Patch application determination method and patch application determination device

Abstract

A criteria estimation unit (121) performs learning using, as training data, the survey results of a vulnerability handling survey regarding handling of information-security vulnerabilities, and estimates patch application determination criteria for determining whether to apply a security patch when a new vulnerability is disclosed. When a new vulnerability is disclosed, a patch application proposal unit (114) determines whether to apply a security patch to the new vulnerability on the basis of the patch application determination criteria, and outputs a patch application proposal indicating the determination result.

Description

Patch application determination method and patch application determination apparatus

[0001] The present disclosure relates to determining application of a security patch for an information security vulnerability.

[0002] In order to promote distribution of secure software, utilization of SBOM is being promoted. As part of OT security assessment services, technology for managing software vulnerabilities using SBOM is attracting attention. SBOM is an abbreviation for Software Bill of Materials. OT is an abbreviation for Operational Technology.

[0003] For a system administrator, accurately grasping vulnerability information is indispensable. On the other hand, a large amount of judgment material increases the work time required to determine patch application. Furthermore, SBOM has problems of false positives and false negatives, and integrating all information for judgment is considered to impose an extremely large work load. As a result, vulnerability response may be delayed, leading to social problems. Therefore, rapid determination of vulnerability response is required.

[0004] Patent Document 1 discloses a security test system for realizing a determination equivalent to that made by a user with knowledge of vulnerabilities. This system uses generative AI and LLM for information collection and answering questions. AI is an abbreviation for Artificial Intelligence. LLM is an abbreviation for Large Language Models.

[0005] However, Patent Document 1 does not disclose or suggest any proposal regarding whether to apply or not apply a patch for a new vulnerability. Further, Patent Document 1 does not disclose or suggest any proposal of patch application suitable for a target system by combining information input to generative AI with vulnerability information.

[0006] Japanese Patent No. 7488976

[0007] An object of the present disclosure is to enable support for determining application of a security patch for an information security vulnerability.

[0008] The patch application decision method described in this disclosure uses the results of a vulnerability response questionnaire regarding responses to information security vulnerabilities as training data to estimate patch application decision criteria for determining whether to apply security patches when new vulnerabilities are disclosed.

[0009] This disclosure will help in determining whether to apply security patches to information security vulnerabilities.

[0010] Configuration diagram of the patch application determination device 100 in Embodiment 1. Functional configuration diagram of the patch application determination device 100 in Embodiment 1. Flowchart of the patch application determination method (estimation) in Embodiment 1. Flowchart of the patch application determination method (proposed) in Embodiment 1. Diagram showing an overview of the estimation of the patch application criterion evaluation function in Embodiment 1. Hardware configuration diagram of the patch application determination device 100 in Embodiment 1.

[0011] In the embodiments and drawings, the same or corresponding elements are denoted by the same reference numeral. The descriptions of elements denoted by the same reference numeral as the described elements are omitted or simplified as appropriate. The arrows in the figures mainly indicate the flow of data or processing.

[0012] Embodiment 1. The method for determining whether to apply the patch will be explained based on Figures 1 to 6.

[0013] ***Configuration Description*** The configuration of the patch application determination device 100 will be described based on Figure 1. The patch application determination device 100 is a computer equipped with hardware such as a processor 101, memory 102, auxiliary storage device 103, communication device 104, and input / output interface 105. These hardware components are connected to each other via signal lines.

[0014] The processor 101 is an integrated circuit (IC) that performs arithmetic processing and controls other hardware. For example, the processor 101 is a CPU, DSP, GPU, or a combination of these. IC is an abbreviation for Integrated Circuit. CPU is an abbreviation for Central Processing Unit. DSP is an abbreviation for Digital Signal Processor. GPU is an abbreviation for Graphics Processing Unit.

[0015] Memory 102 is a volatile or non-volatile storage device. Memory 102 is also called main memory. For example, memory 102 is RAM. Data stored in memory 102 is saved to auxiliary storage device 103 as needed. RAM is an abbreviation for Random Access Memory.

[0016] The auxiliary storage device 103 is a non-volatile storage device. For example, the auxiliary storage device 103 is a ROM, HDD, flash memory, or a combination thereof. Data stored in the auxiliary storage device 103 is loaded into memory 102 as needed. ROM is an abbreviation for Read Only Memory. HDD is an abbreviation for Hard Disk Drive.

