System, method, and program for inspecting vulnerability of website

Abstract

A vulnerability inspection server 10 according to one embodiment of the present invention reduces important function inspection omissions in a vulnerability inspection of a website. The server 10 provides, to a user who operates a user terminal 30 that is communicatively connected via a communication network 20, a vulnerability inspection service for inspecting the vulnerability (information security defects) of a website 22 or the like designated by the user. When automatically circulating the website 22, the server 10: determines an inspection-required function requiring a vulnerability inspection; determines a degree of association between each of a plurality of executable operations executable on a web page and the inspection-required function; and executes, from among the plurality of executable operations, an operation specified on the basis of the degree of association. Therefore, it becomes possible to execute an operation specified on the basis of the degree of association with a function requiring inspection, and promote circulation to a web page corresponding to an important function.

Description

System, method, and program for inspecting website vulnerabilities

[0001] The present invention relates to a system, method, and program for automatically crawling a website and inspecting the vulnerability of the website.

[0002] Conventionally, various services have been provided for inspecting vulnerability of websites (see, for example, Patent Document 1 below). These services may automatically crawl websites, and such automatic crawling typically involves repeatedly extracting links, forms, and the like from HTML data of web pages and accessing these in sequence.

[0003] JP 2012-133406 A

[0004] However, in the above-described automatic crawling, if an upper limit is set on the number of accessed web pages, the number of hierarchies, the elapsed time, etc., the automatic crawling may stop before crawling all pages of the website, resulting in some of the multiple functions of the website being left out of the vulnerability testing. For example, it is desirable to prevent functions that should be tested intensively, such as the product purchasing function on an e-commerce site, from being left out of the automatic crawling.

[0005] One of the objects of the embodiments of the present invention is to prevent important functions from being overlooked in vulnerability testing of websites. Other objects of the embodiments of the present invention will become apparent by reading the entire specification.

[0006] A system according to one embodiment of the present invention is a system for inspecting vulnerabilities of a website, comprising one or more computer processors, and automatically crawling the website, wherein the one or more computer processors perform the following steps: acquiring a first web page included in the website; determining functions that require inspection for vulnerability based on first page information about the first web page; identifying a plurality of executable operations that can be performed on the first web page; determining the degree of association between each of the plurality of executable operations and the functions that require inspection; executing a first operation from the plurality of executable operations that is identified based on the degree of association; and acquiring a second web page in response to the execution of the first operation.

[0007] A method according to one embodiment of the present invention is executed by one or more computers and is a method for testing vulnerabilities of a website involving automatic crawling of the website, and includes the steps of: obtaining a first web page included in the website; determining functions that require testing for vulnerabilities based on first page information about the first web page; identifying a plurality of executable operations that can be performed on the first web page; determining the degree of association between each of the plurality of executable operations and the functions that require testing; executing a first operation from the plurality of executable operations that is identified based on the degree of association; and obtaining a second web page in response to the execution of the first operation.

[0008] A program according to one embodiment of the present invention is a program for inspecting vulnerabilities of a website while automatically crawling the website, and causes one or more computers to execute the following steps: acquiring a first web page included in the website; determining functions that require inspection for vulnerability based on first page information about the first web page; identifying a plurality of executable operations that can be performed on the first web page; determining the degree of association between each of the plurality of executable operations and the functions that require inspection; executing a first operation from the plurality of executable operations that is identified based on the degree of association; and acquiring a second web page in response to the execution of the first operation.

[0009] Various embodiments of the present invention reduce the risk of important functions being overlooked in vulnerability testing of websites.

