JP6023121B2 - Vulnerability visualization server, vulnerability visualization method, vulnerability visualization server program - Google Patents

Description

  The present invention relates to a vulnerability visualization server, a vulnerability visualization method, and a vulnerability visualization server program for visualizing a vulnerability included in a system registered as a user asset.

  In recent years, various services are provided to users by connecting a mobile terminal connected to a public network to a Web server or the like. Here, looking at the service provider side, it can be seen that the system is composed of various component technologies such as a framework, execution software, and library.

  On the other hand, any software may contain a bug and it is virtually impossible to zero it. Therefore, even a system in which a large number of softwares are combined is vulnerable, and in some cases, fatal damage that may cause the service itself to fail, such as leakage of customer information and payment information, may occur.

  Vulnerabilities are usually fixed by updating the software provider if they recognize it. However, there is a problem that it is difficult to grasp all software included in the system managed by the system administrator, to check the vulnerability information every day, and to perform the update process, and to increase the labor cost.

  In response to such a problem, a vulnerability diagnosis apparatus for diagnosing a vulnerability such as SQL injection has been disclosed for a web server apparatus that changes the content of a response to a request according to a predetermined condition.

JP 2012-133406 A

  According to Patent Document 1, the normal response collection means 10 transmits a normal request REQN with a registered user ID and password a plurality of times, and a plurality of responses RESN (referred to as normal responses) from the web server for the normal request. Is received, the common area is extracted by the common area extracting means 12 for a plurality of normal responses. Thereafter, the abnormal response collection unit 18 performs SQL injection on the web server, receives a response RESA (referred to as an abnormal response), and records it in the recording unit 16. If the normal response and the abnormal response are the same in the common area, the determination unit 14 determines that there is a vulnerability.

  However, the method disclosed in Patent Document 1 has a problem that it can deal only with vulnerabilities mainly using SQL injection and cannot deal with vulnerabilities related to requests other than those assumed in advance.

  Therefore, the inventor of the present invention extracts constituent element technologies included in the system, links vulnerability information and threat information, and configures a server that notifies the user as soon as related vulnerability information is found. We focused on the fact that once a system is registered, vulnerability information can be automatically notified to users without omission and without delay, and the operational costs related to the vulnerability can be greatly reduced.

  In view of these problems, the present invention extracts component technology included in a system registered as an asset by a user, links vulnerability information and threat information, and when related vulnerability information is found, Provided are a vulnerability visualization server, a vulnerability visualization method, and a vulnerability visualization server program that automatically notify the user of the vulnerability information.

  The present invention provides the following solutions.

The invention according to the first feature is communicably connected to a user terminal used by a user, and includes an asset database and a vulnerability information database in a storage unit, and visualizes vulnerabilities included in the system that is the asset of the user Vulnerability visualization server that
System information receiving means for receiving system information from the user terminal;
Asset registration means for registering the received system information as an asset by storing it in the asset database as the user's asset;
Vulnerability diagnosis means for diagnosing whether the registered asset includes a vulnerability stored in the vulnerability information database;
As a result of the diagnosis, when the vulnerability is included in the asset, the vulnerability information visualization that visualizes the vulnerability included in the asset by notifying the user of the asset and the vulnerability information Means,
There is provided a vulnerability visualization server characterized by comprising:

  According to the first aspect of the invention, the vulnerability included in the system that is the asset of the user, which is communicably connected to the user terminal used by the user and includes an asset database and a vulnerability information database in the storage unit. The vulnerability visualization server that visualizes the system receives system information from the user terminal, registers the received system information as the user asset in the asset database, and registers the asset as the asset. Diagnose whether the vulnerability stored in the vulnerability information database is included in the asset, and if the vulnerability is included in the asset as a result of the diagnosis, the asset and the vulnerability are Visualize vulnerabilities contained in the asset by notifying sex information.

  The invention according to the first feature is a category of vulnerability visualization server, but the same effect and effect are exhibited in the category of vulnerability visualization method and vulnerability visualization server program.

The invention according to the second feature comprises a threat information database in the storage unit,
Threat information reference means for referring to the threat corresponding to the vulnerability and reinforcing vulnerability information related to the vulnerability,
Threat information visualization means for including in the notification the threat information corresponding to the diagnosed vulnerability in the notification;
There is provided a vulnerability visualization server which is an invention according to the first feature.

