Communication system, communication method, and communication program

Abstract

A communication system (100) includes: an agent (10) that is provided in an assessment target apparatus (20); and an assessment device (30) that carries out risk assessment for the assessment target apparatus (20). The assessment device (30) includes an assessment unit for carrying out, on the basis of the operation state of communication by the assessment target apparatus (20) acquired via the agent (10), risk assessment pertaining to vulnerability information transmitted to the assessment target apparatus (20).

Description

Communication system, communication method, and communication program

[0001] The present invention relates to a communication system, a communication method, and a communication program.

[0002] In traditional vulnerability management work, upon receiving a notification of a vulnerability related to a device, the operator checks the vulnerability information (e.g., attack source classification: network (NW)), checks the settings and operation of the device, and compares this information to confirm the risk of an attack being successful against the system.

[0003] Fujitsu Systems East Ltd., "Launching Vulnerability Visualization Service: Industry's First Network Security Risk Diagnosis Service," July 20, 2016, [Retrieved May 26, 2023], Internet <URL: https: / / pr.fujitsu.com / jp / news / grp-archives / feast / feast20160720-1.html> NEC, "Cyber ​​Attack Route Diagnosis Service," [Retrieved May 29, 2023], Internet <URL: https: / / jpn.nec.com / cybersecurity / professionalservice / vulnerability_diagnosis / attack_route.html> NEC, "Cyber ​​Attack Risk Automated Diagnosis Technology," [Retrieved May 29, 2023], Internet <URL: https: / / jpn.nec.com / rd / technologies / 201804 / index.html>

[0004] However, risk assessment technology based on network configuration has the problem that the risk assessment does not take into account the impact of actual device communication operations.

[0005] The present invention has been made in consideration of the above, and aims to provide a communication system, a communication method, and a communication program that enable risk assessment based on the actual communication operation of devices.

[0006] In order to solve the above-mentioned problems and achieve the objectives, the communication system of the present invention is a communication system having an agent provided in a device to be judged and a judgment device that performs a risk judgment on the device to be judged, and the judgment device is characterized in that it has a judgment unit that performs a risk judgment on vulnerability information sent to the device to be judged based on the communication operating status of the device to be judged obtained via the agent.

[0007] According to the present invention, risk assessment can be performed based on the actual communication behavior of devices.

[0008] FIG. 1 is a diagram illustrating an overview of processing according to an embodiment. FIG. 2 is a diagram illustrating a flow of processing according to an embodiment. FIG. 3 is a diagram illustrating an example of the configuration of a communication system according to an embodiment. FIG. 4 is a diagram illustrating an example of the configuration of an agent shown in FIG. 3. FIG. 5 is a diagram illustrating an example of the configuration of a determination device shown in FIG. 3. FIG. 6 is a diagram illustrating communication information generation processing. FIG. 7-1 is a diagram illustrating an example of communication operation information generated in the communication information generation processing. FIG. 7-2 is a diagram illustrating an example of communication operation information generated in the communication information generation processing. FIG. 7-3 is a diagram illustrating an example of communication operation information generated in the communication information generation processing. FIG. 7-4 is a diagram illustrating an example of communication operation information generated in the communication information generation processing. FIG. 8 is a diagram illustrating a method of acquiring software information from process information. FIG. 9 is a diagram illustrating a method of acquiring software information from process information. FIG. 10 is a diagram illustrating device information updating processing. FIG. 11-1 is a diagram illustrating the definition of a risk level generated in the device information updating processing. FIG. 11-2 is a diagram illustrating the definition of a risk level generated in the device information updating processing. FIG. 12 is a diagram illustrating an example of the data configuration of device information. Fig. 13 is a diagram illustrating a risk threshold setting process. Fig. 14 is a diagram illustrating a risk determination process. Fig. 15 is a diagram illustrating a specific example of the risk determination process. Fig. 16 is a diagram illustrating a specific example of the risk determination process. Fig. 17 is a flowchart showing the processing procedure for communication information generation processing. Fig. 18 is a flowchart showing the processing procedure for device information updating processing. Fig. 19 is a flowchart showing the processing procedure for risk threshold setting processing. Fig. 20 is a flowchart showing the processing procedure for risk determination processing. Fig. 21 is a diagram showing an example of a computer in which an agent and a determination device are realized by executing a program.

