Evaluation device

Abstract

In the present invention, an agent (10) uses process management information acquired by a device under evaluation during operation, communication trace information obtained by tracing communication in the device under evaluation (30), and environment management information relating to an execution environment operating on the device under evaluation (30), to generate communication operation information including the name of software that has performed the communication operation, version information, Common Platform Enumeration (CPE) information, communication destination classification, execution environment, and execution target information. The agent (10) cross-references the communication operation information and vulnerability detail information, evaluates the risk of device under evaluation (30) with respect to the vulnerability, and outputs the execution environment and the execution target of the software that has performed the communication operation together with the evaluation result.

Description

Judgment device

[0001] The present invention relates to a determination device.

[0002] Vulnerability management typically involves collecting vulnerability information relevant to one's own system and determining whether or not to address the issue and the priority based on the impact and risk.

[0003] In recent years, there has been a growing trend to utilize SBOM (Software Bill of Materials), a database of software components, to manage security risks such as the software configuration and vulnerabilities of devices and systems.

[0004] When security risk management using SBOM accurately identifies vulnerabilities in operational devices, the burden of vulnerability management work on operators increases. Just understanding communication behavior and startup status takes time, so analysis and decision-making work must be carried out efficiently.

[0005] In addition, current systems sometimes use virtualization technology to isolate execution environments, or use different versions of execution environments in parallel.

[0006] In vulnerability management work, operators need to identify the scope of impact of vulnerabilities, but doing so manually takes time and effort and makes it difficult to quickly determine a course of action, so it is necessary to identify the scope of impact efficiently.

[0007] A technique has been proposed for outputting vulnerability response priorities using information on the vulnerability risk, the presence or absence of attack code, and the presence or absence of system disclosure (Non-Patent Document 1).

[0008] It has also been proposed to automatically generate information on the software name, version, and communication partner that performed the communication operation from process information obtained by the OS (Operating System) and SBOM, and to determine the risk of vulnerability based on this information (Non-Patent Document 2).

[0009] “Software Vulnerability Management”, yamory, [online], [Retrieved June 5, 2024], Internet <URL: https: / / yamory.io / service / vulnerability-management / > Yasunori Wada, Takayuki Uehara, “A Vulnerability Risk Assessment Method Using Visualized Data of Device Communication Behavior”, IEICE General Conference, March 2024

[0010] In the technology described in Non-Patent Document 1, one of the pieces of information used is information regarding whether or not the system is open to the public. However, the information regarding whether or not the system is open to the public is manually entered, and there is a problem in that if an update is not made, an accurate determination cannot be made.

[0011] Furthermore, with the technology described in Non-Patent Document 2, if a virtual environment is used on a device or if multiple versions of an execution environment are used simultaneously, the execution environment or execution target of the process that performed the communication operation is unknown, and the operator must manually check the scope of the impact. For this reason, the technology described in Non-Patent Document 2 does not allow for a quick determination of a course of action. Another issue with the technology described in Non-Patent Document 2 is that the functional configuration targeted at devices with resource constraints is not clear.

[0012] The present invention has been made in consideration of the above, and aims to provide a determination device that can automatically determine the execution environment and execution target of a process in risk determination of equipment or systems, and perform appropriate risk determination.

[0013] In order to solve the above-mentioned problems and achieve the object, a determination device according to the present invention is characterized by comprising: an agent provided in a device to be determined, the agent comprising a first generation unit that generates communication operation information including a software name, version information, CPE (Common Platform Enumeration) information, a communication destination classification, an execution environment, and information on an execution target, using process management information acquired by the device to be determined while the device is running, communication trace information that traces communications within the device to be determined, and environment management information related to an execution environment currently running in the device to be determined; an acquisition unit that, when vulnerability testing information is input to the agent running on the device to be determined, acquires detailed information on a vulnerability corresponding to the input vulnerability testing information, extracts one or more of an attack source classification, a software name, version information, and CPE information from the acquired detailed vulnerability information, and stores the extracted information together with vulnerability ID information as vulnerability detailed information; and a determination unit that compares the communication operation information with the detailed vulnerability information to determine a risk of the device to be determined with respect to the vulnerability, and outputs the execution environment and the execution target of the software that performed the communication operation together with the determination result.

[0014] According to the present invention, in risk assessment of equipment or systems, the process execution environment and execution target can be automatically assessed, and appropriate risk assessment can be performed.