[0017] The communication device 104 is a receiver and transmitter. For example, the communication device 104 is a communication chip or NIC. Communication of the patch application determination device 100 is performed using the communication device 104. NIC is an abbreviation for Network Interface Card.

[0018] The input / output interface 105 is a port to which input and output devices are connected. For example, the input / output interface 105 is a USB terminal, the input devices are a keyboard and mouse, and the output device is a display. Input and output of the patch application determination device 100 are performed via the input / output interface 105. USB is an abbreviation for Universal Serial Bus.

[0019] The patch application determination device 100 comprises elements such as a data acquisition unit 111, a trend analysis unit 112, an analysis result determination unit 113, a patch application proposal unit 114, a standard estimation unit 121, and a questionnaire regeneration unit 122. These elements are implemented by software.

[0020] The auxiliary storage device 103 stores a patch application judgment program that enables the computer to function as a data acquisition unit 111, a trend analysis unit 112, an analysis result determination unit 113, a patch application proposal unit 114, a standard estimation unit 121, and a questionnaire regeneration unit 122. The patch application judgment program is loaded into memory 102 and executed by the processor 101. The auxiliary storage device 103 also stores the OS. At least a portion of the OS is loaded into memory 102 and executed by the processor 101. The processor 101 executes the patch application judgment program while executing the OS. OS is an abbreviation for Operating System.

[0021] The data for the patch application decision program (input data, output data, etc.) is stored in the storage unit 190. Memory 102 functions as the storage unit 190. However, storage devices such as auxiliary storage device 103, registers in the processor 101, and cache memory in the processor 101 may function as the storage unit 190 instead of memory 102, or together with memory 102.

[0022] The patch application determination program can be recorded (stored) in a computer-readable format on a non-volatile recording medium such as an optical disc or flash memory.

[0023] Figure 2 shows the functional configuration of the patch application determination device 100. The data acquisition unit 111, trend analysis unit 112, analysis result determination unit 113, and patch application proposal unit 114 are implemented, for example, as a generation AI 110. The generation AI 110 is a generation AI for trend analysis. AI is an abbreviation for artificial intelligence. The generation AI is an example of a learning model. A learning model is also called a machine learning model or a trained model. The questionnaire storage unit 191 and the analysis result storage unit 192 are included in the storage unit 190.

[0024] ***Explanation of Operation*** The operation procedure of the patch application determination device 100 corresponds to the patch application determination method. Furthermore, the operation procedure of the patch application determination device 100 corresponds to the processing procedure of the patch application determination program.

[0025] Based on Figure 3, the patch application decision method (estimation) will be explained. The patch application decision method (estimation) involves conducting a vulnerability response questionnaire, using the results of the questionnaire as training data, and then estimating the criteria for patch application.

[0026] The vulnerability response survey is a questionnaire about responses to known vulnerabilities in information security.

[0027] Patch application criteria are data that outlines the standards for applying security patches when new vulnerabilities are disclosed.

[0028] In step S110, the data acquisition unit 111 acquires the survey results and stores the survey results in the survey storage unit 191.

[0029] The survey results are obtained as follows: First, the user conducts a vulnerability response survey with multiple system administrators. Next, the user generates survey data 181 and inputs the survey data 181 into the patch application determination device 100. The survey data 181 shows multiple questions from the vulnerability response survey and multiple survey results obtained from multiple system administrators. Then, the data acquisition unit 111 receives the input survey data 181 and stores the survey data 181 in the survey storage unit 191.

[0030] Furthermore, the data acquisition unit 111 acquires system data 182. System data 182 is data that indicates information about an information system and includes asset information and a software bill of materials. For example, a user generates system data 182 that indicates information about multiple information systems corresponding to multiple system administrators and inputs the system data 182 to the patch application determination device 100. The data acquisition unit 111 then acquires the input system data 182.

[0031] Furthermore, the data acquisition unit 111 acquires vulnerability information 183 regarding known vulnerabilities. Vulnerability information 183 is data that shows information about vulnerabilities and includes a vulnerability score. Examples of vulnerability scores are the CVE score and the CVSS score. For example, the data acquisition unit 111 acquires vulnerability information 183 from a vulnerability database. CVE is an abbreviation for Common Vulnerabilities and Exposures. CVSS is an abbreviation for Common Vulnerability Scoring System.

