processing to identify the type of management server 30 and the unmanaged software based on the sent file.

[0142] In step S930, the AI ​​agent performs data processing to crawl public website 50 and collect vulnerability information related to the identified unmanaged software. Next, in step S940, the AI ​​agent performs data processing to create a definition file based on the collected vulnerability information and display this created definition file in the web browser of user computer 20. For example, a collection result such as "The following vulnerability information exists..." is displayed in the web browser of user computer 20. The "..." lists the created definition files.

[0143] In step S950, the AI ​​agent adds the created definition file to the definition file database Db3, thereby executing data processing to construct the definition file database Db3. In step S950, all of the definition files created in step S940 may be added to the definition file database Db3, or only the desired definition files selected by the user may be added to the definition file database Db3. For example, a message such as "The following definition files will be added..." is displayed in the web browser of the user computer 20. The definition files are listed in the "...", and a check box or toggle switch is provided for each definition file, allowing the definition file to be enabled or disabled. Finally, the execute button displayed in the web browser of the user computer 20 is clicked, and the definition file selected as enabled is added to the definition file database Db3.

[0144] In step S950 above, the AI ​​agent may execute data processing to select a desired definition file from the definition file database Db3 that is suited to the specifications of the user and management server 30. When the AI ​​agent adds the selected desired definition file to the definition file database Db3, the definition file identifier of the definition file to be added is returned as a return value to the application server 7c. The application server 7c then saves the definition file identifier in the web browser of the user computer 20 via the web server 6.

[0145] It is not realistic for users or manufacturers to faithfully understand all of the modules and libraries included in unmanaged software and build the definition file database Db3, as this requires a great deal of effort. Therefore, it is advantageous to have the web server 6 equipped with an AI agent and have that AI agent collect information about the modules and libraries of unmanaged software, thereby reducing the burden on users. Furthermore, since the definition file database Db3 can be built by the AI ​​agent, it is also advantageous to reduce the burden on manufacturers to build the definition file database Db3.

[0146] The agent 2 and each of the application servers 7a to 7d may be configured to include an AI agent, and the AI ​​agent may perform the preparation step S400 and each of the visualization steps S500 to S800. For example, the application server 7b may be configured to include an AI agent, and this AI agent may construct a public vulnerability information database Db1 that accumulates vulnerability information related to vulnerabilities in publicly available managed software.

[0147] Although an embodiment of the present invention has been described above, the management server vulnerability visualization web system and its construction method of the present invention are not limited to a specific embodiment, and various modifications and variations are possible within the scope of the gist of the present invention. [Explanation of symbols]

[0148] 1. Vulnerability visualization web system 2 Agent 3. Server Computer 4 Servers 5 Update Server 6 Web Server 7a~7d Application Server 8 Database Server 9 DNS Server 10 Authentication Server 11a, 11b Load distribution section 12 Processing unit 13 Main memory 14 Auxiliary storage 20 User Computers 30 Management Server 40 Manufacturer Computer 50 public websites Db1 Public Vulnerability Information Database Db2 Agent Information Database Db3 definition file database Db4 Summary Database Db5 Update Database D1 Software Data D2 Vulnerability Information Data D3 Resource Data D4 Process Data D5 scan data T1 List Data R request< / pid> < / pid>

Claims

1. A management server vulnerability visualization web system that visualizes vulnerabilities of multiple software programs that cause data processing on multiple management servers managed by a user, the system comprises a plurality of agents resident on each of the management servers, and a server group made up of a plurality of server computers, the server group having a web server, an application server, and a database server, the database server storing metadata including a public vulnerability information database that accumulates vulnerability information relating to vulnerabilities in the software that are publicly available; the server group and the agent are configured to, when the user accesses the web server, perform a visualization step for each of the management servers managed by the user, and, when the user releases access to the web server, erase the remaining data, excluding the metadata, from the data used in the visualization step; In the visualization process, the agent executes data processing to acquire software data including the specifications of each piece of software on the management server where it resides, and data processing to send the software data to the application server; the application server executes data processing to determine whether or not each piece of software has a vulnerability based on the transmitted software data and the public vulnerability information database, and data processing to send vulnerability information data that accumulates vulnerability information for the software determined to have a vulnerability to the web server; and the web server executes data processing to distribute the vulnerability information data to the users who are accessing the web server.

