Assessment device and assessment program

Abstract

An agent (10) includes: a communication information generation unit (19) that, by using process management information acquired by equipment (30) to be assessed, information obtained by tracing communication within the equipment (30) to be assessed, and a target list indicating targets for which process additional information indicating a module to be called by a process is to be acquired, generates communication operation information, including the name of software that has performed an communication operation, version information, common platform enumeration (CPE) information, a communication destination classification, and / or the process additional information; and an assessment unit (22) that, if the process additional information contains module information that does not include CPE information, performs a comparison process with the description included in vulnerability detail information to assess the vulnerability risk of the equipment (30) to be assessed.

Description

Determination device and determination program

[0001] The present invention relates to a determination device and a determination program.

[0002] Vulnerability management typically involves collecting vulnerability information relevant to one's own system and determining whether or not to address the issue and the priority based on the impact and risk.

[0003] In recent years, there has been a growing trend to utilize SBOM (Software Bill of Materials), a database of software components, to manage security risks such as software configuration and vulnerabilities of devices and systems.

[0004] When security risk management using SBOM accurately identifies vulnerabilities in operational devices, the burden of vulnerability management work on operators increases. Just understanding communication behavior and startup status takes time, so analysis and decision-making work must be carried out efficiently.

[0005] A technique has been proposed for outputting vulnerability response priorities using information on the vulnerability risk, the presence or absence of attack code, and the presence or absence of system disclosure (Non-Patent Document 1).

[0006] It has also been proposed to automatically generate information on the software name, version, and communication partner that performed the communication operation from process information obtained by the OS (Operating System) and SBOM, and to determine the risk of vulnerability based on this information (Non-Patent Document 2).

[0007] "Software Vulnerability Management", yamory, [online], [Retrieved June 5, 2024], Internet <URL: https: / / yamory.io / service / vulnerability-management / > Yasunori Wada, Takayuki Uehara, "A Vulnerability Risk Assessment Method Using Visualized Data of Device Communication Behavior", IEICE General Conference, March 2024.

[0008] In the technology described in Non-Patent Document 1, one of the pieces of information used is information regarding whether or not the system is open to the public. However, the information regarding whether or not the system is open to the public is manually entered, and there is a problem in that if an update is not made, an accurate determination cannot be made.

[0009] Furthermore, although the technology described in Non-Patent Document 2 can generate communication operation information for process execution commands, there is a demand for generating information that visualizes information indicating the modules called by a process in order to more accurately assess vulnerability risks.

[0010] The present invention has been made in consideration of the above, and aims to provide a determination device and a determination program that can visualize information indicating modules called by a process and determine vulnerability risks with high accuracy when determining the risk of equipment or systems.

[0011] In order to solve the above-mentioned problems and achieve the object, the determination device according to the present invention is an agent provided in a device to be determined, and determines the name, version information, and CPE (Common Platform Environment) of the software that performed the communication operation by using process management information acquired by the device to be determined while it is running, communication trace information that traces communications within the device to be determined, and a target list that indicates targets from which process additional information indicating modules called by the process is acquired. an acquisition unit that, when vulnerability testing information is input to the agent running on the device to be assessed, acquires detailed information about the vulnerability corresponding to the input vulnerability testing information, extracts one or more of the attack source classification, software name, version information, CPE information, and description from the acquired detailed vulnerability information, and stores the information together with vulnerability ID information as vulnerability detailed information; and a determination unit that compares the communication operation information with the detailed vulnerability information, and, if the level of the destination classification is equal to or higher than a threshold and the process attached information contains module information that does not contain CPE information, performs a comparison process with the description included in the detailed vulnerability information, and determines the risk of the device to be assessed against the vulnerability.

[0012] In addition, the determination program of the present invention causes a computer to execute the following steps: generating communication operation information including the name of the software that performed the communication operation, version information, CPE (Common Platform Enumeration) information, communication destination classification, and / or the process additional information, using process management information acquired from a running device to be determined, communication information obtained by tracing communications within the device to be determined, and a target list indicating targets from which process additional information indicating modules called by a process is obtained; acquiring, when vulnerability testing information is input, detailed information on a vulnerability corresponding to the input vulnerability testing information, extracting one or more pieces of information from the acquired detailed vulnerability information, including the attack source classification, the software name, the version information, the CPE information, and the description, and storing the extracted information together with vulnerability ID information as vulnerability detailed information; and matching the communication operation information with the vulnerability detailed information, and if the level of the communication destination classification is equal to or higher than a threshold and the process additional information contains module information that does not include CPE information, performing a matching process with the description included in the vulnerability detailed information, and determining the risk of the device to be determined from the vulnerability.

[0013] According to the present invention, in risk assessment of devices and systems, information indicating modules called by processes is visualized, and vulnerability risks can be assessed with high accuracy.

[0014] FIG. 1 is a diagram illustrating an example of the configuration of a communication system according to an embodiment. FIG. 2 is a diagram illustrating an example of detailed vulnerability information. FIG. 3 is a diagram illustrating an example of detailed vulnerability information. FIG. 4 is a diagram illustrating process management information. FIG. 5 is a diagram illustrating communication trace information. FIG. 6-1 is a diagram illustrating an SBOM. FIG. 6-2 is a diagram illustrating an SBOM. FIG. 6-3 is a diagram illustrating an SBOM. FIG. 7 is a diagram illustrating the processing of a target list generation unit. FIG. 8 is a diagram illustrating an example of a target list indicating process attachment information acquisition targets. FIG. 9 is a diagram illustrating the processing of the communication information generation unit illustrated in FIG. 1. FIG. 10 is a diagram illustrating process attachment information generation processing. FIG. 11 is a diagram illustrating process attachment information generation processing. FIG. 12 is a diagram illustrating process attachment information generation processing. FIG. 13 is a diagram illustrating an example of the data configuration of communication operation information. FIG. 14 is a diagram illustrating an example of level definitions in risk judgment. FIG. 15 is a flowchart illustrating the processing procedure of vulnerability detailed information acquisition processing. FIG. 16 is a flowchart illustrating an example of the processing procedure of target list generation processing. FIG. 17 is a flowchart illustrating an example of the processing procedure of risk judgment criterion registration processing. Fig. 18 is a flowchart showing an example of a processing procedure for communication action information acquisition processing. Fig. 19 is a flowchart showing an example of a processing procedure for risk assessment processing. Fig. 20 is a diagram showing an example of information generated in conventional technology. Fig. 21 is a diagram showing an example of information generated in an agent according to an embodiment. Fig. 22 is a diagram showing an example of a computer in which an agent is realized by executing a program.