[0032] In step S120, the criteria estimation unit 121 uses the survey results as training data to perform learning and estimate the criteria for deciding whether to apply the patch.

[0033] Patch application criteria are data that outlines the standards for deciding whether to apply security patches when new vulnerabilities are disclosed.

[0034] The criteria for deciding whether to apply the patch are estimated as follows: The generating AI 110 learns using the survey results, system data 182, and vulnerability information 183 as training data, and performs a multi-objective optimization calculation to estimate a multivariable higher-order function. The multi-objective optimization calculation is performed by the criterion estimation unit 121. The multivariable higher-order function is the function used as the criteria for deciding whether to apply the patch. The multivariable higher-order function is stored in the analysis result storage unit 192.

[0035] In step S130, the trend analysis unit 112 compiles the survey results.

[0036] The survey results are compiled as follows. In survey data 181, the survey results are quantified. For example, survey data 181 shows a numerical value that identifies the option selected as the answer for each multiple-choice question. For example, five options are identified by a numerical value from 1 to 5. The trend analysis unit 112 uses survey data 181 to compile the quantified survey results for each question in the vulnerability response survey.

[0037] Data obtained by aggregating questionnaire results is referred to as questionnaire aggregation results.

[0038] The description of step S130 will be continued. A trend analysis unit 112 generates a trend analysis result based on the questionnaire aggregation results.

[0039] The trend analysis result is data indicating a trend of responses to information security vulnerabilities. The trend analysis result is stored in an analysis result storage unit 192.

[0040] The trend analysis result is generated as follows. The trend analysis unit 112 inputs the questionnaire aggregation results, system data 182, and vulnerability information 183, and generates the trend analysis result using generative AI 110. The generative AI 110 performs learning using the questionnaire aggregation results, system data 182, and vulnerability information 183 as learning data, and generates the trend analysis result.

[0041] In step S140, an analysis result determination unit 113 determines whether the trend analysis result is correct.

[0042] Whether the trend analysis result is correct is determined as follows. First, the analysis result determination unit 113 determines whether to apply a security patch for a known vulnerability indicated in the vulnerability information 183 based on the trend analysis result. Next, the analysis result determination unit 113 outputs the determination result. For example, the analysis result determination unit 113 displays the determination result on a display. Next, a user determines whether the determination result output for the known vulnerability is correct, and inputs the determination result to the patch application determination apparatus 100. An example of the user is a system administrator. Then, the analysis result determination unit 113 accepts the input determination result as the determination result regarding the correctness of the trend analysis result.

[0043] If it is determined that the trend analysis result is correct, the process ends. If it is determined that the trend analysis result is not correct, the process proceeds to step S150.

[0044] In step S150, a questionnaire regeneration unit 122 generates a new question and outputs data indicating the new question (question data).

[0045] For example, the questionnaire regeneration unit 122 generates a new question for each system administrator. For example, the questionnaire regeneration unit 122 acquires a new question from the question dataset. For example, the questionnaire data 181 indicates priority items for vulnerability response for each system administrator. Further, the question dataset indicates a plurality of questions for each item. Then, the questionnaire regeneration unit 122 acquires, from the question dataset, a new question associated with the same item as the system administrator's priority item for each system administrator. The priority item indicates an item that is prioritized in response to a vulnerability. An example of the priority item is the cost required for response to a vulnerability.

[0046] After step S150, the process proceeds to step S110. In this case, the user re-conducts the vulnerability response questionnaire using the new question. Then, the data acquisition unit 111 acquires a new questionnaire result (step S110). Next, the criterion estimation unit 121 learns the new questionnaire result and estimates a patch application determination criterion (step S120). Next, the trend analysis unit 112 aggregates the new questionnaire results and generates a new trend analysis result (step S130). Then, the analysis result determination unit 113 determines whether the new trend analysis result is correct or incorrect (step S140). If it is determined that the new trend analysis result is correct, the process ends. If it is determined that the new trend analysis result is not correct, the process proceeds to step S150 again.

[0047] The proposed patch application determination method will be described with reference to FIG. 4. When a new vulnerability related to information security is disclosed, the proposed patch application determination method determines application of a security patch for the new vulnerability based on a patch application determination criterion, and outputs a patch application proposal 184.

[0048] The patch application proposal 184 is data indicating a result of determination based on a patch application determination criterion regarding application of a security patch for a new vulnerability.

