Assessment device, assessment method, and assessment program

Abstract

An agent (10) comprises: a communication operation information generation unit (17) that uses process management information acquired by risk assessment target equipment (30) in operation and information obtained by tracing communication within the risk assessment target equipment (30) to generate communication operation information consisting of a set of the name of the software that performed the communication operation, version information, common platform enumeration (CPE) information, and information about the communication partner; a detailed vulnerability information acquisition unit (12) that, when vulnerability test information is input, acquires detailed information of vulnerability corresponding to the input vulnerability test information, extracts the attack source category, software name, version information, and CPE information from the acquired detailed information of the vulnerability, and stores the extracted information together with vulnerability ID information as detailed vulnerability information; and a risk assessment unit (19) that compares the communication operation information with the detailed vulnerability information to assess risk for the risk assessment target equipment in terms of the vulnerability.

Description

Determination device, determination method, and determination program

[0001] The present invention relates to a determination device, a determination method, and a determination program.

[0002] Vulnerability management typically involves collecting vulnerability information relevant to one's own system and determining whether or not to address the issue and the priority based on the impact and risk.

[0003] In recent years, there has been a growing trend to utilize SBOM (Software Bill of Materials) to manage security risks such as software configuration and vulnerabilities of equipment and systems.

[0004] When security risk management using SBOM accurately identifies vulnerabilities in operational devices, the burden of vulnerability management work on operators increases. Just understanding communication behavior and startup status takes time, so analysis and decision-making work must be carried out efficiently.

[0005] A technique has been proposed for outputting vulnerability response priorities using four pieces of information (Non-Patent Document 1).

[0006] In addition, a vulnerability visualization service has been proposed that generates vulnerability reports using network visualization information from Redseal and a vulnerability scanner (Non-Patent Document 2).A cyber-attack risk assessment service has also been proposed that analyzes cyber-attack routes and cyber-attack risks through simulations using network (NW) configurations, vulnerability information, etc. (Non-Patent Documents 3 and 4).

[0007] "Software Vulnerability Management," yamory, [online], [Retrieved January 18, 2024], Internet <URL: https: / / yamory.io / service / vulnerability-management / > "Launching Vulnerability Visualization Service: Industry's First Network Security Risk Diagnosis Service," Fujitsu, July 20, 2016, [online], [Retrieved January 18, 2024], Internet <URL: https: / / pr.fujitsu.com / jp / news / grp-archives / feast / feast20160720-1.html> "Cyber ​​Attack Route Diagnosis Service," NEC, [online], [Retrieved January 18, 2024], Internet <URL: https: / / jpn.nec.com / cybersecurity / professionalservice / vulnerability_diagnosis / attack_route.html> "Cyber ​​Attack Risk Automated Diagnosis Technology," NEC, [online], [January 18, 2020], Internet <URL: https: / / jpn.nec.com / rd / technologies / 201804 / index.html>

[0008] In the technology described in Non-Patent Document 1, one of the pieces of information used is whether the software in question has been made public. However, since the method of registering this information on attack routes is manual, there are issues such as the burden on the operator to perform the registration work and the inability to accurately determine priority if the information is not updated. Furthermore, since the information used is whether the software has been made public, there is also the issue that the priority cannot be accurately determined if the software is unused.

[0009] Furthermore, the risk assessment techniques based on network configurations described in Non-Patent Documents 2 to 4 do not include the impact of communication operations of each piece of software running in the device in the risk assessment, which limits the assessment.

[0010] The present invention has been made in consideration of the above, and aims to provide a judgment device, judgment method, and judgment program that can make appropriate risk judgments when assessing the risk of equipment or systems, while reducing the processing burden on operators of manually analyzing and determining the impact.

[0011] In order to solve the above-mentioned problems and achieve the object, the determination device of the present invention is characterized by having: an agent provided in a device to be determined, the agent comprising: a generation unit that generates communication operation information, which is a set of software name that performed a communication operation, version information, CPE (Common Platform Enumeration) information, and information on the communication partner, using process management information acquired by the device to be determined while it is running and information on communication traced within the device to be determined; an acquisition unit that, when vulnerability testing information is input to the agent running on the device to be determined, acquires detailed information on a vulnerability corresponding to the input vulnerability testing information, extracts attack source classification, software name, version information, and CPE information from the acquired detailed information on the vulnerability, and stores the information together with vulnerability ID information as vulnerability detailed information; and a determination unit that compares the communication operation information with the detailed vulnerability information to determine a risk of the device to be determined for the vulnerability.