  According to the second aspect of the invention, the vulnerability visualization server according to the first aspect of the invention includes a threat information database in the storage unit, refers to the threat corresponding to the vulnerability, and manages the vulnerability. Such vulnerability information is reinforced, and the threat information corresponding to the diagnosed vulnerability is included in the notification at the time of the notification.

The invention according to a third feature includes: component technology acquiring means for acquiring the component technology of the system from at least one of the user terminal and the system registered as the asset,
Provided is a vulnerability visualization server which is an invention according to the first or second feature, characterized in that it diagnoses whether or not the vulnerability is included based on the acquired component technology.

  According to the invention pertaining to the third feature, the vulnerability visualization server that is the invention pertaining to the first or second feature is based on at least one of the user terminal and the system registered as the asset. A system component technology is acquired, and a diagnosis of whether the vulnerability is included is performed based on the acquired component technology.

According to a fourth aspect of the invention, diagnostic history storage means for storing the type and number of cases together with the diagnosis time for at least one of the vulnerability information diagnosed to be included in the asset and the referenced threat information; ,
Statistical information providing means for providing a history of the diagnosis as statistical information;
There is provided a vulnerability visualization server which is an invention according to any one of the first to third features.

  According to the fourth aspect of the invention, the vulnerability visualization server according to any one of the first to third aspects is referred to the vulnerability information diagnosed to be included in the asset. For at least one of the threat information, the type and the number of cases are stored together with the diagnosis time, and the diagnosis history is provided as statistical information.

The invention according to a fifth aspect is connected to a user terminal used by a user so as to be communicable, and includes an asset database and a vulnerability information database in a storage unit, and visualizes vulnerabilities included in the user asset system The vulnerability visualization method executed by the vulnerability visualization server
Receiving system information from the user terminal;
Registering the received system information as an asset of the user;
Diagnosing whether a vulnerability stored in the vulnerability information database is included from the registered asset; and
As a result of the diagnosis, when the vulnerability is included in the asset, a step of visualizing the vulnerability included in the asset by notifying the user of the asset and the vulnerability information;
There is provided a vulnerability visualization method characterized by comprising:

The invention according to a sixth aspect is connected to a user terminal used by a user so as to be communicable, and includes an asset database and a vulnerability information database in a storage unit, and visualizes vulnerabilities included in the user asset system To the vulnerability visualization server
Receiving system information from the user terminal;
Registering the received system information as an asset of the user;
Diagnosing whether the vulnerability stored in the vulnerability information database is included from the registered asset;
As a result of the diagnosis, when the vulnerability is included in the asset, a step of visualizing the vulnerability included in the asset by notifying the user of the asset and the vulnerability information;
Provided is a vulnerability visualization server program characterized by executing

  According to the present invention, when a component technology included in a system registered as an asset by a user is extracted, vulnerability information and threat information are linked, and related vulnerability information is found, the vulnerability information Vulnerability Visualization Server, Vulnerability Visualization Method, and Vulnerability Visualization Server Program are provided.

FIG. 1 is a diagram for explaining an overview of the vulnerability visualization system 1. FIG. 2 is an overall configuration diagram of the vulnerability visualization system 1. FIG. 3 is a functional block diagram of the user terminal 10 and the vulnerability visualization server 200. FIG. 4 is a flowchart showing vulnerability visualization processing executed by the user terminal 10 and the vulnerability visualization server 200. FIG. 5 is a flowchart showing vulnerability diagnosis processing executed by the user terminal 10 and the vulnerability visualization server 200. FIG. 6 is an example of a project list screen displayed as an example of notification. FIG. 7 is an example of the vulnerability details screen displayed as an example of notification. FIG. 8 is an example of an asset table stored in the asset database 250. FIG. 9 is an example of the vulnerability information table stored in the vulnerability information database 251. FIG. 10 is an example of a threat information table stored in the threat information database 252. FIG. 11 is an example of a diagnosis history table in the diagnosis history database 253.

  Hereinafter, the best mode for carrying out the present invention will be described with reference to the drawings. This is merely an example, and the technical scope of the present invention is not limited to this.

[Overview of Vulnerability Visualization System 1]
FIG. 1 is a diagram for explaining an overview of a vulnerability visualization system 1 which is a preferred embodiment of the present invention. Based on this FIG. 1, the outline | summary of the vulnerability visualization system 1 is demonstrated.

