Information processing systems, information processing methods, and programs

Abstract

We provide information processing systems and other tools that enable more accurate risk assessments of systems than conventional methods. [Solution] According to one aspect of the present invention, an information processing system is provided, comprising at least one processor, the processor configured to perform the following steps by reading a program, wherein in the metadata acquisition step, metadata of a system to be diagnosed for risk assessment is acquired, and in the determination step, the importance used for risk assessment of the system to be diagnosed is determined based on the metadata and first reference information, the first reference information being information relating to the correlation between metadata and importance.

Description

Technical Field

[0001] The present invention relates to an information processing system, an information processing method, and a program.

Background Art

[0002] Patent Document 1 discloses a technique for determining information related to the vulnerability of a system.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] There is a need for a technique that can perform a more appropriate risk diagnosis.

[0005] In view of the above circumstances, the present invention aims to provide an information processing system or the likes that can perform a more appropriate risk diagnosis of a system than in the prior art.

Means for Solving the Problems

[0006] According to one aspect of the present invention, there is provided an information processing system including at least one processor, the processor being configured to execute the following steps by reading a program. In a metadata acquisition step, metadata of a diagnostic target system for performing a risk diagnosis is acquired. In a determination step, based on the metadata and first reference information, the importance used for the risk diagnosis of the diagnostic target system is determined, and the first reference information is information regarding the correlation between the metadata and the importance.

[0007] According to such an aspect, it is possible to perform a more appropriate risk diagnosis of a system than in the prior art.

Brief Description of the Drawings

[0008] [Figure 1] This is a diagram showing the configuration of Information Processing System 1. [Figure 2] This is a block diagram showing the hardware configuration of the information processing device 10. [Figure 3] This is a block diagram showing the hardware configuration of user terminal 20. [Figure 4] This is a block diagram showing the functions realized by the information processing device 10 (control unit 11) and the user terminal 20 (control unit 21). [Figure 5] This flowchart shows an example of the processing performed by the determination unit 115 in the first determination method. [Figure 6] This flowchart shows an example of the process executed by the determination unit 115 in the second determination method. [Figure 7] This is an activity diagram showing an example of the flow of information processing (vulnerability management processing) performed by Information Processing System 1. [Modes for carrying out the invention]

[0009] Embodiments of the present invention will be described below with reference to the drawings. The various features shown in the embodiments below can be combined with each other.

[0010] Incidentally, the program for implementing the software appearing in one embodiment may be provided as a non-transitory computer-readable medium, or it may be provided as a downloadable medium from an external server, or it may be provided so that the program is launched on an external computer and its functions are realized on a client terminal (so-called cloud computing).

[0011] Furthermore, in various information processing according to one embodiment, an input and an output corresponding to the input can be realized. Here, as long as an output is obtained as a result of the input, the form of the information referenced in such information processing (hereinafter referred to as "reference information") is not limited. The reference information may be, for example, rule-based information such as a database, a lookup table, or a predetermined function (including a decision formula such as a regression equation constructed by a statistical method), or a trained model that has been pre-trained to learn the correlation between input and output, or a generative AI such as a large-scale language model that can output a desired result by inputting a prompt (these models include parameters that construct the correlation relationship between input and output) or a visual language model.

[0012] Furthermore, in one embodiment, "part" may include, for example, hardware resources implemented by a circuit in a broad sense, and the information processing of software that can be specifically realized by these hardware resources. Also, in one embodiment, various types of information are handled, and this information can be represented, for example, by the physical values ​​of signal values ​​representing voltage and current, the high or low values ​​of signal values ​​as a set of binary bits composed of 0s or 1s, or by quantum superposition (so-called qubits), and communication and calculations can be performed on a circuit in a broad sense.

[0013] Furthermore, a circuit in a broad sense is a circuit realized by combining at least a suitable combination of circuits, circuits, processors, and memory. The processor may be a general-purpose processor or a dedicated circuit. In other words, it includes application-specific integrated circuits (ASICs), programmable logic devices (for example, simple programmable logic devices (SPLDs), complex programmable logic devices (CPLDs), and field programmable gate arrays (FPGAs)), etc.

[0014] 1. Hardware Configuration This section describes the hardware configuration.

[0015] <Information Processing System 1> Figure 1 is a configuration diagram representing information processing system 1. Information processing system 1 comprises a communication line 2, an information processing device 10, multiple user terminals 20, multiple managed servers 30, and a vulnerability information server 40. The information processing device 10, user terminals 20, managed servers 30, and vulnerability information server 40 are configured to communicate with each other via the communication line 2. The connection between the information processing device 10, user terminals 20, managed servers 30, and vulnerability information server 40 may be wired or wireless. Furthermore, the information processing device 10, user terminals 20, managed servers 30, and vulnerability information server 40 are each examples of "information processing devices".

[0016] The information processing system 1 constitutes at least a part of a vulnerability management system that manages the vulnerabilities of the managed server 30, for example. The information processing system 1 mainly performs detection of vulnerabilities of the managed server 30 used or managed by the user U, software management, and the like. In one embodiment, the information processing system 1 is composed of one or more devices or components. Hereinafter, these components will be described.

[0017] <Information processing device 10> FIG. 2 is a block diagram showing the hardware configuration of the information processing device 10. The information processing device 10 is a risk diagnosis device (server having a processor) that performs scanning, identification, management, etc. of risks such as vulnerability information of a system (for example, software). The information processing device 10 may be provided by a provider of a vulnerability diagnosis service that performs, for example, scanning, identification, management, etc. of vulnerability information, and may be used by a user (user U) of the vulnerability diagnosis service. As shown in FIG. 2, the information processing device 10 includes a control unit 11, a storage unit 12, a communication unit 13, and a communication bus 14. The control unit 11, the storage unit 12, and the communication unit 13 are electrically connected via the communication bus 14 inside the information processing device 10.

[0018] <Control unit 11> The control unit 11 performs processing and control of the overall operation related to the information processing device 10. The control unit 11 is, for example, a Central Processing Unit (CPU). The control unit 11 realizes various functions related to the information processing device 10 by reading a predetermined program stored in the storage unit 12. That is, the information processing by the software stored in the storage unit 12 is specifically realized by the control unit 11, which is an example of hardware, and can be executed as each functional unit included in the control unit 11. These will be described in more detail in the next section. Note that the control unit 11 is not limited to being single, and the information processing device 10 may have a plurality of control units 11 for each function. Also, the information processing device 10 may be configured by a combination of these.

[0019] <Storage unit 12> The storage unit 12 stores various information defined by the foregoing description. This can be implemented, for example, as a storage device such as a solid state drive (SSD) that stores various programs and the like related to the information processing apparatus 10 executed by the control unit 11, or as a memory such as a random access memory (RAM) that stores temporarily necessary information (arguments, arrays, etc.) related to the calculation of programs. The storage unit 12 stores various programs, variables, etc. related to the information processing apparatus 10 executed by the control unit 11.

[0020] <Communication unit 13> Although wired communication means such as USB, IEEE1394, Thunderbolt (registered trademark), and wired LAN network communication are preferable for the communication unit 13, wireless LAN network communication, mobile communication such as LTE / 5G, and BLUETOOTH (registered trademark) communication may be included as necessary. That is, the communication unit 13 may be implemented as a collection of these plural communication means. Also, the information processing apparatus 10 may communicate various information with the outside via the communication unit 13 and a network.

[0021] The information processing apparatus 10 may be in an on-premises form or in a cloud form. The information processing apparatus 10 in the cloud form may provide the above-described functions and processes, for example, in the form of SaaS (Software as a Service) or cloud computing.

[0022] <User terminal 20> Figure 3 is a block diagram showing the hardware configuration of the user terminal 20. The user terminal 20 is an information processing terminal used by user U (administrator) who manages the managed server 30, and can access the information processing device 10, which acts as a server. As shown in Figure 3, the user terminal 20 comprises a control unit 21, a storage unit 22, a communication unit 23, an input unit 24, an output unit 25, and a communication bus 26. The control unit 21, storage unit 22, communication unit 23, input unit 24, and output unit 25 are electrically connected within the user terminal 20 via the communication bus 26. The explanation of the control unit 21, storage unit 22, and communication unit 23 is the same as the explanation of each part in the information processing device 10, so it is omitted.

[0023] <Input section 24> The input unit 24 receives operation inputs made by the user. The operation inputs are transmitted as command signals to the control unit 21 via the communication bus 26. The control unit 21 can perform predetermined controls, calculations, etc., based on the transmitted command signals as needed. The input unit 24 may be included in the casing of the user terminal 20 or it may be an external component. For example, the input unit 24 may be implemented as a touch panel integrated with the output unit 25. When the input unit 24 is implemented as a touch panel, the user can input tap operations, swipe operations, etc. to the input unit 24. Instead of a touch panel, the input unit 24 can be a switch button, mouse, trackpad, QWERTY keyboard, etc.

