Protocol analysis device and protocol analysis method

Abstract

The present invention comprises: an identification unit that receives input of protocol specification data pertaining to a protocol which includes at least one item and that identifies items included in the protocol specification data; a hazard index allocation unit that allocates, to each item, a hazard index indicating an index of vulnerability; a severity level calculation unit that imparts, to each item, an individual severity level, which is set according to the severity of the allocated hazard index, that performs ranking, and that identifies a prescribed item having vulnerability from among the items and calculates a total severity level of each prescribed item for the protocol; and a report presentation unit that externally presents, for the protocol, a prescribed description item for which the total severity level is higher than a prescribed threshold value.

Description

Protocol analysis device and protocol analysis method

[0001] The present invention relates to a protocol analysis device and a protocol analysis method, and is suitable for application to, for example, a protocol analysis device relating to a technique for presenting recommended candidate information for narrowing down targets for fuzz testing.

[0002] In recent years, identifying vulnerabilities in existing assets and new products has become a critical instruction for vulnerability management. Among various tests for verifying vulnerabilities, fuzz testing identifies vulnerabilities using random inputs. For example, Non-Patent Document 1 discloses a technology that scans documents related to LTE (Long Term Evolution), detects vulnerabilities using test cases, and analyzes the detection results.

[0003] Y. Chen et al., "Bookworm Game: Automatic Discovery of LTE Vulnerabilities Through Documentation Analysis," 2021 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA, 2021, pp. 1197-1214, doi: 10.1109 / SP40001.2021.00104. https: / / ieeexplore.ieee.org / document / 9519388

[0004] The fuzz testing described above uses random input, so if the correct fields / operations are not targeted, the processing time can be long and it can be difficult to find vulnerabilities. When performing fuzz testing on a protocol, identifying sensitive fields / operations that may affect vulnerabilities is important for finding vulnerabilities, as this affects processing time and vulnerability detection.

[0005] The present invention has been made in consideration of the above points, and aims to propose a protocol analysis device and a protocol analysis method that can narrow down the target of fuzz testing, shorten the processing time of fuzz testing, and efficiently verify the vulnerability of protocols.

[0006] In order to solve this problem, the present invention comprises an identification unit that receives protocol specification data related to a protocol including at least one item and identifies each of the items included in the protocol specification data; a hazard index assignment unit that assigns a hazard index indicating an index of vulnerability to each of the items; a severity level calculation unit that assigns an individual severity level determined according to the severity of the assigned hazard index to each of the items and ranks them, identifies specific items that are vulnerable from among the items, and calculates a total severity level for each of the specific items for the protocol; and a report presentation unit that externally presents the specific description items for the protocol whose total severity level is higher than a predetermined threshold.

[0007] In addition, the present invention includes an identification step in which protocol specification data related to a protocol including at least one item is input to an identification unit, and each of the items included in the protocol specification data is identified; a hazard index assignment step in which a hazard index assignment unit assigns a hazard index indicating an index of vulnerability to each of the items; a severity level calculation step in which a severity level calculation unit assigns an individual severity level to each of the items determined in accordance with the severity of the assigned hazard index, ranks the items, identifies specific items that are vulnerable from among the items, and calculates a total severity level of each of the specific items for the protocol; and a report presentation step in which a report presentation unit presents to the outside the specific description items for the protocol whose total severity level is higher than a predetermined threshold.

[0008] According to the present invention, it is possible to narrow down the target of fuzz testing, thereby shortening the processing time of fuzz testing and efficiently verifying the vulnerability of a protocol.

[0009] FIG. 1 is a block diagram showing an example of a system configuration of a protocol analysis device according to the present embodiment. FIG. 2 is a block diagram showing an example of a hardware configuration of a protocol analysis device. FIG. 3 is a system configuration diagram showing an example of a system configuration that is a premise for executing a protocol analysis method according to the present embodiment. FIG. 4 is a flowchart showing an example of a protocol analysis method according to the present embodiment. FIG. 5 is a diagram showing an example of a protocol framework. FIG. 6 is a diagram showing an example of protocol items. FIG. 7 is a diagram showing an example of a protocol. FIG. 8 is a diagram showing an example of classification of hazard indicators. FIG. 9 is a diagram showing an example of calculating an individual severity level and a total severity level. FIG. 10 is a diagram showing an example of a severity level for each operation of a protocol. FIG. 11 is an example of a list created in step S6 of FIG. 4. FIG. 12 is a diagram showing an example of a recommendation screen.