[0015] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. Note that the present invention is not limited to this embodiment. In addition, in the description of the drawings, the same parts are designated by the same reference numerals.

[0016] [Embodiment] [Communication System] Next, a communication system according to an embodiment will be described. Fig. 1 is a diagram showing an example of the configuration of a communication system according to an embodiment.

[0017] As shown in FIG. 1, a communication system 100 according to the embodiment includes a device 30 to be assessed, which is a risk assessment target.

[0018] The device 30 to be determined can communicate via the Internet or an internal network with a vulnerability inspection tool 41, a vulnerability information distribution service 42, and an external vulnerability database (DB) 50. The device 30 to be determined can receive the inspection results of the vulnerability inspection tool 41 in two ways: by directly communicating with the tool, or by receiving the results output by the tool by transferring them from a terminal or the like.

[0019] The vulnerability inspection tool 41 is a tool for inspecting vulnerabilities that affect software in devices. The vulnerability information distribution service 42 is a vulnerability information distribution service for distributing vulnerability information that affects software in devices.

[0020] The external vulnerability DB 50 is a server that stores detailed information on vulnerabilities of various software.

[0021] The device 30 to be judged is provided with an agent 10 (a judgment device) that judges the risk of the device 30 to be judged.

[0022] The agent 10 additionally collects description information when acquiring vulnerability information. The agent 10 generates a target list to be used in the process attachment information generation process. When a process matching a keyword listed in this target list is detected, the agent 10 generates process attachment information and adds it to the communication operation information. The process attachment information is information that indicates the modules called by the process.

[0023] The communication operation information includes the name of the software that performed the communication operation, version information, CPE (Common Platform Enumeration) information, communication destination classification, time, and / or process additional information. The process additional information includes the name of the module called by the process, its version information, and CPE information. In this way, the agent 10 generates module-level information called by the process.

[0024] In the vulnerability risk assessment process, if the communication destination classification is above a threshold and the process additional information contains module information that does not contain CPE information, the agent 10 performs a matching process with the description contained in the vulnerability detailed information and makes a risk assessment.

[0025] [Agent] The agent 10 is realized, for example, by loading a predetermined program into a computer or the like including a ROM (Read Only Memory), a RAM (Random Access Memory), a CPU (Central Processing Unit), etc., and having the CPU execute the predetermined program. The agent 10 is also capable of communicating with other devices via a communication interface that the determination target device 30 has and that transmits and receives various information to and from other devices connected via a network or the like.

[0026] As shown in FIG. 1, the agent 10 includes an inspection information acquisition unit 11, a detailed information acquisition unit 12, a DB 13, a management information acquisition unit 14, a communication trace information acquisition unit 15, a configuration information storage unit 16, a target list generation unit 18 (second generation unit), a file access information acquisition unit 17, a communication information generation unit 19 (first generation unit), an additional information generation unit 20, a criteria registration unit 21, a judgment unit 22, a judgment result output unit 23, and an SBOM (Software Bill of Materials) generation tool 60.

[0027] As will be described later, the agent 10 is capable of generating information such as modules called by processes by providing a file access information acquisition unit 17 and a target list generation unit 18. In the embodiment, the process of generating information such as modules called by processes is referred to as a process additional information generation process.

[0028] The inspection information acquisition unit 11 acquires a vulnerability ID (identification) corresponding to the device to be determined 30 from the vulnerability inspection information through the result information output by the vulnerability inspection tool 41 or communication with the vulnerability information distribution service 42. The inspection information acquisition unit 11 receives an input of the vulnerability ID of the vulnerability information corresponding to the software of the device to be determined 30 as vulnerability inspection information through the result information output by the vulnerability inspection tool 41 or communication with the vulnerability information distribution service 42.

[0029] When vulnerability test information (e.g., a vulnerability ID) is input to the agent 10 running on the device to be determined 30, the detailed information acquisition unit 12 acquires detailed information about the vulnerability corresponding to the input vulnerability test information. The detailed information acquisition unit 12 acquires detailed information from the external vulnerability DB 50 for the vulnerability ID that corresponds to the software of the device to be determined 30. The detailed information acquisition unit 12 additionally collects description information when acquiring the vulnerability information. Note that if the vulnerability test result already includes detailed information about the vulnerability, the agent 10 omits the detailed information acquisition process from the external vulnerability DB 50 by the detailed information acquisition unit 12.

[0030] The detailed information acquisition unit 12 stores the acquired detailed information on vulnerabilities as detailed vulnerability information in a predetermined format suitable for judgment. The detailed information acquisition unit 12 extracts one or more pieces of information from the acquired detailed information on vulnerabilities, including the attack source classification, software name, version information, CPE information, and description, and stores the extracted information as detailed vulnerability information. For example, the detailed information acquisition unit 12 extracts information such as the software name, version information, CPE information, and description regarding AV:N vulnerabilities from the detailed information acquired from the external vulnerability DB 50, and stores the extracted information together with the vulnerability ID as detailed vulnerability information in the DB 13.

