Information processing device, information processing system, information processing method and program

Abstract

To efficiently select vulnerability which should be coped wit.SOLUTION: An information processing device concerning an embodiment comprises a risky vulnerability detection unit, a technical similarity calculation unit, a risk score calculation unit, and an output unit. The risky vulnerability detection unit detects vulnerability with possibility that an object system which executes information processing is attacked as risky vulnerability. The technical similarity calculation unit calculates technical similarity representing technical similarity with the risky vulnerability for each of a plurality of pieces of preliminarily registered vulnerability. The risk score calculation unit calculates a risk score representing magnitude of a risk of attacking the corresponding vulnerability in the object system on the basis of the technical similarity for each of the plurality of pieces of vulnerability. The output unit determines at least one of the plurality of pieces of vulnerability as coped vulnerability which should be coped with and outputs identification information for identifying the coped vulnerability on the basis of the risk score in each of the plurality of pieces of vulnerability.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to an information processing device, an information processing system, an information processing method, and a program. [Background technology]

[0002] Security vulnerabilities are reported every day. It is desirable to address reported vulnerabilities immediately. However, there are systems for which it is not possible to address all reported vulnerabilities immediately. For example, OT (Operational Technology) systems in factories, plants, and social infrastructure such as transportation, electricity, and water supply have limited maintenance windows, so it is not possible to address all reported vulnerabilities immediately.

[0003] In OT systems, there is a demand for addressing vulnerabilities by applying only the minimum number of patch programs to avoid a major impact on systems in operation. For example, there is a known technology that efficiently selects vulnerabilities to be addressed from the large number of reported vulnerabilities by increasing the priority of vulnerabilities that match specific keywords.

[0004] However, when only a minimum number of patch programs are applied, only high-risk vulnerabilities at a specific time are addressed, and there is a possibility that other vulnerabilities similar to the high-risk vulnerabilities will not be addressed. For example, in the method of increasing the priority of vulnerabilities matching specific keywords, the user must determine the keywords for other vulnerabilities similar to the high-risk vulnerabilities, making it difficult to address them. Therefore, if an attack is made against other vulnerabilities similar to the high-risk vulnerability, it will be necessary to address them again, and the system will not operate efficiently. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Application Laid-Open No. 2007-58514 Summary of the Invention [Problem to be solved by the invention]

[0006] The problem to be solved by the present invention is to efficiently select vulnerabilities to be addressed. [Means for solving the problem]

[0007] An information processing device according to an embodiment includes a dangerous vulnerability detection unit, a technical similarity calculation unit, a risk score calculation unit, and an output unit. The dangerous vulnerability detection unit detects, as dangerous vulnerabilities, vulnerabilities that may be exploited in attacks against a target system that executes information processing. The technical similarity calculation unit calculates, for each of a plurality of pre-registered vulnerabilities, a technical similarity that represents the technical similarity between the pre-registered vulnerability and the dangerous vulnerability. The risk score calculation unit calculates, for each of the plurality of vulnerabilities, a risk score that represents the degree of risk of an attack against the corresponding vulnerability in the target system, based on the technical similarity. The output unit determines at least one of the plurality of vulnerabilities as a countermeasure vulnerability that should be addressed, based on the risk score for each of the plurality of vulnerabilities, and outputs identification information that identifies the countermeasure vulnerability. The technical similarity calculation unit calculates, for each of the plurality of vulnerabilities, a similarity to the dangerous vulnerability in one or more items of the vulnerability type, the vulnerability characteristics, and the feature amount of the vulnerability's source code or binary code, as the technical similarity. A score is assigned in advance to each of the type, the characteristics, and the feature amount. The technical similarity calculation unit calculates, for each of the plurality of vulnerabilities, a value obtained by adding up the scores of items that are the same as the dangerous vulnerability, as the technical similarity. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is a diagram showing the configuration of an information processing system according to a first embodiment. [Figure 2] FIG. 1 is a diagram showing the configuration of a selection device according to a first embodiment. [Figure 3] FIG. 10 is a diagram showing an example of vulnerability technical information. [Figure 4] FIG. 10 is a diagram showing an example of technology score information. [Figure 5] FIG. 10 is a diagram showing an example of vulnerability target information. [Figure 6] FIG. 10 is a diagram showing an example of target score information. [Figure 7]FIG. 10 is a diagram showing an example of an environment value. [Figure 8] 5 is a flowchart showing the flow of processing by the selection device according to the first embodiment. [Figure 9] FIG. 10 is a diagram showing the configuration of a selection device according to a second embodiment. [Figure 10] FIG. 10 is a diagram showing an example of mitigation measure information. [Figure 11] 10 is a flowchart showing the flow of processing by a selection device according to the second embodiment. [Figure 12] FIG. 2 is a diagram showing an example of the hardware configuration of a selection device according to each embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0009] Hereinafter, an embodiment of the present invention will be described with reference to the accompanying drawings.

[0010] (First embodiment) FIG. 1 is a diagram showing the configuration of an information processing system 10 according to the first embodiment.

[0011] When the information processing system 10 detects a high-risk vulnerability, it efficiently selects a countermeasure vulnerability that is similar to the high-risk vulnerability and requires countermeasure. Then, the information processing system 10 executes countermeasures by applying a patch program to the countermeasure vulnerability. This enables the information processing system 10 to proactively deal with other vulnerabilities similar to the high-risk vulnerability, resulting in efficient system operation.

[0012] The information processing system 10 includes a target system 20, a selection device 24, and a security management device 26.

[0013] The target system 20 is a computer system that executes information processing. The target system 20 is, for example, an OT system that executes information processing in a factory, a plant, or social infrastructure such as transportation, electricity, and water. The target system 20 may be an IT (Information Technology) system. The target system 20 may include, for example, a plurality of systems (e.g., a first system, a second system, ..., an Nth system). For each of the plurality of systems, application of a patch program and application of mitigation measures for vulnerabilities may be executed individually.

[0014] The selection device 24 is realized by an information processing device such as a computer.

[0015] For example, the selection device 24 acquires information about vulnerabilities from a server device that provides security-related information. The selection device 24 detects vulnerabilities that may be exploited against the target system 20 as dangerous vulnerabilities, and selects other vulnerabilities similar to the detected dangerous vulnerabilities as countermeasure vulnerabilities to be addressed.

[0016] The security management device 26 takes measures for the target system 20 with respect to vulnerabilities (dangerous vulnerabilities) that may expose the target system 20 to attacks. At the same time, the security management device 26 takes measures for the target system 20 with respect to the vulnerabilities to be dealt with that have been selected by the selection device 24.

[0017] Here, a vulnerability refers to a security flaw that occurs due to a defect or mistake in the program code in the operating system and application programs executed by a computer. Vulnerabilities also include security flaws that exist in hardware processors and processing circuits similar to hardware processors. If vulnerabilities are left unaddressed in a computer system, they can be exploited for infection by viruses or worms, or for unauthorized access. In other words, if a vulnerability is left unaddressed in a computer system, it becomes a target for attack.

[0018] Countermeasures for preventing vulnerabilities include, for example, updating the operating system and application programs to new programs that eliminate vulnerabilities, and eliminating vulnerabilities by applying patch programs such as additional programs or correction programs.Further countermeasures for preventing vulnerabilities include, for example, implementing mitigation measures such as installing a firewall, installing an IDS (Intrusion Detection System), and introducing an antivirus program.