  In the vulnerability visualization system 1, first, the user uses the user terminal 10 to transmit the system managed by the user as an asset to the vulnerability visualization server 200 (step S01). Examples of the information to be transmitted include system names, hardware resources such as constituent servers, component technologies such as a framework, an execution system, and a library. These component technologies are represented by CPE (Common Platform Enumeration) names.

  The vulnerability visualization server 200 registers the received system information in the asset database 250 as a user asset (step S02). Next, the vulnerability visualization server 200 reads vulnerability information and threat information from the vulnerability information database 251 and the threat information database 252 (step S03).

  Vulnerability refers to flaws and specifications that can be used by third parties for security threats such as computer hijacking or leakage of confidential information in information systems such as computers and networks. Point to the above problem. Threats mean that vulnerabilities are particularly prone to manifest, and are important as factors that are likely to cause risks that may damage or affect the security of organizations and information systems. Vulnerabilities and threats are associated with each other by a CVE-ID described later.

  Vulnerability information includes the name and details of the vulnerability and the CPE name of the relevant platform. Therefore, the vulnerability visualization server 200 refers to the asset database 250 and diagnoses the presence or absence of the vulnerability depending on whether each system includes a CPE name related to the vulnerability (step S04).

  Here, when a vulnerability is found, the existence of the asset having the vulnerability and its details are notified to the user terminal 10 (step S05). Each vulnerability is uniquely assigned with a CVE (Common Vulnerabilities and Exposures) -ID, and each threat information includes a CVE-ID of the related vulnerability. Therefore, it is possible to include threat information in the notification by referring to the related threat information by the CVE-ID of the discovered vulnerability.

  Next, the vulnerability visualization server 200 stores the detected vulnerability as a result of diagnosis in the diagnosis history database 253 together with asset information and diagnosis time (step S06). The user may manage the response status by updating the response status portion of the diagnosis history. In addition, when the correspondence status is not supported and the device is left for a certain period of time, the user may be periodically notified. When the vulnerability information includes a risk level, the period of periodic notification may be adjusted with reference to the risk level.

  Note that these vulnerability information and threat information need to be updated to the latest. The vulnerability visualization server 200 may update the vulnerability information database 251 and the threat information database 252 to the latest every few hours or minutes (step S07). The information source of the update may be a source of vulnerability information that is widely disclosed, or vulnerability information or the like may be provided by a user or an administrator. The above is the outline of the vulnerability visualization system 1.

[System configuration of vulnerability visualization system 1]
FIG. 2 is a system configuration diagram of the vulnerability visualization system 1 which is a preferred embodiment of the present invention. The vulnerability visualization system 1 includes a public network 3 (Internet network, mobile communication network, etc.), user terminal 10, vulnerability visualization server 200, asset database 250, vulnerability information database 251, threat information database 252, diagnosis history database. 253.

  The user terminal 10 is communicably connected to the vulnerability visualization server 200 via the public line network 3. The communication in the vulnerability visualization system 1 may be wireless communication or wired communication. In order for the user terminal 10 to connect to the public line network 3, communication may be possible via a network device such as a router.

  The user terminal 10 may be a general information terminal that allows a user to authenticate the system and exert its function, and is an information device or an electrical appliance having a function to be described later. The user terminal 10 may be, for example, a white appliance such as a refrigerator, a washing machine, a network device such as a mobile phone, a smartphone, a composite printer, a television, a router or a gateway, a computer, a telephone, a network It may be a general information appliance such as a book terminal, a slate terminal, an electronic book terminal, an electronic dictionary terminal, a portable music player, and a portable content playback / recording player.

  The vulnerability visualization server 200 includes an asset database 250, a vulnerability information database 251, a threat information database 252, and a diagnosis history database 253 in a storage unit, and has a function to be described later that performs vulnerability visualization processing on the user terminal 10. Server.

[Description of each function]
FIG. 3 is a diagram illustrating the relationship between the function blocks of the user terminal 10 and the vulnerability visualization server 200 and each function.

  The user terminal 10 includes a CPU (Central Processing Unit), a RAM (Random Access Memory), a ROM (Read Only Memory), and the like as the control unit 11, and the communication unit 12 is, for example, WiFi (Wireless) compliant with IEEE 802.11. (Fidelity) or a wireless device capable of communicating via a mobile communication network (may be a wired LAN connection).