[0010] An embodiment of the present invention will be described in detail below with reference to the drawings. FIG. 1 is a block diagram showing an example of the system configuration of a protocol analysis device 360 ​​according to this embodiment. The protocol analysis device 360 ​​has a function of presenting recommended candidate information for narrowing down protocol items to be subjected to fuzz testing when performing fuzz testing on a protocol, for example. This fuzz testing may be performed by a computer provided independently of the protocol analysis device 360, or may be performed by the protocol analysis device 360 ​​itself.

[0011] The protocol analysis device 360 ​​includes an identification unit 371 , a hazard index assignment unit 372 , an individual seriousness level (individual severity level) calculation unit 374 , a report presentation unit 377 , confidentiality keywords 380 , integrity keywords 382 , and availability keywords 383 .

[0012] The specification unit 371 receives protocol specification data including at least one item, and specifies each item included in the protocol specification data.

[0013] The hazard index assigning unit 372 assigns a hazard index indicating an index of vulnerability to each item.

[0014] The severity level calculation unit 374 assigns an individual severity level to each item that is determined according to the severity (severity value) of the assigned hazard index, ranks the items, identifies specific items that are vulnerable (critical) from among the items, and calculates the overall severity level of each specific item for the protocol.

[0015] The severity level calculation unit 374 includes an individual severity level assignment unit 375 and a total severity level assignment unit 376. The individual severity level assignment unit 375 assigns an individual severity level determined according to the severity of the assigned hazard index to each item, thereby ranking the items, and identifies certain items that have vulnerabilities from among the items. Meanwhile, the total severity level assignment unit 376 calculates the total severity level of each certain item for the protocol. The individual severity level assignment unit 375 and the total severity level assignment unit 376 will be described in detail below.

[0016] The individual severity level assigning unit 375, which will be described in detail later, classifies the hazard indicators into one of confidentiality, integrity, and availability.

[0017] The above-mentioned specification unit 371 specifies, as the above-mentioned items, at least one field and at least one operation for performing processing on the field. The field may include data such as a function and a control.

[0018] The report presentation unit 377 presents to the outside predetermined description items for protocols whose total severity level is higher than a predetermined threshold. The report presentation unit 377 will be described in detail later.

[0019] The confidentiality keywords 380 are a group of keywords used when classifying hazard indicators by confidentiality. The integrity keywords 382 are a group of keywords used when classifying hazard indicators by integrity. The availability keywords 383 are a group of keywords used when classifying hazard indicators by availability.

[0020] 2 is a block diagram showing an example of the hardware configuration of the protocol analysis device 360. The protocol analysis device 360 ​​includes a communication device 41, an input / output device 42, a storage device 43, a CPU (Central Processing Unit) 44, a memory 45, and an internal signal line 46. The communication device 41, the input / output device 42, the storage device 43, the CPU 44, and the memory 45 are connected to the internal signal line 46, which is a type of bus, and can exchange, for example, data.

[0021] The communication device 41 has a function of communicating data and the like with external devices under the control of the CPU 44. The input / output device 42 is, for example, a mouse, keyboard, or display. The storage device 43 is a non-volatile storage device, for example, a hard disk drive or SSD (Solid State Drive). The CPU 44 is an example of a central processing unit, and controls the entire protocol analysis device 360. The memory 45 stores data, programs executed by the CPU 44, and temporary areas used by the programs.

[0022] The protocol analysis device 360 ​​according to this embodiment has the above-described configuration, and next, an example of the operation of the protocol analysis device 360 ​​will be described. First, an example of a protocol analysis method according to this embodiment will be described.