[0009] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. Note that the present invention is not limited to this embodiment. In addition, in the description of the drawings, the same parts are designated by the same reference numerals.

[0010] [Embodiment] Fig. 1 is a diagram for explaining an outline of the process of the embodiment. As shown in Fig. 1, in the embodiment, four processes are executed.

[0011] In the embodiment, first, as preparation for risk assessment in response to a vulnerability notification, a communication information generation process (first generation process), a device information updating process (second generation process), and a risk threshold setting process are executed in advance. The communication information generation process acquires packets generated by the device to be assessed, acquires information on the software that performs communication, and updates communication operation information. The device information updating process generates risk level information and registers the latest device information. The risk threshold setting process sets a threshold for risk assessment (hereinafter referred to as the risk threshold). This ensures that the assessment device always holds the latest risk level information.

[0012] In the embodiment, when the determination device receives a vulnerability notification, the determination device executes a risk determination process (determination process) for the vulnerability notification content. In the risk determination process, if it determines that notification of the determination result is necessary, the determination device executes a notification process for notifying the determination result.

[0013] In this manner, in the embodiment, risk level information generated from the communication behavior of the device is used for the determination, and therefore, unlike conventional risk determination techniques based on network configuration, the embodiment enables risk determination based on the actual communication behavior of the device.

[0014] Fig. 2 is a diagram illustrating the processing flow of an embodiment. In the embodiment, a communication information generation process, a device information updating process, and a risk threshold setting process are executed at the timings shown in Fig. 2. The communication information generation process is a process that is performed continuously. The device information updating process is a process that is performed periodically. The risk threshold setting process and the risk determination process are processes that are performed irregularly.

[0015] [Communication System] Next, a communication system according to an embodiment will be described. Fig. 3 is a diagram showing an example of the configuration of the communication system according to an embodiment.

[0016] As shown in FIG. 3, the communication system 100 according to the embodiment includes a device to be assessed 20 that is the subject of risk assessment, a determination device 30 that performs risk assessment on the device to be assessed 20, a vulnerability information distribution service 40 that is suspected of having communication vulnerabilities, an external server 50, and an internal server 60 that communicates with the device to be assessed 20.

[0017] The vulnerability information distribution service 40 and the external server 50 are capable of communicating with the determination target device 20 via the Internet.

[0018] A firewall is provided between the device 20 to be determined and the Internet to protect the internal device from external attacks. An agent 10 is provided in the device 20 to be determined. The agent 10 acquires the communication operation status of the device 20 to be determined. The agent 10 generates risk level information for each software unit based on the communication operation information of the device 20 to be determined, and registers the risk level information in the determination device 30.

[0019] The determination device 30 performs risk determination for the vulnerability information transmitted to the determination target device 20 based on the communication operation state of the determination target device 20 acquired by the agent 10 .

[0020] [Agent] Fig. 4 is a diagram showing an example of the configuration of the agent 10 shown in Fig. 3. The agent 10 is realized, for example, by loading a predetermined program into a computer or the like including a ROM (Read Only Memory), a RAM (Random Access Memory), a CPU (Central Processing Unit), etc., and having the CPU execute the predetermined program. In addition, the agent 10 is capable of communicating with other devices via a communication interface that the device to be determined has and that transmits and receives various information to and from other devices connected via a network, etc.

[0021] As shown in Figure 4, the agent 10 has a packet capture result 11, a communication operation information DB 12, a packet capture acquisition unit 13, a software information acquisition unit 14, a communication operation information generation unit 15, a risk level information generation unit 16, a device information generation unit 17, and a device information transmission unit 18.