[0019] In the first embodiment, the security management device 26 provides a patch program corresponding to the vulnerability to be addressed to the target system 20 and causes the target system 20 to execute the patch program, thereby addressing the vulnerability to be addressed. Note that in the information processing system 10, a user may address the vulnerability to be addressed instead of the security management device 26. That is, in the information processing system 10, a user may provide a patch program corresponding to the vulnerability to be addressed selected by the selection device 24 to the target system 20 and cause the target system 20 to execute the patch program.

[0020] FIG. 2 is a diagram showing the configuration of the selection device 24 according to the first embodiment.

[0021] The selection device 24 includes a risk vulnerability detection unit 32, a risk score calculation unit 34, a technical information storage unit 36, a technical similarity calculation unit 38, a target information storage unit 40, a target similarity calculation unit 42, an environmental value storage unit 44, a prediction model storage unit 46, a prediction unit 48, a correction unit 50, and an output unit 52.

[0022] The dangerous vulnerability detection unit 32 acquires information about vulnerabilities from a server device or the like that provides security-related information. Based on the acquired vulnerability information, the dangerous vulnerability detection unit 32 detects, as dangerous vulnerabilities, vulnerabilities that may allow attacks on the target system 20. The dangerous vulnerability detection unit 32 provides information identifying dangerous vulnerabilities to the risk score calculation unit 34.

[0023] For example, the dangerous vulnerability detection unit 32 determines whether to detect the acquired vulnerability as a dangerous vulnerability using a CVSS base score and a CVSS environmental score calculated according to the evaluation criteria of the Common Vulnerability Scoring System (CVSS).The dangerous vulnerability detection unit 32 may also determine whether to detect the acquired vulnerability as a dangerous vulnerability using an index such as an Exploit Prediction Scoring System (EPSS), information indicating whether the vulnerability has actually been used in an attack, the presence or absence of exploit code, which is program code created to reproduce fraudulent behavior that exploits the vulnerability, etc.

[0024] When the risk score calculation unit 34 acquires information that identifies a dangerous vulnerability, it provides the acquired information that identifies a dangerous vulnerability to the technical similarity calculation unit 38 and the object similarity calculation unit 42. For each of a plurality of pre-registered vulnerabilities, the risk score calculation unit 34 acquires a technical similarity that indicates the technical similarity between the dangerous vulnerability and the vulnerability from the technical similarity calculation unit 38. Furthermore, for each of a plurality of pre-registered vulnerabilities, the risk score calculation unit 34 acquires an object similarity that indicates the similarity between the dangerous vulnerability and the target, which is software and hardware that has the vulnerability or executes the vulnerability.

[0025] Each of the plurality of pre-registered vulnerabilities is, for example, a vulnerability that has been discovered in the past, analyzed, registered, etc. The plurality of pre-registered vulnerabilities does not need to include vulnerabilities that have already been addressed for the target system 20.

[0026] The risk score calculation unit 34 calculates, for each of the multiple vulnerabilities, a risk score that indicates the degree of risk of an attack on the corresponding vulnerability in the target system 20, based on the acquired technical similarity and the acquired target similarity. Then, the risk score calculation unit 34 generates a vulnerability list that lists information indicating pairs of information that identifies the vulnerability and the risk score for each of the multiple vulnerabilities, and provides the generated vulnerability list to the correction unit 50. Note that an example of a method for calculating the risk score will be described in detail in S15 of FIG. 8.

[0027] The technical information storage unit 36 ​​stores vulnerability technical information and technical score information. The vulnerability technical information includes information indicating technical features for each of a plurality of pre-registered vulnerabilities. The vulnerability technical information includes technical features for each of a plurality of items classified according to category. An example of the vulnerability technical information will be described in detail below with reference to FIG. 3.

[0028] The technical score information includes a score assigned to each of a plurality of items indicated in the vulnerability technical information. The score is used to calculate the technical similarity between each of a plurality of pre-registered vulnerabilities and a critical vulnerability. The greater the impact of an item on the technical similarity, the larger the score value. An example of the technical score information will be described in detail later with reference to FIG. 4.

[0029] The technical similarity calculation unit 38 acquires information that identifies dangerous vulnerabilities from the risk score calculation unit 34. When acquiring the information that identifies dangerous vulnerabilities, the technical similarity calculation unit 38 refers to the vulnerability technical information and technical score information stored in the technical information storage unit 36, and calculates the technical similarity for each of the multiple vulnerabilities that have been registered in advance. The technical similarity calculation unit 38 provides the calculated technical similarity to the risk score calculation unit 34. An example of a method for calculating the technical similarity will be described in detail later with reference to FIG. 4.

[0030] The target information storage unit 40 stores vulnerability target information and target score information. The vulnerability target information includes information indicating targets, which are software and hardware that have or execute the vulnerability, for each of a plurality of pre-registered vulnerabilities. The vulnerability target information includes targets for each of a plurality of items classified according to category. An example of vulnerability target information will be described in detail below with reference to FIG. 5.

[0031] The target score information includes a score assigned to each of a plurality of items indicated in the vulnerability target information. The score is used to calculate the target similarity between each of a plurality of pre-registered vulnerabilities and a critical vulnerability. The greater the impact on the target similarity, the larger the score value. An example of the target score information will be described in detail later with reference to FIG. 6.

[0032] The target similarity calculation unit 42 acquires information identifying dangerous vulnerabilities from the risk score calculation unit 34. When the target similarity calculation unit 42 acquires information identifying dangerous vulnerabilities, the target similarity calculation unit 42 calculates a target similarity for each of a plurality of pre-registered vulnerabilities by referring to the vulnerability target information and target score information stored in the target information storage unit 40. The target similarity calculation unit 42 provides the calculated target similarity to the risk score calculation unit 34. An example of a method for calculating the target similarity will be described in detail later with reference to FIG. 6.

[0033] The environmental value storage unit 44 stores, for each of a plurality of vulnerabilities, an environmental value, which is a parameter indicating the magnitude of the impact when the target system 20 is attacked. When the target system 20 includes a plurality of systems (first system, second system, ..., Nth system), the environmental value storage unit 44 stores an environmental value for each of the plurality of systems and for each of a plurality of vulnerabilities. For example, the environmental value is a CVSS environmental value calculated according to the CVSS evaluation criteria. The environmental value may also be a value calculated according to evaluation criteria other than CVSS. An example of the environmental value will be described in detail later with reference to FIG. 7.

[0034] The prediction model storage unit 46 stores a prediction model for acquiring time-series changes in the risk of attacks against vulnerabilities from a specific point in time to an arbitrary prediction point in time. For example, the prediction model is a model that outputs the amount of risk change from a specific point in time to the prediction point in time by inputting a set period from the specific point in time to the point in time at which the risk of attacks against vulnerabilities is to be predicted. The prediction model is, for example, a machine learning model trained using past data on fluctuations in risk levels as training data. The prediction model may also be a function, an arithmetic expression, a program, or the like.

[0035] The prediction unit 48 acquires the set period from the correction unit 50. When the prediction unit 48 acquires the set period, it reads out the prediction model from the prediction model storage unit 46, inputs the set period into the read prediction model, and calculates the amount of risk change. The prediction unit 48 then provides the calculated amount of risk change to the correction unit 50. Note that the prediction model storage unit 46 and the prediction unit 48 may be realized by a server or the like provided outside the selection device 24.

[0036] The correction unit 50 acquires the vulnerability list from the risk score calculation unit 34. When the correction unit 50 acquires the vulnerability list, it reads out the environmental values ​​of the target system 20 for each of the multiple vulnerabilities from the environmental value storage unit 44. If the target system 20 includes multiple systems, the correction unit 50 acquires the environmental values ​​of each of the multiple systems for each of the multiple vulnerabilities from the environmental value storage unit 44.