[0015] FIG. 1 is a diagram illustrating an operation image of a determination system according to an embodiment. FIG. 2 is a diagram illustrating a conventional technique. FIG. 3 is a diagram illustrating a communication system according to an embodiment. FIG. 4 is a diagram illustrating an example of a configuration of a communication system according to an embodiment. FIG. 5 is a diagram illustrating an example of process management information. FIG. 6 is a diagram illustrating an example of communication trace information. FIG. 7 is a diagram illustrating an example of an SBOM of a container stored in the configuration information storage unit illustrated in FIG. 4. FIG. 8 is a diagram illustrating processing by the environment management information generation unit illustrated in FIG. 4. FIG. 9 is a diagram illustrating processing by the environment management information generation unit illustrated in FIG. 4. FIG. 10 is a diagram illustrating an example of container management information. FIG. 11 is a diagram illustrating processing for generating communication operation information. FIG. 12 is a diagram illustrating processing for generating communication operation information. FIG. 13 is a diagram illustrating processing for generating communication operation information. FIG. 14 is a diagram illustrating processing for generating communication operation information. FIG. 15 is a diagram illustrating an example of a data configuration of communication operation information. FIG. 16 is a diagram illustrating an example of a level definition for risk determination. FIG. 17 is a flowchart illustrating a processing procedure for vulnerability detailed information acquisition processing. FIG. 18 is a flowchart illustrating an example of a processing procedure for risk determination criterion registration processing. FIG. 19 is a flowchart showing an example of a processing procedure for generating environment management information. FIG. 20 is a flowchart showing an example of a processing procedure for acquiring communication operation information. FIG. 21 is a flowchart showing an example of a processing procedure for risk assessment processing. FIG. 22 is a diagram showing an example of information generated in the prior art. FIG. 23 is a diagram showing an example of information generated in an agent according to an embodiment. FIG. 24 is a diagram showing another example of the configuration of a communication system according to an embodiment. FIG. 25 is a diagram showing an example of an operation image of a determination system according to an embodiment. FIG. 26 is a diagram showing an example of an operation image of a determination system according to an embodiment. FIG. 27 is a diagram showing an example of an operation image of a determination system according to an embodiment. FIG. 28 is a diagram showing an example of an execution environment. FIG. 29 is a diagram showing an example of a computer in which an agent is realized by executing a program.

[0016] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. Note that the present invention is not limited to this embodiment. In addition, in the description of the drawings, the same parts are designated by the same reference numerals.

[0017] [Embodiment] Fig. 1 is a diagram showing an operation image of a determination system according to an embodiment. As shown in Fig. 1, an agent 10 according to an embodiment captures communication operations regardless of whether the operations are processes on a host or in a virtual environment, and when the kernel captures the communication operations, it generates communication operation information that visualizes the source of the execution ((1) in Fig. 1).

[0018] By referring to the visualized information generated by the agent 10, the operator can quickly understand in which environment a process that performed a high-risk operation against a vulnerability was executed ((2) in FIG. 1).

[0019] Fig. 2 is a diagram illustrating a conventional technique, and Fig. 3 is a diagram illustrating a communication system according to an embodiment.

[0020] As shown in Fig. 2, in the prior art, it was impossible to determine in which environment a process captured by the kernel was executed ((1) in Fig. 2). In contrast, in the determination system according to the embodiment, the parent-child relationship between processes is traced, and the virtual environment in which the process to be determined is executed is identified from the parent process ((1) in Fig. 3). In the following, a specific description will be given using an example in which the execution environment is a container.

[0021] [Communication System] Next, a communication system according to an embodiment will be described. Fig. 4 is a diagram showing an example of the configuration of the communication system according to an embodiment.

[0022] As shown in FIG. 4, the communication system 100 according to the embodiment includes a device 30 to be assessed, which is a risk assessment target.

[0023] The device 30 to be determined can communicate via the Internet or an internal network with a vulnerability inspection tool 41, a vulnerability information distribution service 42, and an external vulnerability database (DB) 50. The device 30 to be determined can receive the inspection results of the vulnerability inspection tool 41 in two ways: by directly communicating with the tool, or by receiving the results output by the tool by transferring them from a terminal or the like.

[0024] The vulnerability inspection tool 41 is a tool for inspecting vulnerabilities that affect software in devices. The vulnerability information distribution service 42 is a vulnerability information distribution service for distributing vulnerability information that affects software in devices.

[0025] The external vulnerability DB 50 is a server that stores detailed information on vulnerabilities of various software.

[0026] The device 30 to be determined is provided with an agent 10 (determination device) that performs risk determination for the device 30. The device 30 to be determined is also provided with an SBOM (Software Bill of Materials) generation tool 60.

[0027] The SBOM generation tool 60 generates an SBOM. The SBOM is a file containing information such as the components that make up the software included in the product, their mutual dependencies, and license data. Specifically, the SBOM contains information indicating the full path, software name, and version relationships of the software, as well as CPE (Common Platform Enumeration) information. The data provided by the SBOM generation tool 60 only needs to include information indicating the full path, software name, and version relationships of the software included in the product, and may be, for example, information from a package management system.

[0028] The agent 10 sequentially stores communication operation information using process management information acquired by the device 30 to be determined while it is running, communication trace information obtained by tracing communications within the device 30 to be determined, and container management information (environment management information) related to the container (execution environment) running in the device to be determined. The container management information is information for identifying the execution environment of the process (software that performed the communication operation) that performed the communication operation in post-container processing. The communication operation information is information including the name of the software that performed the communication operation, version information, CPE information, communication destination classification, time, execution environment, and execution target.

[0029] When the vulnerability test results are input to the agent 10 running on the device 30 to be assessed, the agent 10 obtains detailed vulnerability information from the external vulnerability DB 50 and stores it as detailed vulnerability information in a predetermined format suitable for assessment. The agent 10 compares the communication operation information with the detailed vulnerability information to assess risk, and automatically outputs information on the execution environment and execution target of the process (software) to be assessed. Note that if the detailed vulnerability information is already included in the vulnerability test results, the agent 10 omits the process of accessing the external vulnerability DB 50 and performs the process of storing the detailed vulnerability information in the predetermined format.