[0049] In step S160, the data acquisition unit 111 acquires vulnerability information 183 about a new vulnerability.

[0050] For example, the data acquisition unit 111 acquires vulnerability information 183 about a new vulnerability from the vulnerability database.

[0051] Furthermore, the data acquisition unit 111 acquires system data 182.

[0052] In step S170, the patch application proposal unit 114 makes a decision on whether to apply a security patch to the new vulnerability based on the vulnerability information 183 and the patch application decision criteria.

[0053] The decision regarding the application of security patches to new vulnerabilities is made as follows: The patch application proposal unit 114 uses the vulnerability information 183 and system data 182 as input and generates a decision result regarding the application of security patches to new vulnerabilities using the generating AI 110. The generating AI 110 uses the vulnerability information 183 and system data 182 to perform a multi-objective optimization calculation and calculates the optimal solution of a multivariable higher-order function used as a patch application decision criterion. The optimal solution of the multivariable higher-order function becomes the decision result.

[0054] In step S180, the patch application proposal unit 114 generates a patch application proposal 184 that indicates the result of its decision regarding the application of a security patch for a new vulnerability, and outputs the patch application proposal 184.

[0055] For example, the patch application suggestion unit 114 displays the patch application suggestion 184 on the display.

[0056] The system administrator will make a decision regarding the application of security patches, referring to Patch Application Proposal 184. The system administrator will then decide whether to apply security patches to the information system (maintenance) or to continue operating the information system without applying security patches.

[0057] ***Supplementary Information on Configuration and Operation*** Supplementary information on the vulnerability response questionnaire. The vulnerability response questionnaire includes one or more questions for each of the following items, for example: (1) Current status of vulnerability management. (2) Experience with false positives and false negatives. (3) Prioritization of vulnerability response. (4) Assessment of vulnerability severity. (5) Setting acceptable vulnerability levels. (6) Assessment of trade-offs in vulnerability response. (7) Areas for improvement and feedback. Questions in the vulnerability response questionnaire include multiple-choice questions and open-ended questions. Multiple-choice questions have multiple answer options, and one or more options may be selected. Questions with a single option may have multiple options that represent degrees such as frequency, reliability, or impact.

[0058] A vulnerability response questionnaire is designed to understand the thinking patterns of system administrators regarding vulnerability response. It is conducted to measure the allocation of response costs and the level of vulnerability risk tolerance. In other words, the vulnerability response questionnaire is used to determine the extent and cost of addressing vulnerabilities.

[0059] The vulnerability response survey is conducted in two stages: a weighting survey and a vulnerability response survey, in order to optimize it with as few questions as possible. The weighting survey has the following characteristics: The weighting survey investigates what is given the most importance. For example, the weighting survey investigates whether to completely eliminate false positives or to prioritize cost. Questions are generated that make it easier to reflect the thinking of the survey respondents. The vulnerability response survey has the following characteristics: The priority of responses when vulnerabilities are found is quantified. In the vulnerability response survey, the results of the trend analysis are displayed, and survey respondents are asked to rate whether they are satisfied or not. The survey is repeated until the survey respondents are satisfied.

[0060] Let me add some information about system data 182. System data 182 is data used to link system configuration with vulnerabilities.

[0061] System data 182 includes asset information and SBOM. Asset information is information that allows us to understand the hierarchical structure of the entire system. SBOM is a software bill of materials.

[0062] System data 182 includes asset information to assess the impact on the entire system. Examples of asset information are shown below. "Product Name" indicates the name of the asset. "Product ID" indicates the asset's identification ID. "IP Address" indicates the IP address assigned to the asset. "MAC Address" indicates the asset's MAC address. "Type" indicates whether it is an information system, network system, or control system. "Layer" indicates which layer the asset is located on (master-slave relationship). "Function" indicates its role, such as data storage or command issuance. "Connected Network" indicates how the asset is connected to which equipment or device. "Installation Location" indicates where the asset is installed. "Construction Vendor / Equipment Manufacturer" indicates the provider of the asset. "OS Type / Version" indicates the asset's OS type (including distribution) and version. "Protocol" indicates the communication protocol used by the asset. "Data Path and Type" indicates the data (including commands) type and path (sender, relay, receiver). "Connection type" refers to types such as WAN, LAN, dedicated line, internet, wireless, and wired.