[0022] The packet capture result 11 stores the packet capture acquired by the packet capture acquisition unit 13 .

[0023] The communication action information DB 12 stores communication action information generated by the communication information generation process.

[0024] The packet capture acquisition unit 13 acquires packets generated in the determination target device 20. The packet capture acquisition unit 13 captures packets generated by communication from the inside to the outside or communication from the outside to the inside. The packet capture acquisition unit 13 stores the captured packets in the packet capture result 11.

[0025] In the communication information generation process, the software information acquisition unit 14 acquires information about the software that performed the communication of the packet acquired by the packet capture acquisition unit 13. If the captured packet does not have a known communication pattern, the software information acquisition unit 14 acquires information about the software that performed the communication of this packet. The software information acquisition unit 14 acquires software information on a software-by-software basis.

[0026] The communication operation information generating unit 15 generates communication operation information indicating the communication operation of the packet in the communication information generating process. The communication operation information includes at least the software that performed the communication of the packet acquired by the packet capture acquiring unit 13.

[0027] If the packet captured by the packet capture acquisition unit 13 has a known communication pattern, the communication operation information generation unit 15 updates the last communication time of the communication operation information of this known communication pattern. If the packet captured by the packet capture acquisition unit 13 does not have a known communication pattern, the communication operation information generation unit 15 generates communication operation information of the communication of this packet based on the software information acquired by the software information acquisition unit 14. The communication operation information generation unit 15 generates communication operation information on a software-by-software basis.

[0028] In the device information updating process, the risk level information generating unit 16 generates risk level information based on communication operations using the communication operation information. The risk level information generating unit 16 generates risk level information for each piece of software.

[0029] The risk level information generation unit 16 generates risk level information for software based on whether or not the software's communication information has changed since the previous execution, and whether or not software that was not present at the previous execution has been added to the communication information. The risk level information generation unit 16 generates risk level information for external communication and risk level information for internal communication. As will be described later, risk levels are defined, for example, in four stages, depending on the state of connectivity and communication operation.

[0030] If there is software whose communication information has changed since the last time it was executed, the risk level information generation unit 16 updates the risk level of this software in accordance with the state of communication and communication operation, and generates risk level information including the updated risk level. Also, even if there is no software whose communication information has changed since the last time it was executed, if software that was not present at the last time it was executed has been added to the communication information, the risk level information generation unit 16 determines the risk level of the added software in accordance with the state of communication and communication operation, and generates risk level information indicating the determined risk level.

[0031] In the device information updating process, the device information generation unit 17 generates the latest device information of the determination target device 20. The device information generation unit 17 registers device information in which software is associated with risk level information corresponding to the software in the determination device 30. The device information has a configuration in which, for each piece of software, software identification information is associated with risk level information for external communication and risk level information for internal communication.

[0032] The device information transmitting unit 18 transmits the latest device information of the device to be determined 20 generated by the device information generating unit 17 to the determination device 30, and requests the determination device 30 to register the latest device information.

[0033] [Determination Device] Fig. 5 is a diagram showing an example of the configuration of the determination device 30 shown in Fig. 3. The determination device 30 is realized, for example, by loading a predetermined program into a computer or the like including a ROM, a RAM, a CPU, etc., and causing the CPU to execute the predetermined program. In addition, the determination device 30 is capable of communicating with other devices via a communication interface that the determination target device has and that transmits and receives various information to and from other devices connected via a network, etc.

[0034] As shown in FIG. 5, the determination device 30 includes a device information DB 31, risk threshold setting information 32, a device information registration unit 33, a risk threshold setting unit 34, a vulnerability information receiving unit 35, a risk determination unit 36, and a result notification unit 37.

[0035] The device information DB 31 stores the device information sent from the agent 10 .