[0012] According to the present invention, in risk assessment of equipment and systems, it is possible to perform appropriate risk assessment while reducing the processing burden on the operator of manually analyzing and determining the impact.

[0013] FIG. 1 is a diagram illustrating an example of the configuration of a communication system according to an embodiment. FIG. 2 is a diagram illustrating process management information. FIG. 3-1 is a diagram illustrating communication trace information. FIG. 3-2 is a diagram illustrating communication trace information. FIG. 4-1 is a diagram illustrating SBOM information stored in the configuration information storage unit shown in FIG. 1. FIG. 4-2 is a diagram illustrating SBOM information stored in the configuration information storage unit shown in FIG. 1. FIG. 4-3 is a diagram illustrating SBOM information stored in the configuration information storage unit shown in FIG. 1. FIG. 5 is a diagram illustrating the processing of the communication operation information generation unit shown in FIG. 1. FIG. 6 is a diagram illustrating an example of the data configuration of communication operation information. FIG. 7 is a diagram illustrating an example of level definitions in risk assessment. FIG. 8 is a flowchart illustrating a processing procedure for vulnerability detailed information acquisition processing. FIG. 9 is a flowchart illustrating an example of a processing procedure for communication operation information acquisition processing. FIG. 10 is a flowchart illustrating an example of a processing procedure for risk assessment criterion registration processing. FIG. 11 is a flowchart illustrating an example of a processing procedure for risk assessment processing. FIG. 12 is a diagram illustrating an example of a computer in which an agent is implemented by executing a program.

[0014] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. Note that the present invention is not limited to this embodiment. In addition, in the description of the drawings, the same parts are designated by the same reference numerals.

[0015] [Embodiment] [Communication System] Next, a communication system according to an embodiment will be described. Fig. 1 is a diagram showing an example of the configuration of a communication system according to an embodiment.

[0016] As shown in FIG. 1, a communication system 100 according to the embodiment includes a risk assessment target device 30 (assessment target device) that is a target of risk assessment.

[0017] The risk assessment target device 30 can communicate via the Internet or an internal network with a vulnerability inspection tool 41, a vulnerability information distribution service 42, and an external vulnerability database (DB) 50. The risk assessment target device 30 can receive the inspection results of the vulnerability inspection tool 41 in two ways: by communicating directly with the tool, or by receiving the results output by the tool by transferring them from a terminal or the like.

[0018] The vulnerability inspection tool 41 is a tool for inspecting vulnerabilities that affect software in devices. The vulnerability information distribution service 42 is a vulnerability information distribution service for distributing vulnerability information that affects software in devices.

[0019] The external vulnerability DB 50 is a server that stores detailed information on vulnerabilities of various software.

[0020] The risk assessment target device 30 is provided with an agent 10 (a determination device) that performs risk assessment of the risk assessment target device 30.

[0021] The agent 10 sequentially stores communication operation information using process management information acquired by the running risk assessment target device 30 and communication trace information obtained by tracing communication within the risk assessment target device 30. The communication operation information is a set of information including the software name, version information, CPE (Common Platform Enumeration) information, and communication partner that performed the communication operation.

[0022] When the vulnerability test results are input to the agent 10 running on the risk assessment target device 30, the agent 10 obtains detailed vulnerability information from the external vulnerability DB 50 and stores it as detailed vulnerability information in a predetermined format suitable for assessment. The agent 10 performs risk assessment by matching the communication operation information with the detailed vulnerability information. This, in the embodiment, reduces the processing burden on the operator of manually analyzing and determining the impact. Note that if the detailed vulnerability information is already included in the vulnerability test results, the agent 10 omits the process of accessing the external vulnerability DB 50 and performs the process of storing the detailed vulnerability information in the predetermined format.

[0023] [Agent] The agent 10 is realized, for example, by loading a predetermined program into a computer or the like including a ROM (Read Only Memory), a RAM (Random Access Memory), a CPU (Central Processing Unit), etc., and having the CPU execute the predetermined program. In addition, the agent 10 is capable of communicating with other devices via a communication interface that the risk assessment target device 30 has and that transmits and receives various information to and from other devices connected via a network or the like.