[0024] <Output section 25> The output unit 25 displays a graphical user interface (GUI) screen that can be operated by the user. The output unit 25 may be included in the casing of the user terminal 20 or it may be an external component. Specifically, the output unit 25 can be implemented as a display device such as a CRT display, liquid crystal display, organic EL display, or plasma display. It is preferable that these display devices be used in accordance with the type of user terminal 20.

[0025] <Managed Server 30> The managed server 30 is a server containing the system to be diagnosed (for example, a system including software that performs vulnerability detection) on which the risk assessment is performed, or a server whose entirety constitutes the system to be diagnosed. The managed server 30 may be a physical server or a virtual server (cloud asset) built on a cloud platform provided by a cloud service provider. In other words, the system to be diagnosed may be a virtual server. The cloud platform may be, for example, a platform on which services such as databases, storage, and applications can be used via the internet.

[0026] <Vulnerability Information Server 40> The vulnerability information server 40 is a server that manages software vulnerability information. The vulnerability information server 40 may consist of multiple servers. Examples of vulnerability information servers 40 include management servers for vulnerability information websites (vulnerability information databases) such as CVE (Common Vulnerabilities and Exposures), NVD (National Vulnerability Database), ICAT (IPA Cybersecurity Alert Service) Metabase, JVN (Japan Vulnerability Notes), JVN iPedia, and OSVDB (Open Source Vulnerability Database). The vulnerability information server 40 may also include servers that store vulnerability information (e.g., security advisories) provided independently by software suppliers. The software for which vulnerability information is managed may also include OSS (Open Source Software).

[0027] 2. Functional Configuration This section describes the functional configuration of this embodiment. Information processing by software stored in the memory unit 12 is specifically realized by the control unit 11, which is an example of hardware, and can be executed as each functional unit included in the control unit 11 (at least one processor provided by the information processing system 1).

[0028] Figure 4 is a block diagram showing the functions realized by the information processing device 10 (control unit 11) and the user terminal 20 (control unit 21).

[0029] As shown in Figure 4A, the information processing device 10 (control unit 11) comprises a basic display control unit 111, a metadata acquisition unit 112, a vulnerability detection unit 113, a correspondence reception unit 114, a determination unit 115, and an artificial intelligence unit 120.

[0030] As shown in Figure 4B, the user terminal 20 (control unit 21) includes a display unit 211 and an operation acquisition unit 212.

[0031] <Basic display control unit 111> The basic display control unit 111 is configured to display various information on the user terminal 20. For example, the basic display control unit 111 displays vulnerability information detected by the vulnerability detection unit 113 on the display unit 211 of the user terminal 20.

[0032] <Metadata acquisition unit 112> The metadata acquisition unit 112 is configured to acquire metadata of the system to be diagnosed for risk assessment.

[0033] The "risks" covered by a "risk assessment" include, for example, security risks (e.g., vulnerabilities), management risks (e.g., end-of-life (EOL)), and business continuity risks (e.g., risks considered in a business continuity plan (BCP)).

[0034] Metadata is data that describes the structure, purpose, characteristics, network environment, etc., of the system being diagnosed. Metadata includes data expressed in natural language, numerical data, symbolic data, and combinations of these.

[0035] The metadata acquisition unit 112 may acquire multiple types of metadata. The "type" of metadata is a categorization of the information represented by the metadata. Examples of metadata types include an overview of the system to be diagnosed, tags, title, hostname, number of IPs (Internet Protocol), instance size, volume size, monitoring settings, LB (Load Balancer) settings, DNS (Domain Name System) settings, public IP settings, CIDR (Classless Inter-Domain Routing) settings, security group settings, public cloud information, etc.

[0036] "Overview," "Tags," and "Title" are optional items set by the system administrator, for example, through the system management service provided by the information processing device 10, the provider of the system to be diagnosed, or a cloud service, and are written in natural language.

[0037] The "Overview" section primarily includes the use, purpose, and functions of the system being diagnosed. The "Tags" section primarily includes terms indicating the importance of the system being diagnosed, its environment (type such as production environment or test environment), etc. Note that tags may exist as different types of metadata: those attached to the system being diagnosed itself via the system management service (security management service) provided by the information processing device 10 ("system being diagnosed tags"), and those attached to the public cloud on which the system being diagnosed (virtual server) is provided via the cloud service providing that public cloud ("public cloud tags"). The "Title" section primarily includes a name used to identify the system being diagnosed.

[0038] "hostname" is a mandatory item that is set by a system administrator via, for example, a system management service provided by the information processing device 10, a provider or cloud service that provides the system to be diagnosed, or is automatically set by the provider or cloud service, and is described using a combination of natural language, symbols, numbers, etc. "hostname" is set according to a naming convention that includes, for example, type, purpose, environment, etc.

[0039] "Number of IP addresses" refers to the number of IP addresses assigned to the system being diagnosed. A higher number of IP addresses indicates more complex network requirements and a greater concentration of access routes, certificate management, etc.

[0040] "Instance size" is a numerical value that indicates, for example, the amount of CPU, memory, etc. allocated (the magnitude of computing performance) of the system being diagnosed. "Volume size" is a numerical value that indicates, for example, the size of the storage (storage capacity). Instance size and volume size may also be relative values ​​(ratios to the mean, median, etc.) across multiple systems (system groups) being diagnosed by the same user.

[0041] "Monitoring settings" refer to, for example, a list of items for which alerts are set for the system being diagnosed (e.g., stability indicators such as CPU utilization), the number of items, etc.

[0042] "LB settings" indicates, for example, whether or not a load balancer (LB) is configured. "DNS settings" indicates, for example, whether or not DNS is configured. A system being diagnosed with an LB or DNS configured is considered to have a high probability of providing publicly available services. "Public IP settings" indicates whether or not a public IP address has been assigned.

[0043] "CIDR settings" are information such as whether a CIDR is set, and the number of bits in the host portion of the CIDR (number of usable IP addresses). A system being diagnosed with a CIDR set is considered to be accessible from the internet. "Security group settings" are information such as the settings of the security group (scope of permitted communication).

[0044] "Public cloud information" refers to information such as the scope of public access of the public cloud where the system (virtual server) being diagnosed is provided, and whether or not there is any unintended exposure. Note that public cloud information may be inferred based on CIDR settings, security group settings, etc. Furthermore, public cloud information may be obtained from a CSPM (Cloud Security Posture Management) tool.

[0045] The types of metadata may include those referenced by the determination unit 115 (described later) as elements that increase importance, those referenced as elements that decrease importance, and those referenced as both elements that increase importance and elements that decrease importance.

[0046] "Importance" is an indicator that shows the priority of risk management for the system being diagnosed, and is determined based on factors such as the likelihood of the risk occurring and the magnitude of its impact (damage) if the risk occurs. Specifically, importance is used to determine the priority level of vulnerabilities detected by the vulnerability detection unit 113, which will be described later.

[0047] The metadata acquisition unit 112 may acquire metadata, including natural language, that is stored in association with the system to be diagnosed. This allows the determination unit 115, described later, to determine the importance level based on the purpose, characteristics, etc., of the system to be diagnosed, as assigned by the system administrator, etc. Examples of metadata including natural language include summary, tags, title, hostname, etc.

[0048] The metadata acquisition unit 112 may acquire metadata that includes a numerical value indicating the resource size of the system to be diagnosed. This allows the determination unit 115, described later, to determine the importance according to the size of the resources. Examples of metadata that include a numerical value indicating the resource size include instance size, volume size, etc.

[0049] The metadata acquisition unit 112 may acquire metadata that includes configuration information for the network environment of the system to be diagnosed. This allows the determination unit 115, described later, to determine the importance of the network environment (e.g., scope of public access). Examples of metadata that include network environment configuration information include the number of IP addresses, monitoring settings, load balancer settings, DNS settings, public IP settings, CIDR settings, security group settings, and public cloud information.

[0050] The metadata acquisition unit 112 may acquire metadata of a type specified by the user, or it may acquire all types of metadata that can be acquired as metadata for the system being diagnosed.

[0051] <Vulnerability detection unit 113> The vulnerability detection unit 113 is configured to detect vulnerabilities in the system being diagnosed.

[0052] "Vulnerability" (vulnerability information) includes, for example, information about vulnerabilities in software, programs, applications, components, etc., such as defects in use or bugs. Vulnerabilities may also include vulnerability identifiers that uniquely identify software vulnerabilities, information about software affected by the vulnerability (e.g., identifiers and versions), whether or not attack code exploiting the software vulnerability is circulating, score information indicating the level of the software vulnerability, and security information such as misconfigurations or omissions in cloud services.

[0053] The vulnerability detection unit 113 may perform a vulnerability scan on a snapshot that preserves the state of at least a portion of the system under diagnosis. A snapshot is, for example, information that records the state of assets included in the system under diagnosis (the resource under diagnosis). Typically, a snapshot contains information that allows the system under diagnosis (the resource under diagnosis) at the time the snapshot was created to be restored by mounting it to a virtual server, operating system (OS), etc.

