JP2017068691A - Diagnostic program, diagnostic method and diagnostic apparatus - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a diagnostic program, a diagnostic method and a diagnostic apparatus capable of efficiently carrying out vulnerability diagnosis on an information processor.SOLUTION: A diagnostic apparatus 1 includes: a storage section 14 that stores a piece of device information which is acquired from an information processor 2 as the diagnostic object when a vulnerability diagnosis is executed based on a first diagnostic rule; and a diagnostic part 23 that, when a new vulnerability diagnosis is made based on a second diagnostic rule different from a first diagnostic rule after carrying out the vulnerability diagnosis, carries out a vulnerability diagnosis on an information processor 2 as the diagnostic object based on the device information stored in the storage section 14.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a diagnostic program, a diagnostic method, and a diagnostic apparatus.

  Vulnerabilities may exist in the operating system (OS), middleware, application programs, etc. that run on information processing devices. In order to investigate the vulnerability, for example, a technique is used in which a diagnostic packet according to a signature is transmitted to the information processing apparatus, and the vulnerability is diagnosed based on a reaction from the information processing apparatus.

  As a related technique, a technique for instructing security diagnosis to an agent that diagnoses security and analyzing security diagnosis data received from the agent has been proposed (for example, see Patent Document 1).

JP 2012-48556 A

  If the frequency of vulnerability diagnosis for the information processing device to be diagnosed becomes low, the time during which vulnerability diagnosis is not performed increases. Therefore, the vulnerability diagnosis for vulnerability information added during this time is sent to the information processing device. Not against. It is not preferable from the viewpoint of security that the vulnerability diagnosis is not performed on the information processing apparatus for a long time.

  On the other hand, when the frequency of vulnerability diagnosis for the information processing apparatus to be diagnosed increases, the diagnosis load on the information processing apparatus increases. Further, since the vulnerability diagnosis is performed by communication using the diagnostic packet, the network load is also increased.

  As one aspect, an object of the present invention is to reduce the load of vulnerability diagnosis on an information processing apparatus.

  In one aspect, the diagnosis program stores, in a storage unit, device information acquired from the information processing device to be diagnosed when the vulnerability diagnosis based on the first diagnosis rule is executed on the computer, and the vulnerability diagnosis is performed. When performing a new vulnerability diagnosis based on a second diagnostic rule different from the first diagnostic rule after the execution of the information processing apparatus, the information processing apparatus to be diagnosed based on the apparatus information stored in the storage unit Vulnerability diagnosis for, and execute the process.

  According to one aspect, the load of vulnerability diagnosis on the information processing apparatus can be reduced.

It is a figure which shows an example of a diagnostic apparatus and a diagnostic object terminal. It is a figure which shows an example of the database in the 1st example of a vulnerability diagnosis. It is a figure for demonstrating the 1st example of a vulnerability diagnosis. It is a figure which shows an example of the database and list | wrist in the 1st example of a vulnerability diagnosis. It is a figure which shows an example of the database in the 2nd example of a vulnerability diagnosis. It is a figure for demonstrating the 2nd example of a vulnerability diagnosis. It is a figure which shows an example of the database and list | wrist in the 2nd example of a vulnerability diagnosis. It is a figure which shows an example of the database in the 3rd example of a vulnerability diagnosis. It is a flowchart (the 1) which shows an example of the process of embodiment. It is a flowchart (the 2) which shows an example of the process of embodiment. It is a flowchart (the 3) which shows an example of the process of embodiment. It is a figure which shows an example of the hardware constitutions of a diagnostic apparatus.

<Example of Diagnostic Device of Embodiment>
Hereinafter, embodiments will be described with reference to the drawings. FIG. 1 shows an example of a diagnosis apparatus 1 and a diagnosis target terminal 2 according to the embodiment. The diagnostic device 1 is a computer that diagnoses the vulnerability of the terminal 2 to be diagnosed. The diagnosis target terminal 2 is an example of an information processing apparatus.

  The diagnosis target terminal 2 is running an OS, and middleware operates on the OS. On the middleware, one or a plurality of application programs (hereinafter referred to as applications) operate. In the embodiment, it is assumed that a plurality of applications are operating on the middleware.

  The OS, middleware, and application are programs executed by the central processing unit (CPU). Each of these programs may be vulnerable.

  From the viewpoint of security, it is not preferable that a vulnerable program operates on the diagnosis target terminal 2. The diagnosis apparatus 1 diagnoses whether each of the programs that operate on the diagnosis target terminal 2 has a vulnerability or may have a vulnerability.

  Hereinafter, the above diagnosis performed by the diagnosis apparatus 1 on the diagnosis target terminal 2 is referred to as vulnerability diagnosis. The diagnosis device 1 performs vulnerability diagnosis for each of the OS, middleware, and application.