[0024] 1 , the agent 10 includes a vulnerability testing information acquisition unit 11, a vulnerability detail information acquisition unit 12, a DB 13, a process management information acquisition unit 14, a communication trace information acquisition unit 15, a configuration information storage unit 16, a communication operation information generation unit 17, a judgment criterion information registration unit 18, a risk assessment unit 19, a judgment result output unit 20, and an SBOM (Software Bill of Materials) generation tool 60. Note that the vulnerability testing information acquisition unit 11, the vulnerability detail information acquisition unit 12, the DB 13, the judgment criterion information registration unit 18, the risk assessment unit 19, and the judgment result output unit 20 may be provided in a device other than the risk assessment target device 30 that is capable of communicating with the risk assessment target device 30.

[0025] The vulnerability testing information acquisition unit 11 acquires a vulnerability ID (identification) corresponding to the risk assessment target device 30 from the vulnerability testing information through the result information output by the vulnerability testing tool 41 or communication with the vulnerability information distribution service 42. The vulnerability testing information acquisition unit 11 receives an input of the vulnerability ID of the vulnerability information corresponding to the software of the risk assessment target device 30 as vulnerability testing information through the result information output by the vulnerability testing tool 41 or communication with the vulnerability information distribution service 42.

[0026] When vulnerability test information (e.g., a vulnerability ID) is input to the agent 10 running on the risk assessment target device 30, the vulnerability detail information acquisition unit 12 acquires detailed information about the vulnerability corresponding to the input vulnerability test information. The vulnerability detail information acquisition unit 12 acquires detailed information from the external vulnerability DB 50 about the vulnerability ID that corresponds to the software of the risk assessment target device 30. Note that if the vulnerability test result already includes detailed information about the vulnerability, the agent 10 omits the process of acquiring detailed information from the external vulnerability DB 50 by the vulnerability detail information acquisition unit 12.

[0027] The vulnerability detail information acquisition unit 12 stores the acquired detailed vulnerability information in a predetermined format suitable for judgment as vulnerability detail information. The vulnerability detail information acquisition unit 12 extracts the attack source classification, software name, version information, and CPE information from the acquired detailed vulnerability information, and stores the extracted information as vulnerability detail information. For example, the vulnerability detail information acquisition unit 12 extracts information such as the software name, version information, and CPE information regarding AV:N vulnerabilities from the detailed information acquired from the external vulnerability DB 50, and stores the extracted information together with the vulnerability ID as vulnerability detail information in DB 13.

[0028] The DB 13 stores vulnerability detailed information and communication operation information (described later). The DB 13 may be built on a separate server.

[0029] The process management information acquisition unit 14 acquires process management information of the running risk assessment target device 30. Fig. 2 is a diagram illustrating an example of process management information. As shown in Fig. 2, the process management information D1 includes PCOMM (process command), PID (process ID), PPID (process ID of parent process), and RET ARGS (arguments).

[0030] The communication trace information acquisition unit 15 acquires communication trace information that traces communications within the risk assessment target device 30 .

[0031] 3-1 and 3-2 are diagrams illustrating examples of communication trace information. The communication trace information acquisition unit 15 acquires communication trace information D2 shown in FIG. 3-1 as information obtained by tracing communications originating from the risk assessment target device 30. The communication trace information D2 includes PID, COMM (command), SADDR (source IP address), DADDR (destination IP address), and DPORT (destination port). The communication trace information acquisition unit 15 acquires communication trace information D3 shown in FIG. 3-2 as information obtained by tracing communications addressed to the risk assessment target device 30. The communication trace information D3 includes PID, COMM, RADDR (remote IP address), RPORT (remote port), LADDR (local IP address), and LPORT (local port).

[0032] The SBOM generation tool 60 generates an SBOM. The SBOM is a file containing information such as the components that make up the software included in the product, their mutual dependencies, and license data. Specifically, the SBOM contains information indicating the full path, software name, and version relationships of the software. The data provided by the SBOM generation tool 60 only needs to include information indicating the full path, software name, and version relationships of the software included in the product, and may be, for example, information from a package management system.