  In the user terminal 10, when the control unit 11 reads a predetermined program, the system information transmission module 13, the component technology transmission module 14, the vulnerability information visualization module 15, and the statistical information reception module cooperate with the communication unit 12. 16 is realized.

  Similarly, the vulnerability visualization server 200 includes a CPU, RAM, ROM, and the like as the control unit 201, and includes, for example, a WiFi-compatible device compliant with IEEE 802.11 (may be wired) as the communication unit 202. . In addition, the vulnerability visualization server 200 includes a data storage unit such as a hard disk or a semiconductor memory as the storage unit 203. The vulnerability visualization server 200 includes an asset database 250, a vulnerability information database 251, a threat information database 252, and a diagnosis history database 253.

  In the vulnerability visualization server 200, when the control unit 201 reads a predetermined program, the system information reception module 204, the vulnerability information visualization module 205, the threat information visualization module 206, and the component technology cooperate with the communication unit 202. An acquisition module 207 and a statistical information provision module 208 are realized. In the vulnerability visualization server 200, the asset registration module 209, vulnerability diagnosis module 210, threat information reference module 211, diagnosis history storage in cooperation with the storage unit 203 by the control unit 201 reading a predetermined program. Module 212 is implemented.

[Vulnerability visualization processing]
FIG. 4 is a flowchart of vulnerability visualization processing executed by the user terminal 10 and the vulnerability visualization server 200. The processing performed by the module of each device described above will be described together with this processing.

  First, the system information transmission module 13 of the user terminal 10 transmits system information to the vulnerability visualization server 200 (step S11). Information transmitted here includes the name of the system, hardware resources such as a server constituting the system, and the like. Here, component technologies such as a framework represented by a CPE name, an execution system, and a library may be included. However, in this flowchart, a separate transmission opportunity is provided in the vulnerability diagnosis processing described later.

  When the system information receiving module 204 of the vulnerability visualization server 200 receives the system information (step S12), the asset registration module 209 stores the system information in the asset database 250 in association with the user terminal 10 that performed the transmission. It registers as a user asset (step S13).

  FIG. 8 is an example of an asset table in the asset database 250. Each asset is assigned a unique asset ID, and the registration date and time is managed. Each asset is managed by associating the number of component technologies, the number of unsupported vulnerabilities, and the number of threats with each asset, and is updated at each diagnosis or each update from the user. Details of the diagnosis will be described in detail in the vulnerability diagnosis processing described later.

  Subsequently, the user terminal 10 and the vulnerability visualization server 200 perform vulnerability diagnosis processing for the registered asset and the registered asset (step S14).

[Vulnerability diagnosis processing]
FIG. 5 is a flowchart of vulnerability diagnosis processing executed by the user terminal 10 and the vulnerability visualization server 200. The processing performed by the module of each device described above will be described together with this processing.

  Here, the subsequent diagnosis is performed for all registered assets (step S21). First, the component technology transmission module 14 of the user terminal 10 transmits the component technology for the asset being diagnosed (step S22). This component technology is represented by the CPE name. In addition, as long as there is no change, transmission of a component technology should just be performed once about each asset. The component technology may be detected and collected not only by the user terminal 10 but also by agent-side software installed in the system itself, and automatically transmitted to the vulnerability visualization server 200.

  When the component technology acquisition module 207 of the vulnerability visualization server 200 receives the component technology from the user terminal 10 or the system itself (step S23), the vulnerability diagnosis module 210 receives the vulnerability from the vulnerability information database 251. Information is read (step S24).

  Then, the vulnerability related to the component technology included in the system is detected by associating the CPE name of the received component technology with the CPE name included in the read vulnerability information (step S25).

  FIG. 9 is an example of a vulnerability information table in the vulnerability information database 251. In the vulnerability information table, a uniquely defined CVE-ID, a related CPE name, a vulnerability name, an outline, and a response method are recorded.

  Here, when a vulnerability is not detected (step S26: "NO"), the diagnosis regarding this asset is complete | finished and a process is moved to the following asset (step S29). On the other hand, if a vulnerability is detected in the asset (step S26: "YES"), the subsequent processing is continued.

  That is, the threat information reference module 211 of the vulnerability visualization server 200 refers to related threat information from the threat information database 252 using the CVE-ID included in the detected vulnerability information (step S27).