[0063] Vulnerability information 183 shows the CVE score and CVSS score.

[0064] To elaborate on patch application proposal 184, the patch application proposal unit 114 proposes vulnerability countermeasures based on trend analysis results and vulnerability information. Specifically, patch application proposal 184, which proposes a decision including the costs involved in applying the patch, shows the costs and the risks of not addressing the vulnerability.

[0065] The generating AI 110 makes patch application decisions based on the trends of the survey respondents. For example, the generating AI 110 determines where and what to apply. The patch application proposal 184 shows how much it will cost and what the risks are if the patch is not applied, as a result of the patch application decision. Ultimately, it is the user who applies the patch.

[0066] Further details regarding the trend analysis unit 112 are provided. The trend analysis unit 112 aggregates the survey results, analyzes the trends using the generation AI 110, and enables the generation AI to act as a proxy for the survey respondents. The trend analysis unit 112 quantifies the survey results and derives a vulnerability response score.

[0067] Let me elaborate on the analysis result determination unit 113. The analysis result determination unit 113 makes a decision on patch application for specific examples of vulnerability countermeasures based on the trend analysis results and outputs the decision result.

[0068] Let me add some information about the reference estimation unit 121. The reference estimation unit 121 performs multi-objective optimization calculations. Multi-objective optimization calculations are a calculation method for training the generating AI 110 on the survey results. Multi-objective optimization calculations find the optimal value to solve a problem involving multiple factors. The results of the multi-objective optimization calculations are stored in the analysis result storage unit 192.

[0069] Let me add some details about the questionnaire regeneration unit 122. The questionnaire regeneration unit 122 regenerates questions to ask respondents to answer the questionnaire again if the thinking tendencies in the first questionnaire do not match the respondents' judgments. The questionnaire regeneration unit 122 re-examines the questionnaire, focusing on the items extracted in the weighted survey.

[0070] ***Features of Embodiment 1*** The patch application decision method learns from known vulnerabilities published in the vulnerability database using the following training data. The training data includes information such as countermeasures, system asset information, system software bill of materials, exploitability score, and vulnerability response questionnaire results. The vulnerability response questionnaire results include a description of the cost focus limit. An example of the vulnerability database is CVE. An example of the software bill of materials is SBOM.

[0071] The patch application decision method outputs estimated patch application criteria as a result when a new vulnerability is disclosed. The patch application criteria indicate, to the extent that system administrators can respond to the risks of the new vulnerability, when the patch should be applied and what level of risk is involved if the patch is not applied.

[0072] The patch application decision-making method involves repeatedly training a generating AI to understand the thought processes of system administrators based on publicly disclosed vulnerabilities and estimated patch application criteria. In this process, a satisfactori-based tradeoff method is used to find the optimal solution to a multivariable higher-order function.

[0073] Figure 5 shows an overview of the estimated patch application criteria evaluation function. The black circles represent the weights for each priority item (cost and risk) for each disclosed vulnerability. The curve represents the patch application criteria evaluation function. For example, if the weights for the priority items are above the curve, it is decided to apply a security patch.

[0074] ***Effects of Embodiment 1*** Conventionally, when a new vulnerability is disclosed, the task of deciding whether or not to apply a patch is enormous. Embodiment 1 improves work efficiency by using a generative AI that has learned from survey results to make suggestions. This enables early response to vulnerabilities. Embodiment 1 reduces an optimization problem with multiple variables into a single function of thinking tendencies. This makes it possible to decide whether or not to apply a patch using only one variable, the new vulnerability.

[0075] ***Supplement to Embodiment 1*** Based on Figure 6, the hardware configuration of the patch application determination device 100 will be described. The patch application determination device 100 includes a processing circuit 109. The processing circuit 109 is hardware that implements a data acquisition unit 111, a trend analysis unit 112, an analysis result determination unit 113, a patch application proposal unit 114, a standard estimation unit 121, and a questionnaire regeneration unit 122. The processing circuit 109 may be dedicated hardware, or it may be a processor 101 that executes a program stored in memory 102.

[0076] If the processing circuit 109 is dedicated hardware, the processing circuit 109 may be, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC, an FPGA, or a combination thereof. ASIC is an abbreviation for Application Specific Integrated Circuit. FPGA is an abbreviation for Field Programmable Gate Array.

[0077] The patch application determination device 100 may include multiple processing circuits that replace the processing circuit 109.