[0033] The configuration information storage unit 16 acquires and stores SBOM information generated by the SBOM generation tool 60 for software included in the running risk assessment target devices 30. The configuration information storage unit 16 acquires the SBOM information in advance. FIGS. 4-1 to 4-3 are diagrams illustrating examples of SBOM information stored by the configuration information storage unit 16 shown in FIG. 1. As illustrated in SBOM information D4 to D6 in FIGS. 4-1 to 4-3, the SBOM information is information including the full path, software name, and version of the software.

[0034] The communication operation information generation unit 17 generates communication operation information using process management information acquired by the operating risk assessment target device 30 and communication trace information obtained by tracing communication within the risk assessment target device 30. Fig. 5 is a diagram illustrating the processing of the communication operation information generation unit 17 shown in Fig. 1.

[0035] The communication operation information generating unit 17 determines the full path information of the command that performed the communication operation by, for example, comparing the process management information D1 with the communication trace information D2 ((1) in FIG. 5). For example, for the bottom row of the process management information D1, the information within the frame W1 is determined (arrow Y1).

[0036] Next, the communication operation information generation unit 17 identifies the name and version information of the software that actually performed the communication operation by comparing the full path information of the command that performed the communication operation with information indicating the relationship between the full path, software name, and version (SBOM information, PKG management system information, etc.).

[0037] The communication operation information generator 17 compares the full path information of the command that performed the communication operation (for example, the information in box W1) with the SBOM information D4 to D6 prepared in advance ((2) in FIG. 5), thereby acquiring the name, version information, and CPE information of the software that actually performed the communication operation (boxes W2 to W5). The version information and CPE information of the software that actually performed the communication operation can be acquired by referring to the SBOM information D5 from the SBOM information D4 ((3) in FIG. 5, lines 3 and 1 of the SBOM information D5), and further by referring to the SBOM information D6 ((4) in FIG. 5, lines 2, 6-7, and 10 of the SBOM information D6).

[0038] The communication operation information generation unit 17 groups together the name of the software that actually performed the communication operation, version information, CPE information, and information about the communication partner (for example, (5) in FIG. 5 ) and stores this as communication operation information in the DB 13. The communication operation information generation unit 17 associates the name of the software that actually performed the communication operation, version information, CPE information, communication destination address, communication destination classification, and communication time, and stores this as communication operation information in the DB 13.

[0039] 6 is a diagram showing an example of the data structure of communication action information. As shown in FIG. 6, the communication action information has the following items: communication action information identification ID, software name, version, CPE, communication destination address, communication destination classification, and time. The communication action information stored by the communication action information generation unit 17 is used to determine the risk of vulnerability.

[0040] The judgment criteria information registration unit 18 registers judgment criteria information used for risk judgment in the configuration. The judgment criteria information is set for each software in accordance with, for example, an operation policy. The judgment criteria information is a threshold value for risk judgment. Level information for comparison with the threshold value used for risk judgment is defined in advance using the IP address of the communication destination. FIG. 7 is a diagram showing an example of level definition for risk judgment. As shown in FIG. 7, the level for risk judgment is set, for example, depending on the communication partner.

[0041] In Fig. 7, if the communication partner is a global IP address or a pre-specified local IP address, the level is "2." If the communication partner is a local IP address, the level is "1." Note that the level definition for risk assessment is not limited to the example in Fig. 7, and may be freely determined by the operator, etc.

[0042] The risk determination unit 19 compares the communication operation information with the vulnerability detail information to determine the risk of the risk determination target device 30 against a vulnerability for each vulnerability ID. The risk determination unit 19 compares predetermined determination criteria information with level information corresponding to the actual communication partner of the risk determination target device 30 to determine the risk of the risk determination target device 30 against a vulnerability for each vulnerability ID. The risk determination unit 36 ​​performs risk determination for the risk determination target device 30 for each vulnerability ID in accordance with the determination criteria information, based on the attack source classification, name, version, CPE, communication destination address, communication destination classification, communication time, and vulnerability ID in the communication operation information and the vulnerability detail information.

[0043] Specifically, an example of the determination process of the risk determination unit 19 will be described. For example, for each vulnerability ID, the risk determination unit 19 acquires a CPE from the communication operation information for the AV:N vulnerability, and compares it with the CPE in the vulnerability detail information. If a match is found as a result of the comparison, the risk determination unit 19 checks the communication partner information from the communication operation information for the matched software, checks which predefined level it matches, and compares the matched level with the determination criterion information.