[0023] First, the protocol analysis method includes an identification step in which an identification unit 371 receives protocol specification data 365 related to a protocol including at least one item and identifies each item included in the protocol specification data 365; a hazard index assignment step in which a hazard index assignment unit 372 assigns a hazard index indicating an index of vulnerability to each item; a severity level calculation step in which a severity level calculation unit 374 assigns an individual severity level (severity level) determined according to the severity of the assigned hazard index to each item, ranks the items, identifies specific items that are vulnerable from among the items, and calculates a total severity level for each specific item for the protocol; and a report presentation step in which a report presentation unit 377 presents to the outside specific description items for the protocol whose total severity level is higher than a specific threshold.

[0024] 3 is a system configuration diagram showing an example of a system configuration that is a premise for executing the protocol analysis method according to this embodiment. In this protocol analysis method, device A is connected to device B, device C, and another device D, and performs data communication with these devices using a protocol. In the following, we will particularly explain data communication between device A and devices B and C using the protocol.

[0025] 4 is a flowchart showing an example of a protocol analysis method according to this embodiment. Note that the following description will be made with reference to FIGS. 7 to 10 as needed.

[0026] In step S1, protocol specification data 365 relating to a protocol including at least one item is input to the identification unit 371, which identifies each item included in the protocol specification data 365. In this embodiment, operations and fields are identified as examples of such items.

[0027] The identification unit 371 identifies operations included in this protocol and fields as data used, for example, between different stages in the protocol. Here, the fields may be operations and fields used in the same stage in the protocol. Note that at least one of the operations and fields may be identified. Hereinafter, the identified operations and fields are also collectively referred to as "operations, etc."

[0028] For example, between device A and device B, protocol P1 is used as shown in FIG. 7, and this protocol P1 includes operations OP1, OP2, and OP3, and these operations OP1, etc. each include data and control as examples of fields.

[0029] On the other hand, for example, between device A and device C, protocol P2 is used as shown in FIG. 7, and this protocol P2 includes operations OP1 and OP2, and these operations OP1, etc. each include data and control as examples of fields.

[0030] Furthermore, for example, as in the example of the protocol framework shown in FIG. 5, for a protocol framework having an identification number of "235124", the identification unit 371 identifies "protocol P1" as another variable, "OP1" as an operation, "l3" as a first field, and "l2" as a second field.

[0031] In step S2, the hazard index assignment unit 372 identifies a hazard index that indicates an index of vulnerability and assigns the hazard index to each vulnerable operation, etc., which is displayed, for example, in a highlighted display mode, among the items of the protocol as shown in the upper part of Fig. 6. The hazard index assignment unit 372 may assign a hazard index prepared in advance as a table to each operation, etc., or may identify a hazard index using artificial intelligence that uses a learning model that has undergone machine learning and assign it to each operation, etc.

[0032] In step S3, the severity level calculation unit 374 categorizes the hazard indicators into confidentiality, integrity, and availability in accordance with predetermined criteria, as shown in the lower part of Fig. 6. The predetermined criteria here may be set in advance in a table (not shown), or may be set by an analyst or artificial intelligence with reference to a risk analysis report.

[0033] In step S4, the severity level calculation unit 374 assigns each individual severity level to each hazard indicator. The severity level calculation unit 374 assigns each individual severity level to each identification number and to each of confidentiality, integrity, and availability, as in the categories shown in Fig. 8. In the illustrated example, for example, the assignments are as follows:

[0034] First, for confidentiality, there are three types of severity as hazard indices, for example, "C1," "C2," and "C3," each of which is assigned "High," indicating that the individual severity level is high. For integrity, there are three types, "11," "12," and "13," each of which is assigned "Mid," indicating that the individual severity level is medium. For availability, there are three types, "A1," "A2," and "A3," each of which is assigned "Low," indicating that the individual severity level is low.

[0035] In step 5, the individual severity level assigning unit 375 of the severity level calculation unit 374 estimates the individual severity level of each operation, etc. Specifically, the individual severity level assigning unit 375 of the severity level calculation unit 374 assigns an individual severity level to each operation, etc., which is determined according to the severity of the assigned hazard index.

[0036] In step S5, the individual seriousness level assigning unit 375 determines the individual seriousness level of the operation, the first field, and the second field of each operation, etc., as "Mid," indicating that the level is medium, as shown in Fig. 9. Note that the individual seriousness level increases from "Low" to "Mid" to "High."