[0054] The assets of the system being diagnosed include all system environments, entities, and services that the user can manage (or, in the case of virtual servers, manage on the cloud platform). Assets may include, for example, virtual machines, virtual disks, virtual networks, storage accounts, software such as web applications, databases, roles, and policies included in the system being diagnosed. Here, roles and policies are information that defines who has what permissions on a resource.

[0055] The vulnerability detection unit 113 extracts asset information from a snapshot, for example, and determines whether the asset information contains vulnerabilities based on vulnerability master information (reference information for vulnerability scanning). "Asset information" is information that indicates the status of an asset. Asset information includes, for example, application libraries, hosts, container images, SBOMs (Software Bill of Material), etc.

[0056] The vulnerability detection unit 113 may indirectly access snapshots within the system being diagnosed and perform scans by sending requests to APIs (Application Programming Interfaces) provided by the system being diagnosed, the cloud platform provider, etc.

[0057] Vulnerability master information is, for example, information obtained by the information processing device 10 from the vulnerability information server 40 and stored in the vulnerability information database of the storage unit 12. Vulnerability master information includes, for example, security vulnerabilities (defects) contained in hardware or software, the type of defect, countermeasures against the defect, and severity (level of vulnerability). Severity can be expressed as, for example, a score value defined by CVSS (Common Vulnerability Scoring System) (e.g., Base Score). Vulnerability master information may also include the CVSS version.

[0058] Furthermore, vulnerability master information may include information indicating the vulnerability level set by a third-party organization, information indicating whether or not it is accessible from the outside, information indicating the magnitude of the impact on business operations due to attacks on the vulnerability, information indicating whether or not attack code for the vulnerability is circulating, and information indicating whether or not the exploitation of the vulnerability has been confirmed. If attack code for the vulnerability is circulating, vulnerability master information may also include said attack code.

[0059] The vulnerability master information may be information obtained from the vulnerability information server 40 and then processed. Examples of processing the information obtained from the vulnerability information server 40 include partial extraction of information, modification of information, and addition of new information. These processing may be performed by a user, for example, or by the control unit 11 through text analysis, processing by a learning model, etc. Furthermore, the vulnerability master information may be information obtained from websites such as security-related news sites or blogs, or it may be information registered in the vulnerability information database by a user inputting it from the user terminal 20.

[0060] The vulnerability detection unit 113 may cause an agent installed on the system to be diagnosed (managed server 30) to collect system configuration information to obtain configuration information of at least a portion of the system to be diagnosed (the resources to be diagnosed), receive the configuration information obtained by the agent, and further perform a vulnerability scan on the configuration information.

[0061] An agent is a resident program installed on the system to be diagnosed (e.g., a virtual server) to monitor the system. The configuration information collected by the agent includes, for example, the hardware configuration of the system to be diagnosed (e.g., CPU model), the name and version of the OS installed on the system, the names, versions, and settings of the software installed on the system, the user accounts and account privileges of the system, the network to which the system is connected, the IP address of the system, the devices connected to the system, the devices communicating with the system, the content and protocols of the communication, and information indicating the status of the ports on the system (open ports). The configuration information collected by the agent may also include asset information obtained from the snapshots mentioned above.

[0062] Furthermore, the vulnerability detection unit 113 may reconstruct at least a portion of the system to be diagnosed as a scanning system based on a snapshot that saves the state of at least a portion of the system to be diagnosed (the resources to be diagnosed), and perform a vulnerability scan on this scanning system.

[0063] The vulnerability detection unit 113 may perform vulnerability detection at any time of the user's choosing (for example, when a command to perform vulnerability detection is entered on the user terminal 20), or it may be performed periodically at predetermined intervals. Furthermore, vulnerability detection may be performed at the same time as metadata acquisition by the metadata acquisition unit 112, or at a different time from metadata acquisition.

[0064] <Reception Department 114> The correspondence reception unit 114 is configured to receive input from the user terminal 20 regarding the correspondence between metadata acquired by the metadata acquisition unit 112 and the importance level determined by the determination unit 115, which will be described later.

[0065] A "correspondence relationship" is information such as a table defining the relationship between the content of metadata (e.g., keywords included in the metadata, the magnitude of numerical values ​​included in the metadata, etc.) and the magnitude of importance, as well as a judgment formula and judgment conditions. Correspondence relationships may be set for each type of metadata.

[0066] For metadata of the "Summary" or "Title" type, an example of a correspondence is that if important keywords such as "payment," "member," "order," "financial information," or "personal information" are included, the importance level is increased, and if non-important keywords such as "verification" or "test" are included, the importance level is decreased.

[0067] For metadata of the "tag" type ("system tag to be diagnosed" or "public cloud tag"), an example of a correspondence is given where the importance level is increased if it contains important keywords such as "important," "confidential," or "production," or keywords similar to important keywords, and the importance level is decreased if it contains non-important keywords such as "dev," "test," or "staging," or keywords similar to non-important keywords.

[0068] The similarity between two keywords is determined, for example, by the difference in the features of each keyword (for example, the distance between the vectors obtained by vectorizing the keywords). The correspondence reception unit 114 determines that two keywords are similar if the difference in their features is small (for example, the cosine similarity, which is the distance between the two vectors, is above a threshold). Vectorization is performed by quantification using known methods such as natural language processing by morphological analysis or encoding. Alternatively, features may be calculated by referring to a table that defines features for each keyword. Furthermore, the correspondence reception unit 114 may determine the similarity between two keywords using a database containing synonyms, related words, variations in spelling, etc., or a learning model (for example, a large-scale language model).

[0069] For metadata of the "hostname" type, an example of a correspondence is given where the importance is increased if it contains specific important keywords that conform to naming conventions, or keywords similar to important keywords, and decreased if it contains keywords that indicate non-production environments such as testing environments (specific non-important keywords), or keywords similar to non-important keywords. Note that hostnames may not be expressed in natural language depending on the naming convention, so they may be used as supplementary criteria for determination.

[0070] For metadata of the "number of IP addresses" type, an example of a correspondence is given where, for instance, the importance level is increased when the number of IP addresses exceeds a threshold.

[0071] For metadata of the type "instance size" or "volume size," an example of a correspondence is provided where, among multiple systems (system groups) being diagnosed by the same user (same account or same environment), the importance is increased if the instance size is relatively large (for example, the deviation from the mean or median exceeds a threshold, or the ranking from the largest is above a threshold).

[0072] For metadata of the "monitoring settings" type, an example of a correspondence is provided where the importance level is increased when the number of monitoring items, the level of monitoring (for example, the ratio of the number of items set to be monitored to the total number of items that can be monitored), etc., exceed a threshold.

[0073] For metadata of the type "LB settings" or "DNS settings," an example of a correspondence is provided where, for instance, the importance level is increased if an LB or DNS is configured.

[0074] For metadata of the "Public IP Settings" type, an example of a correspondence is given where, for instance, if a public IP address is assigned, the importance is increased, and if a public IP address is not assigned, the importance is decreased.

[0075] For metadata of the type "CIDR setting" or "security group setting," examples of correspondences include determining the importance level to be increased if, for example, internet access is possible (e.g., if a CIDR is set), or if the network exposure of the system being diagnosed exceeds a certain limit, and determining the importance level to be decreased if, for example, it is only accessible from within the organization (i.e., internet access is not possible), or if the network exposure is below a certain limit.

[0076] For metadata of the "public cloud information" type, examples of correspondences are given where the importance is increased when, for example, the scope of public access of the public cloud exceeds a certain level, or when the degree to which the target system, such as Exposure, is exposed to the internet exceeds a certain level.

[0077] The correspondence reception unit 114 may accept correspondence input for all types of metadata that can be used for determination in the determination unit 115, or it may accept correspondence input only for some types of metadata (for example, summaries, tags, etc., which can be set by the user). The accepted correspondence is registered in the database, linked to the user who entered it.

[0078] The correspondence may include the relationship between the keywords included in the metadata and the importance level of those keywords. "Importance level" is information that, in the importance determination of the determination unit 115, indicates whether a keyword is important (increases its importance) or unimportant (decreases its importance), or information that indicates the volume (size of the positive score) that increases its importance or the volume (size of the negative score) that decreases its importance.

[0079] The correspondence reception unit 114 may, for example, receive a selection from the user terminal 20 of the type of metadata (e.g., summary, tags, etc.) to set (edit) the correspondence, and may further receive input from the user terminal 20 of important keywords (keywords that increase importance) or unimportant keywords (keywords that decrease importance) for that type. Here, the correspondence reception unit 114 may receive a selection of either important keywords or unimportant keywords, and input of keywords to add to the correspondence. In this case, information indicating whether the added keyword is an important keyword or an unimportant keyword corresponds to the importance level of that keyword.