  FIG. 10 is an example of the threat information table in the threat information database 252. The threat information table stores the CVE-ID of the related vulnerability, the name of the threat, the outline of the threat, and the like. Although not shown in the figure, more detailed information such as vulnerability and threat related risk may be added.

  Then, the vulnerability information visualization module 205 and the threat information visualization module 206 make the notification awaiting notification (step S28), and the processing shifts to the diagnosis of the next asset (step S29).

  Here, the notification may be performed each time, but the notification may be temporarily set as in the present embodiment, and the notification may be collectively performed for each user. When the above processing is executed for all registered assets, the vulnerability diagnosis processing is finished (steps S21 and S29).

  Returning to the vulnerability visualization process, if there is even one asset including the vulnerability (step S15: “YES”), the vulnerability information visualization module 205 and the threat information visualization module 206 of the vulnerability visualization server 200 Vulnerability information and threat information are notified (step S16). On the other hand, when there is no asset including vulnerability (step S15: “NO”), the processing is skipped until transmission of statistical information described later.

  The vulnerability information visualization module 15 of the user terminal 10 receives notification of vulnerability information and threat information (step S17). Here, when the user terminal 10 includes a display unit or the like, a notification may be displayed on the display unit.

  FIG. 6 is an example of a project list screen displayed as an example of notification. In FIG. 6, a system registered as an asset by the logged-in user is called a project and displayed on the project list screen. As project information, along with the project name 61, the number of unsupported vulnerabilities 62, the number of unsupported threats 63, and the number of component technology 64 are displayed in each column. That is, as long as the number of unsupported vulnerabilities 62 and the number of unsupported threats 63 are displayed as notifications, this indicates that vulnerabilities are included.

FIG. 7 is an example of the vulnerability details screen displayed as an example of notification. In FIG.
Vulnerability name 71, overview 72, risk level 73, detailed information 74, and countermeasure method 75 are displayed on the screen, so that the user can intuitively grasp information on the vulnerability. Further, when there is a threat related to the vulnerability, a link 76 to the threat information is provided so that details of the threat information can be browsed. In addition, the project 77 including the displayed vulnerability is displayed. If the project 77 is not yet supported, an unsupported mark 78 is displayed, so that it is possible to immediately grasp that there is an asset that needs to be addressed regarding this vulnerability. 6 and 7 are merely examples of notification, and notification may be performed by transmitting the same content to the user by e-mail, SNS, or the like, or registering in an external task management system.

  After the notification, the diagnosis history storage module 212 of the vulnerability visualization server 200 stores the detected vulnerability as a diagnosis history in the diagnosis history database 253 along with the asset and time (step S18).

  FIG. 11 is an example of a diagnosis history table in the diagnosis history database 253. In the diagnosis history table, the CVE-ID of the detected vulnerability and the CPE name used for association are stored together with the related asset ID. When the user manually updates the response status, the response status may be stored and updated in the diagnosis history table.

  Through the above processing, it is possible to detect vulnerability information included in assets and notify related threat information. Then, the history can be used as statistical information by eliminating user and asset information. Therefore, the statistical information providing module 208 of the vulnerability visualization server 200 may process the information in the diagnosis history database 253 as statistical information and send it to the user terminal 10 (step S19). The statistical information receiving module 16 of the user terminal 10 may receive and display the transmitted statistical information (step S20).

  The above processing is started with asset registration of system information as a starting point. However, the vulnerability visualization processing may be periodically executed with the update of vulnerability information and threat information. Vulnerability information and threat information may be updated by periodically acquiring them from information sources that provide them, or may be manually updated by the user or the administrator of the vulnerability visualization server 200.

  The above is the procedure of vulnerability visualization processing.

  The means and functions described above are realized by a computer (including a CPU, an information processing apparatus, and various terminals) reading and executing a predetermined program. The program is provided in a form recorded on a computer-readable recording medium such as a flexible disk, CD (CD-ROM, etc.), DVD (DVD-ROM, DVD-RAM, etc.), for example. In this case, the computer reads the program from the recording medium, transfers it to the internal storage device or the external storage device, stores it, and executes it. The program may be recorded in advance in a storage device (recording medium) such as a magnetic disk, an optical disk, or a magneto-optical disk, and provided from the storage device to a computer via a communication line.