[0037] Furthermore, when the correction unit 50 acquires the vulnerability list, it acquires a prediction time point. The correction unit 50 calculates the period from the specific time point to the prediction time point as a set time. The correction unit 50 provides the calculated set time to the prediction unit 48, and acquires from the prediction unit 48 the amount of change in risk of an attack on the vulnerability when the set period has elapsed.

[0038] The specific point in time may be the current point in time, or may be the point in time when the vulnerability technical information and the vulnerability target information were last updated.

[0039] The predicted time may be input by the user. For example, the predicted time is the time when the next maintenance is to be performed on the target system 20 to apply a patch program. If the predicted time is the time when the next maintenance is to be performed, the correction unit 50 can calculate the risk score at the time when the next maintenance is to be performed.

[0040] The correction unit 50 then corrects the risk score for each of the multiple vulnerabilities included in the vulnerability list based on the acquired environmental values ​​and risk change amounts. If the target system 20 includes multiple systems, the correction unit 50 corrects the risk scores for each of the multiple vulnerabilities for each of the multiple systems from the environmental value storage unit 44. The correction unit 50 then provides the vulnerability list after the risk scores have been corrected to the output unit 52. An example of a method for correcting the risk scores will be described in S19 of FIG. 8.

[0041] The output unit 52 acquires the vulnerability list with the corrected risk scores from the correction unit 50. When the output unit 52 acquires the vulnerability list, it determines at least one of the multiple vulnerabilities included in the vulnerability list as a countermeasure vulnerability that should be addressed based on the risk score of each of the multiple vulnerabilities. For example, a threshold is set in advance for the output unit 52. Then, the output unit 52 determines, from among the multiple vulnerabilities, a vulnerability whose risk score is equal to or greater than the preset threshold as a countermeasure vulnerability. Furthermore, when the target system 20 includes multiple systems, the output unit 52 determines a countermeasure vulnerability for each of the multiple systems.

[0042] Then, the output unit 52 outputs the identification information that identifies the addressed vulnerability to the security management device 26. The output unit 52 may output the risk score of the addressed vulnerability together with the identification information that identifies the addressed vulnerability. Furthermore, the output unit 52 may display the identification information that identifies the addressed vulnerability and the risk score on a display device to present them to the user.

[0043] 3 is a diagram showing an example of vulnerability technical information stored in the technical information storage unit 36. The vulnerability technical information includes, as an example, technical features related to each of a plurality of items, in association with identification information that identifies a vulnerability.

[0044] The identification information for identifying a vulnerability is, for example, a CVE (Common Vulnerabilities and Exposures) identifier, which is represented by a combination of letters, symbols, and numbers defined by the non-profit organization Mitre Corporation.

[0045] Each of the multiple items represents a category of technical features, for example, the multiple items include a vulnerability type, a vulnerability characteristic, and a feature amount of a source code or binary code of the vulnerability.

[0046] The vulnerability type is, for example, the Common Weakness Enumeration (CWE), which is information published by Mitre Corporation that classifies and identifies vulnerabilities.

[0047] An example of a vulnerability characteristic is a CVSS vector, which is a textual representation of the evaluation criteria used to determine the score.

[0048] The feature amount of the vulnerable source code or binary code is, for example, a vulnerable code feature amount, which is a characteristic part of the vulnerable source code or binary code.

[0049] FIG. 4 is a diagram showing an example of technical score information stored in the technical information storage unit 36. As shown in FIG.

[0050] The technical score information includes a score assigned in advance to each of a plurality of items indicated in the vulnerability technical information. For example, the technical score information includes a score assigned in advance to each of the vulnerability type (e.g., CWE), the vulnerability characteristics (e.g., CVSS vector), and the features of the vulnerability's source code or binary code (e.g., vulnerability code features). The scores are assigned by an administrator or the like.

[0051] The score shown in the technical score information increases the greater the impact of an item on the technical similarity between vulnerabilities. In the example of Figure 4, if the source code or binary code features of two vulnerabilities are identical, the technical similarity is considered to be the highest and a score of 3 is assigned. Also in the example of Figure 4, if the characteristics of two vulnerabilities are identical, the technical similarity is considered to be relatively low and a score of 1 is assigned. Also in the example of Figure 4, if the types of two vulnerabilities are the same, the technical similarity is considered to be medium and a score of 2 is assigned.

[0052] When the technical similarity calculation unit 38 acquires information that identifies dangerous vulnerabilities, the technical similarity calculation unit 38 refers to the vulnerability technical information and technical score information to calculate the technical similarity for each of the multiple vulnerabilities that have been registered in advance. The technical similarity calculation unit 38 provides the calculated technical similarity to the risk score calculation unit 34.

[0053] For example, when the technical similarity calculation unit 38 acquires information that identifies dangerous vulnerabilities, it calculates the technical similarity for each of the multiple vulnerabilities (CVE-2019-xxxxx to CVE-2021-yyyyy) shown in Figure 3, excluding the dangerous vulnerabilities.

[0054] For example, the technical similarity calculation unit 38 calculates, for each of a plurality of vulnerabilities, a value obtained by adding up the scores of items that are the same as the dangerous vulnerabilities, as the technical similarity.

[0055] For example, suppose that the technical similarity calculation unit 38 acquires a vulnerability with identification information CVE-2021-yyyyy as a dangerous vulnerability. In this case, the vulnerability with identification information CVE-2019-xxxxx and the acquired dangerous vulnerability (CVE-2021-yyyyy) have the same vulnerability type (CWE), but the vulnerability characteristics (CVSS vector) and features (vulnerability code features) are not the same. Therefore, the technical similarity calculation unit 38 calculates the technical similarity between the vulnerability with identification information CVE-2019-xxxxx and the dangerous vulnerability (CVE-2021-yyyyy) as 2 + 0 + 0 = 2 points.

[0056] In this case, the vulnerability with identification information CVE-2019-zzzzz and the acquired dangerous vulnerability (CVE-2021-yyyyy) have the same vulnerability type (CWE), vulnerability characteristics (CVSS vector), and feature values ​​(vulnerability code feature values). Therefore, the technical similarity calculation unit 38 calculates the technical similarity between the vulnerability with identification information CVE-2019-zzzzz and the dangerous vulnerability (CVE-2021-yyyyy) as 2 + 1 + 3 = 6 points.

[0057] 5 is a diagram showing an example of vulnerability target information stored in the target information storage unit 40. The vulnerability target information includes, as an example, targets related to each of a plurality of items in association with identification information that identifies a vulnerability.

[0058] Each of the plurality of items represents a category of the target, for example, the plurality of items includes target software / hardware, software type, and target hardware type.

[0059] The target software / hardware is, for example, software or hardware that has a vulnerability.

[0060] The software type is the type of software that has the vulnerability if the software has the vulnerability. Note that if the hardware has the vulnerability, no description is made for the software type, and the field is left blank.

[0061] If software has a vulnerability, the target hardware type is the type of hardware that runs the vulnerable software. Note that if the vulnerable software runs on all hardware, not just specific hardware, the target hardware type is all. Also, if hardware has a vulnerability, the target hardware type is the vulnerable hardware.

[0062] FIG. 6 is a diagram showing an example of the object point information stored in the object information storage unit 40. As shown in FIG.

[0063] The target score information includes a score assigned in advance to each of the multiple items indicated in the vulnerability target information. For example, the target score information includes a score assigned in advance to each of the target software / hardware, software type, and target hardware type. The scores are assigned by an administrator or the like.