[0080] Furthermore, the correspondence reception unit 114 may accept the input of a keyword along with the importance level (numerical value, etc.) of that keyword. In addition, the correspondence reception unit 114 may determine whether the input keyword is an important keyword or not based on the input importance level. For example, a keyword with a positive numerical value (e.g., "1") entered as the importance level may be registered as an important keyword, and a keyword with a negative numerical value (e.g., "-1") entered as the importance level may be registered as an unimportant keyword. The importance level may also be a numerical value that represents the importance of each type of metadata, as determined by the determination unit 115 described later (for example, a value set as importance when the importance determination conditions are met).

[0081] <Judgment unit 115> The determination unit 115 is configured to determine the importance level used for risk diagnosis of the system to be diagnosed, based on the metadata acquired by the metadata acquisition unit 112 and the first reference information.

[0082] The first reference information is information relating to the correlation between metadata and importance. The first reference information is stored, for example, in the memory unit 12. The first reference information may include, for example, a table, a function, a simple algorithm, etc., that shows the correlation between metadata and importance. The correlation included in the first reference information can be constructed, for example, by statistically analyzing data that records metadata and corresponding importance.

[0083] The first reference information may include a set of parameters for generating importance from metadata. For example, the first reference information may be various pre-trained models. For example, the first reference information may include an importance determination model which is a dedicated or general-purpose learning model that has been trained to take metadata as input and output importance. In this case, the determination unit 115 inputs the metadata into the importance determination model and causes the importance determination model to output importance.

[0084] The importance determination model is included in the artificial intelligence unit 120. The importance determination model, which is a dedicated learning model, may be constructed, for example, by training using metadata data and corresponding importance data as training data. In such an importance determination model, parameters calculated and tuned through learning construct a correlation between metadata and importance. The dedicated learning model may also include a generative AI capable of generating answers not included in the training data. The generative AI of the dedicated learning model is a limited-use generative AI that does not require input of instructions such as the content of the output information to be generated or the content of the task to be executed.

[0085] If the importance determination model is a general-purpose learning model (for example, a language model such as a large-scale language model), the determination unit 115 inputs a prompt to the importance determination model that includes metadata and an instruction to output the importance corresponding to the metadata, causing the importance determination model to output the importance. The determination unit 115 may also generate a prompt that gives an instruction to the importance determination model to determine importance and input this prompt to the importance determination model. In addition to metadata and an instruction to determine and output importance, the determination unit 115 may also input a prompt to the importance determination model that includes, for example, one or more metadata samples and one or more corresponding importance samples as examples, samples, or training data of input and output pairs. Here, the parameters that construct the importance determination model and the prompt that includes an instruction to output the importance corresponding to the metadata construct the correlation between metadata and importance. The general-purpose learning model may include a generative AI capable of generating arbitrary output information based on input information. Generative AI for general-purpose learning models is a general-purpose generative AI that requires input such as instructions on the content of the output information to be generated and the content of the task to be performed.

[0086] The determination unit 115 may determine the importance based on the metadata and the first reference information, which includes the correspondence relationships entered by the user. This allows the importance to be determined according to the user's environment, as it is based on the judgment criteria specified by the user (for example, important keywords, unimportant keywords, etc., set in the correspondence relationships).

[0087] If the correspondence includes a relationship between a keyword and its importance level, the determination unit 115 may determine the importance based on the metadata and the first reference information including the correspondence, such that the importance increases according to the importance level of the keyword included in the metadata. This makes it possible for users to easily and accurately adjust the criteria for determining importance. Here, "importance level" refers to the importance level of a keyword if that keyword is included in the metadata, and refers to the importance level of a similar keyword if that similar keyword is included in the metadata.

[0088] The determination unit 115 may determine the priority level of the vulnerability based on its severity. This makes it possible to prioritize vulnerabilities in the system being diagnosed based on the likelihood of risk occurrence for each system being diagnosed, the impact (damage) if a risk occurs, etc.

[0089] "Priority level" refers to the degree of priority given to countermeasures against a vulnerability. In other words, vulnerabilities with a high priority level require immediate countermeasures and should be addressed with higher priority than vulnerabilities with a low priority level. In short, the determination unit 115 uses the severity level to triage the vulnerabilities detected by the vulnerability detection unit 113.

[0090] The determination of the vulnerability priority level by the determination unit 115 includes, for example, the first determination method and the second determination method described below.

[0091] <First judgment method> In the first determination method, the determination unit 115 performs a severity determination process that determines the severity based on the metadata acquired by the metadata acquisition unit 112 and the first reference information, and a level determination process that determines the priority level based on the combination of the vulnerability detected by the vulnerability detection unit 113 and the severity determined in the severity determination process, and the second reference information. As a result, the severity is determined based on the metadata, and then the priority level is determined, making it easy to adjust the severity determination criteria (first reference information).

[0092] The determination unit 115 may determine the importance for each type of metadata in the importance determination process. For example, the determination unit 115 may individually determine the importance of "Overview," "Tags," "Number of IPs," etc., based on the corresponding relationships set for each.

[0093] Furthermore, in the importance determination process, if the metadata contains information indicating that the system to be diagnosed is in a development environment, the determination unit 115 may set the importance of the metadata to a specific value indicating the development environment.

[0094] "Information indicating that the system being diagnosed is in a development environment" includes keywords such as "verification," "test," "development," and "experimentation" that indicate a development environment. The type of metadata containing information indicating a development environment is not particularly limited.

[0095] The "development environment" is an environment accessible to the developers of the system being diagnosed, but inaccessible to users of the system being diagnosed, and is not made public to such users. The development environment includes, for example, a repository management environment and a CI / CD (Continuous Integration / Continuous Delivery) environment.

[0096] A "repository management environment" is an environment that centrally manages the versions of the source code and related files (documents) of the software included in the system being diagnosed. In the repository management environment, the change history of the source code and related files is saved and / or shared. A "CI / CD environment" is an environment that continuously executes a process of integrating (merging) the software code included in the system being diagnosed into a shared repository, automatically building and testing it, and automatically preparing the application that has passed the tests to be deployable to the production environment.

[0097] The "specific value indicating the development environment" may be a unique indicator when the system being diagnosed is in a development environment (e.g., a numerical value, symbol, code, etc. indicating the development environment), or it may be an indicator that is set regardless of whether the system being diagnosed is in a development environment or not (e.g., a numerical value, symbol, code, etc. assigned to a system being diagnosed that is of low importance (i.e., indicating a low level of importance)).

[0098] The second reference information is information regarding the correlation between vulnerability and severity combinations and priority levels. The second reference information is stored, for example, in the memory unit 12. The second reference information may include, for example, tables, functions, simple algorithms, etc., that show the correlation between vulnerability and severity combinations and priority levels. The correlations included in the second reference information can be constructed, for example, by statistically analyzing data that records vulnerability and severity combinations and corresponding priority levels.

[0099] The second reference information may include a set of parameters for generating priority levels from combinations of vulnerabilities and severity. For example, the second reference information may be various pre-trained models. For example, the second reference information may include a first priority level determination model, which is a dedicated or general-purpose pre-trained model that has been trained to take combinations of vulnerabilities and severity as input and output priority levels. In this case, the determination unit 115 inputs the combinations of vulnerabilities and severity to the first priority level determination model and causes the first priority level determination model to output priority levels.

[0100] The first priority level determination model is included in the artificial intelligence unit 120. The first priority level determination model, which is a dedicated learning model, may be constructed, for example, by training with data of vulnerability and severity combinations and corresponding priority level data as training data. In such a first priority level determination model, parameters calculated and tuned through learning construct a correlation between vulnerability and severity combinations and priority levels.

[0101] If the first priority level determination model is a general-purpose learning model (for example, a language model such as a large-scale language model), the determination unit 115 inputs a prompt to the first priority level determination model that includes a combination of vulnerability and severity, and an instruction to output a priority level corresponding to the combination of vulnerability and severity, taking the combination of vulnerability and severity as input, causing the first priority level determination model to output a priority level. The determination unit 115 may also generate a prompt that gives an instruction to the first priority level determination model to determine a priority level, and input this prompt to the first priority level determination model. In addition to the combination of vulnerability and severity and the instruction to determine and output a priority level, the determination unit 115 may also input a prompt to the first priority level determination model that includes, for example, one or more samples of vulnerability and severity combinations and one or more samples of corresponding priority levels as examples, samples, or training data of input and output pairs. Here, the parameters that construct the first priority level determination model and the prompt that includes an instruction to output a priority level corresponding to the combination of vulnerability and severity construct a correlation between the combination of vulnerability and severity and the priority level.

