Information processing device, information processing method, and information processing program

Abstract

This information processing device (1) comprises a storage unit (20), a reception unit (31), an identifier acquisition unit (32), a vulnerability information acquisition unit (33), and a provision unit (34). The reception unit (31) stores identifier dictionary information in which a first identifier, which is an identifier pertaining to each of a plurality of software packages, and a second identifier, which is a group identifier, are associated for each group. The reception unit (31) receives a designation of a target group or a designation of a second identifier of the target group. The identifier acquisition unit (32) acquires, from the identifier dictionary information, a plurality of first identifiers associated with the second identifier of the target group for which the designation has been received by the reception unit (31). The vulnerability information acquisition unit (33) acquires vulnerability information about software corresponding to each of the plurality of first identifiers acquired by the identifier acquisition unit (32). The provision unit (34) provides the vulnerability information acquired by the vulnerability information acquisition unit (33).

Description

Information Processing Apparatus, Information Processing Method, and Information Processing Program

[0001] The present invention relates to an information processing apparatus, an information processing method, and an information processing program.

[0002] Conventionally, the complexity of systems and software has increased, and as a result, the number of vulnerabilities has also increased. And vulnerability information is provided from various sources, and they are updated daily. Vulnerability management requires a series of processes such as information collection, analysis, and application of countermeasures. However, due to the daily occurrence of new vulnerability information, resources (for example, human resources, time, budget, etc.) for dealing with all of them may be insufficient. In addition, the diversity and complexity of vulnerability information increase the risk of overlooking important vulnerability information.

[0003] Due to the diversity and complexity of systems, software, and vulnerability information, etc., problems occur such that the dependency relationships between software packages, that is, the relationships for one package to function depending on other packages become complicated. For example, since vulnerability information may be provided in various programming languages, versions, and settings, it is not easy to classify and manage software packages. In addition, since one software package may depend on a plurality of other packages, when the dependency relationships become complicated, it becomes difficult to accurately grasp the scope of influence of vulnerabilities.

[0004] Also, due to the above-described diversity and complexity, etc., problems also occur such that it becomes difficult to appropriately grasp the influence associated with changes in software packages. For example, when the version of a software package is updated, new vulnerabilities may occur or existing vulnerabilities may be corrected, so it is necessary to appropriately update the scope of influence. In addition, when the function of a software package is changed, the compatibility between software packages may be lost, so it is necessary to appropriately confirm whether the dependency relationships are available.

[0005] One known method for managing vulnerabilities in software involves obtaining information explicitly described about software packages from external websites or actual devices to understand the dependencies between software packages and manage the vulnerabilities contained within them. For vulnerability management, for example, tools for vulnerability management (see, for example, Non-Patent Documents 1-3) can be used.

[0006] Assured Co., Ltd., vulnerability management cloud yamory, [Searched October 8, 2024], Internet <URL: https: / / yamory.io / > Snyk Co., Ltd., vulnerability management tool Snyk, [Searched October 8, 2024], Internet <URL: https: / / go.snyk.io / jp.html> GUAC (Graph for Understanding Artifact Composition), [Searched October 8, 2024], Internet <URL: https: / / guac.sh / >

[0007] However, if vulnerability management is performed by incorporating all explicitly listed dependencies, there is a possibility that information obtained from external sites or actual devices may be incomplete.

[0008] Furthermore, because each user uses different types of software packages and has different management policies, when identifying related software packages based on a certain vulnerability, relationships such as whether a package is frequently used together with the software package containing that vulnerability cannot be grasped simply by considering library dependencies. In other words, there is a problem in that user policies are not reflected.

[0009] Furthermore, even if the severity of vulnerabilities can be assessed at the individual software package level, it is not possible to grasp the importance of the functionality provided by the software package as a whole. In other words, there is a problem in that the unit for assessing the severity of vulnerabilities is too small.

[0010] Thus, conventional technologies have several drawbacks, such as incomplete information obtained from external sites or actual devices, failure to reflect user policies, or small units for assessing the severity of vulnerabilities, and there is room for improvement.

[0011] Therefore, in order to solve the above problems and achieve the objective, the information processing device of the present invention comprises a storage unit, a reception unit, an identifier acquisition unit, a vulnerability information acquisition unit, and a provision unit. The storage unit stores identifier dictionary information in which a first identifier, which is an identifier for a plurality of software packages, and a second identifier, which is a group identifier, are linked for each group. The reception unit accepts the designation of a target group or the designation of a second identifier for a target group. The identifier acquisition unit acquires a plurality of first identifiers linked to the second identifier of the target group whose designation has been accepted by the reception unit from the identifier dictionary information. The vulnerability information acquisition unit acquires software vulnerability information corresponding to each of the plurality of first identifiers acquired by the identifier acquisition unit. The provision unit provides the vulnerability information acquired by the vulnerability information acquisition unit.

[0012] This invention has the effect of being able to better support the identification of vulnerabilities contained in software.

[0013] Figure 1 is a diagram showing an example of information processing in an information processing device according to an embodiment. Figure 2 is a diagram showing an example of the configuration of an information processing device according to an embodiment. Figure 3 is a diagram showing an example of a first identifier dictionary database stored in a dictionary information storage unit according to an embodiment. Figure 4 is a diagram showing an example of a second identifier dictionary database stored in a dictionary information storage unit according to an embodiment. Figure 5 is a diagram showing an example of a vulnerability information database stored in a vulnerability information storage unit according to an embodiment. Figure 6 is a diagram showing an example of a package information database stored in a package information storage unit according to an embodiment. Figure 7 is a diagram showing an example of a vector information database stored in a vector information storage unit according to an embodiment. Figure 8 is a diagram showing an example of a cluster information database stored in a cluster information storage unit according to an embodiment. Figure 9 is a flowchart showing an example of information processing by the processing unit of the information processing device according to an embodiment. Figure 10 is a flowchart showing an example of vulnerability information provision processing by the processing unit of the information processing device according to an embodiment. Figure 11 is a flowchart showing an example of linking information generation processing by the processing unit of the information processing device according to an embodiment. Figure 12 is a diagram showing an example of a computer on which the information processing device according to an embodiment is implemented.

[0014] Hereinafter, embodiments for carrying out the present invention (hereinafter referred to as "embodiments") will be described with reference to the drawings. However, each embodiment is not limited to those described below.

[0015] [Overview] Figure 1 shows an example of information processing in an information processing device according to the embodiment. The information processing device 1 shown in Figure 1 can group software packages that are frequently used simultaneously, in addition to explicitly defined dependencies and inclusion relationships, and can also reflect the user's package management policy in the grouping of software packages.

[0016] As shown in Figure 1, the information processing device 1 includes identifier dictionary information and a vulnerability information database, and provides vulnerability information. The identifier dictionary information includes package identifiers, which are identifiers for each of multiple software packages, and group identifiers, which are identifiers for each of multiple groups. In the identifier dictionary information, the package identifier of each software package is linked to the corresponding group identifier from among the multiple group identifiers. In this way, in the identifier dictionary information, multiple package identifiers and group identifiers are linked for each group.

[0017] A package identifier associates the software identifier and version number of each of the multiple software components included in the software package. Each software component may be, for example, a program, library, or script, but is not limited to these examples. The software identifier is, for example, the software name, and the version number is, for example, the version number of the software package.

[0018] A group identifier may be associated with a software identifier, either in place of or in addition to a package identifier. A package identifier associated with a group identifier, or a software identifier associated with a group identifier, is an example of a first identifier for a software package, while the group identifier is an example of a second identifier.

[0019] Multiple groups include not only groups containing multiple software packages with explicitly defined dependencies or inclusion relationships, but also groups of multiple software packages that do not have explicitly defined dependencies or inclusion relationships but are desirable to manage as the same group.

