JP2010117887A - Vulnerability determining device, vulnerability determination method, and vulnerability determination program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a vulnerability determining device, a vulnerability determination method, and a vulnerability determination program for resolving the problems, wherein the vulnerability of a program is determined by only a particular development information. <P>SOLUTION: The vulnerability determining device 1 includes a development information storage unit 20 for storing development information 21a, 21b, 21c categorized based on their respective kinds and associated with one another; and a vulnerability information storing unit 30 for storing vulnerability information 31. The vulnerability determination device 1 includes a determination processing unit 10 determining the vulnerability of the program, on the basis of the development information 21a, 21b, 21c, 50 to be determined and vulnerability information 31 stored in the vulnerability information storage unit 30, while including also the development information 21a, 21b, 21c of the kind, associated with the kind of development information 50 to be determined, when the vulnerability of the development information 50 of a predetermined kind is determined. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a vulnerability determination device, a vulnerability determination method, and a vulnerability determination program, and more particularly to a vulnerability determination device, a vulnerability determination method, and a vulnerability determination program for determining the vulnerability of a program.

The system for determining the vulnerability executes the determination of the vulnerability by inputting a keyword related to the program for determining the vulnerability. For example, when a user develops a program to be determined for vulnerability with JAVA (registered trademark), the vulnerability determination system uses JRE (Java Runtime Environment) (registered trademark) used when executing this program. ) As a keyword to search for program vulnerabilities.
In the system for searching for vulnerabilities described in Non-Patent Document 1, when the user determines the vulnerability of the program, the user inputs a desired keyword related to the program, and the vulnerability information corresponding to the input keyword is entered. Search from the database where vulnerability information is stored and display it.

  Further, Patent Document 1 relates to vulnerabilities stored in vulnerability keyword DBs (DataBase) such as privilege escalation, DoS (Denial of Service attack), XSS (Cross Site Scripting), and HTTP (Hyper Text Transfer Protocol). Vulnerability to be investigated using keywords related to products stored in the product DB, such as operating system names, OS (Operating System) names, HW (HardWare) names, used SW (SoftWare) names, and used library names. A technique for effectively presenting sex information is disclosed. Also in the device described in Patent Document 1, when a user determines the vulnerability of a program, as in Non-Patent Document 1, a keyword related to the program is input, and the vulnerability indicated by the input keyword is input. This can be done by searching for sex information.

On the other hand, when creating a program in software development or system development, development information such as a development document, a source code, and a program is created at each development stage.
However, when the vulnerability is determined by inputting a keyword as described above, the vulnerability of the program may be determined based only on specific development information depending on how the user searches. . For example, the vulnerability is determined using only keywords that can be confirmed from the source code, such as determining the vulnerability of a library function used in the program.

Patent Document 2 discloses a technique for managing in cooperation the product created in software development, the change factor of the product, and information related to the test.
In Patent Document 3, a plurality of data files are acquired via a network, and necessary information is acquired from the acquired data files using an ontology that is a relationship description between a predetermined clipping rule and a term. A technique is disclosed that can automatically extract catalogs of various areas that are open to the public by extracting.

Furthermore, in Patent Document 4, customers and product development personnel are identified by determining vulnerabilities in security measures for products created using support tools based on data on vulnerabilities recorded in a database. A technology that can determine a vulnerability regardless of the level of knowledge and experience regarding security is disclosed.
Further, in Patent Document 5, a Web (World Wide Web) page corresponding to an input URL (Uniform Resource Locator) is acquired, and a Web page corresponding to a URL serving as a link included in the acquired Web page is acquired. A technique that can collect a wide range of disclosed vulnerability information by repeating the process is disclosed.
JP 2007-058514 A JP 2003-122570 A JP 2004-062446 A JP 2007-122372 A JP 2008-197877 A Independent Administrative Institution Information Processing Promotion Organization (IPN), etc., JVN iPedia Vulnerability Countermeasure Information Database, [online], [October 23, 2008 search], Internet <URL: http://jvnd.jvn.jp/>

  When the vulnerability is determined by the technique described in the background art, there is a problem that the vulnerability of the program is determined only by specific development information.

  An object of the present invention is to provide a vulnerability determination device, a vulnerability determination method, and a vulnerability determination that can solve the problem of determining the vulnerability of a program only by specific development information, which is a problem as described above. To provide a program.