[0030] [Agent] The agent 10 is realized, for example, by loading a predetermined program into a computer or the like including a ROM (Read Only Memory), a RAM (Random Access Memory), a CPU (Central Processing Unit), etc., and having the CPU execute the predetermined program. The agent 10 is also capable of communicating with other devices via a communication interface that the determination target device 30 has and that transmits and receives various information to and from other devices connected via a network or the like.

[0031] 4, the agent 10 includes an inspection information acquisition unit 11, a detailed information acquisition unit 12, a DB 13, a management information acquisition unit 14, a communication trace information acquisition unit 15, a configuration information storage unit 16, an environment management information generation unit 17, a communication information generation unit 18, an identification information generation unit 19, a reference registration unit 20, a judgment unit 21, and a judgment result output unit 22. By providing the environment management information generation unit 17, the communication information generation unit 18, and the identification information generation unit 19, the agent 10 can identify the source of the process (software) that generated the communication when the kernel acquires the communication operation, as will be described later.

[0032] The inspection information acquisition unit 11 acquires a vulnerability ID (identification) corresponding to the device to be determined 30 from the vulnerability inspection information through the result information output by the vulnerability inspection tool 41 or communication with the vulnerability information distribution service 42. The inspection information acquisition unit 11 receives an input of the vulnerability ID of the vulnerability information corresponding to the software of the device to be determined 30 as vulnerability inspection information through the result information output by the vulnerability inspection tool 41 or communication with the vulnerability information distribution service 42.

[0033] When vulnerability test information (e.g., a vulnerability ID) is input to the agent 10 running on the device to be determined 30, the detailed information acquisition unit 12 acquires detailed information about the vulnerability corresponding to the input vulnerability test information. The detailed information acquisition unit 12 acquires detailed information from the external vulnerability DB 50 about the vulnerability ID that corresponds to the software of the device to be determined 30. Note that if the vulnerability test result already includes detailed information about the vulnerability, the agent 10 omits the detailed information acquisition process from the external vulnerability DB 50 by the detailed information acquisition unit 12.

[0034] The detailed information acquisition unit 12 stores the acquired detailed vulnerability information as detailed vulnerability information in a predetermined format suitable for judgment. The detailed information acquisition unit 12 extracts one or more of the attack source classification, software name, version information, and CPE information from the acquired detailed vulnerability information, and stores the extracted information as detailed vulnerability information. For example, the detailed information acquisition unit 12 extracts information such as the software name, version information, and CPE information regarding AV:N vulnerabilities from the detailed information acquired from the external vulnerability DB 50, and stores the extracted information together with the vulnerability ID as detailed vulnerability information in DB 13.

[0035] The DB 13 stores vulnerability detailed information and communication operation information (described later). The DB 13 may be built on a separate server.

[0036] The management information acquisition unit 14 acquires process management information of the operating determination target device 30. Fig. 5 is a diagram illustrating an example of the process management information. As shown in Fig. 5, the process management information D1 includes PCOMM (process command) (process name), PID (process ID), PPID (process ID of parent process), and RET ARGS (arguments).

[0037] The communication trace information acquisition unit 15 acquires communication trace information obtained by tracing communications within the device 30 to be determined.

[0038] Fig. 6 is a diagram illustrating an example of communication trace information. The communication trace information acquisition unit 15 acquires communication trace information D2 shown in Fig. 6 as information obtained by tracing communications of the determination target device 30. The communication trace information D2 includes PID, COMM (command), IP, RADDR, RPORT, LADDR, and LPORT.

[0039] The configuration information storage unit 16 acquires and stores the SBOM of the software included in the running determination target device 30, which is generated by the SBOM generation tool 60. The configuration information storage unit 16 acquires the SBOM of the host and the container in advance to understand the environment in which the process captured by the kernel was executed. FIG. 7 is a diagram illustrating an example of the SBOM of the container stored by the configuration information storage unit 16 shown in FIG. 4. As illustrated in SBOMD3 in FIG. 7, the SBOM is information including the full path, software name, and version of the software.

[0040] The environment management information generation unit 17 generates container management information including the name of a container running in the determination target device 30, identification information of the container, and identification information of a process that manages a process within the container. If the process management information acquired by the management information acquisition unit 14 includes a process name that manages the process of the container, the environment management information generation unit 17 acquires a container ID and a process ID that correspond to the process name that manages the process of the container from the process management information.

[0041] Specifically, the environment management information generation unit 17 acquires the container name of the container ID from the container information corresponding to the container ID acquired from the process management information. The environment management information generation unit 17 stores data consisting of a set of the container ID, process ID, and container name in the DB 13 as container management information. The environment management information generation unit 17 stores the container name, container ID, and process ID of the running container as container management information. The container management information is information about the container running in the device to be determined, and is used to identify the execution source environment of the process in post-container processing.

[0042] 8 and 9 are diagrams illustrating the processing of the environment management information generating unit 17 shown in Fig. 4. Fig. 10 is a diagram illustrating an example of container management information. In the embodiment, an example will be described in which a plurality of containers are running as the execution environment.

[0043] The following describes a case where a process that manages processes within a container is started. When the environment management information generation unit 17 determines from the process management information D1 in FIG. 8 that the process "[Identification Keyword]" (box W11) that manages processes within a container has been started, the environment management information generation unit 17 acquires and stores the container ID "0c20bada7e3100ca13326d3f0b50884c6cddd42f36100244a2e2176020f45c10" (boxes W12 and W14) of this "[Identification Keyword]" and the process ID "pppp63" (box W13) corresponding to this container ID ((1) in FIG. 8). The identification keyword is, for example, a command name that includes a keyword used to identify the execution environment.