[0020] Groups of software packages that do not have explicitly defined dependencies or inclusion relationships but are desirable to manage as the same group include, but are not limited to, groups of software packages that are frequently used simultaneously, or groups of software packages based on a user's package management policy.

[0021] Multiple software packages that are frequently used simultaneously but do not have explicitly defined dependencies or inclusion relationships include, but are not limited to, multiple software packages that work in conjunction with the same database, multiple software packages that use the same API (Application Programming Interface), and multiple software packages that depend on specific hardware.

[0022] Because databases and APIs are susceptible to unauthorized data acquisition and tampering by attackers, it is desirable that multiple software packages that work in conjunction with the same database or utilize the same API be managed as a single group.

[0023] Furthermore, because certain hardware can affect software due to its vulnerabilities, it is desirable that multiple software packages, each containing software that depends on specific hardware, be managed as a single group. Examples of specific hardware vulnerabilities include "Spectre" and "Meltdown" vulnerabilities found in Intel CPUs, but are not limited to CPU vulnerabilities.

[0024] The association of package identifiers or software identifiers with group identifiers in the identifier dictionary information can be performed by the operator U of the information processing device 1. For example, the operator U of the information processing device 1 can operate the terminal device 3 to identify multiple package identifiers or multiple software identifiers to be associated with a group identifier.

[0025] The information processing device 1 adds association information, which is information linking a group identifier identified by the operator U or the like to multiple package identifiers or multiple software identifiers, to the identifier dictionary information. This allows the identifier dictionary information to be configured to include software packages or software groups that are frequently used simultaneously, as well as software packages or software groups based on the user's package management policy.

[0026] Furthermore, the vulnerability information database includes a link between the package identifier of a software package and vulnerability information, which is information about vulnerabilities in the software contained within that software package. Vulnerability information includes, but is not limited to, information such as the vulnerability identifier (e.g., CVE (Common Vulnerabilities and Exposures) number), a summary of the vulnerability, the impact of the vulnerability, the severity of the vulnerability (e.g., CVSS (Common Vulnerability Scoring System) score), and countermeasures for the vulnerability (e.g., methods for mitigating or fixing the vulnerability). In the following, vulnerability information for software contained within a software package may be referred to as software package vulnerability information.

[0027] As shown in Figure 1, the information processing device 1 performs vulnerability testing information acquisition processing to obtain vulnerability testing information from the external system 2 (step S1). The external system 2 includes a tool for testing vulnerabilities in software included in a software package. The tool for testing software vulnerabilities is, for example, Grype, but is not limited to this example. Grype detects software vulnerabilities by scanning the SBOM.

[0028] The vulnerability test information includes the package identifier of the software package and vulnerability information of the software contained in that software package. The information processing device 1 extracts the package identifier and vulnerability information of the software package from the vulnerability test information obtained from the external system 2, and adds the linked information, which associates the extracted software package identifier and vulnerability information, to the vulnerability information database.

[0029] Furthermore, the information processing device 1 can also extract vulnerability information from GitHub repositories (manifest files) and SBOMs, and add the extracted vulnerability information to the vulnerability information database.

[0030] Operator U of the information processing device 1 operates the terminal device 3 to specify the target group or the group identifier of the target group. The target group is a group of software packages that operator U wants to check for vulnerabilities.

[0031] The information processing device 1 can display a list of software package groups on the terminal device 3, and the operator U can specify the target group by selecting the group whose vulnerability they want to check from among the multiple groups displayed in the list. Alternatively, the operator U can specify the group identifier of the target group by operating the terminal device 3 and directly entering the group identifier of the target group.

[0032] The information processing device 1 performs an acceptance process to receive the designation of a target group or the designation of a group identifier for a target group by the operator U (step S2). If the information processing device 1 receives the designation in step S2, it performs an identifier acquisition process to obtain multiple package identifiers associated with the group identifier of the target group designated in step S2 from the identifier dictionary information (step S3).

[0033] Next, the information processing device 1 performs a vulnerability information acquisition process to acquire vulnerability information for multiple software packages included in the target group using the multiple package identifiers obtained in the identifier acquisition process of step S3 (step S4).

[0034] In the vulnerability information acquisition process of step S4, the information processing device 1 acquires vulnerability information for each of the multiple software packages included in the target group by acquiring vulnerability information associated with each of the multiple package identifiers corresponding to the multiple software packages included in the target group.

[0035] Next, the information processing device 1 performs a provisioning process to provide operator U with vulnerability information for multiple software packages included in the target group, which was obtained in the vulnerability information acquisition process in step S4 (step S5). For example, the information processing device 1 provides operator U with vulnerability information for multiple software packages included in the target group by transmitting the vulnerability information for multiple software packages included in the target group to terminal device 3.

[0036] The information processing device 1 can provide operator U with vulnerability information for multiple software packages included in groups that have explicitly defined dependencies or inclusion relationships, as well as groups of software packages that are frequently used simultaneously and groups based on operator U's package management policy. This allows operator U to manage vulnerabilities in the software more effectively, and the information processing device 1 can better support operator U in identifying vulnerabilities in the software.

[0037] If the group identifier of the target group is associated with one or more software identifiers in addition to or instead of a package identifier, the information processing device 1 obtains one or more software identifiers associated with the group identifier of the target group from the identifier dictionary information in step S3. Then, in step S4, the information processing device 1 uses the obtained one or more software identifiers to obtain vulnerability information (for example, vulnerability information for all versions) of one or more software included in the target group. In step S5, the information processing device 1 provides the operator U with vulnerability information for multiple software included in the target group.

[0038] The information processing device 1 can further generate association information included in the identifier dictionary information, and can perform, for example, the processing shown in steps S10 to S13 in Figure 1.

[0039] First, the information processing device 1 performs an information acquisition process to acquire multiple package information from an external system (step S10). Each package information includes, for example, external information about a software package, which includes a package repository (a repository for software packages), visualization data, and information about software vulnerabilities. Furthermore, each package information is associated with a corresponding package identifier. Visualization data refers to data that visualizes the configuration, status, and evaluation of a device, system, or service, and this data includes SBOM information.

[0040] The information processing device 1 obtains package repository information from, for example, a package manager repository site (e.g., maven). The information processing device 1 also obtains visualization data from, for example, an SBOM. The package repository and visualization data include information such as descriptions of software packages and dependencies of software packages.

[0041] Furthermore, the information processing device 1 can also obtain vulnerability information as package information from sources such as the NVD (National Vulnerability Database). Vulnerability information includes, but is not limited to, information about software vulnerabilities, such as vulnerability identifiers, vulnerability summaries, vulnerability impacts, vulnerability severity, and vulnerability countermeasures.

[0042] Next, the information processing device 1 performs a vectorization process to vectorize each of the multiple package information obtained in the information acquisition process of step S10 (step S11). The information processing device 1 vectorizes each of the multiple package information using, for example, an embedding model. The embedding model used in step S11 is, for example, a text embedding model such as text-embedding-ada or BERT (Bidirectional Encoder Representations from Transformers), but is not limited to such examples.

[0043] The package information to be vectorized by the vectorization process is, for example, part or all of one or more pieces of information among package repositories, visualization data, and vulnerability information, but is not limited to such examples.

[0044] For example, the information processing apparatus 1 inputs one or more pieces of information among package repositories, visualization data, and vulnerability information to an LLM (Large Language Models), extracts features of effective software packages by clustering from one or more pieces of information among package repositories, visualization data, and vulnerability information, and can also vectorize the extraction result as package information. Here, the LLM is, for example, a large language model such as GPT-4 (Generative Pre-trained Transformer 4) (registered trademark).

[0045] Further, the information processing apparatus 1 can, for example, cause an LLM to summarize one or more pieces of information among package repositories, visualization data, and vulnerability information, and vectorize the summary result as package information. The LLM may be arranged inside the information processing apparatus 1, or an LLM arranged on an external server via an API or the like can also be used.