  Next, each part of the diagnostic apparatus 1 will be described. The diagnostic device 1 includes a processing unit 11, a communication unit 12, a screen unit 13, a scan information DB 14, a vulnerability information DB 15, and a list storage unit 16. DB is an abbreviation for database. The scan information DB 14 is an example of a storage unit.

  The processing unit 11 includes an acquisition unit 21, an estimation unit 22, a diagnosis unit 23, a list processing unit 24, and an expiration date management unit 25.

  The acquisition unit 21 acquires various types of information (hereinafter referred to as device information) for performing vulnerability diagnosis from the diagnosis target terminal 2. The device information acquired by the acquisition unit 21 is stored in the scan information DB 14 as scan information.

  The acquisition unit 21 acquires apparatus information from the diagnosis target terminal 2 or the scan information DB 14. When the acquisition unit 21 acquires device information from the diagnosis target terminal 2, communication occurs between the diagnosis device 1 and the diagnosis target terminal 2.

  That is, in this case, device information is acquired online. Hereinafter, the acquisition of the device information from the diagnosis target terminal 2 by the acquisition unit 21 is referred to as a network scan.

  The acquisition unit 21 may acquire apparatus information from the scan information DB 14. The device information acquired by the acquisition unit 21 from the scan information DB 14 is referred to as scan information. When the acquisition unit 21 acquires scan information from the scan information DB 14, no communication occurs between the diagnostic device 1 and the diagnosis target terminal 2.

  That is, in this case, apparatus information (scan information) is acquired offline. Hereinafter, the acquisition of the scan information from the scan information DB 14 by the acquisition unit 21 is referred to as a cache scan.

  The estimation unit 22 estimates the type of OS and middleware operating on the diagnosis target terminal 2 based on the device information (scan information). In the embodiment, the device information includes information related to the OS, middleware, and applications operating on the diagnosis target terminal 2.

  In the embodiment, the OS information includes, for example, the OS fingerprint and banner information (information indicating the OS name, etc.), and the middleware information includes, for example, an open port, fingerprint, banner information, and the like. Is included. However, the information about the OS and the information about the middleware are not limited to the above example.

  The estimation unit 22 estimates the type of OS and middleware operating on the diagnosis target terminal 2 based on these pieces of information. For example, the estimation unit 22 estimates the type and version of the OS and middleware as types.

  The diagnosis unit 23 performs vulnerability diagnosis of the diagnosis target terminal 2. The diagnosis unit 23 compares the estimated OS type, middleware type, information on whether or not the application is operating, and vulnerability information stored in the vulnerability information DB 15 to check the vulnerability of the diagnosis target terminal 2. Make a sex diagnosis.

  The list processing unit 24 performs processing such as recording and updating on a list indicating the result of vulnerability diagnosis by the diagnosis unit 23. In the embodiment, the list processing unit 24 performs processing such as recording and updating on two lists of the vulnerability detection list and the vulnerability possibility list.

  The vulnerability detection list is a list indicating the vulnerabilities detected from the diagnosis target terminal 2 as a result of the vulnerability diagnosis by the diagnosis unit 23. The vulnerability detection list is an example of a first list.

  The vulnerability possibility list is a list indicating vulnerabilities that may exist in the diagnosis target terminal 2 as a result of the vulnerability diagnosis by the diagnosis unit 23. The vulnerability possibility list is an example of a second list.

  The expiration date management unit 25 manages the expiration date of the scan information stored in the scan information DB 14. A predetermined expiration date is set in the scan information, and the expiration date management unit 25 invalidates the scan information that has exceeded the expiration date.

  The communication unit 12 communicates with the diagnosis target terminal 2. The screen unit 13 displays predetermined information. The scan information DB 14 stores the device information acquired by the acquisition unit 21 as scan information. Each time the acquisition unit 21 acquires apparatus information, the scan information is stored in the scan information DB 14.

  The vulnerability information DB 15 stores vulnerability information. Vulnerability information is information regarding vulnerabilities existing in the OS, middleware, applications, and the like. Every time new vulnerability information is detected, the vulnerability information DB 15 stores vulnerability information.

  For example, when a device (not shown) collecting vulnerability information detects new vulnerability information, the diagnostic device 1 may acquire the newly detected vulnerability information from the device. The acquired new vulnerability information is stored in the vulnerability information DB 15.

<Examples of individual requests and individual reactions>
Next, individual requests and individual reactions will be described. The individual request is a request including information on an instruction for executing an application. The individual request is transmitted to the diagnosis target terminal 2.

  When the application corresponding to the individual request is operating effectively on the diagnosis target terminal 2, the application transmits information indicating that the application based on the individual request is executed to the diagnosis apparatus 1.

  When the application corresponding to the individual request is not operating effectively on the diagnosis target terminal 2, the application transmits information indicating that the application based on the individual request has not been executed to the diagnosis apparatus 1.