[0064] The score indicated in the target score information increases as the impact of an item on the target similarity between vulnerabilities increases. In the example of Figure 6, when the target software / hardware for two vulnerabilities is the same, the target similarity is highest and a score of 3 is assigned. Also, in the example of Figure 6, when the software type for two vulnerabilities is the same, the target similarity is relatively low and a score of 1 is assigned. Also, in the example of Figure 6, when the target hardware type for two vulnerabilities is the same, the target similarity is relatively low and a score of 1 is assigned.

[0065] When the target similarity calculation unit 42 acquires information identifying dangerous vulnerabilities, it refers to the vulnerability target information and target score information to calculate a target similarity for each of the multiple vulnerabilities registered in advance. The target similarity calculation unit 42 provides the calculated target similarity to the risk score calculation unit 34.

[0066] For example, when the target similarity calculation unit 42 acquires information that identifies dangerous vulnerabilities, it calculates the target similarity for each of the multiple vulnerabilities (CVE-2019-xxxxx to CVE-2021-yyyyy) indicated by the vulnerability identification information shown in Figure 5.

[0067] Specifically, the target similarity calculation unit 42 calculates, for each of the multiple vulnerabilities, a value obtained by adding up the scores of items that are the same as the dangerous vulnerabilities, as the target similarity.

[0068] For example, suppose that the target similarity calculation unit 42 acquires a vulnerability with identification information CVE-2021-yyyyy as a dangerous vulnerability. In this case, the target software / hardware and software type of the vulnerability with identification information CVE-2019-xxxxx and the acquired dangerous vulnerability (CVE-2021-yyyyy) are the same, but the target software / hardware are not the same. Note that CVE-2019-xxxxx includes all target hardware types, including processor A. Therefore, the target similarity calculation unit 42 determines that the target hardware type of the vulnerability with identification information CVE-2019-xxxxx is the same as the target hardware type of the dangerous vulnerability (CVE-2021-yyyyy). Therefore, the target similarity calculation unit 42 calculates the target similarity between the vulnerability with identification information CVE-2019-xxxxx and the dangerous vulnerability (CVE-2021-yyyyy) as 0 + 1 + 1 = 2 points.

[0069] In this case, the vulnerability with identification information CVE-2019-zzzzz and the acquired dangerous vulnerability (CVE-2021-yyyyy) have the same target hardware type, but the target software / hardware and software type are not the same. Therefore, the target similarity calculation unit 42 calculates the target similarity of the vulnerability with identification information CVE-2019-zzzzz to the dangerous vulnerability (CVE-2021-yyyyy) as 0 + 1 + 0 = 1 point.

[0070] 7 is a diagram showing an example of the environmental values ​​stored in the environmental value storage unit 44. The environmental value storage unit 44 stores, for each of one or more systems included in the target system 20, an environmental value, which is a parameter indicating the magnitude of the impact in the event of an attack, for each of a plurality of pre-registered vulnerabilities.

[0071] In this embodiment, the environment value storage unit 44 stores the environment values ​​of each of a plurality of vulnerabilities registered in advance for each of the first system and the second system. For example, the environment values ​​are CVSS environment values.

[0072] FIG. 8 is a flowchart showing the flow of processing by the selection device 24 according to the first embodiment.

[0073] The selection device 24 starts the process from S11 every time it acquires information about vulnerability from, for example, a server device that provides security information.

[0074] First, in S11, the selection device 24 detects, as dangerous vulnerabilities, vulnerabilities that may be exploited to attack the target system 20, based on the acquired vulnerability information. If no vulnerabilities that may be exploited are detected, the selection device 24 ends this flow.

[0075] Next, in S12, the selection device 24 executes the processes from S13 to S22 for each of the plurality of pre-registered vulnerabilities (loop processing of S12 and S23). Note that the selection device 24 does not execute the loop processing of S12 and S23 for a vulnerability that is the same as a dangerous vulnerability among the plurality of pre-registered vulnerabilities.

[0076] In S13, the selection device 24 calculates the technical similarity for the vulnerabilities that are the target of the loop processing. For example, the selection device 24 refers to the vulnerability technical information and the technical score information and calculates the technical similarity by the calculation method described with reference to FIG.

[0077] Next, in S14, the selection device 24 calculates the target similarity for the vulnerability that is the loop processing target. For example, the selection device 24 refers to the vulnerability target information and the target score information and calculates the target similarity by the calculation method described with reference to FIG.

[0078] Next, in S15, the selection device 24 calculates a risk score that represents the degree of risk of an attack being made on the vulnerability that is the target of the loop processing in the target system 20, based on the calculated technical similarity and the calculated target similarity.

[0079] For example, let the calculated technical similarity be represented as A, the calculated object similarity be represented as B, and the risk score be represented as RISK. In this case, the selection device 24 may calculate the risk score by adding the technical similarity and the object similarity as shown in formula (1). RISK=A+B…(1)

[0080] Furthermore, the selection device 24 may calculate the risk score by multiplying the technical similarity by the target similarity, as shown in equation (2). RISK=A×B…(2)

[0081] In addition, the selection device 24 may calculate the risk score as 1 if either the technical similarity or the object similarity is greater than a predetermined threshold, and 0 if neither is greater than the threshold, as shown in equation (3). IF(A>THD_A OR B>THD_B) THEN RISK=1 ELSE RISK=0 …(3)

[0082] In equation (3), THD_A is a threshold for technology similarity, and THD_B is a threshold for object similarity.

[0083] Alternatively, the selection device 24 may calculate the risk score by multiplying each of the technical similarity and the object similarity by a weighting coefficient and adding the results together, as shown in equation (4). RISK = α × A + β × B…(4)

[0084] In equation (4), α is a weighting coefficient for technology similarity, and β is a weighting coefficient for object similarity.

[0085] The selection device 24 may calculate the risk score using other methods based on the technical similarity and the object similarity, and may calculate the risk score based only on the technical similarity, or may calculate the risk score based only on the object similarity.

[0086] Next, the selection device 24 executes the processes from S17 to S21 for each of one or more systems included in the target system 20 (loop process between S16 and S22).

[0087] In S17, the selection device 24 uses a prediction model to calculate the change in risk of an attack on a vulnerability after a set period of time has elapsed from a specific time point to a prediction time point for the system that is the target of the loop processing. For example, the selection device 24 calculates the change in risk by setting the current time point as the specific time point and the time point of the next maintenance to apply a patch program to the system that is the target of the loop processing as the prediction time point.

[0088] Next, in S18, the selection device 24 acquires the environmental values ​​of the system that is the target of the loop processing for the vulnerability that is the target of the loop processing.

[0089] Next, in S19, the selection device 24 corrects the risk score for the system that is the target of the loop processing for the vulnerability that is the target of the loop processing, based on the calculated risk change amount and the acquired environment value.

[0090] For example, when the risk change amount is R(n) and the environment value is the CBSS environment value, the selection device 24 calculates the corrected risk score as shown in equation (5). Adjusted risk score = RISK × R(n) × CVSS Environmental Score…(5)

[0091] This allows the selection device 24 to calculate a risk score taking into account the magnitude of the impact of an attack on a vulnerability that is the target of loop processing contained in the system that is the target of loop processing, and the amount of risk change from a specific point in time to a predicted point in time.