[0078] In the processing circuit 109, some functions may be implemented by dedicated hardware, while the remaining functions may be implemented by software or firmware.

[0079] Thus, the functions of the patch application determination device 100 can be realized by hardware, software, firmware, or a combination thereof.

[0080] Embodiment 1 is an example of a preferred embodiment and is not intended to limit the technical scope of this disclosure. Embodiment 1 may be implemented in part or in combination with other embodiments. The procedure described using flowcharts, etc., may be modified as appropriate.

[0081] The word "part" in each element of the patch application determination device 100 may be read as "processing," "step," "circuit," or "circuit."

[0082] 100 Patch application determination device, 101 Processor, 102 Memory, 103 Auxiliary storage device, 104 Communication device, 105 Input / output interface, 109 Processing circuit, 110 Generation AI, 111 Data acquisition unit, 112 Trend analysis unit, 113 Analysis result determination unit, 114 Patch application proposal unit, 121 Criteria estimation unit, 122 Questionnaire regeneration unit, 181 Questionnaire data, 182 System data, 183 Vulnerability information, 184 Patch application proposal, 190 Storage unit, 191 Questionnaire storage unit, 192 Analysis result storage unit.

Claims

1. A patch application decision method that uses the results of a vulnerability response questionnaire regarding responses to information security vulnerabilities as training data to estimate patch application decision criteria for determining whether to apply security patches when new vulnerabilities are disclosed.

2. The patch application determination method according to claim 1, wherein the vulnerability response questionnaire is conducted again using new questions, and each time the vulnerability response questionnaire is conducted, the results of the questionnaire are used as training data to perform a multi-objective optimization calculation to estimate a multivariable higher-order function used as the patch application determination criterion.

3. The patch application determination method according to claim 2, wherein the patch application determination method comprises aggregating the survey results to generate survey aggregation results, generating trend analysis results showing trends in responses to information security vulnerabilities based on the survey aggregation results, determining whether the trend analysis results are correct or incorrect, and conducting the vulnerability response survey again each time the trend analysis results are determined to be incorrect.

4. The patch application determination method according to claim 3, wherein the method determines whether to apply security patches to existing vulnerabilities based on the trend analysis results, outputs the determination result, and accepts the determination of whether the determination result is correct or incorrect as the determination of whether the trend analysis results are correct or incorrect.

5. The patch application determination method according to claim 3 or claim 4, wherein a new question is generated each time the trend analysis result is determined to be incorrect.

6. A patch application determination method according to any one of claims 1 to 5, which, when a new vulnerability is disclosed, determines whether to apply a security patch to the new vulnerability based on the patch application determination criteria, and outputs a patch application proposal indicating the determination result.

7. A patch application decision device equipped with a criteria estimation unit that uses the results of a vulnerability response questionnaire regarding responses to information security vulnerabilities as training data to estimate patch application decision criteria for determining the application of security patches when new vulnerabilities are disclosed.

8. The patch application determination device according to claim 7, wherein the vulnerability response questionnaire is conducted again using new questions, and each time the vulnerability response questionnaire is conducted, the criteria estimation unit uses the results of the questionnaire as training data to perform a multi-objective optimization calculation to estimate a multivariable higher-order function that serves as the patch application determination criterion.

9. The patch application determination device according to claim 8, comprising: a trend analysis unit that aggregates the survey results to generate survey aggregation results and generates trend analysis results showing trends in responses to information security vulnerabilities based on the survey aggregation results; and an analysis result determination unit that determines whether the trend analysis results are correct or incorrect, wherein the vulnerability response survey is conducted again each time the trend analysis results are determined to be incorrect.

10. The patch application determination device according to claim 9, wherein the analysis result determination unit determines whether to apply security patches to existing vulnerabilities based on the trend analysis results, outputs the determination result, and accepts the determination of whether the determination result is correct or incorrect as a determination of whether the trend analysis results are correct or incorrect.

11. The patch application determination device according to claim 9 or claim 10, further comprising a questionnaire regeneration unit that generates a new question each time the trend analysis result is determined to be incorrect.

12. A patch application determination device according to any one of claims 7 to 11, comprising a patch application proposal unit that, when a new vulnerability is disclosed, determines whether to apply a security patch to the new vulnerability based on the patch application determination criteria and outputs a patch application proposal indicating the determination result.

Images