[0031] 2 and 3 are diagrams showing examples of detailed vulnerability information. For example, as shown in Fig. 2, for software "xxxxxx," the module name is described in both the CPE and the description. The detailed information acquisition unit 12 extracts information from this description R1 and stores the extracted information together with the vulnerability ID as detailed vulnerability information in the DB 13.

[0032] 3, in the case of software "yyyyyy," accurate judgment cannot be made based on the CPE information alone, but the name of the module to which the vulnerability applies is described in the description. Therefore, the detailed information acquisition unit 12 refers to the description, extracts a description portion R2 indicating that the vulnerability occurs when the module "mod_aaaaa" is used, and stores the extracted information together with the vulnerability ID as detailed vulnerability information in the DB 13.

[0033] The DB 13 stores vulnerability detailed information and communication operation information (described later). The DB 13 may be built on a separate server.

[0034] The management information acquisition unit 14 acquires process management information of the operating determination target device 30. Fig. 4 is a diagram illustrating an example of the process management information. As shown in Fig. 4, the process management information D1 includes PCOMM (process command) (process name), PID (process ID), PPID (process ID of parent process), and RET ARGS (arguments).

[0035] The communication trace information acquisition unit 15 acquires communication trace information obtained by tracing communications within the device 30 to be determined.

[0036] Fig. 5 is a diagram illustrating an example of communication trace information. The communication trace information acquisition unit 15 acquires communication trace information D2 shown in Fig. 5 as information obtained by tracing communications of the determination target device 30. The communication trace information D2 includes PID, COMM (command), IP, SADDR, DADDR, and DPORT.

[0037] The SBOM generation tool 60 generates an SBOM. The SBOM is a file containing information such as the components that make up the software included in the product, their mutual dependencies, and license data. Specifically, the SBOM contains information indicating the full path, software name, version relationships, and CPE (Common Platform Enumeration) information of the software. The data provided by the SBOM generation tool 60 only needs to include information indicating the full path, software name, and version relationships of the software included in the product, and may be, for example, information from a package management system.

[0038] The configuration information storage unit 16 acquires and stores the SBOM of the software included in the operating evaluation target device 30, which is generated by the SBOM generation tool 60. The configuration information storage unit 16 acquires the SBOM in advance. FIGS. 6-1 to 6-3 are diagrams illustrating examples of SBOM. As illustrated by SBOMs D4 to D6 in FIGS. 6-1 to 6-3, the SBOM is information including the full path, software name, and version of the software.

[0039] The file access information acquisition unit 17 acquires file access information from the kernel.

[0040] The target list generation unit 18 generates a target list indicating targets for which process additional information is to be acquired and registers the list in the DB 13. The target list generation unit 18 generates the target list indicating targets for which process additional information is to be acquired based on file access information acquired from the kernel. When the communication information generation unit 19 detects a process that matches a keyword written in the target list, the additional information generation unit 20 executes a process additional information generation process, and the generated process additional information is added to the communication operation information.

[0041] Fig. 7 is a diagram for explaining the processing of the target list generating unit 18. Fig. 8 is a diagram showing an example of a target list indicating targets for which additional process information is to be obtained.

[0042] The full paths of the modules and libraries called by a process may differ depending on the software and environment. Therefore, the target list generation unit 18 generates a target list for each device to be determined using pre-listed process additional information extraction list information D11 ( FIG. 7 ). The keywords for extracting additional information in the extraction list information D11 are common to each piece of software, regardless of the device configuration or operating status. Therefore, it is sufficient to create a list of keywords for extracting additional information in advance using official information, development information, operational information, etc.

[0043] The target list generation unit 18 uses the keywords in the extraction list information D11 to perform a file search within the device to be determined 30. As a result, a large number of files are hit, as shown in file search results D21, D22, and D23 (FIG. 7). The target list generation unit 18 extracts common portions W21, W22, and W23 containing the additional information extraction keywords from the full paths of these files. This process is performed on a software name basis.

[0044] As shown in Figure 8, the target list D31 has the following items: an identification ID of the target from which process additional information is to be obtained, keywords contained in the process, and information used to extract information to be used as additional information (the ``***'' part).

[0045] For example, in the case of the keyword "xxxxxx" included in the process, the target list generation unit 18 registers the common part W21 of the file search result D21 within the device to be determined 30 as information with "***" as additional information, excluding " / home / XXXX / .local / lib / xxxxxx3.8 / ddd-packages / ***" (frame W31).

[0046] For example, in the case of the keyword "yyyyyy" included in the process, the target list generation unit 18 registers the common part W22 of the file search results D22 within the target device, excluding " / usr / lib / yyyyyy2 / modules / ***" (box W33), as information with "***" as additional information. In the case of the keyword "yyyyyy" included in the process, the target list generation unit 18 registers the common part W23 of the file search results D23 within the target device, excluding " / usr / lib / x86_64-ggggg-mmm / ***" (box W34), as information with "***" as additional information. The communication information generation unit 19 (described below) and the additional information generation unit 20 (described below) match the "***" part of the target list D31 with the file access information to generate process additional information.

[0047] The communication information generation unit 19 generates communication operation information using process management information acquired by the operating device 30 to be determined, communication trace information obtained by tracing communications within the device 30 to be determined, a target list indicating targets from which process additional information is acquired, and file access information. The communication operation information generated by the communication information generation unit 19 includes process additional information indicating modules called by processes. The communication operation information includes, for each piece of software that performed a communication operation, the name of the software that performed the communication operation, version information, CPE (Common Platform Enumeration) information, communication partner information (communication destination classification), and / or process additional information.

[0048] The communication information generating unit 19 acquires the name of the communicated command, the full path of the command, and communication partner information based on the process management information and communication trace information.