[0036] The risk threshold setting information 32 is a DB that stores setting information of risk thresholds. The risk thresholds are set for external communications and internal communications, and are expressed as risk level values.

[0037] The device information registration unit 33 receives, for example, device information transmitted from the agent 10 and stores it in the device information DB 31 .

[0038] The risk threshold setting unit 34 receives input of threshold information (risk threshold information) for risk determination, including a risk threshold, and, based on the input risk threshold information, registers the risk threshold as risk threshold setting information 32. For example, the risk threshold is set by the operator for each of external communication and internal communication.

[0039] The vulnerability information receiving unit 35 receives vulnerability information transmitted from the vulnerability information distribution service 40 .

[0040] The risk determination unit 36 ​​determines the risk of the vulnerability information received by the vulnerability information receiving unit 35. The risk determination unit 36 ​​performs risk determination on the vulnerability information transmitted to the determination target device 20 based on the communication operation status of the determination target device 20 acquired by the agent 10. Upon receiving notification of distribution of vulnerability information to the determination target device 20, the risk determination unit 36 ​​determines the risk of the vulnerability information based on the device information registered by the agent 10 and a preset threshold value for risk determination (risk threshold value). As described above, the risk threshold value is set for each software for both external communication and internal communication.

[0041] Specifically, the risk determination unit 36 ​​determines the risk of the received vulnerability information based on the attack source classification of the vulnerability information, the risk level of the software corresponding to the vulnerability information, and the risk threshold. The risk determination unit 36 ​​determines the risk of the vulnerability information based on a predetermined determination rule. For example, the risk determination unit 36 ​​determines the risk to be high if the risk level is equal to or higher than the predetermined risk threshold, and determines the risk to be low if the risk level is lower than the predetermined risk threshold.

[0042] The result notification unit 37 notifies the manager of the result of the risk determination unit 36 ​​according to the degree of risk determined by the risk determination unit 36 ​​.

[0043] [Flow of communication processing] Next, the flow of communication processing according to the embodiment will be described. First, the communication information generation processing will be described.

[0044] [Communication Information Generation Process] FIG. 6 is a diagram illustrating the communication information generation process.

[0045] 6, in the communication information generation process, the agent 10 captures and acquires packets generated in the device to be determined 20 ((1) in FIG. 6). The agent 10 captures packets generated by internal communication, internal-to-external communication, or external-to-internal communication. Internal communication includes communication from the device to be determined 20 to the host and communication from another host to the device to be determined.

[0046] If the captured packet does not have a known communication pattern in the device 20 to be determined, the agent 10 acquires information about the software that communicated this packet ((2) in FIG. 6). If the packet has a known communication pattern in the device 20 to be determined, the agent 10 updates the last communication time of the communication operation information for the corresponding known communication pattern ((3) in FIG. 6).

[0047] 7-1 to 7-4 are diagrams illustrating examples of communication operation information generated in the communication information generation process. The communication operation information generated by the communication information generation process includes, for example, four pieces of information: external communication information (communication from the outside to the inside) of the device to be determined 20 (FIG. 7-1), external communication information (communication from the inside to the outside) of the device to be determined 20 (FIG. 7-2), internal communication information (communication from another host to the device to be determined 20) (FIG. 7-3), and internal communication information (communication from the device to be determined 20 to another host) (FIG. 7-4).

[0048] Each piece of information has the following fields: source IP (srcIP), source port (srcPort), destination IP (dstIP), destination port (dstPort), software name, and last communication time, and is constantly updated.

[0049] For example, the software information is acquired from process information, etc. The software information is acquired from header information of a packet.

[0050] 8 and 9 are diagrams illustrating a method for acquiring software information from process information. The agent 10 identifies the executable file of the process waiting for communication ((3) in FIG. 8) based on the information shown in FIG. 8 (listening port number, PID, executable file name) ((1) and (2) in FIG. 8).