[0010] 1 is a block diagram illustrating a schematic configuration of a network including a vulnerability testing server 10 according to an embodiment of the present invention. A diagram illustrating an example of information managed by a testing management table 152. A diagram illustrating an example of information managed by a page management table 154. A diagram illustrating an example of information managed by an operation management table 156. A flowchart illustrating an example of processing executed by the vulnerability testing server 10 when testing the vulnerability of a website. A diagram illustrating an example of a target site setting screen 50. A flowchart illustrating an example of processing executed by the vulnerability testing server 10 when automatically crawling a website. A diagram showing an example of input / output information in a large-scale language model when acquiring a functional relevance score. A diagram showing an example of registered contents of the operation management table 156. A diagram showing an example of input / output information in a large-scale language model when acquiring a functional relevance score. A diagram showing an example of registered contents of the operation management table 156. A diagram illustrating an example of a testing result confirmation screen 60. A diagram showing an example of input / output information in a large-scale language model when setting a target function (function that needs to be tested). A diagram showing another example of input / output information in a large-scale language model when acquiring a functional relevance score.

[0011] Hereinafter, embodiments of the present invention will be described with reference to the drawings. In the drawings, the same reference numerals may be used to designate the same or similar components.

[0012] FIG. 1 is a schematic diagram illustrating the configuration of a network including a vulnerability testing server 10 according to one embodiment of the present invention. As shown in the figure, the server 10 is communicatively connected to a user terminal 30 via a communication network 20 such as the Internet. While only one user terminal 30 is shown in FIG. 1, the server 10 is communicatively connected to a plurality of user terminals 30. The vulnerability testing server 10 provides a vulnerability testing service to a user operating the user terminal 30, which tests for vulnerabilities (information security flaws) on a website 22 or the like specified by the user. The vulnerability testing server 10 is an example of a device that implements all or part of the system of the present invention.

[0013] First, we will explain the hardware configuration of the vulnerability testing server 10. The vulnerability testing server 10 is configured as a general computer, and as shown in Fig. 1, it includes a computer processor 11, a main memory 12, an input / output I / F 13, a communication I / F 14, and a storage (storage device) 15, and these components are electrically connected via a bus or the like (not shown).

[0014] The computer processor 11 is configured as a CPU, a GPU, or the like, and loads various programs stored in the storage 15 or the like into the main memory 12 and executes various instructions included in the programs. The main memory 12 is configured, for example, by a DRAM or the like.

[0015] The input / output I / F 13 includes various input / output devices for exchanging information with an operator, etc. The input / output I / F 13 includes, for example, information input devices such as a keyboard and a pointing device (e.g., a mouse, a touch panel, etc.), audio input devices such as a microphone, and image input devices such as a camera. The input / output I / F 13 also includes an image output device such as a display, and an audio output device such as a speaker.

[0016] The communication I / F 14 is implemented as hardware such as a network adapter, various communication software, or a combination of these, and is configured to enable wired or wireless communication via a communication network 20 or the like.

[0017] The storage 15 is configured, for example, by a magnetic disk or a flash memory. The storage 15 stores various programs including an operating system, various data, and the like. For example, as shown in FIG. 1 , the storage 15 has an inspection management table 152 that manages information related to vulnerability inspections, a page management table 154 that manages information related to web pages included in the website 22 to be inspected, and an operation management table 156 that manages information related to operations performed on each web page. Some of these tables may be integrated into one table, or may be divided into multiple tables.

[0018] Furthermore, for example, the storage 15 stores a server-side program 40 according to one embodiment of the present invention. The program 40 is a program for causing the server 10 to function as all or part of a system for providing a vulnerability testing service. At least a part of the server-side program 40 can be configured to be executed on the user terminal 30 via a terminal-side program 42, which will be described later.

[0019] In this embodiment, the vulnerability test server 10 may be configured using a plurality of computers each having the above-described hardware configuration. For example, the server 10 may be configured by a plurality of server devices.

[0020] The vulnerability testing server 10 configured in this manner can be configured to function as a web server and an application server, and executes various processes in response to requests from the user terminal 30, and transmits screen data (e.g., HTML data) and control data according to the results of the processes to the user terminal 30. The user terminal 30 outputs a web page or other screen based on the received data.