  Information indicating whether or not an application based on an individual request has been executed is an individual reaction. This individual reaction is transmitted as a response from the diagnosis target terminal 2 to the diagnosis device 1. The individual request may be a request for executing a predetermined function other than the application.

  For example, the command “GET /usage/index.cgi HTTP / 1.1” is an example of an individual request. Of these commands, “index.cgi” indicates an application. When the application is operating effectively on the diagnosis target terminal 2, an individual request command is executed.

  For example, when an application corresponding to the individual request is operating effectively on the diagnosis target terminal 2, the application outputs an execution result “HTTP / 1.1 200 OK”. The individual reaction includes the result of this execution. The individual response indicates that the application corresponding to the individual request is operating effectively on the diagnosis target terminal 2.

  For example, when an application corresponding to the individual request is not operating effectively on the diagnosis target terminal 2, the application outputs an execution result “HTTP / 1.1 404 NOT FOUND”. The individual reaction includes the result of this execution. The individual response indicates that the application corresponding to the individual request is not operating effectively on the diagnosis target terminal 2.

  Therefore, the diagnostic apparatus 1 can recognize whether or not the application corresponding to the individual request is operating effectively on the diagnosis target terminal 2 based on the individual reaction.

<First example of vulnerability diagnosis>
Next, a first example of vulnerability diagnosis will be described. FIG. 2 shows an example of the scan information DB 14 and the vulnerability information DB 15 in “2015/02/26”. The scan information stored in the scan information DB 14 will be described.

  In the scan information, “Target IP” indicates the Internet Protocol (IP) address of the terminal. In the example of FIG. 2, scan information of two terminals whose IP addresses are “10.y.y.y” and “10.z.z.z” are stored in the scan information DB 14.

  “Time to Live” indicates the expiration date of the scan information. The scan information that has exceeded the expiration date is invalidated by the expiration date management unit 25. The invalidated scan information may be deleted from the scan information DB 14 or may be overwritten.

  The above expiration date may be set to an arbitrary period. In the embodiment, an example in which the expiration date is set to one month will be described, but the expiration date may be one week or two months.

  “OS Fingerprint” indicates the fingerprint of the OS. “OS Barner” indicates banner information of the OS. “Mid port No.” indicates the open port number of the middleware. “Mid Fingerprint” indicates a fingerprint of middleware. “Mid Barner” indicates middleware banner information.

  The individual reaction is the above-described individual reaction. In the example of FIG. 2, an individual reaction 1 indicating a response to the individual request 1, an individual reaction 2 indicating a response to the individual request 2, and an individual reaction 3 indicating a response to the individual request 3 are stored in the scan information DB 14.

  Next, vulnerability information stored in the vulnerability information DB 15 will be described. In the case of the example of FIG. 2, the vulnerability information DB 15 stores four vulnerability information of vulnerability 1 to vulnerability 4. Vulnerability information includes items of level and condition.

  The level indicates the vulnerability level of vulnerability information. FIG. 2 shows an example in which the vulnerability level has three levels of “high”, “medium”, and “low”. There may be four or more vulnerability levels, or two.

  The condition is a condition for specifying an OS type having a vulnerability. The condition may further include one or both of a condition for specifying the middleware type and a condition for individual reaction to the individual request.

  Of the vulnerability information conditions, “individual request = individual reaction” is assumed to indicate that the individual reaction indicates that the application corresponding to the individual request is operating effectively.

  For example, in the example of FIG. 2, the vulnerability information of vulnerability 1 indicates that there is a high level vulnerability in an environment where the OS type is “OS1” and the middleware type is “Mid1”. .

  The vulnerability information of Vulnerability 2 has an OS type of “OS2” and an environment in which the response to the individual request 1 is the individual reaction 1 (an environment in which an application corresponding to the individual request 1 is operating effectively) Indicates that a vulnerability with a medium level exists.

  For example, the vulnerability 3 has an OS type “OS3”, a middleware type “Mid2”, and an environment in which an application in which the response to the individual request 3 is the individual response 3 operates, has a low level of vulnerability. Indicates that it exists.

  In the example of FIG. 2, at the time of “2015/02/26”, the scan information DB 14 stores the scan information of the two terminals 2, and the vulnerability information DB 15 stores the four vulnerability information. Yes.

  Hereinafter, the diagnosis apparatus 1 will be described with respect to a case where the terminal whose IP address is “10.x.x.x” is the diagnosis target terminal 2 to be subjected to vulnerability diagnosis. The acquisition unit 21 confirms whether or not the scan information of the diagnosis target terminal 2 (IP address is “10.x.x.x”) is stored in the scan information DB 14.

  In the case of the example in FIG. 2, scan information (device information) of the diagnosis target terminal 2 is not stored in the scan information DB 14. In this case, the acquisition unit 21 controls the communication unit 12 to perform a network scan.