[0037] The individual severity level assigning unit 375 identifies a specific operation or the like that has a vulnerability from among the operations or the like.

[0038] Furthermore, the overall seriousness level assigning unit 376 calculates the overall seriousness level of each of the predetermined items for the protocol. Specifically, the overall seriousness level assigning unit 376 sets the overall seriousness level for the framework of the protocol with identification number "235124" to "Mid" based on the individual seriousness level of each operation ("Mid" in the illustrated example) as shown in Figure 9. Note that the overall seriousness level increases from "Low" to "Mid" to "High" as the level increases in severity.

[0039] In step S6, the report presentation unit 377 creates a list of specified operations, etc. for the protocol, whose overall severity level is higher than a specified threshold value ("Mid") according to the overall severity level for each operation, etc.

[0040] In step S6, the report presenting unit 377 presents a report indicating that, for example, between device A and device B, the individual seriousness level of operation "OP1" is "High," the individual seriousness level of operation "OP2" is "Mid," and the individual seriousness level of operation "OP3" is "Mid" for protocol P1, as shown in Fig. 10. On the other hand, the report presenting unit 377 determines that, for example, between device A and device C, the individual seriousness level of operation "OP1" is "High," and the individual seriousness level of operation "OP2" is "High" for protocol P2, as shown in Fig. 10. Specific display contents will be described later.

[0041] In step S7, the report presenting unit 377 presents the operations etc. with a high overall severity level to the outside. Specifically, the report presenting unit 377 displays the operations etc. with a high overall severity level and protocols including these as recommended candidate information for fuzz testing on a display as an example of the input / output device 42 described above.

[0042] 11 shows an example of the list created in step S6. The severity level calculation unit 374 creates a list that includes, for each protocol assigned an identification number, the name of the protocol, vulnerable operations, the overall severity level of the protocol, each vulnerable field, and information about the identification information of a device group that uses the protocol.

[0043] In the illustrated example, for example, identification number "1" is information relating to protocol "P1" used between device A and device B, and for protocol "P1" including operation "OP1", the overall severity level is "High", the individual severity level of vulnerable field "F1" is "High", and the individual severity level of vulnerable field "F2" is "High".

[0044] 12 is a diagram showing an example of a recommendation screen displayed on the input / output device 42. The recommendation screen is displayed based on the list shown in FIG. 11. When protocol specification data is selected, the report presenting unit 377 displays on the display, based on the list described above, a recommendation screen including the name of the protocol, the overall severity level corresponding to the protocol, vulnerable operations and fields and the individual severity levels of the vulnerable operations and fields, and identification information of multiple devices that use the protocol. A specific description will be given below.

[0045] In the example screen shown, for example, identification number "1" is information relating to protocol "P1" used between device A and device B, and it can be seen that in protocol "P1," the overall severity level of operation "OP1" is "High," the individual severity level of vulnerable field "F1" is "High," the individual severity level of vulnerable field "F2" is "High," and the individual severity level of vulnerable field "F4" is "Mid."

[0046] In this example screen, when one of the "display detailed information" buttons 402a to 402c in the detailed information 402 is pressed, the seriousness level calculation unit 374 displays detailed information for the corresponding identification number.

[0047] Furthermore, when the "display discovered hazard indicators in a list" button 403 is pressed, the severity level calculation unit 374 displays a list of at least one hazard indicator discovered in the target protocol.

[0048] When the "Update confidentiality hazard indicator" button 404 is pressed, the severity level calculation unit 374 updates the protocol description items shown in Figure 6 for each operation, etc., whose individual severity level is "High" so that the individual severity level is lower than "High", preferably to "Low".

[0049] When the "Update Integrity Hazard Index" button 405 is pressed, the severity level calculation unit 374 updates the protocol description items shown in Figure 6 for each operation, etc., whose individual severity level is "High" so that the individual severity level is lower than "High", preferably to "Low".

[0050] When the "Update Availability Hazard Index" button 406 is pressed, the severity level calculation unit 374 updates the protocol description items shown in Figure 6 for each operation, etc., whose individual severity level is "High" so that the individual severity level is lower than "High", preferably to "Low".