[0049] If the acquired command name is not listed in the target list, the communication information generation unit 19 compares the full path of the command with the SBOM of the host and acquires the software name, version information, and CPE information. Figure 9 is a diagram explaining the processing of the communication information generation unit 19 shown in Figure 1.

[0050] The communication information generation unit 19 determines the full path information of the command that performed the communication operation by, for example, comparing the process management information D1 with the communication trace information D2 ((1) in FIG. 9). For example, for the bottom row of the process management information D1, the information within the frame W1 is determined (arrow Y1).

[0051] Next, the communication information generation unit 19 identifies the name and version information of the software that actually performed the communication operation by comparing the full path information of the command that performed the communication operation with information indicating the relationship between the full path, software name, and version (SBOM, information from the PKG management system, etc.).

[0052] The communication information generation unit 19 compares the full path information of the command that performed the communication operation (for example, the information in box W1) with the previously prepared SBOMD4 to D6 ((2) in Figure 9), and obtains the name, version information, and CPE information of the software that actually performed the communication operation (boxes W2 to W5). The version information and CPE information of the software that actually performed the communication operation can be obtained by referring to SBOMD4 to SBOMD5 ((3) in Figure 9, lines 3 and 1 of SBOMD5), and further by referring to SBOMD6 ((4) in Figure 9, lines 2, 6-7, and 10 of SBOMD6).

[0053] The communication information generation unit 19 groups together the software name, version information, CPE information, and communication partner information (communication destination classification) that actually performed the communication operation (for example, (5) in Figure 9) and stores this in DB13 as communication operation information.

[0054] If the acquired command name is listed in the target list, the additional information generating unit 20 executes a process additional information generating process.

[0055] If the acquired command name is written in the target list, the additional information generating unit 20 generates process additional information from the target list and file access information.

[0056] If the full path of the file access information used to generate the process additional information is included in the SBOM, the additional information generator 20 identifies the software package that includes the file from the full path information included in the SBOM and obtains the version information and CPE information. The additional information generator 20 saves the software name, version information, CPE information, communication partner information (communication destination classification), and process additional information (including the version and CPE information) in the DB 13 as communication operation information.

[0057] On the other hand, if the full path of the file access information used to generate the process additional information is not included in the SBOM, the additional information generator 20 separates the accessed file name with commas, extracts the portion excluding unnecessary portions (portions below the extension), and sets it as process additional information.The additional information generator 20 then stores the software name, version information, CPE information, communication partner information (communication destination classification), and process additional information in the DB 13 as communication operation information.

[0058] 10 to 12 are diagrams for explaining the process additional information generation process, and Fig. 13 is a diagram showing an example of the data structure of communication operation information.

[0059] First, a case where the full path of the file access information used to generate the process additional information is included in the SBOM will be described. For example, the communication information generation unit 19 compares the process management information with the communication trace information to obtain the full path information of the command that performed the communication operation.

[0060] Next, as shown in FIG. 10, the communication information generation unit 19 refers to the target list D31 and determines whether full path information that matches the format of the box W31 is written in the file access information D41.

[0061] In the example of FIG. 10, the file access information D41 contains a description of full path information that matches the format of the box W31.

[0062] For this reason, the additional information generation unit 20 compares the file access information D41 with the information of the line containing the keyword "xxxxxx" in the target list D31 ((1) in FIG. 10). At this time, the additional information generation unit 20 extracts from the file access information D41 the information (frame W31) to be used for extracting additional information for the "xxxxxx" portion of the target list D31. In the example of FIG. 10, the portion of frame W41 in the file access information D41 is extracted. Note that the "***" portion (file portion) of frame W31 corresponds to "uuuuu" in frame W42.

[0063] The additional information generation unit 20 then matches the full path (box W41) of the confirmed file access information D41 with the SBOM ((2) in FIG. 10). The SBOM includes the full path of "uuuuu," software dependencies, CPE information, and the like. Therefore, if the full path (box W41) of the confirmed file access information D41 matches the SBOM, the additional information generation unit 20 obtains the version information and CPE information of "uuuuu" (box W42) by tracing the package that includes that file.

[0064] The annotated information generation unit 20 registers the acquired version information and CPE information of "uuuuu" (box W42) as process annotated information D61. In the process annotated information D61, version information (box W62) and CPE information (box W63) are associated with "uuuuu" (box W61). For other common locations (e.g., box W43) in the file access information D41, the file portion "vvvvv2" (box W44) is also obtained, and the full path (box W43) is compared with the SBOM to acquire version information and CPE information for "vvvvv2" (box W44), which are then used as the process annotated information D61 (boxes W64 to W66). The process annotated information D61 is registered, for example, as process annotated information for the software "xxxxxx" with ID "1" in the communication operation information D71 ( FIG. 13 ).

[0065] The file access information acquisition unit 17 may acquire the file access information D41 shown in Fig. 10 by using a file open system call, which is highly versatile.

[0066] Alternatively, as an alternative to the above method, the file access information acquisition unit 17 may use a method that uses a tool that traces the file paths of modules, libraries, etc. that are called in a specific programming language.

[0067] 11 is an example of file access information acquired by a tool that acquires modules and methods called by the "xxxxxx" process. In this case, the file access information D42 of the "xxxxxx" process is compared with the information in the "xxxxxx" part of the target list D31 (FIG. 10).

[0068] The additional information generation unit 20 extracts from the file access information D42 the line (box W31) containing the keyword "xxxxxx" in the target list D31 (FIG. 10). In the example of FIG. 11, the portion of box W45 in the file access information D42 is extracted. Note that the "***" portion of box W31 corresponds to "ffffff" in box W46.