[0051] 8 shows an example of a process in LISTEN mode, but software information can be similarly obtained by referencing information on a connection in ESTABLISHED state even for communications originating from the device to be determined 20. If the execution file name is a command name, a step of referencing the actual file of the command is added.

[0052] Once the executable file name of the communicating process can be confirmed, the software name and version information can be obtained by referencing the package name that includes the executable file name ((1) in FIG. 9), as shown in FIG. 9. FIG. 9 shows an example using information from a package management system. Another method is to use the SBOM (Software Bill of Materials) of the device.

[0053] [Device Information Updating Process] FIG. 10 is a diagram illustrating the device information updating process.

[0054] As shown in Figure 10, in the device information updating process, the agent 10 generates risk level information for the software based on whether or not the communication information for that software has changed since the last time the process was executed, and whether or not software that was not present in the last time the process was executed has been added to the communication information ((1) in Figure 10).

[0055] Next, the agent 10 generates the latest device information of the device 20 to be determined ((2) in FIG. 10). The agent 10 transmits the generated latest device information of the device 20 to the determination device 30 and requests registration of the latest device information ((3) in FIG. 10).

[0056] The device information updating process is a process that is performed periodically, but the timing of its execution can be determined arbitrarily by the operator. For example, the device information updating process may be performed every minute with emphasis on updating the information, or daily with consideration of the load on the target device.

[0057] Figures 11-1 and 11-2 are diagrams explaining the definition of risk levels generated in the device information updating process. In Figures 11-1 and 11-2, the risk level definition is explained using the following items: risk level, destination IP address, protocol / destination port, connectivity / communication operation, and remarks. Note that the definition of risk levels is not limited to the examples in Figures 11-1 and 11-2, and may be freely defined by the operator.

[0058] Figure 11-1 shows the definition of risk levels for external communications, and Figure 11-2 shows the definition of risk levels for internal communications. Figures 11-1 and 11-2 are examples in which risk is defined in increasing order as no communication is possible, no communication, communication with a specific party, and communication with an unspecified party.

[0059] For example, as shown in Figures 11-1 and 11-2, if communication is not possible, the risk is low because communication is not possible, and the risk level is "1." If communication is possible or communication is unknown and no communication occurs during normal device operation, the risk is low as long as the device 20 to be determined itself is operating normally, and the risk level is "2." If communication is possible and communication is only with specific parties during normal operation, the risk is low as long as both the device 20 to be determined and the parties are operating normally, and the risk level is "3." If communication is possible and communication is with unspecified parties, there is a possibility of risk, and the risk level is "4."

[0060] In the agent 10, the risk level information generation unit 16 determines whether there is software whose communication information has changed since the previous execution, and whether there is software that was not present in the previous execution that has been added to the communication information.The risk level information generation unit 16 then refers to Figures 11-1 and 11-2 to determine the risk level of the software and generate risk level information.

[0061] The global IP address in FIG. 11A may include a local IP address (proxy, LB (Load Balancer), etc.) that relays communication with the outside.

[0062] 12 is a diagram illustrating an example of the data configuration of device information. The agent 10 registers device information having the configuration shown in FIG. 12 in the determination device 30. As shown in FIG. 12, the device information includes items such as software name, risk level of external communication, and risk level of internal communication. Therefore, by registering this device information, the determination device 30 stores a set of software configuration information and risk level information based on communication operations.

[0063] [Risk Threshold Setting Process] FIG. 13 is a diagram illustrating the risk threshold setting process.

[0064] The determination device 30 receives risk threshold information input by the operator and sets a threshold value (risk threshold) for risk determination ((1) in FIG. 13). For example, the risk threshold is set to a risk level of "4" or higher for external communications and a risk level of "4" or higher for internal communications.

[0065] [Risk Assessment Process] FIG. 14 is a diagram illustrating the risk assessment process.

[0066] When the determination device 30 receives vulnerability information transmitted from the vulnerability information distribution service 40 ((1) in FIG. 14), it determines the risk of the received vulnerability information ((2) in FIG. 14). If necessary, the determination device 30 notifies the operator of the result of the risk determination ((3) in FIG. 14).