[0046] Subsequently, the information processing apparatus 1 performs a clustering process of clustering the plurality of package information vectorized in step S11 into a plurality of clusters (step S12). The information processing apparatus 1 uses, for example, a clustering algorithm such as k-means clustering, spectral clustering, Gaussian mixture model, or hierarchical clustering to cluster the plurality of package information into a plurality of clusters.

[0047] Subsequently, the information processing apparatus 1 performs a generation process of generating association information in which a group identifier and a plurality of package identifiers are associated with each other, with the plurality of software packages corresponding to the vectorized package information included in the same cluster being regarded as the same group, based on the clustering result of the clustering process in step S12 (step S13).

[0048] The association information generation process in step S13 includes, for example, vector acquisition processing, package information acquisition processing, identifier determination processing, description text generation processing, association information generation processing, output processing, and others. In the following, the vectorized package information may be described as a vector or vector information in some cases.

[0049] First, the information processing apparatus 1 performs vector acquisition processing (step S13a) of acquiring, for each cluster, the vector closest to the cluster center or all the vectors included in the cluster as the target vectors. Note that the target vectors may be a predetermined number of vectors in the order of proximity to the cluster center, or may be a vector closest to the average value or median of a plurality of vectors included in the cluster, or a predetermined number of vectors in the order of proximity to the average value or median of a plurality of vectors included in the cluster.

[0050] Subsequently, the information processing apparatus 1 performs package information acquisition processing (step S13b) of acquiring, for each target vector, the package information corresponding to the target vector acquired in step S13a. The package information acquisition processing in step S13b is performed in units of clusters.

[0051] Subsequently, the information processing apparatus 1 performs identifier determination processing (step S13c) of extracting keywords from the package information acquired in step S13b and determining the extracted keywords as group identifiers. The identifier determination processing in step S13c is performed in units of clusters.

[0052] The information processing apparatus 1 inputs the package information acquired in step S13b to the LLM and causes the LLM to extract keywords from the package information. When a plurality of package information is acquired by the package information acquisition processing, the input information includes the plurality of package information. The LLM may be arranged inside the information processing apparatus 1, or an LLM arranged on an external server via an API or the like may also be used.

[0053] The instruction information includes, for example, string information indicating the extraction of characteristic keywords from among multiple keywords included in the package information, and information on keywords not to be extracted, but is not limited to such examples. The keywords not to be extracted include, for example, package identifiers included in the identifier dictionary information, or package identifiers already determined for other clusters, but is not limited to such examples.

[0054] Furthermore, the information processing device 1 performs a description generation process to generate a description for each cluster corresponding to the cluster (step S13d). For example, the information processing device 1 has the LLM summarize the package description included in the package information acquired in step S13b, and determines the string summarized by the LLM as the group description for each cluster.

[0055] The information processing device 1 inputs information including the package information acquired in step S13b and instruction information indicating an instruction to summarize the package description contained in the package information as input information to the LLM, causing the LLM to generate a group description from the package information. If multiple package information is acquired by the package information acquisition process, the input information will include multiple package information.

[0056] Next, the information processing device 1 performs a linking information generation process (step S13e) to generate linking information that includes a group identifier for the group corresponding to the cluster, multiple package identifiers corresponding to multiple vectors included in the cluster, and a group description generated in step S13d, which is added to the identifier dictionary information. The linking information generation process is performed for each cluster.

[0057] Next, the information processing device 1 performs output processing to output the cluster-specific linking information generated in step S13e (step S13f). For example, the information processing device 1 outputs the cluster-specific linking information generated in step S13e and adds the outputted linking information to the identifier dictionary information.

[0058] The information processing device 1 can also perform tasks such as adding linked information input or specified by the operator U to the identifier dictionary information, and cluster correction.

[0059] Operator U can operate terminal device 3 to input linking information that includes the package identifiers of multiple software packages to be grouped and the group identifier of the group of these multiple software packages. Terminal device 3 outputs the linking information input from operator U to information processing device 1. Information processing device 1 performs an acceptance process to receive the linking information input from operator U as a setting for the group of multiple software packages (step S20).

[0060] Next, the information processing device 1 performs an update process to update the identifier dictionary information by adding the association information received in step S20 to the identifier dictionary information (step S21). The association information added to the identifier dictionary information is information that associates multiple package identifiers with group identifiers.

[0061] Furthermore, the information processing device 1 performs a correction process to correct the clusters based on the linking information, which is information indicating the group settings received in step S20, and the cluster-specific linking information generated in step S13e (step S22). For example, the information processing device 1 can generate semi-supervised learning information from the linking information received in step S20 and correct the clusters using Constrained K-Means, Semi-Supervised SVM, or other semi-supervised learning algorithms. This makes it possible to improve the accuracy of clustering based on the input of operator U and known data.

[0062] For example, the information processing device 1 generates information as semi-supervised learning information that sets up multiple package identifiers included in the linking information, which is information indicating the group settings received in step S20, as a cluster, and corrects the clusters.

[0063] Furthermore, the information processing device 1 can also generate, for example, information in step S20 that sets pairwise constraints (separation constraints) that group multiple package identifiers included in other previously received linking information into different clusters, as semi-supervised learning information.

[0064] Furthermore, the information processing device 1 generates information as semi-supervised learning information that sets pairwise constraints (joining constraints) that group multiple package identifiers included in the same linking information generated in step S13e into the same cluster, and corrects the clusters.

[0065] Furthermore, the information processing device 1 can also generate, for example, information of pairwise constraints (separation constraints) that classify multiple package identifiers included in the linking information of different clusters generated in step S13e into different clusters, as semi-supervised learning information.

[0066] The information processing device 1 generates semi-supervised learning information using, for example, LLM, but is not limited to this example. The information input to LLM may include not only association information and instruction information that instructs the generation of semi-supervised learning information, but also package information.

[0067] Furthermore, the information processing device 1 can use an embedded model to vectorize package information corresponding to multiple package identifiers included in the linked information. The information processing device 1 can also generate semi-supervised learning information using the vectorized package information (vector information).

[0068] The information processing device 1 can correct clusters by, for example, re-executing the clustering process using a clustering algorithm that incorporates pairwise constraints. In this way, the accuracy of clustering can be improved by performing semi-supervised learning. When the information processing device 1 generates semi-supervised learning information using vector information, for example, distance calculations considering pairwise constraints are performed, but the device is not limited to such examples.

[0069] The information processing device 1 can generate new semi-supervised learning information in the correction process of step S22, for example, using LLM. For example, the information processing device 1 can generate new semi-supervised learning information based on the linking information received in step S20, using LLM. The new semi-supervised learning information includes, but is not limited to, information on multiple package identifiers that are predicted to be included in the same cluster or information on multiple package identifiers that are predicted to be included in different clusters.

[0070] The information processing device 1 can input information including the clustering results from the clustering process and the linking information received in step S20 as input information to the LLM, causing the LLM to generate new semi-supervised learning information. The input information may include, for example, instruction information that instructs the generation of new semi-supervised learning information, but if the LLM is tuned to generate new semi-supervised learning information, the instruction information may not be included.

[0071] Furthermore, the information processing device 1 can also generate new semi-supervised learning information using the linking information generated in step S13, for example. For example, the information processing device 1 can use LLM to generate new semi-supervised learning information based on the linking information generated in step S13 through the same process as described above.

[0072] [Configuration of Information Processing Device 1] Figure 2 is a diagram showing an example configuration of the information processing device 1 according to the embodiment. As shown in Figure 2, the information processing device 1 according to the embodiment is implemented on a general-purpose computer such as a personal computer or server, and comprises a communication unit 10, a storage unit 20, and a processing unit 30.