  The communication unit 12 transmits a request for acquiring device information to the diagnosis target terminal 2. FIG. 3 is a diagram for explaining a first example of vulnerability diagnosis. In FIG. 3, the network scan is denoted as “NW scan”. The acquisition unit 21 performs a network scan on the diagnosis target terminal 2.

  As described above, the IP address of the diagnosis target terminal 2 is “10.x.x.x”. It is assumed that the OS type operating on the diagnosis target terminal 2 is “OS1” and the middleware type is “Mid1”.

  In addition, the acquisition unit 21 includes an individual request included in each vulnerability information stored in the vulnerability information DB 15 in a network scan request. In the example of FIG. 2, the acquisition unit 21 includes the individual request 1 and the individual request 3 in the network scan request.

  For example, it is assumed that the individual request 1 is the information of the command “GET /usage/index.cgi HTTP / 1.1” described above. When the application corresponding to the individual request 1 is operating effectively on the diagnosis target terminal 2, the individual reaction 1 is information “HTTP / 1.1 200 OK”, for example.

  On the other hand, when the application corresponding to the individual request 1 is not operating effectively on the diagnosis target terminal 2, the individual reaction 1 is information “HTTP / 1.1 404 NOT FOUND”, for example.

  The device information includes information on the OS (fingerprint, banner information, etc.), information on middleware (open port, fingerprint, banner information, etc.) and individual reaction information.

  The diagnosis target terminal 2 transmits the device information as a response to the diagnosis device 1. Thereby, the acquisition part 21 acquires apparatus information. The acquisition unit 21 stores the acquired device information in the scan information DB 14.

  FIG. 4 shows an example in which device information (scan information) of the diagnosis target terminal 2 whose IP address is “10.x.x.x” is added to the scan information DB 14.

  In the example of FIG. 4, “aaaaaaa” that is the individual reaction 1 indicates that the application corresponding to the individual request 1 is operating effectively. Similarly, “ccccccc” that is the individual reaction 3 indicates that the application corresponding to the individual request 3 is operating effectively.

  The acquisition unit 21 acquires scan information of the diagnosis target terminal 2 from the scan information DB 14. Since this acquisition is acquisition of scan information from the scan information DB 14, it is a cache scan.

  The estimation unit 22 estimates the OS type and middleware type based on the scan information acquired by the acquisition unit 21.

  The diagnosis unit 23 compares all the vulnerability information stored in the vulnerability information DB 15 with the estimated OS type, the estimated middleware type, and the individual reaction to perform the vulnerability diagnosis of the diagnosis target terminal 2. Do.

  If the estimated OS type, the estimated middleware type, and the individual reaction include vulnerability information that matches all the conditions of the vulnerability information stored in the vulnerability information DB 15, the diagnosis unit 23 determines that the diagnosis target terminal 2 It detects that the vulnerability of the vulnerability information exists.

  Further, the diagnosis unit 23, when the estimated OS type and middleware type match among the above-described vulnerability information conditions, and the scan information has insufficient individual responses, the diagnosis target terminal 2 has a vulnerability. Detect that it may exist.

  When it is detected that a vulnerability exists in the diagnosis target terminal 2, the list processing unit 24 adds information indicating that the vulnerability is detected to the vulnerability detection list. When it is detected that there is a possibility that the diagnosis target terminal 2 has a vulnerability, the list processing unit 24 adds information indicating the possibility of the presence of the vulnerability to the vulnerability possibility list.

  When a network scan is performed and the acquired device information is stored in the scan information DB 14, the diagnosis unit 23 performs vulnerability diagnosis based on the vulnerability information stored in the vulnerability information DB 15 at that time. Do.

  The vulnerability information in this case is an example of a first diagnosis rule. Moreover, the executed vulnerability diagnosis is an example of the vulnerability diagnosis based on the first diagnosis rule.

  The request for performing the network scan includes all individual requests stored in the vulnerability information DB 15. Therefore, the device information acquired from the diagnosis target terminal 2 includes individual reactions corresponding to the individual requests.

  Therefore, the scan information DB 14 stores all the individual reactions that are subject to vulnerability diagnosis for the diagnosis target terminal 2, so that the scan information does not lack individual reactions. That is, when a network scan is performed, the diagnosis unit 23 does not detect vulnerability as a possibility.

  For this reason, as shown in the example of FIG. 4, vulnerability possibility information is not recorded in the vulnerability possibility list. On the other hand, the vulnerability 1 detected by the diagnosis unit 23 is added to the vulnerability detection list by the list processing unit 24.