[0044] The environment management information generation unit 17 refers to the container information D4 shown in Fig. 9, and confirms and acquires the container name "ddddd-test-test1-1" (box W16) from the container ID (box W15 in Fig. 9) acquired from the process management information ((2) in Fig. 9). As shown in Fig. 10, the environment management information generation unit 17 assigns an ID "1" to a set of data consisting of the container ID "0c20bada7e3100ca13326d3f0b50884c6cddd42f36100244a2e2176020f45c10", the process ID "pppp63", and the container name "ddddd-test-test1-1", and generates the set as container management information D5.

[0045] The communication information generation unit 18 generates communication operation information using process management information acquired by the operating determination target device 30, communication trace information obtained by tracing communication within the determination target device 30, and container management information generated by the environment management information generation unit 17. The communication information generation unit 18 generates communication operation information including information on the execution environment and the execution target. The communication operation information includes, for each piece of software that performed a communication operation, the name of the software that performed the communication operation, version information, CPE (Common Platform Enumeration) information, a communication destination classification, the execution environment, and information on the execution target.

[0046] First, the communication information generating unit 18 acquires the name of the communicated command, the full path of the command, and communication partner information (communication destination classification) based on the process management information and communication trace information.

[0047] If the parent process ID of the process management information matches the process ID of the container in the container management information, the identification information generation unit 19 generates identification information for identifying the container, which is the execution environment.

[0048] In this case, if the parent process ID of the process management information matches the process ID of the container in the container management information, the identification information generation unit 19 compares the parent process ID with the container management information, and acquires the container name of the process (software) that performed the communication operation, its container ID, etc. as identification information. The identification information generation unit 19 compares the full path of the command with the SBOM of the container of the process that performed the communication operation, and acquires the software name, version information, and CPE information as identification information.

[0049] Based on the acquired identification information, the identification information generation unit 19 generates communication operation information consisting of a set of software name, version information, CPE information, communication destination classification, execution environment, and execution target information, and stores it in DB 13.

[0050] Next, we will explain the case where the parent process ID of the process management information does not match the process ID of the container in the container management information. The communication information generation unit 18 matches the full path of the command with the host's SBOM and obtains the software name, version information, and CPE information. The communication information generation unit 18 generates communication operation information that is a set of the software name, version information, CPE information, communication destination classification, execution environment, and information on the execution target, and saves it in the DB 13.

[0051] 11 to 14 are diagrams for explaining the process of generating communication action information, and Fig. 15 is a diagram showing an example of the data structure of communication action information.

[0052] As illustrated in FIG. 11 , the communication information generation unit 18 compares the process management information D11 with the communication trace information D2 (arrow Y11) to determine the full path information of the command "xxxxxx3" (box W211) that performed the communication operation. For the first line (PID "pppp61" (box W21)) of the communication trace information D2, the communication information generation unit 18 can obtain the command name (box W211) and the communication partner (destination address) (W212) for this command. In the process management information D11, the data corresponding to the PID "pppp61" (box W21) in the first line of the communication trace information D2 is the data in the fourth line (see boxes W22 and W24) (arrow Y11). The communication information generation unit 18 determines the full path information of the command that performed the communication operation from the data in the fourth line of the process management information D11. If the reached information is a symbolic link or the like, the communication information generating unit 18 will further follow that information.

[0053] Then, as shown in FIG. 12, when the communication information generation unit 18 detects a process that performed a communication operation from the communication trace information D2, it compares this process ID (PID "pppp61" (box W21)) with the process management information D11, which is the execution history of the process, and checks the parent process ID ((1) in FIG. 12, arrows Y21 and Y22).

[0054] The communication information generating unit 18 acquires from the process management information D11 that the parent process ID of the PID "pppp61" (box W22) is "pppp63" (box W23) (arrow Y22).

[0055] Next, as shown in Fig. 13, an example will be described in which the parent process ID "pppp63" in the process management information D11 is traced and matches the process ID in the container management information D5 (arrow Y23). In this case, since this process is executed in a container, the identification information generation unit 19 obtains the container name "ddddd-test-test1-1" from the container management information D5 as the execution environment in the communication operation information ((2-1) in Fig. 13).

[0056] 14, the identification information generation unit 19 matches the full path (box W24) of the process execution command in the process management information D11 with the SBOMD3 of the container (arrow Y24). As a result, the identification information generation unit 19 acquires the software name (box W31), version (box W32), and CPE information (box W33) from the description of the SBOMD3 ((3-1) in FIG. 14). The identification information generation unit 19 registers the acquired software name (box W31), version (box W32), and CPE information (box W33) as, for example, the software name, version, and CPE information of the software "xxxxxx3.10-minimal" with ID "4" in the communication operation information D71 (FIG. 15).

[0057] The communication information generation unit 18 acquires the execution target " / usr / bin / xxxxxx3-unique program Y" from the argument (box W24) of the command that performed the communication operation in the process management information D11. The identification information generation unit 19 registers the acquired execution environment "ddddd-test-test1-1" and execution target " / usr / bin / xxxxxx3-unique program Y" as the execution environment and execution target of, for example, the software "xxxxxx3.10-minimal" with ID "4" in the communication operation information D71 ( FIG. 15 ).