[0073] The communication unit 10 controls communication between the processing unit 30 and external devices or systems via a telecommunications line such as a LAN (Local Area Network) or the Internet. The communication unit 10 is implemented, for example, by a NIC (Network Interface Card) or a communication module.

[0074] The storage unit 20 pre-stores information processing programs for operating the information processing device 1, and data used during the execution of the information processing programs, or temporarily stores them each time processing is performed. The storage unit 20 is implemented by, for example, semiconductor memory elements such as RAM (Random Access Memory) and flash memory, or storage devices such as hard disks and optical discs. The storage unit 20 includes a dictionary information storage unit 21, a vulnerability information storage unit 22, a package information storage unit 23, a vector information storage unit 24, and a cluster information storage unit 25.

[0075] The dictionary information storage unit 21 stores identifier dictionary information, which includes information linking group identifiers and software identifiers to multiple package identifiers for each group. Figure 3 shows an example of a first identifier dictionary database stored in the dictionary information storage unit 21 according to this embodiment. As shown in Figure 3, the first identifier dictionary database stored in the dictionary information storage unit 21 includes information linking at least one of the package identifier and software identifier to a group identifier for each group identifier.

[0076] In the example shown in Figure 3, the group identifier "xxxx" is associated with package identifiers such as "aaaa@1.21.2" and "bbbb@3.12.1". In "aaaa@1.21.2", "aaaa" is the name of the software package and "1.21.2" is the version number of the software package. Similarly, in "bbbb@3.12.1", "bbbb" is the name of the software package and "3.12.1" is the version number of the software package.

[0077] Furthermore, the group identifier "yyyy" is associated with package identifiers "dddd@4.3.1", "eeee@1.0.14", and software identifier "FFF", etc. Also, the group identifier "zzzz" is associated with software identifiers "GGG", "HHH", etc.

[0078] Note that in the example shown in Figure 3, the character "@" is used to distinguish the software package name from the version number, but the example is not limited to this. Also, the package identifier may be, for example, a UUID (Universally Unique Identifier), or it may use a hash such as SHA-256.

[0079] Furthermore, the identifier dictionary information includes information linking software identifiers and version numbers to package identifiers. Figure 4 shows an example of a second identifier dictionary database stored in the dictionary information storage unit 21 according to the embodiment. As shown in Figure 4, the second identifier dictionary database stored in the dictionary information storage unit 21 includes information linking package identifiers, software identifiers, and version numbers for each package identifier.

[0080] The software identifier and version number associated with a package identifier are the identifier (e.g., name) of the software included in the software package and the version number of that software.

[0081] In the example shown in Figure 4, the package identifier "aaaa@1.21.2" is associated with combinations such as the software identifier "AAA" and version number "3.5.1", and the software identifier "AAB" and version number "1.22.4".

[0082] Furthermore, in the example shown in Figure 4, the package identifier "bbbb@3.12.1" is linked to combinations such as the software identifier "DDA" and version number "2.31.6", and the software identifier "DDB" and version number "1.0.52". Note that in the example shown in Figure 4, the character used to distinguish the software identifier and version number is ",", but the example is not limited to this. In the following, the database including the first identifier dictionary database and the second identifier dictionary database may be referred to as the identifier dictionary database.

[0083] The vulnerability information storage unit 22 stores vulnerability information for each software package. Figure 5 shows an example of a vulnerability information database stored in the vulnerability information storage unit 22 according to this embodiment. As shown in Figure 5, the vulnerability information database stored in the vulnerability information storage unit 22 includes information for each package identifier in which a first identifier, such as a package identifier or software identifier, is linked to vulnerability information for each first identifier.

[0084] In the example shown in Figure 5, the package identifier "aaaa@1.21.2" is associated with vulnerability information VI1, and the package identifier "bbbb@3.12.1" is associated with vulnerability information VI2. Vulnerability information VI1 is vulnerability information for the software package having the package identifier "aaaa@1.21.2", and vulnerability information VI2 is vulnerability information for the software package having the package identifier "bbbb@3.12.1".

[0085] Furthermore, in the example shown in Figure 5, the software identifier "FFF" is linked to vulnerability information VI10, and the software identifier "GGG" is linked to vulnerability information VI11. Vulnerability information VI1, VI2, VI10, VI11, etc., include, for example, the vulnerability identifier, vulnerability summary, vulnerability impact, vulnerability severity, and vulnerability countermeasures, but are not limited to these examples.

[0086] Although not shown in the diagram, the vulnerability information database may include software package descriptions linked to package identifiers, or software descriptions linked to software identifiers, but is not limited to these examples. Furthermore, the vulnerability information database may be located on an external server (for example, a cloud server), in which case the information processing device 1 obtains vulnerability information from the external server.

[0087] The package information storage unit 23 stores package information for each software package obtained from, for example, an external device or system. Figure 6 shows an example of a package information database stored in the package information storage unit 23 according to this embodiment.

[0088] As shown in Figure 6, the package information database stored in the package information storage unit 23 includes, for each package identifier, information linking package identifiers, package repositories, visualization data, and vulnerability information.

[0089] A package repository is a repository of software packages, and the information obtained is, for example, from repository sites as described above. Software package visualization data is information about software packages, and the information obtained is, for example, from SBOMs as described above.

[0090] Package repositories and visualization data include, but are not limited to, information such as descriptions of software packages and software package dependencies. Vulnerability information includes, but are not limited to, information such as vulnerability identifiers, vulnerability summaries, vulnerability impacts, vulnerability severity, and vulnerability countermeasures.

[0091] The vector information storage unit 24 stores vector information, which is information in which part or all of the package information (for example, information in which part or all of one or more of the information from package repository, visualization data, and vulnerability information has been vectorized).

[0092] Figure 7 shows an example of a vector information database stored in the vector information storage unit 24 according to the embodiment. As shown in Figure 7, the vector information database stored in the vector information storage unit 24 includes, for each vector identifier, a vector identifier, and information linking the vector information to each other.

[0093] A vector identifier is an identifier used to identify vector information and is unique to that vector information. A package identifier is a package identifier corresponding to vectorized package information. Vector information is, for example, information in which package information has been vectorized by an embedding model.

[0094] In the example shown in Figure 7, for instance, the vector identifier "VID1" is linked to the package identifier "pppp@1.4.1" and the vector information V1, and the vector identifier "VID2" is linked to the package identifier "rrrr@2.21.5" and the vector information V2.

[0095] The cluster information storage unit 25 stores cluster information, which is information relating to a cluster. Figure 8 shows an example of a cluster information database stored in the cluster information storage unit 25 according to this embodiment. As shown in Figure 8, the cluster information database stored in the cluster information storage unit 25 includes information for each group identifier in which a group identifier and a plurality of vector identifiers are linked to each other.

[0096] In the example shown in Figure 8, for instance, the group identifier "vvvv" is associated with vector identifiers "VID1", "VID3", etc., and the group identifier "wwww" is associated with vector identifiers "VID2", "VID4", etc.

[0097] The processing unit 30 is a controller, and is realized by a processor such as a CPU (Central Processing Unit) or MPU (Micro Processing Unit) executing various programs (including information processing programs) stored in the memory device inside the information processing device 1, using RAM or the like as a working area.

[0098] As shown in Figure 2, the processing unit 30 includes a reception unit 31, an identifier acquisition unit 32, a vulnerability information acquisition unit 33, a provision unit 34, a package information acquisition unit 35, a linking unit 36, and a cluster correction unit 37, and realizes or executes the information processing functions and operations described below. Note that the internal configuration of the processing unit 30 is not limited to the configuration shown in Figure 2, and other configurations are also acceptable as long as they perform the information processing described later.