  The vulnerability determination device according to the present invention includes a development information storage unit that stores development information classified according to type in association with each other, a vulnerability information storage unit that stores vulnerability information, and a predetermined type of development. When determining vulnerability for information, the development information of the type associated with the type of development information to be determined is also included in the determination target, and stored in the determination target development information and the vulnerability information storage unit. And a determination processing unit for determining the vulnerability of the program based on the vulnerability information.

  According to the present invention, it is possible to provide a vulnerability determination device, a vulnerability determination method, and a vulnerability determination program that can solve the problem of determining the vulnerability of a program only by specific development information.

Embodiment 1 of the Invention
FIG. 1 is a block diagram showing an outline of the vulnerability determination device according to the first exemplary embodiment of the present invention.
Here, the vulnerability in the embodiment of the present invention refers to a factor that hinders proper execution of a program. For example, the hardware on which the program operates, the OS on which the program operates, the defects, bugs, misconfigurations, and specification problems of the program itself, system hijacking due to program malfunction or unauthorized access, information This refers to factors that cause leakage and data alteration.

The vulnerability determination device 1 includes a determination processing unit 10, a development information storage unit 20, and a vulnerability information storage unit 30.
The determination processing unit 10 determines the vulnerability of the development information using the vulnerability information stored in the vulnerability information storage unit 30.

  The development information storage unit 20 stores one or more development information records including the development information record 21. The development information record 21 includes development information 21a, 21b, and 21c. Each of the development information 21a, 21b, and 21c includes one or a plurality of development information. The development information included in the development information 21a, 21b, and 21c is related by the unit of the development information record.

Here, the development information is information related to program development. Development information is divided into, for example, developer information on the developer of the program to be developed, development / introduction environment information indicating the development environment and operating environment of the program to be developed, development documents, source code, and the developed program. It is done.
The developer information 21a, 21b, 21c includes different types of development information. The development information 21b is development information created based on different types of development information 21a, and the development information 21c is development information created based on different types of development information 21b.
The vulnerability information storage unit 30 stores one or more pieces of vulnerability information including vulnerability information 31 that is information related to the vulnerability.

Next, processing of the vulnerability determination device illustrated in FIG. 1 will be described.
First, the determination processing unit 10 receives an input of a predetermined type of development information 50 for determining vulnerability. Here, the development information 50 is program development information, and is development information associated with the development information record 21. The development information 50 is development information in the type of development information 21c.
Next, the determination processing unit 10 also includes the development information of the types of development information 21a, 21b, and 21c related to the type of the development information 50 in the vulnerability determination target.
Then, the determination processing unit 10 determines the vulnerability based on the vulnerability information stored in the vulnerability information storage unit 30 for the development information 21a, 21b, and 21c and the development information 50 as the determination target. By doing so, determine the vulnerability of the program.

  Note that the determination process may be executed with only the development information stored in advance in the development information storage unit 20 as a determination target without including the development information input to the vulnerability determination device 1. For example, instead of the development information 50, information indicating the development information of the development information 21c is input to the determination processing unit 10, and the development information of the types of development information 21a and 21b related to the development information 21c is included in the vulnerability determination target. Vulnerability may be determined for the development information of the development information 21a, 21b, and 21c.

FIG. 2 is a block diagram showing details of the vulnerability determination device according to the first exemplary embodiment of the present invention.
The vulnerability determination apparatus 100 includes an input control processing unit 110, a rule selection processing unit 120, a determination processing unit 130, a development information repository control processing unit 140, a development information repository 141, a vulnerability DB control processing unit 150, a vulnerability DB 151, and an output. A processing unit 160, a public vulnerability information acquisition processing unit 170, and a vulnerability DB processing unit 180 are provided.

The input control processing unit 110 processes the input of development information or vulnerability determination request that is a vulnerability determination target.
The rule selection processing unit 120 performs a process of selecting a vulnerability information determination rule corresponding to each development stage of development information to be determined for vulnerability.
The determination processing unit 130 determines the vulnerability of the development information using the vulnerability record stored in the vulnerability information storage unit 151.
The development information repository control processing unit 140 performs processing for searching and acquiring desired development information from the development information stored in the development information repository 141, and processing for registering desired development information in the development information repository 141.