[0069] The additional information generation unit 20 checks the full path (box W45) of the confirmed file access information D42 against the SBOM. If the full path (box W45) of the file access information D42 matches the SBOM, the additional information generation unit 20 traces the package containing the file to obtain version information and CPE information for "ffffff" (box W46), and sets this as process additional information (not shown). The additional information generation unit 20 registers the obtained process additional information D61 as, for example, process additional information for software "xxxxxx" with ID "1" in the communication operation information D71 ( FIG. 13 ).

[0070] 12, a case where a module does not have version information or CPE information will be described. If a module does not have version information or CPE information, no hits will be found even if the full path of the file access information is matched with the SBOM. In this case, the additional information generation unit 20 separates the accessed file name by commas, extracts the part excluding unnecessary parts (the part below the extension), and sets it as process additional information.

[0071] With reference to FIG. 12, an example will be described in which the communication information generating unit 19 acquires the command name "yyyyyy2" as the command that performed the communication operation.

[0072] As shown in FIG. 12, the additional information generating unit 20 refers to the target list D31 and determines whether or not the target list contains a line that matches the format of the frames W33 and W34.

[0073] In the example of FIG. 12, the relevant line is listed in the target list D43.

[0074] Therefore, the additional information generation unit 20 compares the file access information D43 of the process with the command name "yyyyyy2" with the information in the target list D31 ((1) in FIG. 12). The additional information generation unit 20 extracts from the file access information D43 any portion that contains the same information as the information (boxes W33 and W34) to be used as additional information in the target list D31.

[0075] 12, the sections in boxes W81, W83, and W85 of the file access information D43 are extracted. Of the sections W81, W83, and W85, "mod_aaaaaa.so" (box W82), "mod_bbbb.so" (box W84), and "libpppp.so.3" (box W86) correspond to "***" (file section) of the file access information D43.

[0076] The additional information generation unit 20 compares the full path (for example, frame W81) of the confirmed file access information D43 with the SBOM of each file. If the module does not have version information or CPE information, comparing the full path of the file access information with the SBOM will not result in a hit.

[0077] Therefore, if the confirmed full path is not found in the SBOM, the additional information generating unit 20 extracts elements from the file name of the full path by separating the file name portion of the accessed full path with commas. At this time, the additional information generating unit 20 generates the process additional information excluding the previously specified exclusion target portion (the portion following the characters "ex" and "so") ((2) in FIG. 12).

[0078] For example, for box W82 of the file access information D43, the additional information generation unit 20 separates "mod_aaaaaa.so" with commas and registers "mod_aaaaaaa" (box W92) excluding the portion to be excluded ("so") as the process additional information D62. For box W84 of the file access information D43, the additional information generation unit 20 registers "mod_bbbbb" (box W94) excluding "so" as the process additional information D62. For box W86 of the file access information D43, the additional information generation unit 20 registers "libpppp" (box W96) excluding "so.3" as the process additional information D62.

[0079] The additional information generating unit 20 registers the acquired process additional information D62 as, for example, process additional information for the software "yyyyyy" with ID "2" in the communication operation information D71 (FIG. 13).

[0080] In this way, if the confirmed full path is not found in the SBOM, the additional information generation unit 20 extracts elements separated by commas from the file name portion of the full path, and registers the information excluding the previously specified excluded portion as process additional information.

[0081] By performing the above processing, the communication information generation unit 19 and the additional information generation unit 20 acquire the name, version information, CPE information, communication destination address, communication destination classification, communication time, and / or process additional information of the software that actually performed the communication operation, associate each piece of acquired information, and store it as communication operation information ( FIG. 13 ) in the DB 13. The communication operation information stored by the communication information generation unit 19 is used to determine the risk of vulnerability.

[0082] The criteria registration unit 21 registers the criteria information used for risk assessment in the configuration. The criteria information is set for each software in accordance with, for example, an operation policy. For example, the criteria information is a threshold value for risk assessment. Level information for comparison with the threshold value used for risk assessment is defined in advance using the IP address of the communication destination.

[0083] The judgment unit 22 performs risk judgment on the target device 30 for each vulnerability ID in accordance with the judgment criteria information, based on the attack source classification, name of the software corresponding to the vulnerability information, version, CPE information, communication destination address, communication destination classification, communication time, process additional information, and vulnerability ID in the communication operation information and vulnerability detailed information.

[0084] The determination unit 22 compares the communication operation information with the vulnerability detailed information to determine the risk of the device 30 to a vulnerability for each vulnerability ID. The determination unit 22 compares predetermined determination criterion information with level information corresponding to the actual communication partner (communication destination classification) of the device 30 to determine the risk of the device 30 to a vulnerability for each vulnerability ID.

[0085] If the level to which the actual communication partner (communication destination classification) of the device to be determined 30 corresponds is less than the determination criterion (threshold), the determination unit 22 determines that the risk of the vulnerability is low.

[0086] Specifically, an example of the determination process of the determination unit 22 will be described. For example, for each vulnerability ID, the determination unit 22 acquires CPE information from the communication operation information for the AV:N vulnerability and compares it with the CPE in the vulnerability detail information. If the comparison results in a match, the determination unit 22 checks communication partner information (communication destination classification) from the communication operation information for the matched software, checks which predefined level the match is with, and compares the matched level with the determination criterion information.

[0087] Specifically, the determination unit 22 uses the determination criteria information to determine the risk of the vulnerability of the target based on whether the level of the communication partner is equal to or greater than a threshold. The level of the communication partner is set using the IP address of the communication partner. The threshold is set based on level information defined, for example, as shown in FIG. 14.

[0088] If the risk level of the communication partner of a certain piece of software is equal to or higher than the threshold, the determination unit 22 proceeds to a process of determining whether or not there is module information that does not include CPE information in the process additional information.

[0089] Furthermore, if the level of the communication partner of a certain piece of software is below the threshold, the determination unit 22 determines that the risk of the AV:N vulnerability corresponding to that software is low. For example, if the communication partner of a certain piece of software running on the device to be determined 30 is a local IP address and has a level of "1," and the threshold of the determination criterion information defined for that software is "2," the determination unit 22 determines that the risk of the AV:N vulnerability is low.