[0099] The reception unit 31 receives requests and information. For example, the reception unit 31 accepts the designation of a target group or the designation of a group identifier for a target group. The target group is a group of software packages that operator U wants to investigate for vulnerabilities.

[0100] Operator U of the information processing device 1 operates the terminal device 3 to specify the target group or the group identifier of the target group.

[0101] The reception unit 31 can display a list of software package groups on the terminal device 3, and the operator U can specify a target group by selecting the group whose vulnerability they want to investigate from among the multiple groups displayed in the list. Alternatively, the operator U can specify a target group identifier by operating the terminal device 3 and directly entering the group identifier of the target group.

[0102] Furthermore, the reception unit 31 accepts the setting of a group of multiple software packages. For example, the reception unit 31 accepts the linking information entered by the operator U or the like as information indicating the group setting. The operator U can input linking information into the terminal device 3, which includes the package identifiers of the multiple software packages to be grouped and the group identifier that links these multiple package identifiers. This linking information can be entered directly by the operator, or it can be read from an external source, for example, using a correspondence table in CSV format. The linking information entered by the operator U or the like into the terminal device 3 is input from the terminal device 3 to the information processing device 1 and accepted by the reception unit 31. The linking information may include, in place of or in addition to the package identifiers of the multiple software packages to be grouped, the software identifiers of the software included in the multiple software packages to be grouped.

[0103] This allows operator U to manually enter, for example, groups of software packages that are frequently used simultaneously or groups of software packages based on the user's package management policy.

[0104] The reception unit 31 updates the identifier dictionary database by adding the received linking information to the identifier dictionary database stored in the dictionary information storage unit 21. The linking information added to the identifier dictionary database may be, but is not limited to, information linking multiple package identifiers and group identifiers, information linking a package identifier and multiple software identifiers, or information linking multiple package identifiers, multiple software identifiers, and group identifiers.

[0105] When the receiving unit 31 receives a designation of a target group or a designation of a group identifier for a target group, the identifier acquisition unit 32 acquires multiple package identifiers associated with the group identifier of the target group that was accepted by the receiving unit 31 from the identifier dictionary information. In addition, if a software identifier is associated with the group identifier of the target group, the identifier acquisition unit 32 acquires the software identifier associated with the group identifier of the target group.

[0106] For example, suppose the identifier dictionary information stored in the dictionary information storage unit 21 is represented by the identifier dictionary database shown in Figure 3. In this case, if the group identifier of the target group is "xxxx", the identifier acquisition unit 32 will acquire package identifiers such as "aaaa@1.21.2" and "bbbb@3.12.1" from the identifier dictionary information. Also, if the group identifier of the target group is "yyyy", the identifier acquisition unit 32 will acquire package identifiers such as "dddd@4.3.1" and "eeee@1.0.14" and software identifier "FFF" from the identifier dictionary information.

[0107] If the identifier obtained by the identifier acquisition unit 32 is a set of multiple package identifiers, the vulnerability information acquisition unit 33 acquires vulnerability information for each of the multiple package identifiers obtained by the identifier acquisition unit 32.

[0108] Furthermore, if the identifier obtained by the identifier acquisition unit 32 is a set of multiple package identifiers and software identifiers, the vulnerability information acquisition unit 33 acquires vulnerability information for the software package corresponding to the software package obtained by the identifier acquisition unit 32 and vulnerability information for the software corresponding to the software identifier.

[0109] Furthermore, if the identifier obtained by the identifier acquisition unit 32 is a set of multiple software identifiers, the vulnerability information acquisition unit 33 acquires vulnerability information for each of the multiple software identifiers obtained by the identifier acquisition unit 32.

[0110] For example, suppose the vulnerability information stored in the vulnerability information storage unit 22 is represented in the vulnerability information database shown in Figure 5. In this case, if the package identifiers obtained by the identifier acquisition unit 32 are "aaaa@1.21.2" and "bbbb@3.12.1", the vulnerability information acquisition unit 33 will acquire vulnerability information VI1 and VI2 associated with the package identifiers "aaaa@1.21.2" and "bbbb@3.12.1".

[0111] Furthermore, suppose the identifier acquisition unit 32 acquires the package identifiers "dddd@4.3.1" and "eeee@1.0.14" and the software identifier "FFFF". In this case, the vulnerability information acquisition unit 33 acquires the vulnerability information associated with the package identifiers "bbbb@3.12.1" and "eeee@1.0.14" and the vulnerability information associated with the software identifier "FFFF".

[0112] Furthermore, the vulnerability information acquisition unit 33 acquires vulnerability testing information from the external system 2 via the communication unit 10. The external system 2 includes a tool for testing vulnerabilities in the software included in the software package. The tool for testing software vulnerabilities is, for example, Grype, but is not limited to this example. Grype detects software vulnerabilities by scanning the SBOM.

[0113] The vulnerability test information includes the package identifier of the software package and vulnerability information, which is information about vulnerabilities in the software contained in that software package. The vulnerability information acquisition unit 33 extracts the package identifier and vulnerability information of the software package from the vulnerability test information acquired from the external system 2, and adds the linked information, which associates the extracted software package identifier and vulnerability information, to the vulnerability information database.

[0114] Furthermore, the vulnerability information acquisition unit 33 can also extract vulnerability information from GitHub repositories (manifest files) and SBOMs, and add the extracted vulnerability information to the vulnerability information database.

[0115] The information provision unit 34 provides various information to the operator U. The information provision unit 34 provides various information to the operator U by, for example, transmitting various information to the terminal device 3. For example, the information provision unit 34 provides vulnerability information acquired by the vulnerability information acquisition unit 33. The information provision unit 34 provides vulnerability information acquired by the vulnerability information acquisition unit 33 to the operator U by, for example, transmitting the vulnerability information acquired by the vulnerability information acquisition unit 33 to the terminal device 3.

[0116] As a result, operator U is provided with vulnerability information for multiple software packages included in the group that operator U wants to investigate, enabling operator U to manage vulnerabilities in the software more effectively, and the information processing device 1 provides more appropriate support for identifying vulnerabilities in the software.

[0117] The package information acquisition unit 35 acquires package information, which is information about multiple software packages, from an external system or the like. The package information acquisition unit 35 associates the acquired package information with a package identifier and stores it in the package information storage unit 23.

[0118] Package information includes, for example, external information about a software package, such as the package repository, visualization data, and information about software vulnerabilities. Furthermore, each piece of package information is associated with a corresponding package identifier. Visualization data, as mentioned above, refers to data that visualizes the configuration, status, and evaluation of devices, systems, or services, and this data includes SBOM information.

[0119] The package information acquisition unit 35 acquires package repositories as package information from, for example, a package manager's repository site (e.g., maven). The package information acquisition unit 35 also acquires visualization data from, for example, an SBOM. The package repository and visualization data include information such as a description of the software package and the dependencies of the software package.

[0120] Furthermore, the package information acquisition unit 35 can also acquire vulnerability information as package information from NVD or other sources. Vulnerability information may include, but is not limited to, information such as a vulnerability identifier, a summary of the vulnerability, the impact of the vulnerability, the severity of the vulnerability, and countermeasures for the vulnerability.

[0121] The linking unit 36 ​​generates linking information to be added to the identifier dictionary information based on the multiple package information acquired by the package information acquisition unit 35, and outputs the generated linking information. For example, the linking unit 36 ​​acquires multiple package information acquired by the package information acquisition unit 35 and stored in the package information storage unit 23 from the package information storage unit 23, generates linking information based on the acquired multiple package information, and outputs the generated linking information.

[0122] The linking unit 36 ​​comprises a vectorization unit 40, a clustering unit 41, and a generation unit 42. The vectorization unit 40 vectorizes each of the multiple package information obtained by the package information acquisition unit 35. The vectorization unit 40 links each of the vectorized package information to a corresponding package identifier and stores it in the vector information storage unit 24.