[0021] Next, we will explain the hardware configuration of the user terminal 30. The user terminal 30 is configured as a general computer, and as shown in Fig. 1, it includes a computer processor 31, a main memory 32, an input / output I / F 33, a communication I / F 34, and a storage (storage device) 35, and these components are electrically connected via a bus or the like (not shown).

[0022] The computer processor 31 is configured as a CPU, a GPU, or the like, and loads various programs stored in the storage 35 or the like into the main memory 32 and executes various instructions included in the programs. The main memory 32 is configured, for example, by a DRAM or the like.

[0023] The input / output I / F 33 includes various input / output devices for exchanging information with an operator, etc. The input / output I / F 33 includes, for example, information input devices such as a keyboard and a pointing device (e.g., a mouse, a touch panel, etc.), audio input devices such as a microphone, and image input devices such as a camera. The input / output I / F 33 also includes an image output device such as a display, and an audio output device such as a speaker.

[0024] The communication I / F 34 is implemented as hardware such as a network adapter, various communication software, or a combination thereof, and is configured to realize wired or wireless communication via the communication network 20 or the like.

[0025] The storage 35 is configured, for example, by a magnetic disk or a flash memory. The storage 35 stores various programs including an operating system, various data, and the like. The programs stored in the storage 35 can be downloaded and installed from an application market or the like. The storage 35 also stores the above-mentioned terminal-side program 42. The program 42 can be configured as a web browser or other application (e.g., a terminal-side application for the vulnerability testing service of this embodiment), and can be configured to execute at least a part of the server-side program 40, as described above.

[0026] In this embodiment, the user terminal 30 may be configured as a smartphone, a tablet terminal, a personal computer, or the like.

[0027] A user operating a user terminal 30 configured in this manner can use the vulnerability testing service provided by the server 10 by communicating with the server 10 via a terminal-side program 42 installed in storage 35 or the like.

[0028] Next, we will explain the functions of the vulnerability testing server 10 configured as above. As shown in Figure 1, the computer processor 11 of the server 10 is configured to function as a management function control unit 112, an automatic patrol control unit 114, and a testing control unit 116 by executing instructions included in a program (e.g., at least a part of the server-side program 40) loaded into the main memory 12.

[0029] The management function control unit 112 is configured to execute various processes related to the control of the management functions of the vulnerability testing service. For example, the management function control unit 112 transmits screen data and control data of various screens related to the management functions to the user terminal 30, executes various processes in response to operation input by the user via the screens output on the user terminal 30, and transmits screen data and control data according to the results of the processes to the user terminal 30. The management functions controlled by the management function control unit 112 include, for example, login processing (user authentication), billing control, and user account management.

[0030] The automatic patrol control unit 114 is configured to execute various processes related to the control of automatic patrol of the website 22. For example, the automatic patrol control unit 114 acquires a web page included in the website 22, executes an operation that can be executed on the web page (such as clicking a transition target element (e.g., various types of objects (buttons, images, text, etc.) to which links or scripts, etc. are set)), acquires a transition destination web page, and repeats these operations to patrol the website 22.

[0031] In this embodiment, the automatic patrol control unit 114 is configured to determine functions that require vulnerability testing based on page information about the web page. For example, the automatic patrol control unit 114 determines the functions that require testing based on HTML data of the web page.

[0032] The automatic patrol control unit 114 is also configured to identify multiple executable operations that can be performed on a web page and determine the degree of association between each executable operation and a function that requires inspection. For example, the automatic patrol control unit 114 identifies an operation that can be performed on the web page from multiple predetermined operations based on the HTML data of the web page, etc. The predetermined operations include, for example, operations such as "clicking on a product link," "clicking on a login link," and "entering and submitting a login form."

[0033] In this embodiment, the operations to be executed on the web page are identified based on the degree of association between each executable operation and the function requiring inspection. That is, the automatic patrol control unit 114 is configured to execute an operation among the plurality of executable operations that is identified based on the degree of association, and acquire a destination web page in response to the execution of the operation. For example, among the plurality of executable operations, an operation having a high degree of association with the function requiring inspection is executed preferentially.