[0044] Specifically, the risk assessment unit 19 uses the assessment criteria information to assess the risk of the vulnerability of the target based on whether the level of the communication partner is equal to or greater than a threshold. The level of the communication partner is set using the IP address of the communication partner. The threshold is set based on level information defined, for example, as shown in FIG. 7.

[0045] If the risk level of a communication partner of a certain piece of software is equal to or higher than a threshold, the risk determination unit 19 determines that the risk of the AV:N vulnerability corresponding to that piece of software is high. For example, if the communication partner of a certain piece of software running on the risk determination target device 30 is a global IP address with a level of "2," and the threshold of the determination criterion information defined for that software is "2," the risk determination unit 19 determines that the risk of the AV:N vulnerability is high.

[0046] Furthermore, if the level of the communication partner of a certain piece of software is below a threshold, the risk assessment unit 19 determines that the risk of the AV:N vulnerability corresponding to that software is low. For example, if the communication partner of a certain piece of software running on the risk assessment target device 30 is a local IP address and has a level of "1," and the threshold of the assessment criteria information defined for that software is "2," the risk assessment unit 19 determines that the risk of the AV:N vulnerability is low.

[0047] Next, a specific description will be given of another example of the determination process of the risk determination unit 19. For example, when a vulnerability with an attack source classification of NW applies to the risk determination target device 30, the risk determination unit 19 performs the risk determination process.

[0048] This section will explain an example of an operational policy where the communication partner requests notification of vulnerabilities only for software used globally. In the example of communication operation information shown in Fig. 6, the risk determination unit 19 determines that the software "dddc" and software "ddds", which have a global communication destination category, pose a high risk for vulnerabilities in the attack source category: NW. Since the software "dddg" only communicates with the local host, it is determined that the risk for vulnerabilities in the attack source category: NW is low.

[0049] In addition, the risk assessment unit 19 searches the DB 13 for the software name to which the discovered vulnerability applies, and if no hit is found, it is assumed that the software is not performing communication, and therefore it is assessed as being a low risk.

[0050] The determination result output unit 20 outputs the determination result of the risk determination unit 19 to, for example, the administrator.

[0051] [Processing Procedures Performed by Agent] Next, the processing procedures of each process performed by the agent 10 will be described.

[0052] [Vulnerability Detail Information Acquisition Processing] FIG. 8 is a flowchart showing the processing procedure of vulnerability detail information acquisition processing.

[0053] In the agent 10, the vulnerability test information acquisition unit 11 acquires the vulnerability ID corresponding to the risk assessment target device 30 from the vulnerability test information by communicating with the vulnerability test tool 41 and the vulnerability information distribution service 42 (step S11).

[0054] In the agent 10, the vulnerability detail information acquisition unit 12 acquires detailed information from the external vulnerability DB 50 for the vulnerability ID corresponding to the risk assessment target device 30 (step S12). Note that if the vulnerability inspection result already contains detailed information about the vulnerability, the agent 10 omits step S12.

[0055] In the agent 10, the vulnerability detail information acquisition unit 12 extracts information such as the software name, version information, CPE information, and attack source classification from the detailed information acquired from the external vulnerability DB 50, and stores the extracted information together with the vulnerability ID as vulnerability detail information in DB 13 (step S13).

[0056] [Communication Action Information Acquisition Processing] FIG. 9 is a flowchart showing an example of a processing procedure for communication action information acquisition processing.

[0057] In the agent 10, the communication operation information generation unit 17 acquires the communicated command name, the full path of the command, and communication partner information from the process management information of the running risk assessment target device 30 and the communication trace information that traces communication within the risk assessment target device 30 (step S21). The process management information is acquired by the process management information acquisition unit 14. The communication trace information is acquired by the communication trace information acquisition unit 15.

[0058] The communication operation information generating unit 17 compares the full path of the command with the SBOM information, and acquires the software name, version information, and CPE information (step S22). The SBOM information is acquired by the configuration information storage unit 16.

[0059] The communication operation information generating unit 17 stores the name of the software that actually performed the communication operation, the version information, the CPE information, and the information of the communication partner as communication operation information in the DB 13 (step S23).

[0060] [Risk Determination Criteria Registration Processing] FIG. 10 is a flowchart showing an example of the processing procedure of risk determination criteria registration processing.