[0058] On the other hand, as shown in Fig. 13, if the parent process ID is "systemd" or if the process ID does not match a container after tracing to the limit (if it does not match the process ID in the container management information D5), the communication information generation unit 18 considers the execution environment to be the host ((2-2) in Fig. 13). In this case, the communication information generation unit 18 compares the full path of the process execution command with the SBOM of the host, and obtains the software name, version, and CPE information. The communication information generation unit 18 obtains the execution target from the arguments of the process management information D11.

[0059] By performing the above processing, the communication information generation unit 18 obtains the name, version information, CPE information, communication destination address, communication destination classification, communication time, execution environment, and execution target of the software that actually performed the communication operation, and associates each piece of obtained information with each other and stores it in DB13 as communication operation information.

[0060] 15, the communication operation information includes the following items: a communication operation information identification ID, a software name, version information, CPE information, a communication destination address, a classification result of the communication destination category, a communication time, an execution environment, and an execution target. The communication operation information is used to determine the vulnerability risk.

[0061] The criteria registration unit 20 registers the criteria information used for risk assessment in the configuration. The criteria information is set for each software in accordance with, for example, an operation policy. For example, the criteria information is a threshold value for risk assessment. Level information for comparison with the threshold value used for risk assessment is defined in advance using the IP address of the communication destination.

[0062] The determination unit 21 compares the communication operation information with the vulnerability detailed information to determine the risk of the device 30 to a vulnerability for each vulnerability ID. The determination unit 21 compares predetermined determination criterion information with level information corresponding to the actual communication partner of the device 30 to determine the risk of the device 30 to a vulnerability for each vulnerability ID.

[0063] The determination unit 21 performs risk determination for the determination target device 30 for each vulnerability ID in accordance with the determination criterion information, based on the attack source classification, the name, version, CPE, communication destination address, communication destination classification, communication time, and vulnerability ID of the software corresponding to the vulnerability information in the communication operation information and the vulnerability detailed information. If the determination unit 21 determines that the risk is high and the process that performed this communication operation is executed in a container, the determination unit 21 references the communication operation information and outputs container information along with the determination result. That is, the determination unit 21 references the communication operation information and also outputs information on the execution environment and execution target of the process determined to be high risk. Furthermore, even if the determination unit 21 determines that the risk is low, the determination unit 21 may also output information on the execution environment and execution target along with the determination result.

[0064] Specifically, an example of the determination process of the determination unit 21 will be described. For example, for each vulnerability ID, the determination unit 21 acquires CPE information from the communication operation information for the AV:N vulnerability and compares it with the CPE in the vulnerability detail information. If the comparison results in a match, the determination unit 21 checks communication partner information (communication destination classification) from the communication operation information for the matched software, checks which predefined level the match is with, and compares the matched level with the determination criterion information.

[0065] Specifically, the determination unit 21 uses the determination criteria information to determine the risk of the vulnerability of the target based on whether the level of the communication partner is equal to or greater than a threshold. The level of the communication partner is set using the IP address of the communication partner. The threshold is set based on level information defined, for example, as shown in FIG. 16.

[0066] If the risk level of a communication partner of a certain piece of software is equal to or higher than a threshold, the determination unit 21 determines that the risk of the AV:N vulnerability corresponding to that piece of software is high. For example, if the communication partner of a certain piece of software running on the device to be determined 30 is a global IP address with a level of "2," and the threshold of the determination criterion information defined for that software is "2," the determination unit 21 determines that the risk of the AV:N vulnerability is high. The determination unit 21 outputs the determination result that the risk is high, along with information on the execution environment and the execution target.

[0067] Furthermore, if the level of the communication partner of a certain piece of software is below a threshold, the determination unit 21 determines that the risk of the AV:N vulnerability corresponding to that software is low. For example, if the communication partner of a certain piece of software running on the determination target device 30 is a local IP address and has a level of "1," and the threshold of the determination criterion information defined for that software is "2," the determination unit 21 determines that the risk of the AV:N vulnerability is low. The determination unit 21 may output information on the execution environment and the execution target along with the determination result that the risk is low.

[0068] Next, a specific description will be given of another example of the determination process of the determination unit 21. For example, when a vulnerability with an attack source classification of NW is found in the determination target device 30, the determination unit 21 performs a risk determination process.

[0069] An example will be described below in which an operational policy is adopted in which the communication partner requests notification of vulnerabilities only for software used globally. In the example of communication operation information shown in Figure 15, the determination unit 21 determines that software "yyyyyy" and software "xxxxxx3.10-minimal," which have a global communication destination category, pose a high risk for vulnerabilities in the attack source category: NW. Furthermore, for example, software "xxxxxx" communicates only with the local host, so it is determined that the risk for vulnerabilities in the attack source category: NW is low.

[0070] Furthermore, the determining unit 21 searches the DB 13 for the software name to which the discovered vulnerability applies, and if no hit is found, it is considered that communication is not being performed using that software.

[0071] The determination result output unit 22 outputs the determination result of the determination unit 21 to, for example, an administrator.

[0072] [Processing Procedures Performed by Agent] Next, the processing procedures of each process performed by the agent 10 will be described.