[0092] For example, as shown in Figures 3 to 6, when CVE-2021-yyyyy is considered a critical vulnerability, assume that the risk score for CVE-2019-xxxxx is 4 (= 2 + 2) and the risk score for CVE-2019-zzzzz is 7 (= 6 + 1). Also, as shown in Figure 7, assume that the CVSS environment value for CVE-2019-xxxxx in the first system is 9.5 and the CVSS environment value for CVE-2019-zzzzz is 8.8. Furthermore, assume that the next maintenance to apply a patch program to the first system is 30 days from now, and that the risk change (R(30)) for the first system 30 days from now is 1.1.

[0093] In this case, the selection device 24 calculates the corrected risk score for CVE-2019-xxxxx in the first system according to formula (6). Adjusted risk score = (2 + 2) × 1.1 × 9.5 = 41.8…(6)

[0094] Furthermore, the selection device 24 calculates the corrected risk score for CVE-2019-zzzzz in the first system according to formula (7). Adjusted risk score = (6 + 1) × 1.1 × 8.8 = 67.76…(7)

[0095] Next, in S20, the selection device 24 determines whether the calculated corrected risk score is equal to or greater than a preset threshold. If the corrected risk score is equal to or greater than the threshold (Yes in S20), the selection device 24 proceeds to S21. In S21, the selection device 24 registers the vulnerability that is the target of the loop processing in the vulnerability list. Furthermore, the selection device 24 registers a pair of the system that is the target of the loop processing and the corrected risk score in correspondence with the registered vulnerability. If the corrected risk score is not equal to or greater than the threshold (No in S20), the selection device 24 skips the processing of S21.

[0096] When the selection device 24 completes the processes from S17 to S21 for each of one or more systems, it exits the loop process between S16 and S22 and advances the process to S23.

[0097] Then, when the selection device 24 completes the processes from S13 to S22 for each of the plurality of pre-registered vulnerabilities, it exits the loop process between S12 and S23 and advances the process to S24.

[0098] In S24, the selection device 24 determines, for each of one or more systems, vulnerabilities included in the vulnerability list as vulnerabilities to be addressed. Then, the selection device 24 outputs identification information for identifying the vulnerabilities to be addressed and information for identifying the systems to the security management device 26. The selection device 24 may also output a risk score together with the identification information for identifying the vulnerabilities to be addressed and information for identifying the systems.

[0099] Although the selection device 24 determines whether the corrected risk score is equal to or greater than a threshold in S20, it may add all vulnerabilities to the vulnerability list without making the determination in S20. In this case, the selection device 24 determines, at the output stage of S24, from among the multiple vulnerabilities included in the vulnerability list, vulnerabilities equal to or greater than the threshold as countermeasure vulnerabilities.

[0100] When the selection device 24 finishes the process of S24, it ends the process of this flow.

[0101] As described above, when the information processing system 10 according to the first embodiment detects a high-risk vulnerability, it can efficiently select a vulnerability to be addressed that is similar to the high-risk vulnerability and requires a countermeasure. The information processing system 10 then executes a countermeasure of applying a patch program to the countermeasure vulnerability. This allows the information processing system 10 to proactively address other vulnerabilities similar to the high-risk vulnerability, resulting in efficient system operation.

[0102] For example, the information processing system 10 according to the first embodiment can select, as a countermeasure vulnerability, a vulnerability whose risk of attack exceeds a threshold by the time of the next maintenance, and can execute a countermeasure by applying a patch program. Therefore, in a case where the target system 20 is, for example, a computer system such as an OT system in which the timing for applying a patch program is limited and the number of patch programs to be applied should be minimized, the information processing system 10 according to the first embodiment can reliably counter attacks while reducing the number of times the patch program is applied. Therefore, the information processing system 10 according to the first embodiment can efficiently operate the target system 20.

[0103] (Second embodiment) Next, an information processing system 10 according to a second embodiment will be described. The information processing system 10 according to the second embodiment has substantially the same functions and configuration as the first embodiment described with reference to Figures 1 to 8. Therefore, in describing the information processing system 10 according to the second embodiment, elements having substantially the same functions and configuration as those in the first embodiment will be assigned the same reference numerals, and detailed description will be omitted except for the differences.

[0104] In the second embodiment, the information processing system 10 addresses the vulnerability by executing mitigation measures in addition to or instead of providing the target system 20 with a patch program corresponding to the vulnerability.

[0105] 9 is a diagram showing the configuration of the selection device 24 according to the second embodiment. Compared to the first embodiment, the selection device 24 according to the second embodiment further includes a mitigation measure storage unit 62 and a mitigation measure determination unit 64.

[0106] The mitigation measure storage unit 62 stores mitigation measure information. The mitigation measure information includes, for each of a plurality of pre-registered mitigation measures, one or more items of vulnerabilities for which the measures are effective, the types of vulnerabilities for which the measures are effective, the characteristics of the vulnerabilities, and the features of the source code or binary code of the vulnerabilities.

[0107] Each of the multiple mitigation measures is a method of mitigating the impact of a vulnerability by a method other than addressing the vulnerability with a patch program. For example, one of the multiple mitigation measures is the installation of a firewall. A firewall is a device and program that detects and prevents unauthorized intrusions from the outside and unauthorized transmissions to the outside via a network. One of the multiple mitigation measures is the installation of an IDS. An IDS is a device and program that detects unauthorized intrusions from the outside via a network. For example, one of the multiple mitigation measures is the installation of an antivirus program. An antivirus program is a program that prevents virus programs from entering a system and detects and removes virus programs that have entered a system. Note that the multiple mitigation measures may include other methods instead of or in addition to the installation of a firewall, the installation of an IDS, and the installation of an antivirus program.

[0108] The mitigation measure determination unit 64 determines, from among the multiple mitigation measures registered in the mitigation measure information, one or more effective mitigation measures that are effective for the addressed vulnerability determined by the output unit 52. For example, the mitigation measure determination unit 64 determines, from among the multiple mitigation measures, one or more mitigation measures for which one or more of the types, characteristics, and feature quantities registered as effective measures are the same as those of the addressed vulnerability, as one or more effective mitigation measures. In this way, the mitigation measure determination unit 64 can determine, as effective mitigation measures, mitigation measures that mitigate the impact of the addressed vulnerability.

[0109] Then, the output unit 52 outputs the countermeasure vulnerability and one or more effective mitigation measures determined for the countermeasure vulnerability.

[0110] Furthermore, the mitigation measure determination unit 64 may determine an optimal effective mitigation measure from one or more effective mitigation measures according to a preset policy. Then, the output unit 52 may output the addressed vulnerability and the determined optimal effective mitigation measure.

[0111] For example, when multiple countermeasure vulnerabilities are output, the mitigation measure determination unit 64 may determine the optimal effective mitigation measure using a policy that minimizes the total number of optimal effective mitigation measures. Furthermore, when one or multiple countermeasure vulnerabilities are output, the mitigation measure determination unit 64 may determine the optimal effective mitigation measure using a policy that sets the cost equal to or less than a predetermined cost. Furthermore, the mitigation measure determination unit 64 may determine the optimal effective mitigation measure using a policy that satisfies constraints defined in the target system 20. Furthermore, the mitigation measure determination unit 64 may determine the optimal effective mitigation measure using a policy that applies multiple effective mitigation measures to one countermeasure vulnerability.

[0112] FIG. 10 is a diagram showing an example of mitigation measure information stored in the mitigation measure storage unit 62. As shown in FIG.

[0113] 10, the mitigation information registers the installation of a firewall, the installation of an IDS, and the introduction of an antivirus program as multiple mitigation measures. For each of the installation of a firewall, the installation of an IDS, and the introduction of an antivirus program, the mitigation information registers the vulnerabilities for which the countermeasures are effective (e.g., valid CVEs), the types of vulnerabilities for which the countermeasures are effective (e.g., valid CWEs), the characteristics of the vulnerabilities for which the countermeasures are effective (e.g., valid CVSS vectors), and the features of the source code or binary code of the vulnerabilities for which the countermeasures are effective (e.g., valid vulnerability code features).