[0090] Next, a specific example of the determination process of the determination unit 22 will be described. For example, when a vulnerability with an attack source classification of NW is found in the determination target device 30, the determination unit 22 performs risk determination processing.

[0091] An example will be described in which an operational policy is to notify vulnerabilities only in software used globally by the communication partner. In the example of communication operation information in Figure 13, the determination unit 22 proceeds to a process of determining whether or not there is module information that does not include CPE information in the process additional information for a vulnerability in the attack source category: NW of software "yyyyyy" whose communication destination category is global. Furthermore, for example, since software "xxxxxx" only communicates with the local host, it is determined that the risk is low for vulnerabilities in the attack source category: NW.

[0092] Furthermore, the determining unit 22 searches the DB 13 for the software name to which the discovered vulnerability applies, and if no hit is found, it is considered that communication is not being performed using that software.

[0093] Next, if the level to which the actual communication partner of the device to be determined 30 corresponds is equal to or higher than the determination criterion (threshold), the determination unit 22 performs the risk determination described below using the process additional information of the communication operation information.

[0094] If there is no module information that does not include CPE information in the process additional information for the software to be determined, the determining unit 22 determines that the vulnerability with the vulnerability ID to be determined is a high risk.

[0095] When the process annotated information for the software being judged contains module information that does not contain CPE information, the judgment unit 22 searches for the vulnerability description using the module name included in the process annotated information. If the search results in a match, the judgment unit 22 judges the vulnerability to be at high risk (description matches). If there is no match, the judgment unit 22 judges the vulnerability to be at low risk (description does not match).

[0096] The determination result output unit 23 outputs the determination result of the determination unit 22 to, for example, an administrator.

[0097] [Processing Procedures Performed by Agent] Next, the processing procedures of each process performed by the agent 10 will be described.

[0098] [Vulnerability Detail Information Acquisition Processing] FIG. 15 is a flowchart showing the processing procedure of vulnerability detail information acquisition processing.

[0099] In the agent 10, the inspection information acquisition unit 11 acquires the vulnerability ID corresponding to the device to be determined 30 from the vulnerability inspection information by communicating with the vulnerability inspection tool 41 and the vulnerability information distribution service 42 (step S11).

[0100] In the agent 10, the detailed information acquisition unit 12 acquires detailed information from the external vulnerability DB 50 for the vulnerability ID corresponding to the device 30 to be determined (step S12). Note that if the vulnerability inspection result already contains detailed information about the vulnerability, the agent 10 omits step S12.

[0101] In the agent 10, the detailed information acquisition unit 12 extracts information such as the software name, version information, CPE information, description, etc. from the detailed information acquired from the external vulnerability DB 50, and stores the extracted information together with the vulnerability ID as vulnerability detailed information in DB 13 (step S13).

[0102] [Target List Generation Processing] FIG. 16 is a flowchart showing an example of a processing procedure for target list generation processing.

[0103] In the agent 10, the target list generation unit 18 generates a target list indicating targets for which process additional information should be acquired, in units of software names, for each device to be determined (step S21). The target list generation unit 18 performs a file search within the device to be determined 30 using list information for extracting process additional information, which has been prepared in advance, and generates the target list by extracting common parts from the full paths of the found files.

[0104] In the agent 10, the target list generating unit 18 registers the target list (step S21).

[0105] [Risk Determination Criteria Registration Processing] FIG. 17 is a flowchart showing an example of the processing procedure of risk determination criteria registration processing.

[0106] In the agent 10, the criteria registration unit 21 registers the determination criteria information used for risk determination in the configuration (step S31).

[0107] [Communication Action Information Acquisition Processing] FIG. 18 is a flowchart showing an example of a processing procedure for communication action information acquisition processing.

[0108] In the agent 10, the communication information generation unit 19 acquires the communicated command name, the full path of the command, and communication partner information from the process management information of the operating device 30 to be determined and the communication trace information that traces communication within the device 30 to be determined (step S41). The process management information is acquired by the management information acquisition unit 14. The communication trace information is acquired by the communication trace information acquisition unit 15.

[0109] The communication information generating unit 19 determines whether the command name is listed in the target list (step S42).

[0110] If the command name is listed in the target list (step S42: Yes), the additional information generating unit 20 generates process additional information from the target list and the file access information (step S43).

[0111] The additional information generating unit 20 determines whether the full path of the file access information used to generate the process additional information is included in the SBOM (step S44).

[0112] If the full path of the file access information used to generate the process additional information is included in the SBOM (step S44: Yes), the additional information generator 20 identifies the software package that includes the file from the full path information included in the SBOM and obtains the version information and CPE information (step S45).The additional information generator 20 generates communication operation information that is a set of information including the software name, version information, CPE information, communication partner information (communication destination classification), and process additional information (including the version and CPE information), and stores it in the DB 13 (step S46).

[0113] If the full path of the file access information used to generate the process additional information is not included in the SBOM (step S44: No), the additional information generator 20 separates the accessed file name with commas, extracts the portion excluding unnecessary portions (portion below the extension), and sets it as the process additional information. The additional information generator 20 generates communication operation information that is a set of information including the software name, version information, CPE information, communication partner information (communication destination classification), and process additional information, and stores it in the DB 13 (step S47).

[0114] If the command name is not listed in the target list (step S42: No), the communication information generation unit 19 compares the full path of the command with the host's SBOM to obtain the software name, version information, and CPE information (step S48).The communication information generation unit 19 generates communication operation information that is a set of the software name, version information, CPE information, and communication partner information (communication destination classification), and stores it in the DB 13 (step S49).