[0102] The second reference information may include preliminary reference information and main reference information. In this case, the determination unit 115 determines the preliminary level of the vulnerability in the level determination process based on the vulnerability and the preliminary reference information, and further determines the priority level based on the determined combination of the preliminary level and severity and the main reference information. As a result, the priority level is determined using the preliminary level of the vulnerability, thus improving the accuracy of the priority level determination. In addition, it becomes possible to use existing criteria (preliminary reference information) for determining the preliminary level of the vulnerability. Here, "preliminary level" means the degree of priority for countermeasures against the vulnerability (i.e., priority mainly derived based on the attributes of the vulnerability), without taking into account the severity of the system being diagnosed.

[0103] The preliminary reference information is information regarding the correlation between vulnerabilities and their preliminary levels. The preliminary reference information is stored, for example, in the memory unit 12. The preliminary reference information may include, for example, tables, functions, simple algorithms, etc., that show the correlation between vulnerabilities and their preliminary levels. The correlations included in the preliminary reference information can be constructed, for example, by statistically analyzing data that records vulnerabilities and their corresponding preliminary levels.

[0104] The preliminary judgment reference information may include a set of parameters for generating a preliminary level from a vulnerability. For example, the preliminary judgment reference information may be various trained models. For example, the preliminary judgment reference information may include a preliminary level determination model, which is a dedicated trained model or a general-purpose trained model that has been trained to take a vulnerability as input and output a preliminary level. In this case, the determination unit 115 inputs the vulnerability to the preliminary level determination model and causes the preliminary level determination model to output a preliminary level.

[0105] The preliminary level determination model is included in the artificial intelligence unit 120. The preliminary level determination model, which is a dedicated learning model, may be constructed, for example, by training using vulnerability data and corresponding preliminary level data as training data. In such a preliminary level determination model, parameters calculated and tuned through learning establish a correlation between vulnerabilities and preliminary levels.

[0106] If the preliminary level determination model is a general-purpose learning model (for example, a language model such as a large-scale language model), the determination unit 115 inputs a prompt to the preliminary level determination model that includes a vulnerability and an instruction to output a preliminary level corresponding to the vulnerability, causing the preliminary level determination model to output a preliminary level. The determination unit 115 may also generate a prompt that gives the preliminary level determination model an instruction to determine a preliminary level and input this prompt to the preliminary level determination model. In addition to the vulnerability and the instruction to determine and output the preliminary level, the determination unit 115 may also input a prompt to the preliminary level determination model that includes, for example, one or more vulnerability samples and one or more corresponding preliminary level samples as examples, samples, or training data of input and output pairs. Here, the parameters that construct the preliminary level determination model and the prompt that includes an instruction to output a preliminary level corresponding to a vulnerability construct a correlation between the vulnerability and the preliminary level.

[0107] The reference information for preliminary determination may include part or all of the vulnerability master information and preliminary level determination conditions. For example, the determination unit 115 may determine the preliminary level of a vulnerability detected by the vulnerability detection unit 113 based on at least one of the following pieces of information included in the vulnerability master information: information indicating the vulnerability level set by a third-party organization, information indicating whether or not it is accessible from the outside, information indicating the magnitude of the impact on business operations due to an attack on the vulnerability, information indicating whether or not attack code for the vulnerability is circulating, and information indicating whether or not the exploitation of the vulnerability has been confirmed, and preliminary level determination conditions for this information. For example, the determination unit 115 may determine the preliminary level based on whether or not the vulnerability is accessible from the outside, and, if it is accessible from the outside, preliminary level determination conditions such as setting the preliminary level to 2 or higher.

[0108] For example, a score value defined by CVSS may be used as information indicating the preliminary level. The determination unit 115 determines that a vulnerability whose score value is below a predetermined threshold has the lowest preliminary level of level 0. A level 0 vulnerability is defined, for example, as information about a vulnerability for which no particular countermeasures are required. A vulnerability whose score value is above the threshold is determined to have a preliminary level of level 1 or higher.

[0109] The determination unit 115 determines, for example, that vulnerabilities with a score value above a threshold, that cannot be accessed from outside the system being diagnosed (i.e., can only be accessed from inside the system being diagnosed), and that would have little impact on business operations if attacked, are classified as Level 1. Level 1 vulnerabilities are defined, for example, as information about vulnerabilities for which countermeasures should be taken during the regular maintenance of the system being diagnosed (e.g., once a month). The priority for addressing Level 1 vulnerabilities is higher than the priority for addressing Level 0 vulnerabilities.

[0110] The determination unit 115 determines, for example, that among vulnerabilities with a score value above a threshold, those that are accessible from the outside or vulnerabilities that would have a significant impact on business operations if attacked are at a preliminary level of Level 2 (excluding those corresponding to Level 3 or Level 4 as described later). Level 2 vulnerabilities are defined, for example, as information about vulnerabilities for which countermeasures should be taken within the first deadline (for example, within two weeks). The priority for addressing Level 2 vulnerabilities is higher than the priority for addressing Level 1 vulnerabilities.

[0111] The determination unit 115 determines, for example, that a vulnerability that meets the criteria for Level 2 and for which attack code is circulating is at a preliminary level of Level 3 (excluding those corresponding to Level 4, which will be described later). A Level 3 vulnerability is defined as information about a vulnerability for which countermeasures should be taken within a second deadline (for example, within one day), which is shorter than the first deadline. The priority for addressing Level 3 vulnerabilities is higher than the priority for addressing Level 2 vulnerabilities.

[0112] The determination unit 115 determines, for example, that the preliminary level of vulnerabilities that meet the criteria for Level 3, and for which attacks have been observed and exploitation of the vulnerability has been confirmed, is the highest level, Level 4. Level 4 vulnerabilities are defined as information about vulnerabilities for which countermeasures should be taken by a third deadline (e.g., immediately), which is shorter than the second deadline. The priority for addressing Level 4 vulnerabilities is higher than the priority for addressing Level 3 vulnerabilities.

[0113] In addition to the level determination described above, the determination unit 115 may set the highest preliminary level for vulnerabilities where, for example, exploitation of the vulnerability has been confirmed and the vulnerability can be accessed from the outside.

[0114] Furthermore, the determination unit 115 may, for example, set a first rank as a preliminary level for vulnerabilities for which attack code is circulating, and set a second rank, which is higher than the first rank, as a preliminary level for vulnerabilities for which exploitation has been confirmed and which can be accessed from the outside.

[0115] Furthermore, the determination unit 115 may, for example, set a third rank as a preliminary level for vulnerabilities where attack code for the vulnerability is circulating and the vulnerability can be accessed from the outside, and set a fourth rank, lower than the third rank, as a preliminary level for vulnerabilities where exploitation has been confirmed but the vulnerability cannot be accessed from the outside.

[0116] This reference information for determination is information regarding the correlation between combinations of reserve level and importance and priority level. This reference information for determination is stored, for example, in the memory unit 12. This reference information for determination may include, for example, tables, functions, simple algorithms, etc., that show the correlation between combinations of reserve level and importance and priority level. The correlations included in this reference information for determination can be constructed, for example, by statistically analyzing data that records combinations of reserve level and importance and the corresponding priority levels.

[0117] The reference information for this determination may include a set of parameters for generating a priority level from a combination of a preliminary level and importance. For example, the reference information for this determination may be various pre-trained models. For example, the reference information for this determination may include a second priority level determination model, which is a dedicated learning model or a general-purpose learning model that has been machine-trained to take a combination of a preliminary level and importance as input and output a priority level. In this case, the determination unit 115 inputs the combination of a preliminary level and importance to the second priority level determination model and causes the second priority level determination model to output a priority level.

[0118] The second priority level determination model is included in the artificial intelligence unit 120. The second priority level determination model, which is a dedicated learning model, may be constructed, for example, by training using data of combinations of reserve levels and importance levels and corresponding priority level data as training data. In such a second priority level determination model, parameters calculated and tuned through learning construct a correlation between the combinations of reserve levels and importance levels and the priority levels.

[0119] If the second priority level determination model is a general-purpose learning model (for example, a language model such as a large-scale language model), the determination unit 115 inputs a prompt to the second priority level determination model that includes a combination of preliminary level and importance, and an instruction to output the priority level corresponding to the combination of preliminary level and importance, taking the combination of preliminary level and importance as input, causing the second priority level determination model to output the priority level. The determination unit 115 may also generate a prompt that gives an instruction to the second priority level determination model to determine the priority level, and input this prompt to the second priority level determination model. In addition to the preliminary level and importance combination and the instruction to determine and output the priority level, the determination unit 115 may also input a prompt to the second priority level determination model that includes, for example, one or more samples of preliminary level and importance combinations and one or more samples of corresponding priority levels as examples, samples, or training data of input and output pairs. Here, the parameters that construct the second priority level determination model and the prompt that includes an instruction to output the priority level corresponding to the combination of preliminary level and importance construct the correlation between the preliminary level and importance combination and the priority level.

[0120] When the severity determination process determines the severity for each type of metadata, the reference information for this determination may include information defining the relationship between the sum of the severity values ​​for each type of metadata and the correction value for the preliminary level. In other words, the determination unit 115 may determine the priority level as the preliminary level after increasing or decreasing it according to the sum of the severity values ​​for each type of metadata in the level determination process. This makes it possible to stably determine the priority level of a vulnerability based on a relatively simple logic.