[0073] [Vulnerability Detail Information Acquisition Processing] FIG. 17 is a flowchart showing the processing procedure of vulnerability detail information acquisition processing.

[0074] In the agent 10, the inspection information acquisition unit 11 acquires the vulnerability ID corresponding to the device to be determined 30 from the vulnerability inspection information by communicating with the vulnerability inspection tool 41 and the vulnerability information distribution service 42 (step S11).

[0075] In the agent 10, the detailed information acquisition unit 12 acquires detailed information from the external vulnerability DB 50 for the vulnerability ID corresponding to the device 30 to be determined (step S12). Note that if the vulnerability inspection result already contains detailed information about the vulnerability, the agent 10 omits step S12.

[0076] In the agent 10, the detailed information acquisition unit 12 extracts information about AV:N vulnerabilities, such as the software name, version information, CPE information, and attack source classification, from the detailed information acquired from the external vulnerability DB 50, and stores the extracted information together with the vulnerability ID as vulnerability detailed information in DB 13 (step S13).

[0077] [Risk Determination Criteria Registration Processing] FIG. 18 is a flowchart showing an example of the processing procedure of risk determination criteria registration processing.

[0078] In the agent 10, the criteria registration unit 20 registers the determination criteria information used for risk determination in the configuration (step S21).

[0079] [Generation Process of Environment Management Information] Fig. 19 is a flowchart showing an example of the processing procedure for generating environment management information. Fig. 19 shows the processing flow when a container is used as the execution environment.

[0080] The environment management information generating unit 17 determines whether the process management information acquired by the management information acquiring unit 14 includes a process name for managing a container process (step S31). An example of a process name for managing a container process is a command name including a keyword used to identify the execution environment.

[0081] If the process management information acquired by the management information acquisition unit 14 includes the process name that manages the container process (step S31: Yes), the environment management information generation unit 17 acquires the container ID and process ID corresponding to the process name that manages the container process from the process management information (step S32).

[0082] The environment management information generation unit 17 acquires the container name of the container ID from the container information corresponding to the container ID acquired from the process management information (step S33). The environment management information generation unit 17 stores data consisting of a set of the container ID, process ID, and container name in the DB 13 as container management information (step S34), and ends the processing. If the process name that manages the container process is not included (step S31: No), the environment management information generation unit 17 ends the processing.

[0083] [Communication Action Information Acquisition Processing] FIG. 20 is a flowchart showing an example of a processing procedure for communication action information acquisition processing.

[0084] In the agent 10, the communication information generation unit 18 acquires the communicated command name, the full path of the command, and communication partner information (communication destination classification) from the process management information of the operating device 30 to be determined and the communication trace information that traces communication within the device 30 to be determined (step S41). The process management information is acquired by the management information acquisition unit 14. The communication trace information is acquired by the communication trace information acquisition unit 15.

[0085] The communication information generating unit 18 checks the parent process ID from the process management information, and determines whether or not this parent process ID matches the process ID of the container in the container management information (step S42).

[0086] If the parent process ID of the process management information matches the process ID of the container in the container management information (step S42: Yes), the parent process ID is matched with the container management information to obtain the container name of the process that performed the communication operation, its container ID, etc. (step S43). The identification information generation unit 19 matches the full path of the command with the SBOM of the container of the process that performed the communication operation to obtain the software name, version information, and CPE information (step S44). Based on the obtained information, the identification information generation unit 19 generates communication operation information including the software name, version information, CPE information, communication partner (communication destination classification), execution environment, and execution target information, and stores the generated information in DB 13 (step S45).

[0087] If the parent process ID of the process management information does not match the process ID of the container in the container management information (step S42: No), the communication information generation unit 18 compares the full path of the command with the host's SBOM and obtains the software name, version information, and CPE information (step S46).The communication information generation unit 18 generates communication operation information including the software name, version information, CPE information, communication partner (communication destination classification), execution environment, and execution target information, and stores it in the DB 13 (step S47).

[0088] [Risk Assessment Process] FIG. 21 is a flowchart showing an example of a processing procedure for risk assessment process.

[0089] In the agent 10, the determining unit 21 acquires the vulnerability detailed information and the communication operation information from the DB 13 (step S51).

[0090] The determination unit 21 acquires CPE information from the communication operation information for each vulnerability ID and compares it with the CPE information in the vulnerability detail information (step S52).

[0091] The determining unit 21 determines whether or not there is a match between the CPE in the communication operation information and the CPE information in the vulnerability detailed information (step S53).

[0092] If a match is found between the CPE in the communication operation information and the CPE information in the vulnerability detailed information (step S53: Yes), the determination unit 21 checks the communication partner information (communication destination classification) of the device 30 to be determined from the communication operation information for the matching software, and compares the level information that matches the communication partner (communication destination classification) in the communication operation information with the determination criterion information (step S54). Specifically, the determination unit 21 uses the determination criterion information to determine the risk level of the communication partner in the communication operation information.

[0093] The determination unit 21 determines whether the level of the communication partner in the communication operation information is equal to or higher than a threshold value (step S55).

[0094] If the level of the communication partner is above the threshold (step S55: Yes), the judgment unit 21 judges that the vulnerability of the vulnerability ID being judged is a high risk, and outputs information on the execution environment and the execution target along with the judgment result (step S56).