[0034] The inspection control unit 116 is configured to execute various processes related to the control of the inspection of vulnerabilities of the website 22. For example, when automatically patrolling the website 22, the inspection control unit 116 transmits various requests for inspecting predetermined inspection items, and determines the corresponding inspection items based on the contents of the responses received from the website 22.

[0035] In this way, when automatically crawling the website 22, the vulnerability testing server 10 in this embodiment determines functions that require testing for vulnerabilities, determines the degree of association between each of a plurality of executable operations that can be performed on the web page and the functions that require testing, and executes an operation from among the plurality of executable operations that is identified based on the degree of association. This makes it possible to execute an operation that is identified based on the degree of association with the functions that require testing, thereby promoting crawling to web pages that correspond to important functions. In other words, the vulnerability testing server 10 prevents important functions from being overlooked in vulnerability testing of websites.

[0036] In this embodiment, the functions that need to be inspected may be determined using various methods. For example, the functions that need to be inspected may be determined using a rule-based method. In this case, the functions that need to be inspected may be determined based on label names in a web page (for example, if the corresponding HTML data includes label names such as "login," "login," "password," and "account," the "login function" may be determined as the function that needs to be inspected).

[0037] Furthermore, the determination of the functions that require inspection may be realized using a trained model generated by machine learning. For example, the automatic patrol control unit 114 may be configured to input input information including page information into a trained model for determining the functions that require inspection, and to determine the functions that require inspection based on output information for identifying the functions that require inspection output from the trained model. Such a configuration enables the determination of the functions that require inspection using the trained model.

[0038] In this embodiment, the trained model for determining the functions requiring inspection may be configured to output various information. For example, the trained model may be configured to output information identifying the functions requiring inspection. For example, the trained model may be configured as a large-scale language model (LLM) that, when input with HTML data of a web page and information instructing selection of a function requiring inspection from among a plurality of predetermined functions, outputs information on the selected function requiring inspection. This configuration makes it possible to determine the functions requiring inspection based on the information identifying the functions requiring inspection output from the trained model.

[0039] Furthermore, such a trained model is configured, for example, to output inspection necessity probability information indicating the possibility that each of a plurality of predetermined functions requires vulnerability testing. Such a trained model is generated, for example, through machine learning using a large amount of training data (e.g., page information (e.g., HTML data) of web pages included in a website and information identifying functions on the website that require testing), and is configured to output, as the inspection necessity probability information, a score indicating the possibility that testing is required. In this case, the automatic patrol control unit 114 determines the functions that require testing based on the inspection necessity probability information output from the trained model, so as to prioritize functions that are likely to require vulnerability testing. This configuration enables the determination of functions that require testing based on the inspection necessity probability information output from the trained model.

[0040] The automatic patrol control unit 114 may also be configured to re-determine the functions that need to be inspected based on page information of a destination web page. For example, the automatic patrol control unit 114 may determine a first function as a function that needs to be inspected based on first page information of a first web page, and then determine a second function as a function that needs to be inspected instead of or in addition to the first function based on second page information of a destination second web page in addition to the first page information. This configuration enables repeated determination of functions that need to be inspected based on page information of multiple web pages.

[0041] In this embodiment, the determination of the degree of association between the executable operation and the function requiring inspection can be realized using various methods. For example, the determination of the degree of association can be realized using a rule-based method. In this case, for example, the degree of association can be determined based on a label name corresponding to the operation (for example, if the corresponding label name is "login," the degree of association with the login function can be set to "100," and if the corresponding label name is "account," the degree of association with the login function can be set to "50").