[0051] The protocol analysis device 360 ​​according to this embodiment is equipped with an identification unit 371 that receives protocol specification data 365 relating to a protocol including at least one item and identifies each item included in the protocol specification data 365; a hazard index assignment unit 372 that assigns a hazard index indicating an index of vulnerability to each item; a severity level calculation unit 374 that assigns an individual severity level determined according to the severity of the assigned hazard index to each item, ranks the items, identifies specific items that are vulnerable from among the items, and calculates the total severity level of each specific item for the protocol; and a report presentation unit 377 that externally presents specific description items for the protocol whose total severity level is higher than a predetermined threshold.

[0052] Furthermore, the protocol analysis method according to this embodiment includes an identification step in which the identification unit 371 receives protocol specification data 365 related to a protocol including at least one item and identifies each item included in the protocol specification data 365; a hazard index assignment step in which the hazard index assignment unit 372 assigns a hazard index indicating an index of vulnerability to each item; a severity level calculation step in which the severity level calculation unit 374 assigns an individual severity level determined according to the severity of the assigned hazard index to each item, ranks the items, identifies specific items that are vulnerable from among the items, and calculates the overall severity level of each specific item for the protocol; and a report presentation step in which the report presentation unit 377 presents to the outside specific description items for the protocol whose overall severity level is higher than a specific threshold.

[0053] In this way, the items to be subjected to fuzz testing can be narrowed down, the processing time of fuzz testing can be shortened, and the vulnerability of the protocol can be efficiently verified.

[0054] In the above-described embodiment, the identification unit 371 identifies at least one field and at least one operation that performs processing on the field as the items. In this way, the operations and fields that are the targets of fuzz testing are narrowed down, thereby shortening the processing time of fuzz testing and enabling efficient verification of protocol vulnerabilities.

[0055] In the above-described embodiment, the severity level calculation unit 374 includes an individual severity level assignment unit 375 that assigns an individual severity level (severity level) to each of the items according to the severity of the assigned hazard index, performs ranking, and identifies specific items that have vulnerabilities from among the items, and a total severity level assignment unit 376 that calculates a total severity level for each specific item for the protocol. In this way, the operations and fields to be subjected to fuzz testing can be narrowed down according to the individual severity level and the total severity level, thereby shortening the processing time for fuzz testing and efficiently verifying the vulnerability of the protocol.

[0056] In the above-described embodiment, the individual severity level assigning unit 375 classifies the hazard indicators into any of confidentiality, integrity, and availability. In this way, the operations and fields to be subjected to fuzz testing can be narrowed down according to the individual severity level and the total severity level that are set based on the hazard indicators classified into any of confidentiality, integrity, and availability, thereby shortening the processing time of fuzz testing and enabling efficient verification of protocol vulnerabilities.

[0057] In the above-described embodiment, the severity level calculation unit 374 creates a list for each protocol, including information on the name of the protocol, the vulnerable operation, the overall severity level of the protocol, each vulnerable field, and identification information of a device group that uses the protocol. In this way, the operations and fields to be subjected to fuzz testing can be narrowed down according to the individual severity levels and the overall severity level based on the list, thereby shortening the processing time of fuzz testing and efficiently verifying the vulnerability of the protocol.

[0058] In the above-described embodiment, when the protocol specification data 365 is selected, the report presenting unit 377 displays on the display a recommendation screen including the name of the protocol, the overall severity level corresponding to the protocol, predetermined vulnerable items and individual severity levels of the predetermined vulnerable items, and identification information of multiple devices that use the protocol. In this way, the operations and fields to be subjected to fuzz testing can be narrowed down according to the individual severity levels and overall severity level based on the display content of the recommendation screen, thereby shortening the processing time of fuzz testing and efficiently verifying the vulnerability of the protocol.

[0059] The present invention is not limited to the above-described embodiments, and includes various modifications and equivalent configurations within the spirit and scope of the appended claims. For example, the above-described embodiments have been described in detail to clearly explain the present invention, and the present invention is not necessarily limited to those including all of the described configurations. Furthermore, the elements described in parallel in the present embodiment may be configured such that at least one of the elements is connected in series to the other elements.