[0095] If the result of comparing the CPE in the communication operation information with the CPE information in the vulnerability detailed information shows no match (step S53: No), or if the level of the communication partner is below the threshold (step S55: No), the determination unit 21 determines that the risk for this vulnerability is low (step S57). At this time, the agent 10 may present to the operator the reason for determining the risk as low (for example, there is communication but the communication partner is low risk, or there is no communication at all) along with the determination result.

[0096] If there are any undetermined vulnerability IDs remaining (step S58: Yes), the determination unit 21 returns to step S52 and executes the processes from step S52 onwards for the undetermined vulnerability IDs. If there are no undetermined vulnerability IDs remaining (step S58: No), the determination unit 21 ends the risk determination process.

[0097] [Effects of the embodiment] As described above, in the embodiment, the agent 10 sequentially stores communication operation information that includes the software name, version, CPE information, communication destination classification, execution environment, and execution target that performed the communication operation, using process management information acquired by the device 30 to be determined while it is running, information tracing communication within the device, and container management information for identifying the environment from which the process is executed in post-container processing.

[0098] When the vulnerability inspection results are input to the agent 10 running on the device 30 to be assessed, the agent 10 acquires detailed vulnerability information from an external DB. The agent 10 then extracts the attack source classification, software name, version information, and CPE information from the acquired detailed vulnerability information, and stores the extracted information together with vulnerability ID information as detailed vulnerability information.

[0099] The agent 10 then compares these two pieces of information, automatically performs a risk assessment of the vulnerability of the device 30 to be assessed, and automatically outputs the assessment result as well as information on the execution environment of the process to be assessed and the execution target.

[0100] As described above, in the embodiment, the agent 10 can visualize the execution environment and execution target of a process (software) for which a communication operation has been detected by generating communication operation information that includes identification information of the execution environment and the execution target.

[0101] Fig. 22 is a diagram showing an example of information generated in the prior art, and Fig. 23 is a diagram showing an example of information generated by the agent 10 according to the embodiment.

[0102] When a virtual environment is used on a device or when multiple versions of an execution environment are used in combination, it is necessary to confirm the source and target of the execution in order to confirm the extent of the impact. However, as shown in Fig. 22, in the prior art (see, for example, Non-Patent Document 2), the execution environment and target of the process that performed the communication operation could not be identified.

[0103] In contrast, in the embodiment, for a process determined to be high risk, the agent 10 outputs the execution environment and execution target of this process along with the software name, version information, and communication destination information, as shown in Fig. 23. If there is a process that performs high-risk communication operations, the operator can recognize the execution environment and execution target of the software by checking the determination result by the agent 10.

[0104] That is, according to the embodiment, when a process that performs high-risk communication operations is found, the administrator can quickly determine whether the execution environment of the process is a host or a container and what the execution target of the process is. The administrator can then quickly determine the extent of risk, determine where patches should be applied, and determine the extent of degradation. In the embodiment, even for processes that perform high-risk communication operations, the execution environment and execution target of the software can be output along with the determination result, allowing the administrator to perform smooth management processing.

[0105] Therefore, the agent 10 can automatically determine the process execution environment and execution target, and make appropriate risk assessments when assessing the risk of the equipment 30 or system to be assessed, while reducing the processing burden on the operator of manually analyzing and determining the impact.

[0106] 24 is a diagram showing another example of the configuration of a communication system according to an embodiment. When there are resource constraints on the host that operates the agent or when it is desired to minimize the operational load, agent functions other than the communication behavior information generation function are provided in an external risk assessment server 10B that can communicate with the assessment target device 30, as in the communication system 100A of FIG. 24. Specifically, the risk assessment server 10B has an examination information acquisition unit 11, a detailed information acquisition unit 12, a DB 13, a reference registration unit 20, a determination unit 21, and a determination result output unit 22. Furthermore, when an SBOM is obtained from a vendor or the like, a mode in which the operator transfers the SBOM without using an SBOM generation tool may be adopted.

[0107] Next, the operation of this embodiment will be described. Figures 25 to 27 are diagrams showing an example of an operation image of the determination system according to this embodiment. Figure 28 is a diagram showing an example of an execution environment.

[0108] Fig. 25 shows an example of an operation using container technology as a virtual environment. As shown in Fig. 25, in the case of using containers, the agent 10 on the host captures the process on the container and performs the above-mentioned processing to generate communication operation information including the source of the execution ((1) in Fig. 25). By referring to the visualization information generated by the agent, the operator can quickly understand in which environment a process that performed an operation with a high risk to vulnerabilities was executed ((2) in Fig. 25).

[0109] Furthermore, the execution environment is not limited to a container, and may be configured as a virtual environment other than a container (for example, Fig. 26, Fig. 27). As shown in Fig. 28, for software "xxxxxx", virtual environments with different versions and installation packages can be created on the host.

[0110] FIG. 26 illustrates an example in which a host-type hypervisor (host-type HV) is used as the virtual environment. In this case, if the agent 10 on the host has a function for monitoring processes on virtual machines A and B, the agent 10 captures the processes on virtual machines A and B and generates communication operation information including the execution source. Also, as shown in FIG. 27 , if a hypervisor (HV) is used as the virtual environment and the hypervisor has a function for monitoring processes on virtual machines A and B, the agent 10 captures the processes on virtual machines A and B and generates communication operation information including the execution source. In either case, the agent 10 captures communication operations and generates communication operation information including the execution source, allowing the operator to quickly understand in which environment the process was executed. Furthermore, the execution environment to which the embodiments are applied is not limited to a virtual environment.