The vulnerability DB control processing unit 150 performs processing for searching for and acquiring a desired vulnerability record from the vulnerability records stored in the vulnerability DB 151 and processing for registering the desired vulnerability record in the vulnerability DB 151.
The output processing unit 160 performs a process of outputting the vulnerability determination result.
The public vulnerability information acquisition processing unit 170 performs processing for acquiring information related to public vulnerability via an arbitrary network 200 such as the Internet (registered trademark), an intranet, and a telephone line network.
The vulnerability DB processing unit 180 performs processing for creating a vulnerability record 152 for registration in the vulnerability DB 151 from information on the vulnerability acquired by the public vulnerability information acquisition processing unit 170. The public vulnerability information acquisition processing unit and the vulnerability DB processing unit function as a vulnerability information processing unit.

The development information repository 141 stores one or more project records including the project record 142. The project record 142 includes a project ID 142a, developer information 142b, development / introduction environment information 142c, a document 142d, a source code 142e, a program 142f, and a keyword 142g.
The developer information 142b, the development / introduction environment information 142c, the document 142d, the source code 142e, the program 142f, and the keyword 142g each include one or a plurality of development information of different development stages.

Note that information that is not a general product in program development, such as developer information 142b, development / introduction environment information 142c, and keyword 142g, may be development information in an arbitrary development stage. In the present embodiment, the developer information 142b is the development stage of the most upstream process, and the development / introduction environment information 142c, the document 142d, the source code 142e, the program 142f, the keyword 142g, and the development stage of the downstream process in order. .
The development information repository 141 corresponds to a development information storage unit, and the project record 142 corresponds to a development information record.

The project ID 142a is information indicating a project identifier. The project ID is assigned in units of projects for developing software or systems. That is, the development information included in the project record 142 is associated with the project ID 142a. The project ID may be assigned in an arbitrary unit different from the present embodiment.
The developer information 142b is information related to the developer of the program such as the name of the developer, details of the person in charge of development, contact information such as an e-mail address and a telephone number. In this case, the content in charge of development is information indicating which function or module the developer is in charge of, for example, in system development. Note that information indicating skills and experiences such as the number of years involved in the developer's project may be added to the constituent elements of the developer information 142b. If the information is related to the developer, the content illustrated in the present embodiment is used. Not limited.

The development / introduction environment information 142c is information indicating an environment for developing a program such as a development language, a used library, related software and a development tool, and an environment where a developed program such as an OS, a used library and a related system is operated.
The document 142d is document information related to the development of a requirement specification, basic design, detailed design, and the like.
The source code 142e is a program source code.
The program 142f is a program.
The keyword 142g is information indicating a search key that has already been used in determining the vulnerability. The keyword 142g and the search key will be described in detail later.

The project record 142 may have a configuration in which arbitrary development information other than the development information described above is added, or may be a configuration in which any development information is excluded from the development information described above, and is exemplified in the present embodiment. It is not limited to the configuration.
Further, the development information of all the development stages described above from the beginning of the development may not be stored in the project record 142, and the development information may be added sequentially according to the development stage.
Further, the project record 142 and the development information stored in the development information repository 141 may all be stored on the same disk, or distributedly stored on different disks or different devices to link the development information. It is good. For example, development information may be distributed and stored on different disks, managed in association with the project ID 142a, or may be linked using symbolic links.

The vulnerability DB 151 stores one or more vulnerability records including the vulnerability record 152. The vulnerability DB 151 corresponds to a vulnerability information storage unit, and the vulnerability record 152 corresponds to vulnerability information.
The vulnerability record 152 includes a vulnerability information ID, which is information indicating an identifier of the vulnerability information, a vulnerability target name and a vulnerability content that are keywords for determining the vulnerability, and a software or system to be developed. Information on the impact level, related vendors, and vulnerability judgment priority.

The vulnerability information ID is information for identifying vulnerability information. Classification is performed according to the range of ID, and each class is associated with the development stage of development information.
The target name of the vulnerability is information that becomes a keyword for determining the presence or absence of the vulnerability of the program from the development information. For example, DoS (attack method), JRE (SW name), and the like.
The content of the vulnerability is more specific information than the vulnerability indicated by the target name. For example, when there is a vulnerability in a certain library function, this is an example of source code description using that function. A part of the description of the vulnerability can be extracted and used as a keyword for determining whether or not the program is vulnerable.
The degree of influence is information indicating the influence on the software or system, and an arbitrary stage may be set.