[0121] For example, the determination unit 115 determines whether the important determination conditions included in the correspondence relationship set for each type (item) of metadata are met (for example, whether an important keyword or a keyword similar to an important keyword is included, whether the numerical value exceeds a threshold, etc.). The determination unit 115 also sets an importance level for each item according to whether the important determination conditions are met (for example, a predetermined positive number if the important determination conditions are met, and 0 or a predetermined negative number if the important determination conditions are not met), and calculates a summation value by adding up the importance levels of all items. Furthermore, the determination unit 115 determines a correction value (positive or negative value) for the reserve level based on the magnitude of the summation value, and the reserve level corrected (increased or decreased) by the correction value becomes the priority level. The correction value may also be 0. In other words, depending on the summation value of the priorities, the reserve level may be adopted as the priority level as is.

[0122] More specifically, for example, the judgment unit 115 determines the importance of each type, assigning 5 points to "Overview" containing important keywords or similar keywords such as "payment" and "member" (0 points if no important keywords or similar keywords are included), 3 points to "Tags" containing important keywords or similar keywords such as "important" and "confidential" (0 points if no important keywords or similar keywords are included), 2 points to "Public IP Settings" if a public IP is assigned (0 points if no public IP is assigned), and so on. If the sum of these values ​​is 10 points or more, the priority level is set to the reserve level plus 1 (one rank higher), and if it is less than 5 points, the priority level is set to the reserve level minus 1 (one rank lower). If the sum of these values ​​is 5 points or more but less than 10 points, the priority level is set to the same level as the reserve level.

[0123] In the severity determination process, if the severity of metadata indicating that the system under diagnosis is in a development environment is set to a specific value, the reference information for this determination may include information defining the relationship between that specific value and a correction value for the precaution level. In other words, in the level determination process, if the severity is a specific value, the determination unit 115 may determine the priority level to be a reduced or corrected version of the precaution level. This makes it possible to proactively reduce the priority level of vulnerabilities in development environments where the need for risk response is low, thereby increasing the reliability of the priority level.

[0124] For example, if the determination unit 115 determines that at least one of the importance levels of multiple types of metadata contains a specific value (i.e., if any of the metadata contains information indicating that it is in a development environment), it sets a priority level that is a predetermined number of levels lower than the preliminary level (for example, a level that is one rank lower than the preliminary level).

[0125] Figure 5 is a flowchart showing an example of the processing performed by the determination unit 115 in the first determination method. In the first determination method, the determination unit 115 first performs a preliminary level determination of the vulnerability (step S110) and a severity determination based on metadata (step S120). The execution order of the preliminary level determination step S110 and the severity determination step S120 is not specified; they may be executed in parallel, or the severity determination step S120 may be executed after the preliminary level determination step S110, or the preliminary level determination step S110 may be executed after the severity determination step S120.

[0126] After both the preliminary level determination step S110 and the severity determination step S120 are completed, the determination unit 115 uses the preliminary level and severity to determine the priority level of the vulnerability (the level of vulnerability that will ultimately be presented to the user) (step S130).

[0127] <Second judgment method> In the second determination method, the determination unit 115 determines the priority level based on the combination of metadata acquired by the metadata acquisition unit 112 and the vulnerability detected by the vulnerability detection unit 113, as well as the third reference information. This allows for the determination of severity from the metadata and the overall priority level based on that severity and the content of the vulnerability.

[0128] The third reference information concerns the correlation between metadata and vulnerability combinations and their priority levels. The first reference information is included in the third reference information. In other words, the third reference information encompasses the first reference information, which concerns the correlation between metadata and severity, as part of the information concerning the correlation between metadata and vulnerability combinations and their priority levels. In other words, in the second determination method, the correlation between metadata and severity (first reference information) is incorporated into the logic used to determine the priority level from the metadata and vulnerability combinations.

[0129] The third reference information is stored, for example, in the memory unit 12. The third reference information may include, for example, tables, functions, simple algorithms, etc., that show the correlation between combinations of metadata and vulnerabilities and priority levels. The correlations included in the third reference information can be constructed, for example, by statistically analyzing data that records combinations of metadata and vulnerabilities and their corresponding priority levels.

[0130] The third reference information may include a set of parameters for generating a priority level from a combination of metadata and vulnerabilities. For example, the third reference information may be various pre-trained models. For example, the third reference information may include a third priority level determination model, which is a dedicated or general-purpose pre-trained model that has been trained to take a combination of metadata and vulnerabilities as input and output a priority level. In this case, the determination unit 115 inputs the combination of metadata and vulnerabilities to the third priority level determination model and causes the third priority level determination model to output a priority level.

[0131] The third priority level determination model is included in the artificial intelligence unit 120. The third priority level determination model, which is a dedicated learning model, may be constructed, for example, by training with data of metadata and vulnerability combinations and corresponding priority level data as training data. In such a third priority level determination model, parameters calculated and tuned through learning construct a correlation between metadata and vulnerability combinations and priority levels.

[0132] If the third priority level determination model is a general-purpose learning model (for example, a language model such as a large-scale language model), the determination unit 115 inputs a prompt to the third priority level determination model that includes a combination of metadata and a vulnerability, and an instruction to output a priority level corresponding to the combination of metadata and a vulnerability, taking the combination of metadata and a vulnerability as input, causing the third priority level determination model to output a priority level. The determination unit 115 may also generate a prompt that gives the third priority level determination model an instruction to determine a priority level, and input this prompt to the third priority level determination model. In addition to the determination and output instruction for the combination of metadata and a vulnerability and the priority level, the determination unit 115 may also input a prompt to the third priority level determination model that includes, for example, one or more samples of the combination of metadata and a vulnerability and one or more samples of the corresponding priority level as examples, samples, or training data of input and output pairs. Here, the parameters that construct the third priority level determination model and the prompt that includes an instruction to output a priority level corresponding to the combination of metadata and a vulnerability construct a correlation between the combination of metadata and a vulnerability and the priority level.

[0133] The third reference information may include the relationship between the first level assessment criteria based on the nature of the vulnerability (for example, the level of vulnerability set by a third-party organization, whether or not it is accessible from the outside, the magnitude of the impact on business operations due to an attack on the vulnerability, whether or not attack code for the vulnerability is circulating, whether or not the vulnerability has been confirmed to be exploited, etc.) and the second level assessment criteria based on the severity determined from the metadata (for example, whether or not it is used for critical purposes, whether or not management data contains highly important information, the scope of disclosure of network settings, etc.) and the priority level of the vulnerability. Note that the second level assessment criteria are information included in the "correspondence between metadata and severity."

[0134] For example, the determination unit 115 may determine the priority level of a vulnerability based on the number or types of first-level determination conditions satisfied by the vulnerability detected by the vulnerability detection unit 113, and the number or types of second-level determination conditions satisfied by the severity determined from the metadata.

[0135] Figure 6 is a flowchart showing an example of the processing performed by the determination unit 115 in the second determination method. In the example of the second determination method in Figure 6, the determination unit 115 first determines whether the vulnerability satisfies the first first-level determination condition (in Figure 6, "First-Level Determination Condition A") (step S210). If the First-Level Determination Condition A is satisfied (S210: YES), the determination unit 115 then determines whether the severity determined from the metadata satisfies the second-level determination condition (step S220). If the Second-Level Determination Condition is satisfied (S220: YES), the determination unit 115 determines the priority level of the vulnerability to be "4" (step S230). On the other hand, if the Second-Level Determination Condition is not satisfied (S220: NO), the determination unit 115 determines the priority level of the vulnerability to be "3" (step S240).

[0136] Furthermore, if the first level determination condition A is not met (S210: NO), the determination unit 115 then determines whether the vulnerability satisfies the second first level determination condition (in Figure 6, "first level determination condition B") (step S250). If the first level determination condition B is met (S250: YES), the determination unit 115 determines the priority level of the vulnerability to be "2" (step S260). On the other hand, if the first level determination condition B is not met (S250: NO), the determination unit 115 determines the priority level of the vulnerability to be "1" (step S270).

[0137] Note that the flow in Figure 6 is merely an example. For example, multiple second-level determination conditions may be used in determining the priority level. Also, the order in which the first-level and second-level determination conditions are determined in the priority level determination flow can be set arbitrarily. The first-level determination condition may be determined after the second-level determination condition, or different second-level determination conditions may be determined consecutively. Furthermore, the priority levels of the branch destinations may be swapped depending on whether the determination conditions in the determination flow are met or not. In other words, the priority level when the determination condition is met may be lower than the priority level when the determination condition is not met.