2. The vulnerability visualization web system for a management server according to claim 1 , wherein the series of data processes in the visualization step are stream processes.

3. 3. The vulnerability visualization web system for a management server according to claim 1, wherein the agent is configured to, as a preparatory step before the visualization step, repeat data processing at a predetermined cycle to confirm whether a request from the user who has accessed the web server to visualize vulnerabilities in the software of the management server on which the agent resides has been registered with the application server, until the request is registered with the application server, and when it is confirmed that the request has been registered, execute data processing to acquire the software data as the visualization step.

4. the database server has an agent information database in which the agent and the user are associated as the metadata, the application server is configured to, when the software data is transmitted from the agent, execute, as the visualization step, data processing for confirming association between the agent that transmitted the software data and the user that registered the request, by referring to the agent information database; The vulnerability visualization web system for a management server according to claim 3 , wherein the software data for which the association between the agent and the user has been confirmed is used in the data processing for determining.

5. 3. The vulnerability visualization web system of claim 1, wherein in the visualization step, the application server performs data processing to store in the database server as the metadata an aggregated database in which the number of software programs determined to be vulnerable and the date and time the vulnerability information data was obtained for the agents are accumulated as aggregated data obtained based on the vulnerability information data, and the web server performs data processing to deliver to the accessing user the aggregated data for the agents associated with the user from the aggregated database stored in the database server.

6. 3. The vulnerability visualization web system for a management server according to claim 1, wherein in the visualization step, the agent acquires resource data and / or process data of the management server and executes data processing to transmit the resource data and / or process data to the application server at a timing different from a timing at which the software data is transmitted, the application server executes data processing to sequentially transmit the resource data and / or process data to the web server, and the web server executes data processing to distribute the resource data and / or process data to the user accessing the web server.

7. an update server having updates for the agent; 4. The vulnerability visualization web system of claim 3, wherein when the request is not registered in the application server, the agent is configured to execute, as data processing different from the visualization step, data processing of accessing the update server to check the version of the update program, and data processing of updating the version of the agent itself using the update program if the version of the update program is newer than the agent's own version.

8. If part of the software is managed software managed by a package management system used by the system software of the management server, 3. The vulnerability visualization web system for a management server according to claim 1, wherein the agent is configured to execute data processing to acquire the software data related to the managed software using the package management system of the management server as the visualization step.

9. the database server has a definition file database in which specifications of unmanaged software that is not managed by the package management system are accumulated as the metadata, 9. The vulnerability visualization web system for a management server according to claim 8, wherein, as the visualization step, the agent executes data processing to acquire scan data that accumulates specifications of the unmanaged software by performing a directory scan of the management server using the definition file database sent from the application server, and data processing to send the scan data and the software data to the application server at different times, the application server executes data processing to send the scan data to the web server, and the web server executes data processing to distribute the scan data to the users who are accessing the web server.

10. 10. The vulnerability visualization web system of claim 9, wherein the web server is provided with an AI agent, and the AI ​​agent is configured to execute data processing to build the definition file database by interacting with the user.

11. A method for constructing a vulnerability visualization web system for a management server that visualizes vulnerabilities of multiple pieces of software that cause data processing to be executed on multiple management servers managed by a user, comprising: a server construction step of constructing a server group consisting of a plurality of server computers, and an agent construction step and setting step carried out for each user; In the server construction step, a web server, an application server, and a database server are constructed as the server group, and metadata including a public vulnerability information database that accumulates publicly available vulnerability information related to vulnerabilities in the software is constructed in the database server; In the agent construction step, the agent is installed in each of the management servers, and then made resident; In the setting step, settings related to access to the web server by the user are made, When the user accesses the web server, a visualization step is performed for each of the management servers on which the agent associated with the user resides, and when the user releases access to the web server, the remaining data used in the visualization step, excluding the metadata, is deleted; A method for building a vulnerability visualization web system for a management server, in which, in the visualization process, the agent acquires software data including the specifications of each piece of software on the management server where it resides, transmits the software data to the application server, the application server determines whether or not each piece of software is vulnerable based on the transmitted software data and the public vulnerability information database, transmits vulnerability information data that accumulates the vulnerability information of the software determined to be vulnerable to the web server, and the web server constructs the vulnerability visualization web system that distributes the vulnerability information data to the users accessing the web server.

Images