The related vendor is the name of the vendor of the product if the vulnerability is related to the product.
The priority of vulnerability determination is information indicating the priority when determining the vulnerability. For example, this priority order is referred to when vulnerability determination is performed from a vulnerability record having a higher priority order. The priority is also referred to when vulnerability determination is performed up to a vulnerability record having a specific priority, and a vulnerability record having a lower priority than that is not determined. Furthermore, the order in which the determination result 500 is output may be determined based on the order based on the priority order.
The vulnerability record 152 may have a configuration in which an arbitrary component other than the above-described components is added, or may be a configuration in which an arbitrary component is excluded from the above-described components, and is exemplified in the present embodiment. The configuration is not limited.

Next, processing of the vulnerability determination device illustrated in FIG. 2 will be described.
With reference to the flowchart of FIG. 3, processing for acquiring information related to vulnerability in the vulnerability determination apparatus illustrated in FIG. 2 will be described.
First, the public vulnerability information acquisition processing unit 170 acquires information on the publicly disclosed vulnerability via the network (S710).

Here, the process of acquiring information related to the disclosed vulnerability may be executed periodically or automatically, or may be executed manually.
Information on vulnerabilities that are publicly available may be obtained from a site on the Internet (registered trademark) or obtained from an information processing device such as a PC (Personal Computer) or server installed in the company via the network. May be. Further, the information on the vulnerability may be obtained by receiving an e-mail in which information on the vulnerability is described, and the e-mail in which the information on the vulnerability is described can be obtained from a PC (Personal Computer), a mail server, or the like. You may make it acquire from an information processing apparatus. In addition, the public vulnerability information acquisition processing unit 170 may be provided with a function for capturing information from a publication so that information on the vulnerability may be acquired from the publication. The vulnerability input from an input device such as a keyboard or a mouse may be obtained. Information may be acquired.

  Next, the vulnerability DB processing unit 180 creates a vulnerability record 152 from the acquired information on the vulnerability and outputs it to the vulnerability DB control processing unit 150. The vulnerability DB control processing unit 150 stores the input vulnerability record 152 in the vulnerability DB 151 (S720).

Next, processing for determining vulnerability by the vulnerability determination device shown in FIG. 2 will be described using the flowchart of FIG.
First, when registering predetermined development information in the development information repository 141, the input control processing unit 110 receives input of the development information 300 to be registered. Here, the development information 300 is development information registered in the project record 142.
On the other hand, when determining the vulnerability without registering the development information in the development information repository 141, the input control processing unit 110 receives the input of the vulnerability determination request 400. The vulnerability determination request 400 includes a project ID of a project for which vulnerability determination is to be performed.

The input control processing unit 110 creates a determination target list that is information indicating the determination target of vulnerability based on the input information (S810).
Here, the detailed processing of step S810 will be described with reference to the flowchart of FIG.
First, the input control processing unit 110 acquires the input development information 300 or the vulnerability determination request 400 (S821).

Next, when the development information 300 to be registered in the development information repository is input, the development information in the development stage of the upstream process including the development stage of the input development information is determined as a determination target (S822, S823). For example, when registering the source code as the development information 300, the developer information 142b, the development / introduction environment information 142c, the document 142d, and the development information of the source code 142e are determined.
Only the development information at the development stage of the development information to be registered may be determined as a determination target, or only one development information up to the development stage of the upstream process from the development information to be registered may be determined as a determination target. The process for determining the determination target is not limited to the process exemplified in this embodiment.

On the other hand, when the vulnerability determination request 400 is input, the input control processing unit 110 determines all development stage development information associated with the project ID included in the vulnerability determination request 400 as a determination target (S822, S824). That is, all the development information of the project record 142 in which the designated project ID 142a is stored is a determination target.
In addition, the vulnerability determination request 400 may determine predetermined development information, and may determine the development information of the upstream process stage including the development stage of the predetermined development information as a determination target. The development information can be specified, and only the development information at the development stage of the predetermined development information may be set as the determination target, and the determination target determination process is not limited to the process exemplified in this embodiment.