[0111] [System Configuration of the Embodiment] Each component of the agent 10 is a functional concept and does not necessarily have to be physically configured as shown in the figure. In other words, the specific form of distribution and integration of the functions of the agent 10 is not limited to that shown in the figure, and all or part of the functions can be functionally or physically distributed or integrated in any unit depending on various loads, usage conditions, etc.

[0112] Furthermore, all or any part of the processes performed by the agent 10 may be realized by a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), and a program analyzed and executed by the CPU and GPU. Furthermore, each process performed by the agent 10 may be realized as hardware using wired logic.

[0113] Furthermore, among the processes described in the embodiments, all or part of the processes described as being performed automatically can be performed manually. Alternatively, all or part of the processes described as being performed manually can be performed automatically using a known method. In addition, the processing procedures, control procedures, specific names, and information including various data and parameters described above and illustrated can be changed as appropriate unless otherwise specified.

[0114] 29 is a diagram showing an example of a computer in which an agent 10 is realized by executing a program. The computer 1000 has, for example, a memory 1010 and a CPU 1020. The computer 1000 also has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0115] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM (Random Access Memory) 1012. The ROM 1011 stores, for example, a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to, for example, a mouse 1110 and a keyboard 1120. The video adapter 1060 is connected to, for example, a display 1130.

[0116] The hard disk drive 1090 stores, for example, an OS (Operating System) 1091, application programs 1092, program modules 1093, and program data 1094. That is, the programs that define the processes of the agent 10 are implemented as program modules 1093 in which code that can be executed by the computer 1000 is written. The program modules 1093 are stored, for example, in the hard disk drive 1090. For example, the program modules 1093 for executing processes similar to the functional configuration of the agent 10 are stored in the hard disk drive 1090. The hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

[0117] Furthermore, setting data used in the processing of the above-described embodiment is stored as program data 1094, for example, in memory 1010 or hard disk drive 1090. Then, CPU 1020 reads out program module 1093 or program data 1094 stored in memory 1010 or hard disk drive 1090 into RAM 1012 as necessary and executes them.

[0118] The program module 1093 and program data 1094 may not necessarily be stored in the hard disk drive 1090, but may also be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (such as a local area network (LAN) or a wide area network (WAN)). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070.

[0119] Although the present invention has been described above as an embodiment, the present invention is not limited to the descriptions and drawings that form part of the disclosure of the present invention. In other words, other embodiments, examples, and operational techniques that can be made by those skilled in the art based on the present invention are all included in the scope of the present invention.

[0120] REFERENCE SIGNS LIST 10 Agent 11 Inspection information acquisition unit 12 Detailed information acquisition unit 13 DB 14 Management information acquisition unit 15 Communication trace information acquisition unit 16 Configuration information storage unit 17 Environment management information generation unit 18 Communication information generation unit 19 Identification information generation unit 20 Standard registration unit 21 Judgment unit 22 Judgment result output unit 41 Vulnerability inspection tool 42 Vulnerability information distribution service 50 External vulnerability DB 60 SBOM generation tool

Claims

1. A judgment device comprising: an agent provided in a device to be judged, comprising: a first generation unit that generates communication operation information including the name of the software that performed the communication operation, version information, CPE (Common Platform Enumeration) information, communication destination classification, execution environment, and information on the execution target, using process management information acquired by the device to be judged while it is running, communication trace information that traces communications within the device to be judged, and environment management information related to the execution environment currently running in the device to be judged; an acquisition unit that, when vulnerability testing information is input to the agent running on the device to be judged, acquires detailed information on the vulnerability corresponding to the input vulnerability testing information, extracts one or more of the attack source classification, software name, version information, and CPE information from the acquired detailed vulnerability information, and stores them together with vulnerability ID information as vulnerability detailed information; and a judgment unit that compares the communication operation information with the detailed vulnerability information to judge the risk of the device to be judged against the vulnerability, and outputs the execution environment and execution target of the software that performed the communication operation together with the judgment result.

2. The determination device described in claim 1, further comprising a second generation unit that generates the environment management information, which includes the name of the execution environment running in the device to be determined, identification information of the execution environment, and identification information of a process that manages processes within the execution environment.

3. The second generation unit of the determination device described in claim 2 is characterized in that, when the process management information acquired by the device to be determined while in operation includes a process name that manages a process of the execution environment, it acquires from the process management information identification information of the execution environment corresponding to the process name and identification information of the process, and acquires a container name of the identification information of the execution environment from the execution environment information corresponding to the acquired identification information of the execution environment.

4. The determination device described in claim 1, characterized in that the first generation unit: acquires the communicated command name, full path of the command, and communication partner information based on the process management information and the communication trace information; if the execution environment is found to be a container as a result of tracing the parent process identification information from the process management information, acquires the container name, container identification information, software name, version information, CPE information, and execution target of the process that performed the communication operation based on the environment management information for the container running on the device to be determined and the software parts list of the container of the process that performed the communication operation; if the execution environment is not a container as a result of tracing the parent process identification information from the process management information, considers the execution environment to be a host, and acquires the software name, version information, CPE information, and execution target based on the software parts list of the host.

Images