  As mentioned above, although embodiment of this invention was described, this invention is not limited to these embodiment mentioned above. The effects described in the embodiments of the present invention are only the most preferable effects resulting from the present invention, and the effects of the present invention are limited to those described in the embodiments of the present invention. is not.

  1 Vulnerability Visualization System, 3 Public Line Network, 10 User Terminal, 200 Vulnerability Visualization Server, 250 Asset Database, 251 Vulnerability Information Database, 252 Threat Information Database, 253 Diagnosis History Database

Claims (4)

Vulnerability is likely to be manifested, and is connected to the user terminal used by the user so that it can communicate with the asset database in the storage unit, and the vulnerability information database stores the vulnerabilities that are defects and specifications problems of the assets. A threat information database in which threat information, which is information indicating that it is in a state and is likely to cause damage or influence,
System information receiving means for receiving system information from the user terminal;
Asset registration means for registering the received system information as an asset by storing it in the asset database as the user's asset;
Component component technology acquisition means for automatically acquiring component component technologies of the system from the system registered as the asset ;
Vulnerability diagnosis means for diagnosing whether the registered asset includes a vulnerability stored in the vulnerability information database based on the acquired component technology ;
As a result of the diagnosis, when the vulnerability is included in the asset, by notifying the user of vulnerability information that is information on the asset and the vulnerability , the vulnerability included in the asset is determined. Vulnerability information visualization means to visualize,
Threat information reference means for reinforcing the vulnerability information related to the vulnerability by extracting and referring to the threat information corresponding to the vulnerability from the threat information database ;
Threat information visualization means for including in the notification the threat information corresponding to the diagnosed vulnerability in the notification;
Vulnerability visualization server characterized by comprising: Diagnostic history storage means for storing a type and the number of cases together with a diagnosis time for at least one of the vulnerability diagnosed as being included in the asset and the referenced threat information;
Statistical information providing means for providing a history of the diagnosis as statistical information;
The vulnerability visualization server according to claim 1 , further comprising: Vulnerability is likely to be manifested, and is connected to the user terminal used by the user so that it can communicate with the asset database in the storage unit, and the vulnerability information database stores the vulnerabilities that are defects and specifications problems of the assets A vulnerability visualization server that visualizes vulnerabilities included in the system that is the user's asset, including a threat information database that stores threat information that is information indicating that it is in a state and is likely to cause damage or influence Vulnerability visualization method executed by
Receiving system information from the user terminal;
Registering the received system information as an asset by storing it in the asset database as the asset of the user;
Automatically acquiring the component technology of the system from the system registered as the asset ;
Vulnerability diagnosis means for diagnosing whether the registered asset includes a vulnerability stored in the vulnerability information database based on the acquired component technology ;
As a result of the diagnosis, when the vulnerability is included in the asset, by notifying the user of vulnerability information that is information on the asset and the vulnerability , the vulnerability included in the asset is determined. Visualizing, and
Extracting the threat information corresponding to the vulnerability from the threat information database and referencing the vulnerability information related to the vulnerability; and
Including in the notification the threat information corresponding to the diagnosed vulnerability in the notification;
A vulnerability visualization method characterized by comprising: Vulnerability is likely to be manifested, and is connected to the user terminal used by the user so that it can communicate with the asset database in the storage unit, and the vulnerability information database stores the vulnerabilities that are defects and specifications problems of the assets. A vulnerability visualization server that visualizes vulnerabilities included in the system that is the user's asset, including a threat information database that stores threat information that is information indicating that it is in a state and is likely to cause damage or influence In addition,
Receiving system information from the user terminal;
Registering the received system information by storing it in the asset database as the asset of the user;
Automatically obtaining the component technology of the system from the system registered as the asset ;
Diagnosing whether the vulnerability stored in the vulnerability information database is included from the registered asset based on the acquired component technology ;
As a result of the diagnosis, when the vulnerability is included in the asset, the vulnerability included in the asset is notified by notifying the user of vulnerability information that is information related to the asset and the vulnerability information. Visualizing the steps,
Extracting the threat information corresponding to the vulnerability from the threat information database and referring to it to reinforce the vulnerability information related to the vulnerability;
Including in the notification the threat information corresponding to the diagnosed vulnerability in the notification;
Vulnerability visualization server program characterized by having executed.