[0061] In the agent 10, the determination criterion information registration unit 18 registers the determination criterion information used for risk determination in the configuration (step S31).

[0062] [Risk Assessment Processing] FIG. 11 is a flowchart showing an example of a processing procedure for risk assessment processing.

[0063] In the agent 10, the risk determination unit 19 acquires the vulnerability detailed information and the communication operation information from the DB 13 (step S41).

[0064] The risk determination unit 19 acquires the CPE from the communication operation information for the AV:N vulnerability among the acquired vulnerability detailed information, and compares it with the CPE in the vulnerability detailed information (step S42).

[0065] The risk determination unit 19 determines whether or not there is a match between the CPE in the communication operation information and the CPE in the vulnerability detailed information (step S43).

[0066] If a match is found between the CPE in the communication operation information and the CPE in the vulnerability detailed information (step S43: Yes), the risk determination unit 19 checks the communication partner information of the risk determination target device 30 from the communication operation information for the matching software, and compares the level information that matches the communication partner in the communication operation information with the determination criterion information (step S44). Specifically, the risk determination unit 19 uses the determination criterion information to determine the risk level of the communication partner in the communication operation information.

[0067] The risk determination unit 19 determines whether the level of the communication partner in the communication operation information is equal to or higher than a threshold value (step S45).

[0068] If the level of the communication partner is equal to or higher than the threshold (step S45: Yes), the risk determination unit 19 determines that the vulnerability with the vulnerability ID to be determined is at high risk (step S46).

[0069] If the result of comparing the CPE in the communication operation information with the CPE in the vulnerability detailed information shows no match (step S43: No), or if the level of the communication partner is below the threshold (step S45: No), the risk determination unit 19 determines that the risk of the AV:N vulnerability is low (step S47). At this time, the agent 10 may present to the operator the reason for determining the risk as low (for example, there is communication but the communication partner is low risk, or there is no communication at all) along with the determination result.

[0070] If there are any undetermined vulnerability IDs remaining (step S48: Yes), the risk determination unit 19 returns to step S42 and executes the processes from step S42 onwards for the undetermined vulnerability IDs. If there are no undetermined vulnerability IDs remaining (step S48: No), the risk determination unit 19 ends the risk determination process.

[0071] [Effects of the embodiment] In this way, in the embodiment, the agent 10 uses process management information acquired by the risk assessment target equipment 30 in operation and information tracing communication within the equipment to sequentially store communication operation information including the software name, version, CPE information, and communication partner that performed the communication operation.

[0072] When the vulnerability inspection results are input to the agent 10 running on the risk assessment target device 30, the agent 10 acquires detailed vulnerability information from an external DB. The agent 10 then extracts the attack source classification, software name, version information, and CPE information from the acquired detailed vulnerability information, and stores the extracted information together with vulnerability ID information as detailed vulnerability information.

[0073] The agent 10 then compares these two pieces of information and automatically performs risk assessment on the vulnerabilities of the risk assessment target device 30. Therefore, according to the embodiment, in risk assessment of the risk assessment target device 30 or the system, it is possible to perform appropriate risk assessment while reducing the processing burden of manual impact analysis and judgment by the operator.

[0074] [System Configuration of the Embodiment] Each component of the agent 10 is a functional concept and does not necessarily have to be physically configured as shown in the figure. In other words, the specific form of distribution and integration of the functions of the agent 10 is not limited to that shown in the figure, and all or part of the functions can be functionally or physically distributed or integrated in any unit depending on various loads, usage conditions, etc.

[0075] Furthermore, all or any part of the processes performed by the agent 10 may be realized by a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), and a program analyzed and executed by the CPU and GPU. Furthermore, each process performed by the agent 10 may be realized as hardware using wired logic.

[0076] Furthermore, among the processes described in the embodiments, all or part of the processes described as being performed automatically can be performed manually. Alternatively, all or part of the processes described as being performed manually can be performed automatically using a known method. In addition, the processing procedures, control procedures, specific names, and information including various data and parameters described above and illustrated can be changed as appropriate unless otherwise specified.