[0123] The vectorization unit 40 vectorizes each of the multiple package information using, for example, an embedding model. The embedding model is, for example, a text embedding model such as text-embedding-ada or BERT, but is not limited to such examples.

[0124] The package information vectorized by the vectorization process may be, for example, some or all of one or more pieces of information from a package repository, visualization data, or vulnerability information, but is not limited to such examples. The vectorization unit 40 stores the vectorized package information in the vector information storage unit 24, associating it with the corresponding vector identifier and package identifier.

[0125] The vectorization unit 40 can, for example, input one or more pieces of information from package repositories, visualization data, and vulnerability information into the LLM, have the LLM extract the characteristics of effective software packages from one or more pieces of information from package repositories, visualization data, and vulnerability information through clustering, and vectorize the extraction results as package information.

[0126] For example, the vectorization unit 40 inputs information to the LLM as input information, which includes one or more pieces of information from a package repository, visualization data, and vulnerability information, as well as instruction information indicating instructions to extract features of effective software packages from the package information through clustering. The LLM can then extract features of effective software packages from the package information through clustering. The instruction information may include, but is not limited to, examples of features of effective software packages through clustering. Note that if the LLM is tuned to extract features from the input information, the instruction information may not be included.

[0127] Furthermore, the vectorization unit 40 can, for example, have the LLM summarize one or more pieces of information from the package repository, visualization data, and vulnerability information, and then vectorize the summary result as package information. Note that if the LLM is tuned to summarize the input information, instruction information does not need to be included. In this way, the vectorization unit 40 can vectorize information more appropriately by using the LLM. The LLM may be located within the vectorization unit 40 of the information processing device 1, or an LLM located on an external server via an API or the like can be used.

[0128] The clustering unit 41 clusters the multiple package information vectorized by the vectorization unit 40 into multiple clusters. For example, the clustering unit 41 retrieves the multiple package information vectorized by the vectorization unit 40 and stored in the vector information storage unit 24 from the vector information storage unit 24, and clusters the multiple vectors, which are the obtained vectorized package information, into multiple clusters.

[0129] The clustering unit 41 clusters multiple package information into multiple clusters using a clustering algorithm such as k-means clustering, spectral clustering, Gaussian mixture models, or hierarchical clustering. As a result of the clustering, the clustering unit 41 stores information containing the group identifier and multiple vector identifiers linked together for each group identifier in the cluster information storage unit 25.

[0130] Based on the clustering results from the clustering unit 41, the generation unit 42 groups multiple software packages corresponding to multiple vectors included in the same cluster as the same group, and generates association information where the group identifier is linked to the multiple package identifiers. The processing of the generation unit 42 includes, for example, vector acquisition processing, package information acquisition processing, identifier determination processing, description generation processing, association information generation processing, and output processing.

[0131] First, the generation unit 42 acquires the vector closest to the cluster center, or all vectors included in the cluster, as target vectors for each cluster. For example, the generation unit 42 acquires the target vectors for each cluster from the cluster information storage unit 25.

[0132] The target vector may be a predetermined number of vectors ordered by proximity to the cluster center, or it may be the vector closest to the mean or median of multiple vectors included in the cluster, or a predetermined number of vectors ordered by proximity to the mean or median of multiple vectors included in the cluster.

[0133] Next, the generation unit 42 performs a process for each cluster to acquire package information corresponding to the target vector for each target vector. Then, the generation unit 42 extracts keywords from the package information corresponding to the target vector and performs a process for each cluster to determine the extracted keywords as group identifiers.

[0134] The generation unit 42 inputs package information corresponding to the target vector to the LLM, and causes the LLM to extract keywords from the package information. For example, the generation unit 42 inputs information as input information to the LLM that includes package information corresponding to the target vector and instruction information indicating an instruction to extract a keyword that will be a group identifier from such package information, and causes the LLM to extract keywords from the package information. If the generation unit 42 obtains multiple package information as package information corresponding to the target vector, the input information will include multiple package information. Note that if the LLM is tuned to extract keywords, the instruction information does not need to be included. The LLM may be located in the generation unit 42 of the information processing device 1, or an LLM located on an external server via an API or the like can be used.

[0135] The instruction information includes, for example, string information indicating the extraction of characteristic keywords from among multiple keywords included in the package information, and information on keywords not to be extracted, but is not limited to such examples. The keywords not to be extracted include, for example, package identifiers included in the identifier dictionary information, or package identifiers already determined for other clusters, but is not limited to such examples.

[0136] Furthermore, the generation unit 42 generates a group description corresponding to each cluster. For example, the generation unit 42 has the LLM summarize the package description contained in the package information corresponding to the target vector, and determines the string summarized by the LLM as the group description for each cluster.

[0137] The generation unit 42 inputs information including package information corresponding to the target vector and instruction information indicating an instruction to summarize the package description contained in the package information as input information to the LLM, causing the LLM to generate a group description from the package information. If multiple package information is obtained as package information corresponding to the target vector in the generation unit 42, the input information will include multiple package information.

[0138] Next, the generation unit 42 performs a process for each cluster to generate association information that is added to the identifier dictionary information, including the group identifier of the group corresponding to the cluster, the multiple package identifiers corresponding to the multiple vectors contained in the cluster, and a description of the generated group. The generation unit 42 outputs the generated association information for each cluster. For example, the generation unit 42 outputs the generated association information for each cluster and adds the outputted association information to the identifier dictionary information.

[0139] The cluster correction unit 37 corrects the clusters based on the group settings received by the reception unit 31. For example, the cluster correction unit 37 corrects the clusters based on the linking information received by the reception unit 31. The cluster correction unit 37 generates semi-supervised learning information used to correct the clustering of the clustering unit 41 from the linking information received by the reception unit 31, and can correct the clusters using Constrained K-Means, Semi-Supervised SVM, or other semi-supervised learning algorithms. This makes it possible to improve the accuracy of clustering based on the input of operator U and known data.

[0140] For example, the cluster correction unit 37 generates information as semi-supervised learning information that sets multiple package identifiers included in the linking information received by the reception unit 31 as a cluster, and corrects the clusters.

[0141] Furthermore, the cluster correction unit 37 can also generate, for example, pairwise constraint (separation constraint) information that groups multiple package identifiers included in other linking information previously received by the reception unit 31 into different clusters, as semi-supervised learning information.

[0142] Furthermore, the cluster correction unit 37 corrects the clusters based on the linking information generated by the generation unit 42. The cluster correction unit 37 can generate semi-supervised learning information used for correcting the clustering of the clustering unit 41 from the linking information generated by the generation unit 42, and correct the clusters.

[0143] For example, the cluster correction unit 37 generates information as semi-supervised learning information that sets pairwise constraints (join constraints) that group multiple package identifiers included in the same linking information generated by the generation unit 42 into the same cluster, and corrects the clusters.

[0144] Furthermore, the cluster correction unit 37 can also generate, for example, pairwise constraint (separation constraint) information that classifies multiple package identifiers included in the linking information of different clusters generated by the generation unit 42 into different clusters, as semi-supervised learning information.

[0145] The cluster correction unit 37 generates semi-supervised learning information using, for example, LLM, but is not limited to this example. The information input to LLM may include not only association information and instruction information that instructs the generation of semi-supervised learning information, but also package information.

[0146] Furthermore, the cluster correction unit 37 can use an embedding model to vectorize package information corresponding to multiple package identifiers included in the linking information. The cluster correction unit 37 can also generate semi-supervised learning information using the vectorized package information (vector information).

[0147] The cluster correction unit 37 can correct clusters by, for example, having the clustering unit 41 re-execute the clustering process using a clustering algorithm that incorporates pairwise constraints. In this way, the accuracy of clustering can be improved by performing semi-supervised learning. When the cluster correction unit 37 generates semi-supervised learning information using vector information, for example, distance calculations considering pairwise constraints are performed, but the unit is not limited to such examples.