<Second example of vulnerability diagnosis>
Next, a second example of vulnerability diagnosis will be described. FIG. 5 shows an example of the scan information DB 14 and the vulnerability information DB 15 at the time of “2015/02/27”. Of the scan information stored in the scan information DB 14, the scan information of the terminals having IP addresses “10.yyy” and “10.zzz” exceeds the expiration date “2015/02/26” .

  Therefore, the expiration date management unit 25 invalidates the scan information. The invalidated scan information is shaded. Also, at the time of “2015/02/27”, vulnerability information of vulnerability 5 and vulnerability 6 is added to the vulnerability information DB 15.

  FIG. 6 is a diagram for explaining a second example of vulnerability diagnosis. The acquisition unit 21 checks whether valid scan information of the diagnosis target terminal 2 (IP address is “10.x.x.x”) is stored in the scan information DB 14.

  As of “2015/02/27”, valid scan information of the diagnosis target terminal 2 whose IP address is “10.x.x.x” is stored. In this case, the diagnosis unit 23 performs vulnerability diagnosis of the diagnosis target terminal 2 based on valid scan information stored in the scan information DB 14.

  The vulnerability diagnosis of the second example is performed after the vulnerability diagnosis of the first example described above is executed. Further, in the second example of vulnerability diagnosis, vulnerability information of vulnerability 5 and vulnerability 6 is added to the vulnerability information DB 15 as compared to the first example of vulnerability diagnosis.

  For this reason, in the second example of vulnerability diagnosis, vulnerability diagnosis is performed based on vulnerability information different from that in the first example of vulnerability diagnosis. Each vulnerability information stored in the vulnerability information DB 15 in the second example of vulnerability diagnosis is an example of a second diagnosis rule.

  In the second example of vulnerability diagnosis, the acquisition unit 21 performs a cache scan without performing a network scan, and acquires scan information of the diagnosis target terminal 2 from the scan information DB 14.

  The estimation unit 22 estimates the OS type and middleware type based on the acquired scan information. The diagnosis unit 23 performs vulnerability diagnosis by collating the estimated OS type, the estimated middleware type, and individual reaction with each vulnerability information stored in the vulnerability information DB 15.

  The diagnosis unit 23 determines whether or not the individual reaction of the condition stored in the vulnerability information DB 15 is insufficient in the scan information of the diagnosis target terminal 2 stored in the scan information DB 14.

  In the case of the example in FIG. 5, “individual request 5 = individual reaction 5” is added to the vulnerability information DB 15 as the condition for vulnerability 5, and “individual request 6 = individual reaction 6” is the condition for vulnerability 6. Has been added. Accordingly, the individual reaction 5 and the individual reaction 6 are insufficient in the scan information of the diagnosis target terminal 2.

  The diagnosis unit 23 determines whether or not the vulnerability level of the vulnerability information corresponding to the missing individual reaction is equal to or higher than a predetermined level (the vulnerability level is “high”). The vulnerability level of the vulnerability 5 is “medium”, and the vulnerability level of the vulnerability 6 is “high”.

  The acquisition unit 21 individually performs a network scan only for the individual reaction 6 having the vulnerability level “high” among the individual reactions that are insufficient in the scan information of the diagnosis target terminal 2. This individual network scan is referred to as an individual network scan.

  In this case, in order to perform an individual network scan, the acquisition unit 21 transmits a request for the individual request 6 to the diagnosis target terminal 2. The diagnosis target terminal 2 transmits the individual reaction 6 to the diagnosis device 1 in response to the request for the individual request 6.

  The individual reaction 6 may indicate that the application corresponding to the individual request 6 is operating effectively on the diagnosis target terminal 2, or may indicate that the application is not operating effectively.

  In the example of FIG. 6, “ddddddd” indicates that the application corresponding to the individual request 6 is operating effectively on the diagnosis target terminal 2. After acquiring the individual reaction 6, the acquisition unit 21 adds the individual reaction 6 to the scan information of the diagnosis target terminal 2 stored in the scan information DB 14.

  The acquisition unit 21 acquires scan information of the diagnosis target terminal 2 illustrated in the example of FIG. 7 from the scan information DB 14. This acquisition is a cache scan.

  The diagnosis unit 23 detects vulnerability information that matches the estimated OS type and middleware type among the vulnerability information stored in the vulnerability information DB 15 and has an individual reaction corresponding to the individual request.

  In the case of the example in FIG. 7, each condition of the vulnerability 6 matches the estimated OS type, middleware type, and individual reaction of the diagnosis target terminal 2. In this case, the diagnosis unit 23 detects that the vulnerability 6 exists in the diagnosis target terminal 2. The list processing unit 24 adds the vulnerability 6 to the vulnerability detection list.

  On the other hand, the vulnerability level of vulnerability 5 is “medium” and not “high”. In this case, the acquisition unit 21 does not perform an individual network scan for the individual request 5 for the vulnerability 5. Therefore, the individual reaction 5 is not included in the scan information of the diagnosis target terminal 2 stored in the scan information DB 14.