[0067] Fig. 15 is a diagram illustrating a specific example of risk assessment processing. As a premise, it is assumed that the risk threshold and device information described in box W1 (Fig. 15) are registered in the assessment device 30. In the example of Fig. 15, as shown in box W1, only vulnerability information corresponding to software that communicates with unspecified parties (risk level "4") is notified to the administrator.

[0068] For example, if vulnerability information for the software "RRR" is distributed in this state ((1) in FIG. 15), the following determination process is performed. The risk level based on the communication behavior of the software "RRR" is "2" for external communication and "3" for internal communication, which are below the risk threshold (risk level "4") set by the operator. Therefore, the determination device 30 determines that the vulnerability information for the software "RRR" poses a low risk ((2) in FIG. 15). Because the determination device 30 has determined that the vulnerability information for the software "RRR" poses a low risk, it determines that notification processing to the operator is unnecessary and does not notify the operator of the determination result ((3) in FIG. 15).

[0069] In contrast to the example in Figure 15, in the conventional method where the determination is made based solely on the network configuration, the risk is determined to be high because the determination is not made based on the actual communication partner or communication operation, but in this embodiment, the risk can be determined to be low by making a determination based on the communication operation.

[0070] Fig. 16 is a diagram illustrating a specific example of risk assessment processing. It is assumed that the risk threshold and device information described in box W2 (Fig. 16) are registered in the assessment device 30. In the example of Fig. 16, as shown in box W2, a case is described in which vulnerability information of communicating software (risk level "3" or higher) is notified regardless of whether the other party is unspecified or not.

[0071] For example, if vulnerability information for the software "RRR" is distributed in this state ((1) in FIG. 16), the following determination process is performed. The risk level based on the communication behavior of the software "RRR" is "2" for external communication and "3" for internal communication, which are equal to or greater than the risk threshold (risk level "3") set by the operator. Therefore, the determination device 30 determines that the vulnerability information for the software "RRR" poses a high risk ((2) in FIG. 16). Since the determination device 30 has determined that the vulnerability information for the software "RRR" poses a high risk, it determines that notification processing to the operator is necessary and notifies the operator of the determination result ((3) in FIG. 16).

[0072] In the example of FIG. 16, even if the operator mistakenly determines that the software "RRR" is unused and therefore has a low risk, this embodiment can correctly determine that the risk is high.

[0073] [Processing Procedure of Communication Processing] Next, the processing procedure of each step of the communication processing according to the embodiment will be described.

[0074] [Processing Procedure of Communication Information Generation Processing] FIG. 17 is a flowchart showing the processing procedure of communication information generation processing.

[0075] The agent 10 captures and acquires packets generated in the device 20 to be determined (step S1).

[0076] The agent 10 determines whether the captured packet has a known communication pattern (step S2).

[0077] If the captured packet is of a known communication pattern (step S2: Yes), the agent 10 updates the last communication time of the communication operation information for the corresponding known communication pattern (step S3) and terminates the communication information generation process for the captured packet.

[0078] If the captured packet does not have a known communication pattern (step S2: No), the agent 10 acquires information about the software that performed the communication of this packet (step S4), and then generates communication operation information for the communication (step S5), terminating the communication information generation process for the captured packet.

[0079] [Device Information Updating Processing Procedure] FIG. 18 is a flowchart showing the device information updating processing procedure.

[0080] The agent 10 determines whether there is any software whose communication information has changed since the last time it was executed (step S11).

[0081] If there is software whose communication information has changed since the last time it was executed (step S11: Yes), the agent 10 updates the risk level information of the software whose communication information has changed since the last time it was executed in accordance with the change in the communication information (step S12), and generates the latest device information for the device 20 to be judged.