[0138] The determination unit 115 may display the determination result of the vulnerability priority level in the first determination method or the second determination method on the user terminal 20. The determination result may include, for example, the content of the identified vulnerability, the type of vulnerability (for example, whether or not attack code is circulating), and whether or not countermeasures are necessary (alert). In addition, if the first determination method is used, the determination unit 115 may display the determination result of the preliminary level (the vulnerability level in which the severity is not reflected) on the user terminal 20 in addition to the determination result of the vulnerability priority level.

[0139] <Artificial Intelligence Department 120> The artificial intelligence unit 120 is configured to receive input from each functional unit and return the instructed output. The artificial intelligence used by each functional unit of the information processing device 10 may be common to all units, or it may be prepared individually for each functional unit.

[0140] The artificial intelligence unit 120 may be an AI (Artificial Intelligence) equipped with pre-trained models such as transformers including GPT (Generative Pretrained Transformer, including GPT-1 to GPT-5), BERT (Bidirectional Encoder Representations from Transformers), BART (Bidirectional and Auto-regressive Transformer), and language models such as recurrent neural networks (RNNs). The artificial intelligence unit 120 may be, for example, a general-purpose learning model including various language models, large-scale language models, and generative AI, or an AI agent, and may include specific models such as OpenAI's GPT, Google's Gemini, and models provided through services and platforms such as Microsoft's Azure AI Studio. Generative AI may be, for example, text generation AI, image generation AI, or multimodal generation AI. The pre-trained model may be called an artificial intelligence model, machine learning model, or deep learning model. In addition, the artificial intelligence unit 120 can include any pre-trained model.

[0141] Specific machine learning algorithms used to build trained models include nearest neighbors, naive Bayes, decision trees, support vector machines, and deep learning using neural networks. The artificial intelligence unit 120 can apply these algorithms as appropriate.

[0142] The artificial intelligence unit 120 may have a trained model constructed by a learning method such as supervised learning, unsupervised learning, or self-supervised learning. In supervised learning, machine learning is performed using training data. Training data consists of pairs of input data and output data (correct answer data) for training. Furthermore, the trained model may not only be one trained for a specific task, but also a general-purpose learning model that can be used universally for a wide range of tasks.

[0143] The artificial intelligence unit 120 may include a natural language model as artificial intelligence, or it may be a general-purpose learning model such as a Large Language Model (LLM). An LLM is a learning model that has been pre-trained on a large amount of large data consisting of text data, etc. (for example, (i) web content on the internet, or (ii) data stored in a predetermined database), and can perform various language processing tasks by being given a task. According to the given prompt, it can perform a wide range of natural language processing tasks, such as understanding sentence patterns and context, responding to questions, and generating sentences. Such a general-purpose learning model may include a pre-trained model that can handle various tasks without fine-tuning by One-shot Learning or Few-shot Learning. Furthermore, the general-purpose learning model may also be configured to handle various tasks by Zero-shot Learning. The artificial intelligence used in each functional unit of the control unit 11 may be a separate pre-trained model, or it may be a common general-purpose pre-trained model. In addition, the artificial intelligence unit 120 may include a small-scale language model or a medium-scale language model that is smaller in scale than a large-scale language model as a pre-trained model. Small-scale and medium-scale language models are natural language processing models that are trained on less data (and constructed with fewer parameters) compared to large-scale language models.

[0144] The pre-trained models included in the artificial intelligence unit 120 (such as the priority level determination model, which is used in each functional unit) can undergo additional training using methods such as transfer learning and fine-tuning. For example, whenever new data is registered, the artificial intelligence unit 120 may perform additional training and fine-tuning using this new data as training data. This improves the accuracy of the information output from the pre-trained models.

[0145] The trained model included in the artificial intelligence unit 120 may be a trained model (distilled model) obtained by knowledge distillation using the original trained model. In knowledge distillation, a trained model such as a large-scale language model is used as the teacher model, and the student model is trained by adjusting the parameters of the student model so that the loss of the student model's output (soft target loss) relative to the teacher model's output (soft target) is small, and that student model becomes the distilled model. Alternatively, the student model may be trained so that the loss of the student model's output (hard target loss) relative to the correct labels (hard target) of the teacher data (combinations of input data and output data of the trained model) is small. Compared to the original trained model (teacher model), the distilled model has performance close to that of the trained model, but with fewer parameters and a lower processing load. Therefore, by using the distilled model, the cost of the information processing system 1 can be reduced.

[0146] For example, the trained model used in each functional unit may be a distilled model trained using combinations of input and output data from a large-scale language model as training data. Alternatively, when the information processing system 1 is introduced, a large-scale language model may be used as the trained model in each functional unit, and once training data from the large-scale language model has been accumulated, the distilled model obtained by knowledge distillation using that training data may be used as the trained model in each functional unit.

[0147] An AI agent (also called an autonomous agent) is a model that, upon input of a goal (objective, purpose, etc.) such as "Teach me about XX" or a task such as "Output XX," breaks down the processes necessary to reach the goal or accomplish the task into subtasks, actions, etc., and performs necessary data collection and analysis, program generation and execution, etc. The AI ​​agent takes the information and instructions input by the user as its goal, autonomously selects and executes tasks and actions according to the goal, outputs information according to the goal, and does not require user intervention (operation input). Furthermore, the AI ​​agent may autonomously plan and execute, evaluate the execution results itself, and autonomously learn in order to aim for goal achievement. For example, the AI ​​agent may autonomously update itself based on the execution results of subtasks (e.g., collected information, results of information analysis, etc.).

[0148] <Display section> The display unit 211 of the user terminal 20 shown in Figure 4B displays the screen (information) indicated by the data transmitted from the information processing device 10.

[0149] <Operation acquisition part> The operation acquisition unit 212 of the user terminal 20 receives operations from the user using the user terminal 20.

[0150] 3. Information Processing Methods This section describes the information processing method of the information processing device 10. In this information processing method, each part of the information processing device 10 is executed by a computer as a step.

[0151] The information processing method disclosed herein comprises a metadata acquisition step, a vulnerability detection step, and a determination step. In the metadata acquisition step, metadata of the system to be assessed for risk diagnosis is acquired. In the vulnerability detection step, vulnerabilities are detected in the system to be assessed. In the determination step, the importance level used for risk diagnosis of the system to be assessed is determined based on the metadata and first reference information, and the priority level of the vulnerability is determined based on the importance level.

[0152] Figure 7 is an activity diagram showing an example of the flow of information processing (vulnerability management processing) performed by information processing system 1. The information processing will be explained below in accordance with each activity in this activity diagram.

[0153] The vulnerability management process begins with the acquisition of metadata by the information processing device 10. The information processing device 10 acquires metadata of the system to be diagnosed at a predetermined timing or in response to instructions from the user terminal 20 (Activity A101). Subsequently, the information processing device 10 performs vulnerability detection on the system to be diagnosed (Activity A102). Note that vulnerability detection may be performed before or in parallel with the acquisition of metadata.

[0154] After acquiring metadata and detecting vulnerabilities, the information processing device 10 determines the priority level based on the metadata and vulnerabilities (Activity A103). Subsequently, the information processing device 10 outputs the determined priority level along with the vulnerabilities to the user terminal 20 (Activity A104). As a result, the vulnerabilities of the system being diagnosed are displayed on the user terminal 20 along with their priority levels (Activity A105).

[0155] 4. Effect The operation of this embodiment can be summarized as follows: In other words, it enables more appropriate risk assessment of a system than conventional methods. Specifically, it allows for risk assessment using the importance level obtained from the metadata of the system being assessed.

[0156] Although embodiments of the present invention have been described above, the present invention is not limited thereto and can be modified as appropriate without departing from the technical spirit of the invention.

[0157] 5. Others In the above embodiment, the information processing device 10 performed various storage and control functions, but instead of the information processing device 10, multiple external devices may be used. That is, various information and programs may be stored in a distributed manner across multiple external devices using blockchain technology or the like. In particular, the artificial intelligence unit 120 may be an external component of the information processing device 10. In that case, the external artificial intelligence unit 120 may be provided by, for example, an artificial intelligence service server, and is configured to receive input from each functional unit of the information processing device 10, receive requests to execute artificial intelligence services, and return the output instructed as a processing result to the information processing device 10. The artificial intelligence service server may be a server that provides services using a language model as a learning model, or a server that executes language processing tasks using a language model. The artificial intelligence service server may be constructed using an LLM. The artificial intelligence service server receives prompt input in the form of text, images, audio, etc., and generates and responds with answers to the prompts.

[0158] At least one of the devices included in the information processing system 1 may be located outside the country in which the functions of the information processing system 1 are performed.

[0159] The embodiments of this model are not limited to the information processing system 1, but may also be an information processing method or a program. In the information processing method, the information processing device executes each step of the information processing system 1. In the program, the computer causes the computer to execute each step of the information processing system 1.

[0160] The control unit 11 does not necessarily have to include a vulnerability detection unit 113 and a correspondence relationship receiving unit 114. For example, the information processing system 1 does not necessarily have to have a vulnerability detection function. Also, for example, the information processing system 1 does not necessarily have to have a function to receive input for correspondence relationships between metadata and severity.