Next, after determining the determination target, the input control processing unit 110 creates a determination target list based on the determined determination target (S825).
FIG. 6 shows an example of the determination target list. FIG. 6 illustrates a determination target list created when source code (function.c) is input as the development information 300.
The determination target list includes a project ID to be determined, a development stage of input development information, and information on whether or not development information in each development stage is to be determined. “Y” is indicated as a determination target, and “N” is indicated as a non-determination target.
As shown in FIG. 6, the development information at the development stage of the upstream process including the source code is determined as a determination target.

  The project ID and the development stage may be input at the same time when the source code (function.c) is input to the input control processing unit 110, and based on the input source code (function.c). The input control processing unit 110 may derive. For example, the project ID and the development stage may be derived based on the input source code by referring to the development information repository 141, and information indicating the project ID and the development stage corresponding to each of the development information may be arbitrarily set in advance. May be prepared in the storage device or the input control processing unit 110 and derived based on the information.

Next, the rule selection processing unit 120 determines the vulnerability information based on the determination target list created in the input control processing unit 110 and the vulnerability information determination rule that defines the vulnerability determination method in each development stage. A vulnerability information determination rule list in which the information indicated in the rule is limited to the determination target is created (S825).
Here, the determination target list may be output from the input control processing unit 110 to the rule selection processing unit 120. The input control processing unit 110 stores the determination target list in an arbitrary storage device provided in the vulnerability determination device 100. The rule selection processing unit 120 may be referred to.
Further, the vulnerability information determination rule may be stored in the rule selection processing unit 120 or may be stored in an arbitrary storage device provided in the vulnerability determination device 100 and referred to by the rule selection processing unit 120.

Here, the vulnerability information determination rule shown in FIG. 7 will be described.
The vulnerability information determination rule is specified by a determination target, corresponding vulnerability information, a search key, and a search method.
The determination target indicates a development stage that can be a determination target.
In the corresponding vulnerability information, vulnerability records used for determining the vulnerability among the vulnerability records stored in the vulnerability DB 151 are associated with each of the development stages. In addition, ID in FIG. 7 shows vulnerability information ID.
The search key is a keyword used when determining the vulnerability of development information. In other words, vulnerability is determined by searching development information with this search key.
The search method indicates a search method used when searching for development information using a keyword indicated by a search key.

  The item regarding the developer information in the vulnerability information determination rule indicates that the vulnerability is determined by searching the developer information with the target name included in the vulnerability records from ID10000 to ID19999 as keywords. For example, if there is a vulnerability record regarding coding mistakes that an inexperienced developer is likely to make, and the target name of the vulnerability is the years of experience of “1 year”, a character string that matches the keyword “1 year” Search from developer information 142a.

The item relating to the development / operating environment information of the vulnerability information determination rule indicates that the development / operating environment information is searched using the target name included in the vulnerability records from ID 20000 to ID 29999 as keywords. For example, if there is a vulnerability record related to Linux (registered trademark) and the target name of the vulnerability is “Linux” (registered trademark), a character string that matches the keyword “Linux” (registered trademark) is developed / operating environment. Search from information 142b.
Similar to developer information and development / operation environment, keywords are searched for documents by target name.

  The item related to the source code of the vulnerability information determination rule indicates that a matching pattern is searched from the source code using a pattern extracted from the contents included in the vulnerability records ID40000 to ID49999 as keywords. For example, when there is a description example of the source code as the content of the vulnerability, the description before and after the source code 142e may be any description of a part of the variable or the like in the description example of the source code. It is possible to search by matching the pattern.

  The item relating to the vulnerability information determination rule program does not indicate a search key, but this indicates that the search is performed by existing virus detection software. The AV (Anti Virus) signature of this item is a virus signature. This indicates that the program 142e is searched for a program including a code having a pattern that matches the virus signature.

The item related to the keyword of the vulnerability information determination rule has a search key as a target name. The target name here is a target name that has already been searched for included in the keyword 142g. Here, the search key used in the determination of the vulnerability is stored in the keyword 142g.
When the keyword 142g is determined as a determination target by the vulnerability determination request 400, a search different from other development stages is performed. Specifically, the vulnerability records stored in all the vulnerability DBs 151 are searched using the target name already searched for included in the keyword 142g as a keyword.