[0082] The agent 10 transmits the latest device information of the device 20 to be determined to the determination device 30 (step S13). The determination device 30 registers the latest device information (step S14) and ends the device information updating process.

[0083] If there is no software whose communication information has changed since the previous execution (step S11: No), the agent 10 determines whether software that was not present in the previous execution has been added to the communication information (step S15).

[0084] If software that was not present at the previous execution has not been added to the communication information (step S15: No), the device information updating process ends.

[0085] On the other hand, if software that was not present in the previous execution has been added to the communication information (step S15: Yes), the agent 10 generates risk level information for the software that has been added to the communication information (step S16).

[0086] The agent 10 transmits the latest device information of the device 20 to be determined to the determination device 30 (step S17). The determination device 30 registers the latest device information (step S14) and ends the device information updating process.

[0087] [Procedure for Risk Threshold Setting Process] FIG. 19 is a flowchart showing the procedure for risk threshold setting process.

[0088] The determination device 30 receives input of risk threshold information (step S21), and registers risk threshold setting information 32 based on the input risk threshold information (step S22).

[0089] [Procedure of Risk Assessment Processing] FIG. 20 is a flowchart showing the procedure of risk assessment processing.

[0090] When the determination device 30 receives vulnerability information transmitted from the vulnerability information distribution service 40 (step S31), the determination device 30 determines whether the attack source classification of the received vulnerability information is NW (step S32).

[0091] If the attack source classification of the received vulnerability information is NW (step S32: Yes), the determination device 30 determines whether the risk level of the software corresponding to the vulnerability information is equal to or greater than the risk threshold (step S33).

[0092] If the risk level of the software corresponding to the vulnerability information is equal to or greater than the risk threshold (step S33: Yes), the determination device 30 determines that the risk is high and notifies the administrator (step S34).

[0093] If the risk level of the software corresponding to the vulnerability information is less than the risk threshold (step S33: No), the determination device 30 determines that the risk is low (step S35).

[0094] If the attack source classification of the received vulnerability information is not NW (step S32: No), after step S34 or step S35 is completed, the determination device 30 ends the risk determination process.

[0095] Effect of the embodiment As described above, in the embodiment, the determination device 30 performs risk determination for vulnerability information transmitted to the device to be determined 20, based on the actual communication operation state of the device to be determined 20 acquired via the agent 10. Specifically, the determination device 30 performs risk determination for the device to be determined 20, using risk level information generated by the agent 10 from the actual communication operation of the device to be determined 20. Therefore, in the embodiment, risk determination based on the actual communication operation of the device becomes possible.

[0096] In the embodiment, the agent 10 and the determination device 30 perform communication information generation processing, device information updating processing, and risk threshold setting processing in advance. As a result, the determination device 30 always holds the latest risk level information. When the determination device 30 receives a vulnerability notification, it performs risk determination processing based on the latest risk level information, allowing for rapid and accurate risk determination.

[0097] [System Configuration of the Embodiment] The components of the agent 10 and the determination device 30 are conceptual functional components and do not necessarily have to be physically configured as shown in the figure. In other words, the specific form of distribution and integration of the functions of the agent 10 and the determination device 30 is not limited to that shown in the figure, and all or part of them can be functionally or physically distributed or integrated in any unit depending on various loads, usage conditions, etc.

[0098] Furthermore, all or any part of the processes performed by the agent 10 and the determination device 30 may be realized by a CPU, a GPU (Graphics Processing Unit), and a program analyzed and executed by the CPU and GPU. Furthermore, each process performed by the agent 10 and the determination device 30 may be realized as hardware using wired logic.

[0099] Furthermore, among the processes described in the embodiments, all or part of the processes described as being performed automatically can be performed manually. Alternatively, all or part of the processes described as being performed manually can be performed automatically using a known method. In addition, the processing procedures, control procedures, specific names, and information including various data and parameters described above and illustrated can be changed as appropriate unless otherwise specified.