[0077] 12 is a diagram showing an example of a computer in which an agent 10 is realized by executing a program. The computer 1000 has, for example, a memory 1010 and a CPU 1020. The computer 1000 also has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0078] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM (Random Access Memory) 1012. The ROM 1011 stores, for example, a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to, for example, a mouse 1110 and a keyboard 1120. The video adapter 1060 is connected to, for example, a display 1130.

[0079] The hard disk drive 1090 stores, for example, an OS (Operating System) 1091, application programs 1092, program modules 1093, and program data 1094. That is, the programs that define the processes of the agent 10 are implemented as program modules 1093 in which code that can be executed by the computer 1000 is written. The program modules 1093 are stored, for example, in the hard disk drive 1090. For example, the program modules 1093 for executing processes similar to the functional configuration of the agent 10 are stored in the hard disk drive 1090. The hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

[0080] Furthermore, setting data used in the processing of the above-described embodiment is stored as program data 1094, for example, in memory 1010 or hard disk drive 1090. Then, CPU 1020 reads out program module 1093 or program data 1094 stored in memory 1010 or hard disk drive 1090 into RAM 1012 as necessary and executes them.

[0081] The program module 1093 and program data 1094 may not necessarily be stored in the hard disk drive 1090, but may also be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (such as a local area network (LAN) or a wide area network (WAN)). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070.

[0082] Although the present invention has been described above as an embodiment, the present invention is not limited to the descriptions and drawings that form part of the disclosure of the present invention. In other words, other embodiments, examples, and operational techniques that can be made by those skilled in the art based on the present invention are all included in the scope of the present invention.

[0083] REFERENCE SIGNS LIST 10 Agent 11 Vulnerability testing information acquisition unit 12 Vulnerability detailed information acquisition unit 13 DB 14 Process management information acquisition unit 15 Communication trace information acquisition unit 16 Configuration information storage unit 17 Communication operation information generation unit 18 Judgment criteria information registration unit 19 Risk judgment unit 20 Judgment result output unit 41 Vulnerability testing tool 42 Vulnerability information distribution service 50 External vulnerability DB 60 SBOM generation tool

Claims

1. A judgment device comprising: an agent provided in a device to be judged, comprising: a generation unit that generates communication operation information that combines the name of the software that performed the communication operation, version information, CPE (Common Platform Enumeration) information, and information on the communication partner, using process management information acquired by the device to be judged while it is running and information on communications traced within the device to be judged; an acquisition unit that, when vulnerability testing information is input to the agent running on the device to be judged, acquires detailed information on the vulnerability that corresponds to the input vulnerability testing information, extracts the attack source classification, software name, version information, and CPE information from the acquired detailed vulnerability information, and stores them together with vulnerability ID information as vulnerability detailed information; and a judgment unit that compares the communication operation information with the detailed vulnerability information to judge the risk of the device to be judged regarding the vulnerability.

2. The judgment device described in claim 1, characterized in that the judgment unit compares predetermined judgment criteria information with the communication partner of the judgment target device to judge the risk of the judgment target device regarding the vulnerability.

3. A determination method executed by an agent installed in a device to be determined, comprising: a step of generating communication operation information that is a set of the software name, version information, CPE (Common Platform Enumeration) information, and information on the communication partner that performed the communication operation, using process management information acquired by the device to be determined while it is running and information on communications traced within the device to be determined; a step of acquiring detailed information on a vulnerability that corresponds to the input vulnerability inspection information when vulnerability inspection information is input to the agent running on the device to be determined, extracting the attack source classification, software name, version information, and CPE information from the acquired detailed vulnerability information, and storing them together with vulnerability ID information as detailed vulnerability information; and a step of comparing the communication operation information with the detailed vulnerability information to determine the risk of the device to be determined with respect to the vulnerability.

4. A judgment program that causes a computer to execute a method, comprising the steps of: generating communication operation information, which is a set of software name, version information, CPE (Common Platform Enumeration) information, and information on the communication partner that performed the communication operation, using process management information acquired by the device to be judged while it is running and information on communications traced within the device to be judged; acquiring detailed information on a vulnerability that corresponds to the vulnerability inspection information that was input when vulnerability inspection information is input to the agent running on the device to be judged, extracting attack source classification, software name, version information, and CPE information from the acquired detailed information on the vulnerability, and storing these together with vulnerability ID information as detailed vulnerability information; and comparing the communication operation information with the detailed vulnerability information to judge the risk of the device to be judged against the vulnerability.

Images