[0115] [Risk Assessment Process] FIG. 19 is a flowchart showing an example of a processing procedure for risk assessment process.

[0116] The agent 10 performs the following processes on the assumption that advance preparations such as generation of communication operation information have been completed (step S51). First, the determination unit 22 acquires vulnerability detail information and communication operation information from the DB 13.

[0117] The determining unit 22 acquires CPE information from the communication operation information for each vulnerability ID and compares it with the CPE information in the vulnerability detailed information (step S52).

[0118] The determining unit 22 determines whether or not there is a match between the CPE in the communication operation information and the CPE in the vulnerability detailed information (step S53).

[0119] If a match is found between the CPE in the communication operation information and the CPE in the vulnerability detailed information (step S53: Yes), the determination unit 22 checks the communication partner information (communication destination classification) of the device to be determined 30 from the communication operation information for the matched software, and compares the level information that matches the communication partner in the communication operation information with the determination criterion information (step S54). Specifically, the determination unit 22 uses the determination criterion information to determine the risk level of the communication partner in the communication operation information.

[0120] The determination unit 22 determines whether the level of the communication partner in the communication operation information is equal to or higher than a threshold value (step S55).

[0121] If the level of the communication partner is equal to or higher than the threshold (step S55: Yes), the determining unit 22 determines whether or not the process additional information for the software being determined includes module information that does not include CPE information (step S56).

[0122] If there is no module information that does not include CPE information in the process additional information (step S56: No), the determining unit 22 determines that the vulnerability with the vulnerability ID is at high risk (step S61).

[0123] If the process attachment information contains module information that does not contain CPE information (step S56: Yes), the judgment unit 22 searches for the vulnerability description using the module name included in the process attachment information (step S57) and determines whether there is a match (step S58).

[0124] If there is a match (step S58: Yes), the determining unit 22 determines that the vulnerability has a high risk (the description matches) (step S59).

[0125] If there is no match (step S58: No), the determining unit 22 determines that the vulnerability has a low risk (no description match) (step S60).

[0126] On the other hand, if the result of comparing the CPE in the communication operation information with the CPE in the vulnerability detailed information shows no match (step S53: No), or if the level of the communication partner is below the threshold (step S55: No), the determination unit 22 determines that the risk for this vulnerability is low (step S62). At this time, the agent 10 may present to the operator the reason for determining that the risk is low (for example, there is communication but the communication partner is low risk, or there is no communication at all) along with the determination result.

[0127] If there are any undetermined vulnerability IDs remaining (step S63: Yes), the determination unit 22 returns to step S52 and executes the processes from step S52 onwards for the undetermined vulnerability IDs. If there are no undetermined vulnerability IDs remaining (step S63: No), the determination unit 22 ends the risk determination process.

[0128] [Advantages of the embodiment] In this way, the agent 10 according to the embodiment performs a process-attached information generation process that generates information indicating modules called by a process by using file access information acquired from the kernel. The agent 10 then generates communication operation information that includes the software name that performed the communication operation, version information, CPE information, communication destination classification, and / or process-attached information.

[0129] The agent 10 performs risk assessment for the software to be assessed using assessment criteria (threshold values). If the level of the communication partner is equal to or greater than the assessment criteria, the agent 10 determines whether or not there is module information that does not include CPE information in the process attachment information. For modules that do not include CPE information in the process attachment information, the agent 10 further performs a matching process with the description included in the vulnerability detailed information to perform a highly accurate risk assessment for the vulnerability with the vulnerability ID to be assessed.

[0130] Fig. 20 is a diagram showing an example of information generated in the prior art, and Fig. 21 is a diagram showing an example of information generated by the agent 10 according to the embodiment.

[0131] In the conventional technology (see, for example, Non-Patent Document 2), it was not possible to obtain information about modules called by a process. Therefore, as shown in Fig. 20, in the conventional technology, it was not possible to correctly determine the impact when a vulnerability exists in a module or library called by a process. For this reason, in the conventional technology, there were cases where it was not possible to accurately determine the risk of a vulnerability.

[0132] In contrast, in the embodiment, the agent 10 generates visualized information that not only includes the name and version of the software but also information indicating the modules called by the process, as shown in Fig. 21. Therefore, even when there is a vulnerability in a module or library called by a process, or when there is a vulnerability in a module and it is necessary to correctly determine the impact, the agent 10 can perform a highly accurate risk assessment of the vulnerability.

[0133] In the embodiment, the process additional information generation process using file access information makes it possible to realize the generation of highly versatile process additional information regardless of whether the communication operation is a resident process such as server software or a process that finishes in a short time such as client software.

[0134] Therefore, according to the embodiment, it is possible to determine the risk of vulnerability with higher accuracy than with conventional techniques.

[0135] The embodiments can be applied to the following cases: For example, when a vulnerability in a system is discovered, if the vulnerability requires confirmation of the behavior at the module level called by a process, conventionally, an operator would check the software configuration or design document or contact the developer to confirm the risk, which took time and effort to make an accurate judgment.

[0136] By applying this embodiment and visualizing the behavior of modules called by processes, even when the vulnerability in the system requires checking the behavior of modules called by processes, it becomes possible to automatically assess the risk, thereby reducing the effort required for the operator to take action and the time required to determine a response policy.

[0137] [System Configuration of the Embodiment] Each component of the agent 10 is a functional concept and does not necessarily have to be physically configured as shown in the figure. In other words, the specific form of distribution and integration of the functions of the agent 10 is not limited to that shown in the figure, and all or part of the functions can be functionally or physically distributed or integrated in any unit depending on various additions, usage conditions, etc.

[0138] Furthermore, all or any part of the processes performed by the agent 10 may be realized by a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), and a program analyzed and executed by the CPU and GPU. Furthermore, each process performed by the agent 10 may be realized as hardware using wired logic.