[0042] The determination of the relevance may also be achieved using a trained model generated by machine learning. For example, the automatic navigation control unit 114 may be configured to input information including page information (e.g., HTML data) of a web page and a combination of executable operations and functions to be inspected into a trained model for determining the relevance, and determine the relevance based on information for determining the relevance (including a score indicating the relevance) output from the trained model. Such a trained model may be generated through machine learning using, for example, a large amount of training data (e.g., page information (e.g., HTML data) of a web page, executable operations on the web page, and functions to be inspected related to the operations). In this case, input information for the trained model may include past operation records (operations performed before reaching the corresponding web page). This configuration enables the determination of the relevance using the trained model.

[0043] Next, a specific example of one aspect of the vulnerability testing server 10 of this embodiment having such functions will be described. First, the information managed by each table in this example will be described. FIG. 2 illustrates information managed by the test management table 152 in this example. The test management table 152 in this example manages information about individual tests, and as shown in the figure, manages information such as a "top screen URL," which is the URL of the top screen (top page) that is the starting point for testing the website to be tested, a "screen transition setting date and time," which is the set date and time for screen transitions, and a "test execution date and time," which is the date and time for executing a vulnerability test, in association with an "test ID" that identifies an individual test (case).

[0044] 3 illustrates information managed by the page management table 154. In this example, the page management table 154 manages information about each web page (screen) included in the website to be inspected, and as shown in the figure, associates information such as a "screen URL" that is the URL of the screen, "screen capture information" that is information about a screen capture of the screen, "HTML data" of the screen, a "source screen ID" that identifies the source screen of the screen, a "source operation ID" that identifies the source operation of the screen (the operation performed when transitioning to the screen), "source input information" that is information about input values ​​entered for input fields on the source screen, and "inspection result information" that is information about the inspection result on the screen, in association with a combination of an "inspection ID" that identifies an individual inspection and a "screen ID" that identifies an individual screen in the inspection.

[0045] 4 illustrates information managed by the operation management table 156 in this example. The operation management table 156 in this example manages information related to operations performed on each screen, and manages information such as "element information" which is information (such as a label name) related to screen components corresponding to the operation, a "function ID" which identifies a function requiring examination associated with the operation, a "function relevance score" which indicates the relevance score between the operation and the function requiring examination, and an "execution completion flag" which indicates whether the operation has been performed, in association with a combination of an "examination ID" which identifies an individual examination, a "screen ID" which identifies an individual screen in the examination, and an "operation ID" which identifies an individual operation performed on the screen.

[0046] The information managed by each table in this example has been described above. Next, the processing executed by the vulnerability testing server 10 and the screens output on the user terminal 30 in this example will be described.

[0047] 5 is a flowchart illustrating the process executed by the vulnerability testing server 10 when testing a website for vulnerability in this example. As shown in the figure, the server 10 first accepts settings for the website to be tested for vulnerability (step S100). The settings are accepted via a screen displayed on the user terminal 30.

[0048] 6 illustrates a target site setting screen 50 output on the user terminal 30 for accepting settings for a website to be inspected. As shown, the screen 50 has a URL input area 52 for inputting the URL of the top screen (top page) of the website to be inspected, a login ID input area 54 for inputting a login ID used to log in to the website, a password input area 56 for inputting a password used to log in to the website, and a continue button 58 with the text "Start patrol and inspection" added. In this example, the URL of the top screen, the login ID, and the password are accepted as the setting information for the website to be inspected.

[0049] The continue button 58 is an object for instructing automatic crawling and inspection of the website to be inspected. Returning to the flowchart of Fig. 5, when the continue button 58 is selected, the server 10 then automatically crawls the website to be inspected and sets the screen transitions for the inspection (step S110).

[0050] 7 is a flowchart illustrating a process executed by the server 10 during automatic website crawling. As shown in the figure, the server 10 first accesses the top screen of the website to be inspected and adds the top screen to the screen transitions (step S200). Specifically, the server 10 launches a web browser and accesses the top screen identified by the URL entered via the target site setting screen 50 (obtaining the corresponding web page). Information about the top screen is also registered in the page management table 154. Specifically, the inspection ID, screen ID, screen URL, screen capture information, and HTML data are set.