[0060] The above-described embodiment is an example of application to protocol fuzz testing, but the present invention is not limited to this and may be applied to other tests that require random input. Also, while the present embodiment exemplifies the above-described fields as protocol description items, the present invention is not limited to the above-described field examples and may be applied to other protocol description items.

[0061] The present invention can be applied to, for example, a protocol analysis device relating to a technique for presenting recommended candidate information for narrowing down the targets of fuzz testing.

[0062] 360: Protocol analysis device, 371: Identification unit, 372: Hazard index assignment unit, 374: Severity level calculation unit, 375: Individual severity level assignment unit, 376: Total severity level assignment unit, 377: Report presentation unit

Claims

1. A protocol analysis device comprising: an identification unit that receives protocol specification data relating to a protocol including at least one item and identifies each of the items included in the protocol specification data; a hazard index assignment unit that assigns a hazard index indicating an index of vulnerability to each of the items; a severity level calculation unit that assigns an individual severity level to each of the items according to the severity of the assigned hazard index, ranks each of the items, identifies specific items that are vulnerable from among the items, and calculates an overall severity level for each of the specific items for the protocol; and a report presentation unit that externally presents the specific description items for the protocol whose overall severity level is higher than a predetermined threshold.

2. The protocol analysis device according to claim 1, wherein the identification unit identifies, as the item, at least one field and at least one operation for performing processing on the field.

3. The protocol analysis device described in claim 1, characterized in that the severity level calculation unit has: an individual severity level assignment unit that assigns an individual severity level to each of the items according to the severity of the assigned hazard index, thereby ranking the items, and identifies specific items from among the items that are vulnerable; and a total severity level assignment unit that calculates a total severity level for each of the specific items for the protocol.

4. The protocol analysis device according to claim 3, wherein the individual severity level assignment unit classifies the hazard indicators into one of confidentiality, integrity, and availability.

5. The protocol analysis device according to claim 2, characterized in that the severity level calculation unit creates a list containing, for each protocol, information regarding the name of the protocol, the vulnerable operation, the overall severity level of the protocol, each vulnerable field, and identification information of a device group that uses the protocol.

6. The protocol analysis device according to claim 5, characterized in that when the specification data of the protocol is selected, the report presentation unit displays on a display a recommendation screen based on the list, the name of the protocol, the overall severity level corresponding to the protocol, the specified vulnerable items and the individual severity levels of the specified vulnerable items, and identification information of multiple devices that use the protocol.

7. A protocol analysis method comprising: an identification step in which protocol specification data relating to a protocol including at least one item is input to an identification unit, and each of the items included in the protocol specification data is identified; a hazard index assignment step in which a hazard index assignment unit assigns a hazard index indicating an index of vulnerability to each of the items; a severity level calculation step in which a severity level calculation unit assigns an individual severity level to each of the items determined in accordance with the severity of the assigned hazard index, ranks the items, identifies specific items that are vulnerable from among the items, and calculates a total severity level for each of the specific items for the protocol; and a report presentation step in which a report presentation unit presents to the outside the specific description items for the protocol whose total severity level is higher than a predetermined threshold.

8. The protocol analysis method according to claim 7, wherein the identification unit identifies, as the item, at least one field and at least one operation for performing processing on the field.

9. The protocol analysis method described in claim 7, characterized in that the severity level calculation unit has: an individual severity level assignment unit that assigns an individual severity level to each of the items according to the severity of the assigned hazard index, thereby ranking the items, and identifies specific items that are vulnerable from among the items; and a total severity level assignment unit that calculates a total severity level for each of the specific items for the protocol.

10. The protocol analysis method according to claim 9, wherein the individual severity level assignment unit classifies the hazard indicators into one of confidentiality, integrity, and availability.

11. The protocol analysis method described in claim 8, characterized in that the severity level calculation unit creates a list including, for each protocol, information regarding the name of the protocol, the vulnerable operation, the overall severity level of the protocol, each vulnerable field, and identification information of a device group that uses the protocol.

12. The protocol analysis method according to claim 11, characterized in that, when the protocol specification data is selected, the report presentation unit displays on a display a recommendation screen based on the list, the name of the protocol, the overall severity level corresponding to the protocol, the specified vulnerable items and the individual severity levels of the specified vulnerable items, and identification information of multiple devices that use the protocol.

Images