[0139] Furthermore, among the processes described in the embodiments, all or part of the processes described as being performed automatically can be performed manually. Alternatively, all or part of the processes described as being performed manually can be performed automatically using a known method. In addition, the processing procedures, control procedures, specific names, and information including various data and parameters described above and illustrated can be changed as appropriate unless otherwise specified.

[0140] 22 is a diagram showing an example of a computer in which an agent 10 is realized by executing a program. The computer 1000 has, for example, a memory 1010 and a CPU 1020. The computer 1000 also has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0141] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM (Random Access Memory) 1012. The ROM 1011 stores, for example, a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to, for example, a mouse 1110 and a keyboard 1120. The video adapter 1060 is connected to, for example, a display 1130.

[0142] The hard disk drive 1090 stores, for example, an OS (Operating System) 1091, application programs 1092, program modules 1093, and program data 1094. That is, the programs that define the processes of the agent 10 are implemented as program modules 1093 in which code that can be executed by the computer 1000 is written. The program modules 1093 are stored, for example, in the hard disk drive 1090. For example, the program modules 1093 for executing processes similar to the functional configuration of the agent 10 are stored in the hard disk drive 1090. The hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

[0143] Furthermore, setting data used in the processing of the above-described embodiment is stored as program data 1094, for example, in memory 1010 or hard disk drive 1090. Then, CPU 1020 reads out program module 1093 or program data 1094 stored in memory 1010 or hard disk drive 1090 into RAM 1012 as necessary and executes them.

[0144] The program module 1093 and program data 1094 may not necessarily be stored in the hard disk drive 1090, but may also be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (such as a local area network (LAN) or a wide area network (WAN)). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070.

[0145] Although the present invention has been described above as an embodiment, the present invention is not limited to the descriptions and drawings that form part of the disclosure of the present invention. In other words, other embodiments, examples, and operational techniques that can be made by those skilled in the art based on the present invention are all included in the scope of the present invention.

[0146] REFERENCE SIGNS LIST 10 Agent 11 Inspection information acquisition unit 12 Detailed information acquisition unit 13 DB 14 Management information acquisition unit 15 Communication trace information acquisition unit 16 Configuration information storage unit 17 File access information acquisition unit 18 Target list generation unit 19 Communication information generation unit 20 Additional information generation unit 21 Criteria registration unit 22 Determination unit 23 Determination result output unit 41 Vulnerability inspection tool 42 Vulnerability information distribution service 50 External vulnerability DB 60 SBOM generation tool

Claims

1. An agent provided in a device to be determined, comprising: a first generation unit that generates communication operation information including the software name, version information, CPE (Common Platform Enumeration) information, communication destination classification, and / or the process additional information that performed the communication operation, using process management information acquired by the device to be determined while it is running, communication trace information that traces communications within the device to be determined, and a target list that indicates targets from which process additional information indicating modules called by the process is acquired; and an acquisition unit that, when vulnerability testing information is input to the agent running on the device to be determined, acquires detailed information about the vulnerability corresponding to the input vulnerability testing information, extracts one or more of the attack source classification, software name, version information, CPE information, and description from the acquired detailed information about the vulnerability, and stores the information as a set with vulnerability ID information as vulnerability detailed information; a determination unit that compares the communication operation information with the vulnerability detailed information, and if the level of the communication destination classification is equal to or higher than a threshold and the process additional information contains module information that does not contain CPE information, performs a matching process with a description included in the vulnerability detailed information, and determines the risk of the device to be determined for the vulnerability.

2. The determination device described in claim 1, characterized in that the determination unit determines that the vulnerability has a high risk if the level of the communication destination classification is equal to or higher than a threshold and the process attachment information contains module information including CPE information, determines that the vulnerability has a high risk if the level of the communication destination classification is equal to or higher than a threshold and the process attachment information contains module information not including CPE information and there is a match between the module information and the description in the vulnerability detailed information, and determines that the vulnerability has a low risk if the level of the communication destination classification is equal to or higher than a threshold and the process attachment information contains module information not including CPE information and there is no match between the module information and the description in the vulnerability detailed information.

3. The determination device according to claim 1, further comprising a second generation unit that performs a file search within the device to be determined using keywords for extracting additional information, extracts common parts from the full paths of the files found, and generates a target list in which the common parts are associated with each keyword, wherein the first generation unit: if a communication command obtained from the process management information and the communication trace information is included in the target list, extracts a full path of file access information including the common part of the target list from the file access information of the process of the communication command, obtains the name and version information of the module called by the process based on the extracted full path, compares the full path with a software parts table corresponding to the communication command, obtains CPE information of the module called by the process, and sets the obtained module name, version information and CPE information as the process additional information; and if the extracted full path is not included in the software parts table, separates the accessed file name with commas, extracts unnecessary parts from the file access information, and sets the process additional information.

4. A judgment program for causing a computer to execute the following steps:

4. A judgment program for causing a computer to execute the following steps:

4. A step of generating communication operation information including the software name, version information, CPE (Common Platform Enumeration) information, communication destination classification, and / or said process additional information that performed the communication operation, using process management information acquired from a running judgment target device, communication information obtained by tracing communications within said judgment target device, and a target list indicating targets for acquiring process additional information indicating modules called by a process; when vulnerability testing information is input, a step of acquiring detailed information on a vulnerability corresponding to the input vulnerability testing information, extracting one or more pieces of information from the acquired detailed vulnerability information, including the attack source classification, software name, version information, CPE information, and description, and storing the extracted information together with vulnerability ID information as vulnerability detailed information; and a step of matching the communication operation information with the vulnerability detailed information, and if the level of the communication destination classification is equal to or higher than a threshold and the process additional information contains module information that does not contain CPE information, performing a matching process with the description included in the vulnerability detailed information, and judging the risk of the judgment target device for the vulnerability.

Images