[0148] The cluster correction unit 37 can generate new semi-supervised learning information, for example, using LLM. For example, the cluster correction unit 37 can generate new semi-supervised learning information using LLM based on the linking information received by the reception unit 31 and the linking information generated by the generation unit 42. The new semi-supervised learning information may include, for example, information on multiple package identifiers that are predicted to be included in the same cluster. The new semi-supervised learning information may also include, but is not limited to, information on multiple package identifiers that are predicted to be included in different clusters.

[0149] The cluster correction unit 37 inputs information including the clustering results from the clustering process and the linking information received in step S20 as input information to the LLM, causing the LLM to generate new semi-supervised learning information. The input information may include, for example, instruction information that instructs the generation of new semi-supervised learning information, but if the LLM is tuned to generate new semi-supervised learning information, the instruction information may not be included.

[0150] Furthermore, the cluster correction unit 37 can vectorize package information corresponding to multiple package identifiers contained in the linking information received by the reception unit 31 and the linking information generated by the generation unit 42, and use the information including the vectorized package information as training information to perform supervised learning of a model that predicts clusters, and then use this model to have the clustering unit 41 perform clustering processing. In this case as well, the cluster correction unit 37 can generate new training information using LLM and perform supervised learning of a model that predicts clusters using the new training information.

[0151] [Information Processing] Next, the procedure for information processing by the processing unit 30 of the information processing apparatus 1 according to the embodiment will be described. Figure 9 is a flowchart showing an example of information processing by the processing unit 30 of the information processing apparatus 1 according to the embodiment.

[0152] As shown in Figure 9, the processing unit 30 of the information processing device 1 determines whether or not it has received a group designation or group identifier designation from operator U (step S100). If the processing unit 30 determines that it has received a group designation or group identifier designation (step S100: Yes), it performs vulnerability information provision processing (step S101). The vulnerability information provision processing in step S101 is the processing shown in steps S110 to S112 in Figure 10, which will be described in detail later.

[0153] If the processing in step S101 is completed, or if the processing unit 30 determines that it has not received a group designation or group identifier designation (step S100: No), it determines whether or not it is time to generate the linking information (step S102). The timing for generating the linking information may be, for example, a timing that occurs at a predetermined interval, when the number of newly acquired package information exceeds a threshold, or a timing specified by the operator U, but is not limited to these examples.

[0154] If the processing unit 30 determines that it is time to generate the linking information (step S102: Yes), it performs the linking information generation process (step S103). The linking information generation process in step S103 is the process shown in steps S120 to S125 in Figure 11, which will be described in detail later.

[0155] If the processing unit 30 has finished the processing in step S103, or if it has determined that it is not yet time to generate the linked information (step S102: No), it determines whether it is time to update the vulnerability information database (step S104). The vulnerability information database update timing may be, for example, a timing that occurs at a predetermined interval, or a timing specified by operator U, but is not limited to these examples.

[0156] If the processing unit 30 determines that it is time to update the vulnerability information database (step S104: Yes), it performs the vulnerability information database update process (step S105). The vulnerability information database update process is a process that, for example, obtains vulnerability information from an external system 2 and adds the obtained vulnerability information to the vulnerability information database stored in the vulnerability information storage unit 22.

[0157] If the processing unit 30 has finished the processing in step S105, or if it has determined that it is not time to update the vulnerability information database (step S104: No), it determines whether it is time for cluster correction (step S106). Cluster correction timing is, for example, the time when new linking information input by operator U is received, or the time when the linking information generation process is completed, but is not limited to these examples.

[0158] If the processing unit 30 determines that it is time for cluster correction (step S106: Yes), it performs cluster correction processing (step S107). Cluster correction processing is performed by the cluster correction unit 37 described above.

[0159] If the processing in step S107 is completed, or if the processing unit 30 determines that it is not the cluster correction timing (step S106: No), it determines whether it is the operation termination timing (step S108). The processing unit 30 determines that it is the operation termination timing, for example, when the power to the information processing device 1 is turned off.

[0160] If the processing unit 30 determines that it is not yet time to terminate the operation (step S108: No), it proceeds to step S100. If it determines that it is time to terminate the operation (step S108: Yes), it terminates the process shown in Figure 9.

[0161] Figure 10 is a flowchart showing an example of vulnerability information provision processing by the processing unit 30 of the information processing device 1 according to the embodiment. As shown in Figure 10, the processing unit 30 obtains a plurality of package identifiers associated with the group identifier of the target group, which is a specified group, from the identifier dictionary database stored in the dictionary information storage unit 21 (step S110).

[0162] Next, the processing unit 30 retrieves vulnerability information associated with each of the multiple package identifiers obtained in step S110 from the vulnerability information database stored in the vulnerability information storage unit 22 (step S111). Subsequently, the processing unit 30 provides the multiple vulnerability information obtained in step S111 (step S112), and terminates the process shown in Figure 10.

[0163] Figure 11 is a flowchart showing an example of the linking information generation process by the processing unit 30 of the information processing device 1 according to the embodiment. As shown in Figure 11, the processing unit 30 acquires package information, which is information about each of a plurality of software programs, from an external device or system (step S120).

[0164] Next, the processing unit 30 adds the package information acquired in step S120 to the package information database stored in the package information storage unit 23 (step S121).

[0165] Next, the processing unit 30 vectorizes each package information acquired in step S120 and adds the resulting vector information to the vector information database stored in the vector information storage unit 24 (step S122).

[0166] Next, the processing unit 30 clusters the multiple vector information obtained in step S122 and adds the clustering result to the cluster information database (step S123).

[0167] Next, the processing unit 30 generates association information for each cluster, which is information linking a group identifier with multiple package identifiers, based on the clustering results of step S123 (step S124).

[0168] Next, the processing unit 30 adds the cluster-specific linking information generated in step S124 to the identifier dictionary database (step S125), and then terminates the process shown in Figure 11.

[0169] [Effects] The information processing device 1 according to this embodiment comprises a storage unit 20, a reception unit 31, an identifier acquisition unit 32, a vulnerability information acquisition unit 33, and a provision unit 34. The storage unit 20 stores identifier dictionary information in which a first identifier, which is an identifier for each of a plurality of software packages, and a second identifier, which is a group identifier, are linked for each group. A package identifier is an example of a first identifier, and a group identifier is an example of a second identifier. The reception unit 31 accepts the designation of a target group or the designation of a second identifier for a target group. The identifier acquisition unit 32 acquires a plurality of first identifiers linked to the second identifier of the target group whose designation has been accepted by the reception unit 31 from the identifier dictionary information. The vulnerability information acquisition unit 33 acquires vulnerability information for software corresponding to each of the plurality of first identifiers acquired by the identifier acquisition unit 32. The provision unit 34 provides the vulnerability information acquired by the vulnerability information acquisition unit 33. As a result, the information processing device 1 can, for example, provide vulnerability information for software included in a group that operator U wants to check for vulnerabilities, and can more appropriately support the understanding of vulnerabilities contained in software.

[0170] As mentioned above, conventional technologies have several drawbacks, such as incomplete information obtained from external sites or actual devices, failure to reflect user policies, or small units for assessing the severity of vulnerabilities. As a result of these issues, the software identifier (e.g., software name) listed in the vulnerability information may not match the component name registered in the vulnerability management system. Such mismatches create a risk that vulnerability information may not be properly searched and may be overlooked. For example, suppose the software identifier listed in the vulnerability information is "log4j," and the vulnerability information related to "log4j" is managed in the vulnerability management system under component names such as "log4j-core" and "log4j-api." In this case, even if you search the vulnerability management system using the component name "log4j," you may not be able to find the vulnerability information for "log4j-core" or "log4j-api."