  In this case, the estimated OS type and middleware type of the diagnosis target terminal 2 are the same among the conditions of the vulnerability 5, but the individual information 5 is insufficient in the scan information. Therefore, the diagnosis unit 23 detects that the diagnosis target terminal 2 may have the vulnerability 5. The list processing unit 24 adds the vulnerability 5 to the vulnerability possibility list.

  In the case of the second example of vulnerability diagnosis, the diagnostic device 1 performs an individual network scan for acquiring only individual responses corresponding to individual requests that are lacking in scan information, on the diagnosis target terminal 2. On the other hand, in the case of a network scan, the diagnosis device 1 acquires device information from the diagnosis target terminal 2.

  The device information includes information on the OS, information on middleware, and individual responses to individual requests for a plurality of applications. Therefore, the load on the diagnosis target terminal 2 and the network is lower in the individual network scan than in the network scan.

  For this reason, it is possible to perform vulnerability diagnosis of the diagnosis target terminal 2 at a high frequency while suppressing an increase in the load on the diagnosis target terminal 2 and the network. Therefore, efficient vulnerability diagnosis is realized.

  In the second example of vulnerability diagnosis, if the information for performing vulnerability diagnosis is insufficient using the scan information stored in the scan information DB 14, an individual network scan is performed and the information is insufficient. Get information.

  For example, in the example of FIG. 7, when the vulnerability level of the vulnerability 6 is “medium”, the acquisition unit 21 does not perform the individual network scan. In this case, communication does not occur between the diagnosis apparatus 1 and the diagnosis target terminal 2, and a load for vulnerability diagnosis on the diagnosis target terminal 2 and the network does not occur.

  That is, the diagnostic device 1 can perform the vulnerability diagnosis of the diagnosis target terminal 2 offline. For this reason, even if vulnerability diagnosis is performed with high frequency, the load on the diagnosis target terminal 2 and the network does not increase.

  However, when the vulnerability level is “high”, it is preferable that the diagnosis device 1 quickly obtains the latest information of the diagnosis target terminal 2. Therefore, in this case, an individual network scan is performed.

  In addition, it is possible to prepare the system which reproduces the diagnostic target terminal 2, and to suppress the load with respect to the diagnostic target terminal 2 when the diagnostic apparatus 1 performs a vulnerability diagnosis with respect to this system. However, in this case, it is necessary to prepare a system similar to the diagnosis target terminal 2, and hardware resources will increase in the future.

  In addition, it is difficult to prepare a system that reproduces the diagnosis target terminal 2, and a difference is generated between the system and the diagnosis target terminal 2, and the diagnosis accuracy of vulnerability diagnosis is reduced due to the difference. For this reason, it is preferable that vulnerability diagnosis is performed on the actual diagnosis target terminal 2.

<Third example of vulnerability diagnosis>
FIG. 8 shows an example of the scan information DB 14 and the vulnerability information DB 15 in the third example of vulnerability diagnosis. The scan information DB 14 and the vulnerability information DB 15 illustrated in the example of FIG. 8 indicate information as of “2015/03/27”.

  At the time of “2015/03/27”, the scan information of the diagnosis target terminal 2 (IP address “10.x.x.x”) stored in the scan information DB 14 has expired. The expiration date management unit 25 invalidates the scan information in the scan information DB 14.

  The acquisition unit 21 checks whether valid scan information of the diagnosis target terminal 2 is stored in the scan information DB 14. Since valid scan information of the diagnosis target terminal 2 is not stored in the scan information DB 14, the acquisition unit 21 performs a network scan on the diagnosis target terminal 2.

  When the network scan is performed, the diagnostic apparatus 1 acquires individual responses to all individual requests that are targets of vulnerability diagnosis from the diagnosis target terminal 2. For this reason, since all the individual reactions are stored in the scan information DB 14, the diagnosis unit 23 does not determine that the individual reactions are insufficient in the scan information.

  Therefore, the list processing unit 24 adds the same vulnerability information as the estimated OS type and middleware type of the diagnosis target terminal 2 to the vulnerability detection list regardless of the vulnerability level. On the other hand, since it is not determined that there is no individual reaction in the scan information, the list processing unit 24 does not record vulnerability information in the vulnerability possibility list.

<An example of a flowchart showing the flow of processing of the embodiment>
Next, an example of processing according to the embodiment will be described with reference to a flowchart. The acquisition unit 21 checks whether valid scan information of the diagnosis target terminal 2 is stored in the scan information DB 14 (step S1).

  When valid scan information of the diagnosis target terminal 2 is not stored in the scan information DB 14 (NO in step S2), the acquisition unit 21 performs network can (step S3). Thereby, the acquisition unit 21 acquires device information from the diagnosis target terminal 2.