Thereby, even if the vulnerability record containing the target name searched once is updated, the determination result by the latest vulnerability record can be obtained. Further, by including the search key that has already been searched for and the information indicating the development information having the search key in association with the keyword 142g, the target development information can be included in the determination result.
In the vulnerability information determination rule, the corresponding vulnerability information, search key, and search method shown for each determination target can be freely specified as different from the present embodiment. 7 is not limited to that illustrated in FIG.

FIG. 8 shows a determination target list shown in FIG. 6 and a vulnerability information determination rule list created based on the vulnerability information determination rule shown in FIG.
About the vulnerability information determination rule list shown in FIG. 8, the information shown in the vulnerability information determination rule shown in FIG. 7 is limited to the determination target that is determined in the determination target list shown in FIG. The stored information is the same as the vulnerability information determination rule shown in FIG.

Next, the determination processing unit 130 determines vulnerability for the development information to be determined based on the vulnerability information determination rule list (S830).
Here, the detailed operation of the processing in step S830 will be described using the flowchart of FIG. Here, the case where the process of step S830 is performed based on the vulnerability information determination rule list shown in FIG. 8 is illustrated.
First, the determination processing unit 130 acquires the created vulnerability information determination rule list (S831). Here, the vulnerability information determination rule list may be output from the rule selection processing unit 120 to the determination processing unit 130. The rule selection processing unit 120 stores the vulnerability information determination rule list in an arbitrary storage device provided in the vulnerability determination device 100. The determination processing unit 130 may refer to it.

Next, the determination processing unit 130 acquires a vulnerability record (ID10000 to ID19999) corresponding to the developer information 142b indicated by the vulnerability information determination rule list from the vulnerability DB 151 via the vulnerability DB control processing unit 150. The development information of the developer information 142b is acquired from the development information repository 141 via the development information repository control processing unit 140. Then, the developer information is searched with the search key of the acquired vulnerability record (S832).
And the search result by step S832 is output to the output process part 160 (S833).

Next, if all the search targets of the development information repository are not completed, the search is performed again (S834).
Since the vulnerability information determination rule list shown in FIG. 8 uses development information at the development stage up to the source code as a determination target, the search is performed again on the development / operation environment information 142c, and the search result is output to the output processing unit 160. It is output (S832, S833). Thereafter, the document 142d and the source code 142e, which are development information at the development stage to be determined, shown in the vulnerability information determination rule list shown in FIG. 8 are searched (S832, S833, S834).

When the search is completed up to the source code 142e, the search for all development target development information shown in the vulnerability information determination rule list shown in FIG. 8 ends, so the vulnerability determination ends (S834). ).
Here, in the present embodiment, the search is performed in order from the development stage of the upstream process, but the search order is not limited to that exemplified in the present embodiment. For example, the search may be performed from the development stage of the downstream process, or the search may be performed by acquiring all the development information and vulnerability records to be determined at a time.

  The development information 300 is output from the input control processing unit 110 to the development information repository control processing unit 140, registered in the development information repository 141 by the development information repository control processing unit 140, and then the vulnerability is determined in step S830. Therefore, it can be included in the determination target. The development information 300 may be registered in the development information repository 141 after the determination processing unit 130 determines the vulnerability.

Next, the output processing unit 160 outputs the determination result output from the determination processing unit 130 (S840).
The content of the determination result 500, which is the output of the determination result, is information obtained by freely combining a project ID, a development information name, a development information name such as a search key and vulnerability content, and information included in the development information and vulnerability record. Can be output.
The output here may be displayed on a display device or may be output to a file. The output processing unit 160 includes Web content creation data for information sharing, and the format of the Web content. May be output. In addition, the output processing unit 160 may include contact information of related parties and output the mail in a format for sending mail.

As described above, according to the vulnerability determination device according to the first exemplary embodiment of the present invention, when determining vulnerability for a predetermined type of development information, the type of development information associated with this type of development information is also included. Since it can be included in the determination target of the vulnerability, the problem of determining the vulnerability of the program only by specific development information can be solved.
Thereby, it is possible to efficiently determine the vulnerability of the development information related to the program, and to quickly determine the vulnerability.
Further, even in the initial stage of program development, vulnerability can be determined in a timely manner, and secure development can be performed.