[0114] For example, the mitigation information shown in Figure 10 states in the section on valid vulnerability identification information that installing an IDS is effective against CVE-2019-xxxxx. Furthermore, the mitigation information shown in Figure 10 also states in the section on valid vulnerability characteristics (valid CVSS vectors) that installing a firewall is effective against vector B.

[0115] For example, CVE-2019-xxxxx has a vulnerability characteristic (e.g., a CVSS vector) of vector B. Therefore, in a case where the mitigation information shown in Fig. 10 is stored and CVE-2019-xxxxx is a countermeasure vulnerability, the mitigation measure determination unit 64 determines that the effective mitigation measures are to install a firewall and an IDS.

[0116] 10, the effective vulnerability identification information field describes that installing an IDS is effective against CVE-2019-zzzzz. Therefore, when the mitigation information shown in FIG. 10 is stored and CVE-2019-zzzzz is a vulnerability to be addressed, the mitigation decision unit 64 decides to install an IDS as an effective mitigation measure.

[0117] Also, suppose that two vulnerabilities, CVE-2019-xxxxx and CVE-2019-zzzzz, have been determined to be addressed. Furthermore, suppose that effective mitigation measures for CVE-2019-xxxxx are the installation of a firewall and an IDS. Furthermore, suppose that effective mitigation measures for CVE-2019-zzzzz are the installation of an IDS.

[0118] The mitigation measure determination unit 64 is assumed to have a predetermined policy for minimizing the overall number of optimal effective mitigation measures when outputting multiple vulnerabilities to be addressed. In this case, the mitigation measure determination unit 64 determines the installation of an IDS, which is an effective mitigation measure common to both CVE-2019-xxxxx and CVE-2019-zzzzz, as the optimal effective mitigation measure. This allows the mitigation measure determination unit 64 to minimize the number of optimal effective mitigation measures that it has determined.

[0119] The mitigation measure determination unit 64 may determine the optimal effective mitigation measure based on other policies. For example, the mitigation measure determination unit 64 may determine the optimal effective mitigation measure based on a policy that keeps the cost below a predetermined value when multiple countermeasure vulnerabilities are output, a policy that satisfies constraints defined in the target system 20, or a policy that applies multiple effective mitigation measures to one countermeasure vulnerability.

[0120] FIG. 11 is a flowchart showing the flow of processing by the selection device 24 according to the second embodiment.

[0121] The selection device 24 according to the second embodiment executes processing according to the flow shown in Fig. 11. The selection device 24 according to the second embodiment executes the same processing from S11 to S23 as in the first embodiment shown in Fig. 8. After completing the loop processing between S12 and S23, the selection device 24 according to the second embodiment advances the processing to S31.

[0122] In S31, the selection device 24 determines one or more effective mitigation measures for the countermeasure vulnerabilities included in the vulnerability list. Furthermore, the selection device 24 may determine the optimal effective mitigation measures for the one or more countermeasure vulnerabilities according to a predetermined policy.

[0123] Following S31, the selection device 24 executes the process of S32. In S32, the selection device 24 outputs one or more effective mitigation measures for the addressed vulnerability. Furthermore, the selection device 24 outputs one or more effective mitigation measures for each of the one or more effective mitigation measures. Furthermore, the selection device 24 may output the optimal effective mitigation measures determined for the one or more addressed vulnerabilities.

[0124] Then, when the selection device 24 finishes the process of S32, it ends the process of this flow.

[0125] An administrator of the target system 20 may wish to apply mitigation measures to the target system 20 rather than applying a patch program, as long as the effect of reducing the impact of the vulnerability is sufficient. For example, if the source of the attack is limited to an external network, the administrator may wish to install a firewall instead of applying a patch program. The information processing system 10 according to the second embodiment can provide effective mitigation measures, which are countermeasures other than applying a patch program, for the countermeasured vulnerability. As a result, the information processing system 10 according to the second embodiment can provide the administrator of the target system 20 with a large number of options for countermeasures against the countermeasured vulnerability. Furthermore, the information processing system 10 according to the second embodiment can also provide the administrator with optimal effective mitigation measures according to a preset policy. As a result, the information processing system 10 according to the second embodiment can allow the administrator to easily select the optimal effective mitigation measure from a large number of effective mitigation measures.

[0126] (Hardware configuration of information processing device) FIG. 12 is a diagram showing an example of the hardware configuration of the selection device 24 according to each embodiment.

[0127] The selection device 24 is realized by, for example, a computer (information processing device) having a hardware configuration as shown in Fig. 12. The selection device 24 includes a CPU (Central Processing Unit) 301, a RAM (Random Access Memory) 302, a ROM (Read Only Memory) 303, an operation input device 304, a display device 305, a storage device 306, and a communication device 307. These components are connected by a bus.

[0128] The CPU 301 is a processor that executes arithmetic processing, control processing, etc. in accordance with a program. The CPU 301 uses a predetermined area of ​​the RAM 302 as a work area and executes various processes in cooperation with programs stored in the ROM 303, the storage device 306, etc.

[0129] The RAM 302 is a memory such as an SDRAM (Synchronous Dynamic Random Access Memory), and functions as a work area for the CPU 301. The ROM 303 is a memory that stores programs and various types of information in a non-rewritable manner.

[0130] The operation input device 304 is an input device such as a mouse, a keyboard, etc. The operation input device 304 receives information input by a user as an instruction signal, and outputs the instruction signal to the CPU 301.

[0131] The display device 305 is a display device such as an LCD (Liquid Crystal Display), etc. The display device 305 displays various information based on a display signal from the CPU 301.

[0132] The storage device 306 is a device that writes and reads data to a semiconductor storage medium such as a flash memory, or a magnetically or optically recordable storage medium, etc. The storage device 306 writes and reads data to the storage medium in response to control from the CPU 301. The communication device 307 communicates with external devices via a network in response to control from the CPU 301.

[0133] The program executed by the computer has a modular configuration including a risk vulnerability detection module, a risk score calculation module, a technology similarity calculation module, a target similarity calculation module, a prediction module, a correction module, and an output module. The program may further include a mitigation measure determination module.

[0134] When the program is loaded on RAM 302 and executed by CPU 301 (processor), it causes the computer to function as a dangerous vulnerability detection unit 32, a risk score calculation unit 34, a technical similarity calculation unit 38, a target similarity calculation unit 42, a prediction unit 48, a correction unit 50, and an output unit 52. Furthermore, the program may also cause the computer to function as a mitigation measure determination unit 64. Furthermore, the program may also cause RAM 302, ROM 303, or storage device 306 to function as a technical information storage unit 36, a target information storage unit 40, an environmental value storage unit 44, and a prediction model storage unit 46. Furthermore, the program may also cause RAM 302, ROM 303, or storage device 306 to function as a mitigation measure storage unit 62. Note that some or all of the dangerous vulnerability detection unit 32, the risk score calculation unit 34, the technical similarity calculation unit 38, the target similarity calculation unit 42, the prediction unit 48, the correction unit 50, the output unit 52, and the mitigation measure determination unit 64 may be implemented using hardware circuits.

[0135] In addition, the program to be executed by a computer is provided as a file in a format that can be installed on a computer or in a format that can be executed by a computer, and is recorded on a computer-readable recording medium such as a CD-ROM, a flexible disk, a CD-R, or a DVD (Digital Versatile Disk).