[0161] The product may be provided in any of the following embodiments.

[0162] (1) An information processing system comprising at least one processor, wherein the processor is configured to perform the following steps by reading a program, wherein in the metadata acquisition step, metadata of a system to be diagnosed for risk assessment is acquired, and in the determination step, the importance used for risk assessment of the system to be diagnosed is determined based on the metadata and first reference information, wherein the first reference information is information relating to the correlation between the metadata and the importance.

[0163] (2) An information processing system as described in (1) above, wherein in the vulnerability detection step, a vulnerability is detected in the system to be diagnosed, and in the determination step, the level of the vulnerability is determined based on the severity.

[0164] (3) An information processing system as described in (2) above, wherein the determination step includes performing a severity determination process to determine the severity based on the metadata and the first reference information, and a level determination process to determine the level based on the combination of the vulnerability and the severity and the second reference information, wherein the second reference information is information relating to the correlation between the combination of the vulnerability and the severity and the level.

[0165] (4) An information processing system as described in (3) above, wherein the second reference information includes preliminary determination reference information and main determination reference information, and in the level determination process, the preliminary level of the vulnerability is determined based on the vulnerability and the preliminary determination reference information, and further, the level is determined based on the combination of the preliminary level and the severity and the main determination reference information, wherein the preliminary determination reference information is information relating to the correlation between the vulnerability and the preliminary level, and the main determination reference information is information relating to the correlation between the combination of the preliminary level and the severity and the level.

[0166] (5) An information processing system as described in (4) above, wherein in the metadata acquisition step, multiple types of metadata are acquired; in the importance determination process, the importance is determined for each type of metadata; and in the level determination process, the preliminary level is increased or decreased according to the sum of the importance values ​​for each type of metadata and the result is determined as the level.

[0167] (6) An information processing system as described in (4) or (5) above, wherein in the importance determination process, if the metadata includes information indicating that the system to be diagnosed is in a development environment, the importance is set to a specific value indicating a development environment, and in the level determination process, if the importance is the specific value, the preliminary level is reduced and corrected and determined as the level.

[0168] (7) An information processing system as described in (2) above, wherein in the determination step, the level is determined based on the combination of the metadata and the vulnerability and the third reference information, the third reference information is information relating to the correlation between the combination of the metadata and the vulnerability and the level, and the first reference information is included in the third reference information.

[0169] (8) An information processing system according to any one of (1) to (7) above, wherein the metadata acquisition step acquires metadata including natural language that is stored in association with the system to be diagnosed.

[0170] (9) An information processing system according to any one of (1) to (8) above, wherein the metadata acquisition step acquires metadata including a numerical value indicating the resource scale of the system to be diagnosed.

[0171] (10) An information processing system according to any one of (1) to (9) above, wherein the metadata acquisition step acquires the metadata including the network environment configuration information of the system to be diagnosed.

[0172] (11) An information processing system according to any one of (1) to (10) above, wherein in the correspondence relationship reception step, the system receives input of a correspondence relationship between the metadata and the importance level, and in the determination step, the system determines the importance level based on the metadata and the first reference information including the correspondence relationship.

[0173] (12) An information processing system as described in (11) above, wherein the correspondence relationship includes a relationship between a keyword included in the metadata and the importance level of the keyword, and in the determination step, the information processing system determines the importance based on the metadata and the first reference information such that the importance increases according to the importance level of the keyword included in the metadata.

[0174] (13) An information processing system according to any one of (1) to (12) above, comprising a server having the processor and a terminal that can access the server.

[0175] (14) An information processing method wherein an information processing device performs each step of the information processing system described in any one of (1) to (13) above.

[0176] (15) A program that causes a computer to perform each step of the information processing system described in any one of (1) to (13) above. Of course, this is not always the case.

[0177] Finally, while various embodiments relating to this disclosure have been described, these are presented as examples only and are not intended to limit the scope of the invention. These novel embodiments can be implemented in a variety of other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their variations are included in the scope and spirit of the invention, as well as in the claims and their equivalents. [Explanation of Symbols]

[0178] 1: Information Processing System 2: Communication lines 10: Information Processing Device 11: Control Unit 111: Basic Display Control Unit 112: Metadata Acquisition Unit 113: Vulnerability Detection Unit 114: Support and Inquiries Department 115: Judgment section 120: Artificial Intelligence Department 12: Storage section 13: Communications Department 14: Communications bus 20: User terminal 21: Control Unit 211:Display section 212: Operation acquisition section 22: Storage section 23: Communications Department 24: Input section 25: Output section 26: Communications bus 30: Managed Server 40: Vulnerability Information Server

Claims

1. An information processing system, Equipped with at least one processor, The aforementioned processor is configured to perform the following steps by reading a program: In the metadata acquisition step, metadata is acquired that is stored in association with the system under assessment for risk diagnosis, and represents at least one of the structure, purpose, nature, and network environment of the system under assessment. In the vulnerability detection step, vulnerabilities in the software, database, roles, or policies included in the system being diagnosed are detected. In the determination step, the system determines the importance level used for risk assessment of the system to be diagnosed based on the metadata and the first reference information, and further determines the vulnerability level based on the importance level, where the first reference information is information relating to the correlation between the metadata and the importance level.

2. In the information processing system described in claim 1, In the aforementioned determination step, A importance determination process that determines the importance based on the metadata and the first reference information, A level determination process that determines the level based on the combination of the vulnerability and the severity and the second reference information, An information processing system that performs the following, where the second reference information is information relating to the correlation between the combination of the vulnerability and the severity and the level.

3. An information processing system, Equipped with at least one processor, The aforementioned processor is configured to perform the following steps by reading a program: In the metadata acquisition step, metadata of the system to be assessed for risk diagnosis is acquired. In the vulnerability detection step, vulnerabilities in the system to be diagnosed are detected, In the judgment step, A importance determination process that determines the importance used for risk diagnosis of the system to be diagnosed, based on the metadata and the first reference information, A level determination process that determines the level of the vulnerability based on the combination of the vulnerability and its severity, and the second reference information, The following is performed, where the first reference information is information relating to the correlation between the metadata and the severity, and the second reference information is information relating to the correlation between the combination of the vulnerability and the severity and the level. The second reference information includes preliminary reference information and main reference information. An information processing system in which, in the level determination process, a preliminary level of the vulnerability is determined based on the vulnerability and the preliminary determination reference information, and further, the level is determined based on the combination of the preliminary level and the severity and the main determination reference information, wherein the preliminary determination reference information is information relating to the correlation between the vulnerability and the preliminary level, and the main determination reference information is information relating to the correlation between the combination of the preliminary level and the severity and the level.

4. In the information processing system described in claim 3, In the metadata acquisition step, multiple types of metadata are acquired, In the aforementioned importance determination process, the importance is determined for each type of metadata, An information processing system that determines the level by increasing or decreasing the preliminary level according to the sum of the importance values ​​for each type of metadata in the level determination process.

5. In the information processing system described in claim 3, In the aforementioned importance determination process, if the metadata includes information indicating that the system to be diagnosed is in a development environment, the importance is set to a specific value indicating the development environment. In the level determination process, if the importance is the specified value, the information processing system determines the level to be the reduced version of the preliminary level.

6. In the information processing system described in claim 1, An information processing system in which, in the determination step, the level is determined based on the combination of the metadata and the vulnerability and third reference information, wherein the third reference information is information relating to the correlation between the combination of the metadata and the vulnerability and the level, and the first reference information is included in the third reference information.

7. In the information processing system described in claim 1, The metadata acquisition step involves an information processing system that acquires metadata, including natural language, that is stored in association with the system to be diagnosed.

8. In the information processing system described in claim 1, The information processing system acquires the metadata in the metadata acquisition step, which includes a numerical value indicating the resource size of the system to be diagnosed.

9. In the information processing system described in claim 1, The information processing system acquires the metadata in the metadata acquisition step, which includes configuration information for the network environment of the system to be diagnosed.

10. In the information processing system described in claim 1, In the correspondence relationship reception step, input of the correspondence relationship between the metadata and the importance level is received. An information processing system that determines the importance in the determination step based on the metadata and the first reference information including the correspondence relationship.

11. In the information processing system according to claim 10, The aforementioned correspondence includes the relationship between the keywords included in the metadata and the importance level of those keywords. An information processing system that, in the determination step, determines the importance based on the metadata and the first reference information such that the importance increases according to the importance level of the keywords included in the metadata.

12. In the information processing system described in claim 1, A server having the aforementioned processor, A terminal that can access the aforementioned server, An information processing system equipped with the following features.

13. Information processing method, An information processing method comprising an information processing device performing each step of the information processing system described in any one of claims 1 to 12.

14. It is a program, A program for causing a computer to perform each step of the information processing system described in any one of claims 1 to 12.

Images