Embodiment 2 of the Invention
FIG. 10 is a block diagram showing details of the vulnerability determination device according to the second exemplary embodiment of the present invention.
The overall configuration of the vulnerability determination device 100 according to the second exemplary embodiment of the present invention is compared with the vulnerability determination device according to the first exemplary embodiment illustrated in FIG. 1, the vulnerability countermeasure DB processing unit 190 and the vulnerability. The difference is that a countermeasure DB 191 is further provided.
The vulnerability DB processing unit 190 performs processing for obtaining information indicating a countermeasure plan against the vulnerability from the vulnerability countermeasure DB 191. The vulnerability DB processing unit functions as a vulnerability countermeasure information processing unit.
The vulnerability countermeasure DB 191 stores information indicating a countermeasure measure against the vulnerability. The vulnerability countermeasure DB corresponds to a vulnerability countermeasure information storage unit.
Since the components other than the vulnerability DB processing unit 190 and the vulnerability countermeasure DB 191 are the same as those in the first embodiment, description thereof is omitted.

With reference to the flowchart of FIG. 11, processing for acquiring information related to vulnerability in the vulnerability determination device according to the second exemplary embodiment of the present invention will be described.
Here, the processes in steps S810, S820, and S830 shown in FIG. 11 are the same as those in the first embodiment, and thus the description thereof is omitted.

In the present embodiment, when the determination processing unit 130 determines vulnerability and the output processing unit 160 acquires the determination result output by the determination processing unit 130, the vulnerability countermeasure DB processing unit 190 Information indicating a countermeasure plan for the indicated vulnerability is retrieved and acquired from the vulnerability DB 191, and information indicating the countermeasure plan is output to the output processing unit 160.
The output processing unit 160 acquires information indicating the countermeasure plan output by the vulnerability countermeasure DB processing unit 190, adds information indicating the countermeasure plan, and outputs the determination result 500 (S850).
As described above, according to the vulnerability determination device according to the second exemplary embodiment of the present invention, it is possible to present a countermeasure against vulnerability in addition to the vulnerability determination result.

The vulnerability determination apparatus according to the present invention described above supplies a storage medium storing a program for realizing the functions of the above-described embodiments to a system or apparatus, and a computer or CPU (Central Processing Unit) included in the system or apparatus. ) And MPU (Micro Processing Unit) can be configured by executing this program.
Further, this program can be stored in various types of storage media, and can be transmitted via a communication medium. Here, the storage medium includes, for example, a flexible disk, hard disk, magnetic disk, magneto-optical disk, CD-ROM (Compact Disk Read Only Memory), DVD (Digital Versatile Disk), BD (Blu-ray Disc), ROM ( A read only memory (RAM) cartridge, a battery-backed RAM (Random Access Memory) memory cartridge, a flash memory cartridge, and a nonvolatile RAM cartridge are included. The communication medium includes a telephone line wired communication medium and a microwave line wireless communication medium, and also includes the Internet (registered trademark).

Further, when the computer executes the program that realizes the functions of the above-described embodiment, not only the functions of the above-described embodiment are realized, but also the computer is operating on the basis of the instructions of this program. A case where the functions of the above-described embodiment are realized in cooperation with an OS (Operating System) or application software is also included in the embodiment of the invention.
Further, when the functions of the above-described embodiment are realized by performing all or part of the processing of the program by a function expansion board inserted into the computer or a function expansion unit connected to the computer, the present invention may be implemented. It is included in the form.

It is a block diagram which shows the outline of the vulnerability determination apparatus concerning Embodiment 1 of this invention. It is a block diagram which shows the detail of the vulnerability determination apparatus concerning Embodiment 1 of this invention. It is a flowchart which shows the process which acquires the information regarding a vulnerability in the vulnerability determination apparatus shown in FIG. It is a flowchart which shows the process which determines the vulnerability in the vulnerability determination apparatus shown in FIG. It is a flowchart which shows the detailed operation | movement of the process which produces the determination object list | wrist in the vulnerability determination apparatus shown in FIG. It is a figure which shows the example of the determination target list concerning Embodiment 1 of this invention. It is a figure which shows the vulnerability information determination rule concerning Embodiment 1 of this invention. It is a figure which shows the vulnerability information determination rule list | wrist concerning Embodiment 1 of this invention. It is a flowchart which shows the detailed operation | movement of the process which determines the vulnerability in the vulnerability determination apparatus shown in FIG. It is a block diagram which shows the detail of the vulnerability determination apparatus concerning Embodiment 2 of this invention. It is a flowchart which shows the process which determines the vulnerability in the vulnerability determination apparatus shown in FIG.