[0136] This program may also be configured to be stored on a computer connected to a network such as the Internet and provided by being downloaded via the network. This program may also be configured to be provided or distributed via a network such as the Internet. The program executed by the selection device 24 may also be configured to be provided by being pre-installed in the ROM 303 or the like.

[0137] Although several embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be embodied in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included within the scope and spirit of the invention, and are also included in the scope of the invention and its equivalents as defined in the claims.

[0138] (Addendum) The above-described embodiments can be summarized as the following technical proposals.

[0139] [Technical proposal 1] a dangerous vulnerability detection unit that detects vulnerabilities that may allow attacks against a target system that executes information processing as dangerous vulnerabilities; a technical similarity calculation unit that calculates a technical similarity representing a technical similarity between each of a plurality of pre-registered vulnerabilities and the dangerous vulnerability; a risk score calculation unit that calculates, for each of the plurality of vulnerabilities, a risk score that indicates the degree of risk of an attack on the corresponding vulnerability in the target system based on the technical similarity; an output unit that determines at least one of the plurality of vulnerabilities as a vulnerability to be addressed based on the risk score for each of the plurality of vulnerabilities, and outputs identification information that identifies the vulnerability to be addressed; An information processing device comprising:

[0140] [Technical proposal 2] The output unit determines, from among the plurality of vulnerabilities, a vulnerability whose risk score is equal to or greater than a preset threshold as the vulnerability to be addressed. An information processing device according to Technical Proposal 1.

[0141] [Technical proposal 3] The technical similarity calculation unit calculates, for each of the plurality of vulnerabilities, a similarity with the dangerous vulnerability in one or more items of a vulnerability type, a vulnerability characteristic, and a feature amount of a source code or a binary code of the vulnerability, as the technical similarity. An information processing device according to Technical Solution 1 or 2.

[0142] [Technical proposal 4] a score is assigned in advance to each of the type, the characteristic, and the feature amount; The technical similarity calculation unit calculates, for each of the plurality of vulnerabilities, a value obtained by adding up scores of items that are the same as the dangerous vulnerability, as the technical similarity. An information processing device according to Technical Proposal 3.

[0143] [Technical proposal 5] an object similarity calculation unit that calculates an object similarity representing a similarity between each of a plurality of pre-registered vulnerabilities and the dangerous vulnerability, the object similarity representing a similarity between each of the pre-registered vulnerabilities and an object that has or exploits the vulnerability; The risk score calculation unit calculates the risk score for each of the plurality of vulnerabilities based on the technology similarity and the target similarity. An information processing device described in any one of technical proposals 1 to 4.

[0144] [Technical proposal 6] The target similarity calculation unit calculates, for each of the plurality of vulnerabilities, a similarity between the dangerous vulnerability and one or more items of target software / hardware indicating software or hardware having the vulnerability, software type indicating the type of software having the vulnerability, and target hardware type indicating the type of hardware that becomes vulnerable when the software having the vulnerability is executed, as the target similarity. An information processing device according to Technical Proposal 5.

[0145] [Technical proposal 7] A score is assigned in advance to each of the target software / hardware, the software type, and the target hardware type, The object similarity calculation unit calculates, for each of the plurality of vulnerabilities, a value obtained by adding up scores of items that are the same as the dangerous vulnerability, as the object similarity. An information processing device according to Technical Proposal 6.

[0146] [Technical proposal 8] a correction unit that corrects the risk score for each of the plurality of vulnerabilities based on an environmental value that indicates the magnitude of the impact if the target system is attacked; The information processing device according to any one of technical proposals 1 to 7, further comprising:

[0147] [Technical proposal 9] a prediction unit that predicts a change in risk of attacks against vulnerabilities during a set period from a specific time point to a prediction time point, The correction unit corrects the risk score for each of the plurality of vulnerabilities based on the risk change amount. An information processing device according to Technical Proposal 8.

[0148] [Technical proposal 10] The correction unit sets the period from the specific time point to the time point when the next maintenance is performed on the target system as the set period. An information processing device according to Technical Proposal 9.

[0149] [Technical proposal 11] a mitigation measure determination unit that determines one or more effective mitigation measures that are effective for the addressed vulnerability from among a plurality of pre-registered mitigation measures that mitigate the impact of the vulnerability by a method other than addressing the vulnerability by a patch program; The output unit outputs the one or more determined effective mitigation measures for the addressed vulnerability. An information processing device according to any one of technical proposals 1 to 10.

[0150] [Technical proposal 12] For each of the plurality of mitigation measures, one or more items of vulnerabilities for which the measures are effective, types of vulnerabilities for which the measures are effective, characteristics of the vulnerabilities, and features of source code or binary code of the vulnerabilities are registered in advance; The mitigation measure determination unit determines, as the one or more effective mitigation measures, one or more mitigation measures for which one or more items of the type, the characteristic, and the feature amount registered as effective measures are the same as those of the vulnerability to be addressed. An information processing device according to Technical Proposal 11.

[0151] [Technical proposal 13] the mitigation measure determination unit determines an optimal effective mitigation measure from the one or more effective mitigation measures according to a preset policy; The output unit outputs the optimal effective mitigation measure for the addressed vulnerability. An information processing device according to Technical Proposal 12.

[0152] [Technical proposal 14] The mitigation measure determination unit a policy that minimizes the overall number of optimal effective mitigation measures when outputting a plurality of the countermeasure vulnerabilities; a policy for outputting one or more of the vulnerabilities to be addressed at a cost equal to or less than a predetermined cost; A policy that satisfies constraints defined in the target system; and A policy that applies multiple effective mitigation measures to one vulnerability. The optimal effective mitigation measures are determined by either An information processing device according to Technical Proposal 13.

[0153] [Technical proposal 15] a target system that performs information processing; a security management device that applies a patch program to the target system to fix vulnerabilities in the target system; An information processing device according to any one of technical proposals 1 to 14; An information processing system comprising:

[0154] [Technical proposal 16] An information processing method executed by an information processing device, the information processing device detects, as a dangerous vulnerability, a vulnerability that may allow an attack to be launched against a target system that executes information processing; the information processing device calculates, for each of a plurality of pre-registered vulnerabilities, a technical similarity representing a technical similarity between the pre-registered vulnerabilities and the dangerous vulnerability; the information processing device calculates, for each of the plurality of vulnerabilities, a risk score representing a degree of risk that an attack will be made against the corresponding vulnerability in the target system based on the technical similarity; The information processing device determines at least one of the plurality of vulnerabilities as a vulnerability to be addressed based on the risk score for each of the plurality of vulnerabilities, and outputs identification information for identifying the vulnerability to be addressed. Information processing methods.