  The acquisition unit 21 stores the acquired apparatus information as scan information in the scan information DB 14 (step S4). If YES in step S2, the processes in steps S3 and S4 are not performed. That is, when valid scan information of the diagnosis target terminal 2 is stored in the scan information DB 14, the network scan is not performed.

  The acquisition unit 21 performs a cache scan for acquiring the scan information of the diagnosis target terminal 2 from the scan information DB 14 (step S5). The estimation unit 22 estimates the OS type and middleware type of the diagnosis target terminal 2 based on the acquired scan information (step S6).

  The diagnosis unit 23 collates the estimated OS type, the estimated middleware type, and the individual reaction with the conditions of each vulnerability information stored in the vulnerability information DB 15 (step S7). Then, the process proceeds to “A”. The processing after “A” will be described with reference to the example of FIG.

  The diagnosis unit 23 determines whether or not there is vulnerability information for which the OS type and middleware type match among individual vulnerability information conditions stored in the vulnerability information DB 15 and the individual reaction is insufficient. (Step S8).

  If there is vulnerability information for which the OS type and middleware type match and the individual reaction is insufficient (YES in step S8), the diagnosis unit 23 determines whether or not the vulnerability level of the vulnerability information is “high”. Is determined (step S9).

  When the vulnerability level of the vulnerability information to be determined is “high” (YES in step S10), the acquisition unit 21 performs an individual network scan for acquiring an individual request corresponding to an individual response that is lacking ( Step S10).

  The acquisition unit 21 acquires information on individual reactions corresponding to the individual requests from the diagnosis target terminal 2. Then, the acquisition unit 21 stores the acquired individual reaction information in the scan information DB 14 (step S11). At this time, the acquisition unit 21 adds the acquired individual reaction information to the scan information of the diagnosis target terminal 2 among the scan information stored in the scan information DB 14.

  If NO in step S8 and NO in step S9, the processes in steps S10 and S11 are not performed. In this case, the acquisition unit 21 does not perform an individual network scan for the diagnosis target terminal 2.

  The diagnosis unit 23 performs a vulnerability diagnosis of the diagnosis target device 2 based on each vulnerability information stored in the vulnerability information DB 15 and the OS type, middleware type, and individual reaction of the diagnosis target terminal 2 (step) S12).

  The diagnosis unit 23 determines whether there is vulnerability information that matches all conditions of the OS type, middleware type, and individual reaction of the diagnosis target terminal 2 among the vulnerability information stored in the vulnerability information DB 15. judge.

  If there is the above vulnerability information, the list processing unit 24 records the vulnerability information in the vulnerability detection list stored in the list storage unit 16 (step S13).

  The diagnosis unit 23 matches the OS type and middleware type of the diagnosis target terminal 2 among the conditions of each vulnerability information stored in the vulnerability information DB 15, and the vulnerability information for which the individual reaction is insufficient for the scan information. It is determined whether or not there is.

  If there is the above vulnerability information, the list processing unit 24 records the vulnerability information in the vulnerability possibility list stored in the list storage unit 16 (step S14).

  The processing unit 11 presents the vulnerability detection list and the vulnerability possibility list stored in the list storage unit 16 (step S15). For example, the processing unit 11 may perform presentation by displaying the vulnerability detection list and the vulnerability list on the screen unit 13.

  Further, the processing unit 11 may perform the scheduled time by printing the vulnerability detection list and the vulnerability list on, for example, a printer or the like. As a result, for example, an operator (for example, a maintenance staff member) who operates the diagnostic device 1 is notified that not only the vulnerability is detected in the diagnosis target terminal 2 but also there is a possibility of the vulnerability. You can also

  Next, an example of processing of the expiration date management unit 25 will be described with reference to the flowchart of FIG. The expiration date management unit 25 searches the scan information stored in the scan information DB 14 for scan information that has exceeded the expiration date (step S21).

  As a result of the search, if scan information that has exceeded the expiration date is found (YES in step S22), the expiration date management unit 25 invalidates the scan information that has exceeded the expiration date (step S23). As a result of the search, if scan information that has expired is not found (NO in step S22), the process of step S23 is not performed.

<Example of hardware configuration of diagnostic device>
Next, an example of the hardware configuration of the diagnostic apparatus 1 will be described with reference to the example of FIG. As illustrated in the example of FIG. 12, a processor 111, a RAM 112, a ROM 113, an auxiliary storage device 114, a medium connection unit 115, a communication interface 116, and an input / output interface 117 are connected to the bus 100. In FIG. 12, the interface is abbreviated as “IF”.

  The processor 111 is an arbitrary processing circuit. The processor 111 executes a program expanded in the RAM 112. As a program to be executed, a diagnostic program for performing the processing of the embodiment may be applied. The ROM 113 is a non-volatile storage device that stores programs developed in the RAM 112.