Explanation of symbols

1, 100 Vulnerability determination apparatus 10 Determination processing unit 20 Development information storage unit 21 Development information record 30 Vulnerability information storage unit 31 Vulnerability information 50 Development information 110 Input control processing unit 120 Rule selection processing unit 130 Determination processing unit 140 Development information Repository control processing unit 141 Development information repository 142 Project record 150 Vulnerability DB control processing unit 151 Vulnerability DB
152 Vulnerability Record 160 Output Processing Unit 170 Public Vulnerability Information Acquisition Processing Unit 180 Vulnerability DB Processing Unit 190 Vulnerability Countermeasure DB Processing Unit 191 Vulnerability Countermeasure DB
200 Network 300 Development Information 400 Vulnerability Determination Request 500 Determination Result

Claims (14)

Development information storage unit for storing development information classified according to type in association with each other,
A vulnerability information storage unit for storing vulnerability information;
When determining vulnerability for development information of a predetermined type, the development information of the type associated with the type of development information to be determined is also included in the determination target, and the development information of the determination target and the vulnerability information storage A vulnerability determination device including a determination processing unit that determines the vulnerability of a program based on vulnerability information stored in the unit.   The vulnerability determination device according to claim 1, wherein the type of the development information is a type corresponding to a program development stage.   The vulnerability determination apparatus according to claim 1, wherein the determination processing unit determines the vulnerability of the program by a determination method corresponding to a type of the development information to be determined.   The vulnerability determination apparatus according to claim 3, further comprising a rule selection processing unit that determines a determination method corresponding to each of the types. In the vulnerability information storage unit, the vulnerability information is classified according to each type,
The vulnerability determination apparatus according to any one of claims 1 to 4, wherein the determination processing unit determines the vulnerability of the program based on vulnerability information corresponding to each type of the development information to be determined.   The vulnerability determination apparatus determines the development information to be determined based on the predetermined type of development information, triggered by the input of the predetermined type of development information or information indicating the predetermined type of development information. The vulnerability determination device according to any one of 1 to 5.   7. The vulnerability determination apparatus according to claim 1, further comprising an output processing unit that acquires the vulnerability determination result output from the determination processing unit and outputs the determination result to a predetermined output destination. Vulnerability determination device according to. The vulnerability determination device includes a vulnerability countermeasure information storage unit that stores countermeasure plan information that is information indicating a countermeasure plan for the vulnerability;
A vulnerability countermeasure information processing unit that acquires the countermeasure plan information from the vulnerability countermeasure information storage unit and outputs the countermeasure plan information to the output processing unit;
The vulnerability determination apparatus according to claim 7, wherein the output processing unit adds the countermeasure plan information to the determination result and outputs the result.   The vulnerability determination apparatus further includes a vulnerability information processing unit that acquires vulnerability information via a network, creates vulnerability information from the information, and stores the vulnerability information in a vulnerability information storage unit. The vulnerability determination device according to any one of claims 8 to 9. The development information storage unit stores development information classified according to the type in association with a project ID,
The vulnerability according to any one of claims 1 to 9, wherein, when a project ID is input, the input control processing unit determines the vulnerability of the program by using development information related to the project ID as a determination target. Judgment device. When determining vulnerability for a predetermined type of development information, the step of including the type of development information associated with the type of development information to be determined in the determination target;
A vulnerability determination method comprising a step of determining the vulnerability of a program based on development information and vulnerability information of the determination target.   12. The vulnerability determination method according to claim 11, wherein the type of the development information is a type corresponding to a program development stage. When determining vulnerability for a predetermined type of development information, the step of including the type of development information associated with the type of development information to be determined in the determination target;
A vulnerability determination program that causes a computer to execute a step of determining vulnerability of a program based on development information and vulnerability information of the determination target.   14. The vulnerability determination program according to claim 13, wherein the type of development information is a type corresponding to a program development stage.

Images