[0051] Next, the server 10 determines the target functions (functions that require testing) for the vulnerability testing (step S210). In this example, the target functions are determined using a trained model. Specifically, when HTML data of a corresponding screen (here, the top screen) is input to the trained model, the trained model outputs a test necessity score indicating the possibility that testing is required for each of multiple predetermined functions, and the function with the highest score is determined to be the target function. Such trained models are generated through machine learning using a large amount of training data (e.g., data in which information identifying functions that require testing is added to HTML data). The multiple predetermined functions are set by the provider of the vulnerability testing service and include, for example, "new user registration," "login," "product purchase," "inquiry," etc.

[0052] Next, the server 10 identifies executable operations (step S220). Specifically, one or more executable operations are identified based on the HTML data of the corresponding screen (here, the top screen). The executable operations are identified as operations of clicking screen components (such as buttons, images, and text) to which links or scripts are set.

[0053] Next, the server 10 determines a functional relevance score indicating the relevance between the identified executable operation and the target function (step S230). Specifically, the functional relevance score is obtained using a trained model. In this example, the trained model is configured as a large-scale language model, and is configured to output a functional relevance score between the executable operation and the target function when information instructing the display of the score is input together with HTML data of the corresponding screen. For example, GPT-4 provided by OpenAI, Inc., USA, can be used as such a large-scale language model.

[0054] 8 shows an example of input and output information in a large-scale language model. Such input information is automatically generated by the server 10.

[0055] Returning to the flowchart of FIG. 7 , the server 10 then registers operations whose functional relevance scores are equal to or greater than a threshold (step S235). Specifically, the operation management table 156 contains the following information: an examination ID, a screen ID, an operation ID, element information, a function ID, and a functional relevance score. The element information contains information (such as a label name) that identifies the screen component to be clicked. In this example, an operation whose functional relevance score with the target function is equal to or greater than a threshold (high relevance with the target function) is associated with the target function and registered in the operation management table 156.

[0056] 9 shows an example of the contents of the operation management table 156 at this point in time. As shown in the figure, in the example of Fig. 9, among the executable operations on the screen (top screen) with the screen ID "S01", two operations (with operation IDs "O01" and "O02") whose functional relevance to the target function (with function ID "F01") is equal to or greater than a threshold value are registered in association with the target function.

[0057] Returning to the flowchart of FIG. 7 , if there is an unexecuted operation among the registered operations (YES in step S240), the server 10 determines and executes the operation to be executed (step S250). Specifically, among the unexecuted registered operations (identified by referencing the execution flags in the operation management table 156), the operation identified according to a predetermined rule (e.g., the operation with the highest functional relevance score) is determined as the operation to be executed. Note that if an input field (e.g., an inputtable form element) exists on the corresponding screen, an input value is set for the input field before the operation is executed. The input value is automatically set according to the predetermined rule.

[0058] Next, the server 10 adds a transition to a destination screen corresponding to the execution of the operation to the screen transition (step S260). Specifically, information about the destination screen is registered in the page management table 154, that is, the examination ID, screen ID, screen URL, screen capture information, HTML data, source screen ID, source operation ID, and source input information are set. The source operation ID is set to a value that identifies the operation executed immediately before. Furthermore, the source input information is set to a combination of input items and input values.

[0059] Here, if the destination screen is not a target screen for addition to the screen transition, it may not be added to the screen transition. For example, a screen of a site outside the website being inspected, or a screen that overlaps with a screen already included in the screen transition (determined based on the similarity of the screen, for example), is determined not to be a target screen for addition to the screen transition.

[0060] Next, the server 10 returns to step S210, and for the destination screen, sets the target function (step S210), identifies executable operations (step S220), determines the function relevance score of each operation (step S230), and registers operations whose function relevance score is above the threshold (step S235).