[0100] 21 is a diagram showing an example of a computer in which the agent 10 and the determination device 30 are realized by executing a program. The computer 1000 has, for example, a memory 1010 and a CPU 1020. The computer 1000 also has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0101] The memory 1010 includes a ROM 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

[0102] The hard disk drive 1090 stores, for example, an OS (Operating System) 1091, an application program 1092, a program module 1093, and program data 1094. That is, the programs that define the processes of the agent 10 and the determination device 30 are implemented as program modules 1093 in which code executable by the computer 1000 is written. The program modules 1093 are stored, for example, in the hard disk drive 1090. For example, the program modules 1093 for executing processes similar to the functional configurations of the agent 10 and the determination device 30 are stored in the hard disk drive 1090. Note that the hard disk drive 1090 may be replaced with an SSD (Solid State Drive).

[0103] Furthermore, setting data used in the processing of the above-described embodiment is stored as program data 1094, for example, in memory 1010 or hard disk drive 1090. Then, CPU 1020 reads out program module 1093 or program data 1094 stored in memory 1010 or hard disk drive 1090 into RAM 1012 as necessary and executes them.

[0104] The program module 1093 and program data 1094 may not necessarily be stored in the hard disk drive 1090, but may also be stored in a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (such as a local area network (LAN) or a wide area network (WAN)). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070.

[0105] Although the present invention has been described above as an embodiment, the present invention is not limited to the descriptions and drawings that form part of the disclosure of the present invention. In other words, other embodiments, examples, and operational techniques that can be made by those skilled in the art based on the present invention are all included in the scope of the present invention.

[0106] DESCRIPTION OF SYMBOLS 10 Agent 11 Packet capture result 12 Communication operation information DB 13 Packet capture acquisition unit 14 Software information acquisition unit 15 Communication operation information generation unit 16 Risk level information generation unit 17 Device information generation unit 18 Device information transmission unit 20 Determination target device 30 Determination device 31 Device information DB 32 Risk threshold setting information 33 Device information registration unit 34 Risk threshold setting unit 35 Vulnerability information reception unit 36 ​​Risk determination unit 37 Result notification unit 40 Vulnerability information distribution service 50 External server 60 Internal server

Claims

1. A communications system having an agent provided in a device to be judged and a judgment device that performs a risk judgment on the device to be judged, wherein the agent acquires the communication operation status of the device to be judged, and the judgment device performs a risk judgment on vulnerability information sent to the device to be judged based on the communication operation status of the device to be judged acquired by the agent.

2. The communication system according to claim 1, characterized in that the agent acquires packets generated in the device to be judged, acquires software information that communicated the acquired packets, and generates communication operation information indicating the communication operation of the packets, including at least the acquired software.

3. The communication system described in claim 2, characterized in that the agent uses the communication behavior information to generate risk level information based on the communication behavior for each piece of software, and registers in the judgment device equipment information that associates the software with the risk level information corresponding to the software.

4. The communication system described in claim 3, characterized in that when the judgment device receives notification of the distribution of vulnerability information to the judgment target device, it judges the risk of the vulnerability information based on the device information and a predetermined threshold value for risk judgment.

5. The communication system according to claim 3, wherein said agent constantly generates said communication operation information and periodically registers said device information in said determination device.

6. A communication method executed by a communication system having an agent provided in a device to be judged and a judgment device that performs a risk judgment on the device to be judged, comprising: a step in which the agent acquires the communication operation status of the device to be judged; and a step in which the judgment device performs a risk judgment on vulnerability information sent to the device to be judged based on the communication operation status of the device to be judged acquired in the acquisition step.

7. A communications program for causing a computer to execute a method, comprising the steps of: causing a computer as an agent provided in a device to be judged to execute a step of acquiring the communication operation status of the device to be judged; and causing a computer as a judgment device to execute a step of making a risk judgment on vulnerability information sent to the device to be judged based on the communication operation status of the device to be judged acquired in the acquiring step.