[0171] Furthermore, even if a package is listed in the SBM (Software Bill of Materials) under the package name "log4j-core," if a partial match search is possible using the string "log4j," "log4j-core" can be included in the search results even without prior registration of a correspondence. However, for example, if you want to search for an entire web server program using the string "httpd," and the search string and package name are completely different, such as "nginx," a simple partial match search will not work, and you will not get the desired results.

[0172] The information processing device 1, for example, can store dictionary information in advance, such as software products and their associated package information, and by appropriately linking them, it can prevent the oversight of vulnerability information due to mismatches in software identifiers, and can provide a mechanism for searching for accurate vulnerability information.

[0173] [System Configuration, etc.] Furthermore, the components of each part shown in the diagram are functional concepts and do not necessarily have to be physically configured as shown. In other words, the specific forms of distribution and integration of each device are not limited to those shown in the diagram, and all or part of them can be functionally or physically distributed and integrated in any unit according to various loads and usage conditions. In addition, all or any part of the processing functions performed by each device can be realized by a CPU and the program executed on that CPU, or by hardware using wired logic.

[0174] Furthermore, among the processes described in the embodiments above, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically by known methods. In addition, the processing procedures, control procedures, specific names, and information including various data and parameters shown in the above document and drawings can be arbitrarily changed unless otherwise specified.

[0175] [Hardware Configuration] The components of each illustrated device are functionally conceptual and do not necessarily need to be physically configured as shown. In other words, the specific forms of distribution and integration of each device are not limited to those shown, and all or part of them can be functionally or physically distributed and integrated in any unit depending on various loads and usage conditions. Furthermore, all or any part of the processing functions performed by each device can be realized by a CPU and the program that is analyzed and executed by that CPU, or by hardware using wired logic.

[0176] Furthermore, among the processes described in this embodiment, all or part of those described as being performed automatically can be performed manually using known methods. In addition, the processing procedures, control procedures, specific names, and information including various data and parameters shown in the drawings can be arbitrarily changed unless otherwise specified.

[0177] [Program] In one embodiment, the various devices constituting the information processing device 1 can be implemented by installing the aforementioned information processing program as package software or online software on a desired computer. For example, by having the information processing device execute the above information processing program, the various devices constituting the information processing device 1 can be made to function. The information processing device referred to here includes desktop or notebook personal computers. In addition, the category of information processing device also includes mobile communication terminals such as smartphones and mobile phones, and slate terminals such as PDAs (Personal Digital Assistants).

[0178] Figure 12 shows an example of a computer in which the information processing device 1 according to the embodiment is implemented. The computer 1000 has, for example, a memory 1010 and a CPU 1020. The computer 1000 also has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0179] Memory 1010 includes ROM (Read Only Memory) 1011 and RAM 1012. ROM 1011 stores, for example, a boot program such as BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1090. The disk drive interface 1040 is connected to the disk drive 1100. For example, a removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to, for example, a mouse 1110 and a keyboard 1120. The video adapter 1060 is connected to, for example, a display 1130.

[0180] The hard disk drive 1090 stores, for example, the OS 1091, application programs 1092, program modules 1093, and program data 1094. That is, the programs that define each process of the various devices constituting the information processing device 1 are implemented as program modules 1093 in which executable code for a computer is written. The program modules 1093 are stored, for example, in the hard disk drive 1090. For example, a program module 1093 for performing processes similar to the functional configurations of the various devices constituting the information processing device 1 is stored in the hard disk drive 1090. Note that the hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

[0181] Furthermore, the configuration data used in the processing of the embodiment described above is stored as program data 1094 in, for example, memory 1010 or hard disk drive 1090. The CPU 1020 then reads the program module 1093 and program data 1094 stored in memory 1010 or hard disk drive 1090 into RAM 1012 as needed and executes the processing of the embodiment described above.

[0182] Furthermore, the program module 1093 and program data 1094 are not limited to being stored in the hard disk drive 1090; for example, they may be stored in a removable storage medium and read by the CPU 1020 via a disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (LAN, WAN (Wide Area Network), etc.). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via a network interface 1070.

[0183] [Other] Although this embodiment has been described above, this embodiment is not limited by the description and drawings that constitute part of the disclosure. That is, all other embodiments, examples, and operational techniques made by those skilled in the art based on this embodiment are included in the scope of this embodiment.

[0184] 1 Information Processing Device 2 External System 3 Terminal Device 10 Communication Unit 20 Storage Unit 21 Dictionary Information Storage Unit 22 Vulnerability Information Storage Unit 23 Package Information Storage Unit 24 Vector Information Storage Unit 25 Cluster Information Storage Unit 30 Processing Unit 31 Reception Unit 32 Identifier Acquisition Unit 33 Vulnerability Information Acquisition Unit 34 Provision Unit 35 Package Information Acquisition Unit 36 ​​Linking Unit 37 Cluster Correction Unit 40 Vectorization Unit 41 Clustering Unit 42 Generation Unit U Operator

Claims

1. An information processing device comprising: a storage unit that stores identifier dictionary information, in which a first identifier, which is an identifier for each of a plurality of software packages, and a second identifier, which is a group identifier, are linked for each group; a reception unit that receives the designation of a target group or the designation of a second identifier for a target group; an identifier acquisition unit that obtains a plurality of first identifiers linked to the second identifier of the target group whose designation has been received by the reception unit from the identifier dictionary information; a vulnerability information acquisition unit that obtains software vulnerability information corresponding to each of the plurality of first identifiers obtained by the identifier acquisition unit; and a provision unit that provides the vulnerability information obtained by the vulnerability information acquisition unit.

2. The information processing apparatus according to claim 1, characterized in that the vulnerability information acquisition unit acquires software vulnerability information corresponding to each of the plurality of first identifiers acquired by the identifier acquisition unit from a vulnerability information database in which the first identifier and the software vulnerability information corresponding to the first identifier are linked for each first identifier.

3. The information processing apparatus according to claim 2, characterized in that the storage unit stores the vulnerability information database.

4. The information processing apparatus according to claim 1 or 2, characterized in that the first identifier is at least one of a software package identifier and an identifier for software included in the software package.

5. The information processing apparatus according to claim 1 or 2, wherein the receiving unit receives association information in which a first identifier, which is an identifier corresponding to each of a plurality of software packages, and a second identifier, which is a group identifier, are linked, and the received association information is added to the identifier dictionary information.

6. An information processing method to be executed by a computer having a storage unit that stores identifier dictionary information, in which a first identifier, which is an identifier for each of a plurality of software packages, and a second identifier, which is an identifier for a group, are linked for each group, comprising: a reception step of receiving a designation of a target group or a designation of a second identifier for a target group; an identifier acquisition step of obtaining a plurality of first identifiers linked to the second identifier of the target group whose designation was received in the reception step from the identifier dictionary information; a vulnerability information acquisition step of obtaining software vulnerability information corresponding to each of the plurality of first identifiers obtained in the identifier acquisition step; and a provision step of providing the vulnerability information obtained in the vulnerability information acquisition step.

7. An information processing program characterized by causing a computer having a storage unit that stores identifier dictionary information, in which a first identifier, which is an identifier for each of a plurality of software packages, and a second identifier, which is a group identifier, are linked for each group, to execute: an acceptance procedure for accepting the designation of a target group or the designation of a second identifier for a target group; an identifier acquisition procedure for obtaining a plurality of first identifiers linked to the second identifier of the target group whose designation was accepted by the acceptance procedure from the identifier dictionary information; a vulnerability information acquisition procedure for obtaining software vulnerability information corresponding to each of the plurality of first identifiers obtained by the identifier acquisition procedure; and a provision procedure for providing the vulnerability information obtained by the vulnerability information acquisition procedure.

Images