  The auxiliary storage device 114 is a storage device that stores various types of information. For example, a hard disk drive or a semiconductor memory may be applied to the auxiliary storage device 114. The medium connection unit 115 is provided so as to be connectable to the portable recording medium 119.

  As the portable recording medium 119, a portable memory or an optical disc (for example, Compact Disc (CD), Digital Versatile Disc (DVD), etc.) may be applied. A program for performing the processing of the embodiment may be recorded on the portable recording medium 119.

  The input / output interface 117 is an interface connected to an external device. For example, a display 117A, a printer 117B, or the like may be applied as an external device.

  In the diagnostic apparatus 1, the processing unit 11 may be realized by the processor 111 executing a given diagnostic program. A communication interface 116 may be applied to the communication unit 12.

  A display 117 </ b> A may be applied to the screen unit 13. The RAM 112, the auxiliary storage device 114, and the like may be applied to the scan information DB 14, the vulnerability information DB, and the list storage unit 16.

  The RAM 112, the ROM 113, the auxiliary storage device 114, and the portable recording medium 119 are all examples of a tangible storage medium that can be read by a computer. These tangible storage media are not temporary media such as signal carriers.

<Others>
The present embodiment is not limited to the above-described embodiment, and various configurations or embodiments can be taken without departing from the gist of the present embodiment.

DESCRIPTION OF SYMBOLS 1 Diagnosis apparatus 2 Diagnosis target terminal 11 Processing part 12 Communication part 13 Screen part 14 Scan information DB
15 Vulnerability information DB
16 List storage unit 21 Processing unit 22 Estimation unit 23 Diagnosis unit 24 List processing unit 25 Expiration date management unit 111 Processor 112 RAM
113 ROM

Claims (8)

On the computer,
Storing device information acquired from the information processing device to be diagnosed when the vulnerability diagnosis based on the first diagnosis rule is executed in the storage unit;
After performing the vulnerability diagnosis, when performing a new vulnerability diagnosis based on a second diagnosis rule different from the first diagnosis rule, based on the device information stored in the storage unit, a diagnosis target Performing vulnerability diagnosis on the information processing apparatus;
A diagnostic program characterized by causing processing to be executed. In addition to the computer,
If the valid device information is not stored in the storage unit, a vulnerability diagnosis based on the first diagnosis rule is executed on the information processing device, and the valid device information is stored in the storage unit. If so, the vulnerability diagnosis based on the second diagnosis rule is executed.
The diagnostic program according to claim 1, wherein the process is executed. In addition to the computer,
Invalidating the device information after a predetermined time has elapsed since the device information was stored in the storage unit;
The diagnostic program according to claim 1 or 2, wherein the process is executed. In addition to the computer,
When performing a new vulnerability diagnosis based on the second diagnosis rule, if information used for the vulnerability diagnosis is insufficient, only the information that is insufficient is acquired from the information processing apparatus.
The diagnostic program according to any one of claims 1 to 3, wherein the process is executed. In addition to the computer,
Based on the result of performing a new vulnerability diagnosis based on the second diagnostic rule, the vulnerability information detected to be present in the information processing apparatus is recorded in the first list,
Based on the result of performing a new vulnerability diagnosis based on the second diagnosis rule, the vulnerability information detected to be possibly present in the information processing apparatus is recorded in the second list,
Presenting the first list and the second list;
The diagnostic program according to any one of claims 1 to 4, wherein the process is executed. In the computer,
As a result of performing a new vulnerability diagnosis based on the second diagnosis rule, the vulnerability information that satisfies all the conditions of the device information and has a vulnerability level of a predetermined level or higher is recorded in the first list,
As a result of performing a new vulnerability diagnosis based on the second diagnosis rule, a part of the conditions of the device information is insufficient, or vulnerability information whose vulnerability level is less than the predetermined level is stored in the second Record in the list of
6. The diagnostic program according to claim 5, wherein the process is executed. Computer
Storing device information acquired from the information processing device to be diagnosed when the vulnerability diagnosis based on the first diagnosis rule is executed in the storage unit;
After performing the vulnerability diagnosis, when performing a new vulnerability diagnosis based on a second diagnosis rule different from the first diagnosis rule, based on the device information stored in the storage unit, a diagnosis target Performing vulnerability diagnosis on the information processing apparatus;
A diagnostic method characterized by executing processing. A storage unit for storing device information acquired from the information processing device to be diagnosed when vulnerability diagnosis based on the first diagnosis rule is executed;
After performing the vulnerability diagnosis, when performing a new vulnerability diagnosis based on a second diagnosis rule different from the first diagnosis rule, based on the device information stored in the storage unit, a diagnosis target A diagnostic unit for performing vulnerability diagnosis on the information processing apparatus;
A diagnostic apparatus comprising:

Images