[0061] Here, when determining the functional relevance score for the second or subsequent times, in addition to the target function determined based on the HTML data of the corresponding screen (the target function based on the current screen), the target function registered in association with the most recently executed operation in the operation management table 156 (the target function highly associated with the most recently executed operation) is also considered. In other words, if these two target functions are different, two functional relevance scores between the two target functions are determined for one executable operation. Then, if both of the two functional relevance scores are equal to or greater than a threshold, one target function selected according to a predetermined rule is associated with the operation when it is registered.

[0062] 10 shows an example of input / output information in the large-scale language model when the functional relevance score is determined for the second time. In this case, as shown in the figure, the input information in the large-scale language model includes information about the most recently executed operation as the past operation, and information about the previous screen (top screen) as the URL and HTML of the page reached by the past operation. This information is automatically generated by the server 10 based on the information managed in the page management table 154 and the operation management table 156.

[0063] 11 shows an example of the contents of the operation management table 156 at this point in time. As shown in the figure, in the example of Fig. 11, an operation with an operation ID of "O01" is being executed (the executed flag is "1") on a screen (top screen) with a screen ID of "S01", and among the executable operations on a screen to which the transition is made with a screen ID of "S02", the operation with the operation ID of "O01" is registered in association with a target function with a function ID of "F01", and further, the operation with the operation ID of "O02" is registered in association with a target function with a function ID of "F02" (a target function based on the screen to which the transition is made).

[0064] 7, an operation identified according to a predetermined rule from among the registered operations that have not yet been executed at that time is determined as the operation to be executed and executed (step S250), and a transition to a destination screen corresponding to the execution of the operation is newly added to the screen transitions (step S260). These processes are repeated until there are no registered operations that have not yet been executed (NO in step S240).

[0065] Returning to the flowchart of FIG. 5 , once the screen transitions have been set in this manner, the server 10 then executes vulnerability testing in accordance with the set screen transitions (step S120). Specifically, a web browser is launched, and each screen included in the screen transition is visited in order in accordance with the information managed in the page management table 154, and testing is performed for predetermined vulnerability testing items. Vulnerability testing items include, for example, items specified in OWASP Top 10. The testing results are registered in the testing result information in the page management table 154. Note that testing for testing items may also be performed on each screen during automatic website crawling (i.e., when setting up screen transitions).

[0066] 12 shows an example of an inspection result confirmation screen 60 for confirming inspection results, which is output on the user terminal 30. As shown in the figure, the screen 60 has a list display area 62 that displays a list of vulnerability inspection results. The area 62 displays a list of vulnerability inspection results (severity, vulnerability name, detected location, vulnerable location, etc.) for each screen. This information is managed in the inspection result information of the page management table 154.

[0067] In the above example, when setting target functions (functions that require testing) for vulnerability testing, a trained model is used that outputs a testing necessity score for each function when HTML data for the corresponding screen is input. However, target functions may also be set using a large-scale language model. Figure 13 shows an example of input / output information in a large-scale language model when setting target functions. In this case, as shown in the figure, in addition to the HTML data for the current screen, HTML data for other screens (such as a transition source screen) may be set as input information. Furthermore, setting such target functions may also be achieved using a rule-based method.

[0068] In the above-described example, when a functional relevance score is obtained using a large-scale language model, the basis for the score may be obtained in addition to the score. FIG. 14 shows an example of input / output information for the large-scale language model in this case. Such basis information may be managed, for example, in the operation management table 156 and may be used to verify the validity of the score and as part of the operation history. Furthermore, such determination of functional relevance may be realized using a rule-based method.

[0069] The vulnerability testing server 10 according to the present embodiment described above, when automatically crawling a website 22, determines functions that require testing for vulnerabilities, determines the degree of association between each of a plurality of executable operations that can be performed on a web page and the functions that require testing, and executes an operation from among the plurality of executable operations that is identified based on the degree of association. This makes it possible to execute an operation that is identified based on the degree of association with functions that require testing, thereby promoting crawling to web pages that correspond to important functions. In other words, the vulnerability testing server 10 prevents important functions from being overlooked in vulnerability testing of websites.