[0155] [Technical proposal 17] A program executed by an information processing device, The information processing device a dangerous vulnerability detection unit that detects vulnerabilities that may allow attacks against a target system that executes information processing as dangerous vulnerabilities; a technical similarity calculation unit that calculates a technical similarity representing a technical similarity between each of a plurality of pre-registered vulnerabilities and the dangerous vulnerability; a risk score calculation unit that calculates, for each of the plurality of vulnerabilities, a risk score that indicates the degree of risk of an attack on the corresponding vulnerability in the target system based on the technical similarity; an output unit that determines at least one of the plurality of vulnerabilities as a vulnerability to be addressed based on the risk score for each of the plurality of vulnerabilities, and outputs identification information that identifies the vulnerability to be addressed; A program that makes it work. [Explanation of symbols]

[0156] 10 Information Processing Systems 20 Target System 24 Selection Device 26 Security control devices 32 Risk and vulnerability detection unit 34 Risk score calculation section 36 Technical information storage section 38 Technology similarity calculation section 40 Target information storage unit 42 Object Similarity Calculation Unit 44 Environmental Value Memory Unit 46 Prediction model memory section 48 Prediction Department 50 Correction unit 52 Output section 62 Mitigation measure storage section 64 Mitigation Measures Determination Department

Claims

1. a dangerous vulnerability detection unit that detects vulnerabilities that may allow attacks against a target system that executes information processing as dangerous vulnerabilities; a technical similarity calculation unit that calculates a technical similarity representing a technical similarity between each of a plurality of pre-registered vulnerabilities and the dangerous vulnerability; a risk score calculation unit that calculates, for each of the plurality of vulnerabilities, a risk score that indicates the degree of risk of an attack on the corresponding vulnerability in the target system based on the technical similarity; an output unit that determines at least one of the plurality of vulnerabilities as a vulnerability to be addressed based on the risk score for each of the plurality of vulnerabilities, and outputs identification information that identifies the vulnerability to be addressed; Equipped with the technical similarity calculation unit calculates, for each of the plurality of vulnerabilities, a similarity with the dangerous vulnerability in one or more items of a vulnerability type, a vulnerability characteristic, and a feature amount of a source code or a binary code of the vulnerability, as the technical similarity; a score is assigned in advance to each of the type, the characteristic, and the feature amount; The technical similarity calculation unit calculates, for each of the plurality of vulnerabilities, a value obtained by adding up scores of items that are the same as the dangerous vulnerability, as the technical similarity. Information processing device.

2. The output unit determines, from among the plurality of vulnerabilities, a vulnerability whose risk score is equal to or greater than a preset threshold as the vulnerability to be addressed. The information processing device according to claim 1 .

3. an object similarity calculation unit that calculates an object similarity representing a similarity between each of a plurality of pre-registered vulnerabilities and the dangerous vulnerability, the object similarity representing a similarity between each of the pre-registered vulnerabilities and an object that has or exploits the vulnerability; The risk score calculation unit calculates the risk score for each of the plurality of vulnerabilities based on the technology similarity and the target similarity. The information processing device according to claim 1 .

4. The target similarity calculation unit calculates, for each of the plurality of vulnerabilities, a similarity between the dangerous vulnerability and one or more of the following items: target software / hardware indicating software or hardware having the vulnerability; software type indicating the type of software having the vulnerability; and target hardware type indicating the type of hardware that becomes vulnerable when the software having the vulnerability is executed. The information processing device according to claim 3 .

5. a score is assigned in advance to each of the target software / hardware, the software type, and the target hardware type; The object similarity calculation unit calculates, for each of the plurality of vulnerabilities, a value obtained by adding up scores of items that are the same as the dangerous vulnerability, as the object similarity. The information processing device according to claim 4 .

6. a correction unit that corrects the risk score for each of the plurality of vulnerabilities based on an environmental value that indicates the magnitude of the impact if the target system is attacked; The information processing device according to claim 1 , further comprising:

7. a prediction unit that predicts a change in risk of attacks against vulnerabilities during a set period from a specific time point to a prediction time point, The correction unit corrects the risk score for each of the plurality of vulnerabilities based on the risk change amount. The information processing device according to claim 6 .

8. The correction unit sets the period from the specific time point to the time point when the next maintenance is performed on the target system as the set period. The information processing device according to claim 7 .

9. a mitigation measure determination unit that determines one or more effective mitigation measures that are effective for the vulnerability being addressed from among a plurality of pre-registered mitigation measures that mitigate the impact of the vulnerability by a method other than addressing the vulnerability with a patch program; The output unit outputs the one or more determined effective mitigation measures for the addressed vulnerability. The information processing device according to claim 1 .

10. For each of the plurality of mitigation measures, one or more items of vulnerabilities for which the measures are effective, types of vulnerabilities for which the measures are effective, characteristics of the vulnerabilities, and features of source code or binary code of the vulnerabilities are registered in advance; The mitigation measure determination unit determines, as the one or more effective mitigation measures, one or more mitigation measures for which one or more items of the type, the characteristic, and the feature amount registered as effective measures are the same as those of the addressed vulnerability. The information processing device according to claim 9 .

11. the mitigation measure determination unit determines an optimal effective mitigation measure from the one or more effective mitigation measures according to a preset policy; The output unit outputs the optimal effective mitigation measure for the addressed vulnerability. The information processing device according to claim 10.

12. The mitigation measure determination unit a policy that minimizes the overall number of optimal effective mitigation measures when outputting a plurality of the countermeasure vulnerabilities; a policy for outputting one or more of the vulnerabilities to be addressed at a cost equal to or less than a predetermined cost; A policy that satisfies constraints defined in the target system; and A policy that applies multiple effective mitigation measures to one of the vulnerabilities addressed. The optimal effective mitigation measures are determined by either The information processing device according to claim 11.

13. a target system that performs information processing; a security management device that applies a patch program to the target system to fix vulnerabilities in the target system; The information processing device according to claim 1 ; An information processing system comprising:

14. An information processing method executed by an information processing device, the information processing device detects, as a dangerous vulnerability, a vulnerability that may allow an attack to be launched against a target system that executes information processing; the information processing device calculates, for each of a plurality of pre-registered vulnerabilities, a technical similarity representing a technical similarity between the pre-registered vulnerabilities and the dangerous vulnerability; the information processing device calculates, for each of the plurality of vulnerabilities, a risk score representing a degree of risk that an attack will be made against the corresponding vulnerability in the target system based on the technical similarity; the information processing device determines at least one of the plurality of vulnerabilities as a vulnerability to be addressed based on the risk score for each of the plurality of vulnerabilities, and outputs identification information for identifying the vulnerability to be addressed; the information processing device calculates, for each of the plurality of vulnerabilities, a similarity with the dangerous vulnerability in one or more items of a type of the vulnerability, characteristics of the vulnerability, and a feature amount of a source code or a binary code of the vulnerability, as the technical similarity; a score is assigned in advance to each of the type, the characteristic, and the feature amount; The information processing device calculates, as the technical similarity, a value obtained by adding up the scores of items that are the same as the dangerous vulnerability for each of the plurality of vulnerabilities. Information processing methods.

15. A program executed by an information processing device, The information processing device a dangerous vulnerability detection unit that detects vulnerabilities that may allow attacks against a target system that executes information processing as dangerous vulnerabilities; a technical similarity calculation unit that calculates a technical similarity representing a technical similarity between each of a plurality of pre-registered vulnerabilities and the dangerous vulnerability; a risk score calculation unit that calculates, for each of the plurality of vulnerabilities, a risk score that indicates the degree of risk of an attack on the corresponding vulnerability in the target system based on the technical similarity; an output unit that determines at least one of the plurality of vulnerabilities as a vulnerability to be addressed based on the risk score for each of the plurality of vulnerabilities, and outputs identification information that identifies the vulnerability to be addressed; and make it work, the technical similarity calculation unit calculates, for each of the plurality of vulnerabilities, a similarity with the dangerous vulnerability in one or more items of a vulnerability type, a vulnerability characteristic, and a feature amount of a source code or a binary code of the vulnerability, as the technical similarity; a score is assigned in advance to each of the type, the characteristic, and the feature amount; The technical similarity calculation unit calculates, for each of the plurality of vulnerabilities, a value obtained by adding up scores of items that are the same as the dangerous vulnerability, as the technical similarity. program.

Images