[0070] In other embodiments of the present invention, some or all of the functions possessed by the vulnerability testing server 10 in the above-described embodiments may be realized by cooperation between the vulnerability testing server 10 and the user terminal 30, or may be realized by the user terminal 30.

[0071] The processes and procedures described herein, other than those explicitly described, may be implemented by software, hardware, or any combination thereof. For example, the processes and procedures described herein may be implemented by implementing logic corresponding to the processes and procedures in a medium such as an integrated circuit, volatile memory, non-volatile memory, or magnetic disk. Furthermore, the processes and procedures described herein may be implemented as a computer program corresponding to the processes and procedures and executed by various computers.

[0072] Although processes and procedures described herein are described as being performed by a single device, software, component, or module, such processes or procedures may be performed by multiple devices, software, components, and / or modules. Also, the software and hardware elements described herein may be implemented by combining them into fewer components or breaking them down into more components.

[0073] In this specification, even if a component of the invention is described as either singular or plural, or is described without limitation as either singular or plural, the component may be either singular or plural unless the context requires otherwise.

Claims

1. A system comprising one or more computer processors for testing vulnerabilities of a website involving automatic crawling of the website, the one or more computer processors executing the following steps: obtaining a first web page included in the website; determining functions that require testing for vulnerabilities based on first page information about the first web page; identifying a plurality of executable operations that can be performed on the first web page; determining a degree of association between each of the plurality of executable operations and the functions that require testing; executing a first operation among the plurality of executable operations that is identified based on the degree of association; and obtaining a second web page in response to the execution of the first operation.

2. The system according to claim 1, wherein the first operation is identified by giving priority to an executable operation having a high degree of association among the plurality of executable operations.

3. The system of claim 1, wherein the step of determining the functions requiring inspection includes inputting first input information including the first page information into a first trained model, and determining the functions requiring inspection based on first output information for identifying the functions requiring inspection that is output from the first trained model.

4. The system of claim 3, wherein the first output information includes information identifying the function requiring inspection.

5. The system of claim 3, wherein the first output information includes possibility information indicating the possibility that vulnerability testing is required for each of a predetermined number of functions, and the step of determining the functions that require testing determines the functions that require testing such that, among the predetermined number of functions, functions that are more likely to require vulnerability testing are given priority.

6. The system of claim 1, wherein the one or more computer processors further perform the step of determining again the features to be inspected based further on second page information relating to the second web page in addition to the first page information.

7. The system of claim 1, wherein the step of determining the relevance includes inputting the first page information and second input information including a combination of each of the plurality of executable operations and the function requiring inspection into a second trained model, and determining the relevance based on second output information for determining the relevance that is output from the second trained model.

8. The system of claim 7, wherein the second output information includes the relevance.

9. The system of claim 7, wherein the step of acquiring the first web page acquires the first web page in response to execution of a second operation, and the second input information further includes information identifying the second operation.

10. A method executed by one or more computers for testing vulnerabilities of a website involving automatic crawling of the website, comprising the steps of: obtaining a first web page included in the website; determining a function requiring testing for vulnerabilities based on first page information about the first web page; identifying a plurality of executable operations that can be performed on the first web page; determining a degree of association between each of the plurality of executable operations and the function requiring testing; executing a first operation among the plurality of executable operations that is identified based on the degree of association; and obtaining a second web page in response to the execution of the first operation.

11. A program for testing vulnerabilities of a website while automatically crawling the website, the program causing one or more computers to execute the following steps: obtaining a first web page included in the website; determining functions that require testing for vulnerabilities based on first page information about the first web page; identifying a plurality of executable operations that can be executed on the first web page; determining the degree of association between each of the plurality of executable operations and the functions that require testing; executing a first operation among the plurality of executable operations that is identified based on the degree of association; and obtaining a second web page in response to the execution of the first operation.

Images