JP7008922B2 - Processing equipment and processing method - Google Patents

Description

The present invention relates to a processing apparatus and a processing method.

Conventionally, a technique for effectively selecting vulnerability information to be investigated from a plurality of vulnerability information possessed by software has been proposed. Specifically, the information processing device collects vulnerability information published on a network such as the Internet, and identifies the vulnerability information corresponding to the software. The information processing device determines the priority of the identified vulnerability information based on the attack type, communication protocol, software product type, and the like (for example, Patent Document 1).

Japanese Unexamined Patent Publication No. 2007-55814

However, the above-mentioned technology does not consider public software represented by OSS (Open Source Software), and assumes a case where the software is vulnerable to the in-house developed software. Therefore, in the above-mentioned technology, measures such as not using the public software and upgrading the public software are not assumed.

In view of such a situation, the inventors have found that, as a result of diligent studies, the method of setting the priority disclosed in the above-mentioned technology is not always appropriate in the case of using the public software.

Therefore, the present invention has been made to solve the above-mentioned problems, and is a processing device and a processing method capable of appropriately determining the handling of vulnerable public software in the case of using public software. The purpose is to provide.

The first feature is a processing device for determining the vulnerability of the public software in the system including the public software, and the first information indicating whether or not the public software can be accessed from the outside and the first information. The control unit includes a control unit that outputs the priority of the vulnerability based on at least one of the second information indicating whether or not the attack code for the vulnerability of the public software is distributed. , The vulnerability of the public software that can be accessed from the outside is set to a higher priority than the vulnerability of the public software that is not accessible from the outside, or the attack code is distributed. The gist is to set a higher priority than the vulnerability for which the attack code is not distributed for the vulnerability.

The second feature is the gist of the first feature, that the processing apparatus includes an output unit that outputs a user interface for inputting whether or not the processing device is accessible from the outside.

The third feature is that, in the second feature, the output unit outputs a user interface for inputting whether or not the system is accessible from the outside in a system unit including the public software having the vulnerability. The gist is that.

The fourth feature is that in the first feature to the third feature, the control unit outputs the priority of the vulnerability based on both the first information and the second information. do.

The fifth feature is that in the fourth feature, the control unit determines the priority of the vulnerability based on the third information indicating the type of the vulnerability in addition to the first information and the second information. The gist is to output.

The sixth feature is that in the fifth feature, the control unit has the vulnerability set by a third party regarding the vulnerability in addition to the first information, the second information and the third information. The gist is to output the priority of the vulnerability based on the fourth information indicating the level.

The seventh feature is that in the sixth feature, the control unit identifies a vulnerability in which the level of the vulnerability satisfies the level condition based on the fourth information, and targets the identified vulnerability. The gist is to output the priority of the vulnerability based on the first information, the second information, and the third information.

The eighth feature is that in the fifth to seventh features, the control unit identifies the vulnerability in which the attack code is distributed based on the second information, or the third information. Based on the above, the type of the vulnerability identifies a vulnerability that satisfies the type condition, and the control unit outputs the priority of the vulnerability based on the first information for the identified vulnerability. The gist is to do.

The ninth feature is a processing method for determining the vulnerability of the public software in the system including the public software, and the first information indicating whether or not the public software can be accessed from the outside and the first information. A step of outputting the priority of the vulnerability based on at least one of the second information indicating whether or not the attack code for the vulnerability of the public software is distributed, and the step of being accessible from the outside. For the vulnerability of the public software, a higher priority is set than the vulnerability of the public software that is not accessible from the outside, or the vulnerability in which the attack code is distributed is set. On the other hand, the gist is to provide a step of setting a higher priority than the vulnerability in which the attack code is not distributed.

INDUSTRIAL APPLICABILITY According to the present invention, it is possible to provide a processing device and a processing method capable of appropriately determining the handling of vulnerable public software in the case of using public software.

FIG. 1 is a diagram showing a processing system 100 according to an embodiment. FIG. 2 is a diagram showing a processing device 10 according to an embodiment. FIG. 3 is a diagram showing vulnerability information according to the embodiment. FIG. 4 is a diagram showing a user interface according to the embodiment. FIG. 5 is a diagram for explaining the triage level according to the embodiment. FIG. 6 is a diagram showing a display mode displayed on the display 21 of the user terminal 20 according to the embodiment. FIG. 7 is a diagram showing a processing method according to the embodiment.

Hereinafter, embodiments will be described with reference to the drawings. In the description of the drawings below, the same or similar parts are designated by the same or similar reference numerals.

However, it should be noted that the drawings are schematic and the ratio of each dimension may differ from the actual one. Therefore, the specific dimensions should be determined in consideration of the following explanation. In addition, it goes without saying that there may be a portion where the relations or ratios of the dimensions of the drawings are different from each other.

[Summary of disclosure]
The processing device according to the outline of the disclosure determines the vulnerability of the public software in the system including the public software. The processing device has at least first information indicating whether or not the public software can be accessed from the outside and second information indicating whether or not an attack code for a vulnerability possessed by the public software is distributed. A control unit that outputs the priority of the vulnerability based on any one of them is provided. The control unit sets a higher priority than the vulnerability of the public software that is not accessible from the outside to the vulnerability of the public software that is accessible from the outside, or the control unit sets the priority. A higher priority is set for the vulnerability for which the attack code is distributed than for the vulnerability for which the attack code is not distributed.

In the outline of the disclosure, the processing device sets a higher priority for the vulnerabilities of the public software that can be accessed from the outside than the vulnerabilities of the public software that is not accessible from the outside. Alternatively, the processing device sets a higher priority for the vulnerability for which the attack code is distributed than for the vulnerability for which the attack code is not distributed. That is, since it is less urgent to take countermeasures for vulnerabilities in public software that cannot be accessed from the outside, it can be determined that it is not necessary to take countermeasures immediately even if the impact is large. The same determination can be made for vulnerabilities for which attack codes are not distributed. Therefore, according to the above-mentioned configuration, when measures such as not using the public software or upgrading the public software are assumed, an appropriate priority is given as an index for determining the handling of the public software having a vulnerability. Can be set.

Here, the public software may be software (hereinafter, OSS; Open Source Software) in which the source code of the software is published and improvement and redistribution are permitted. Publication, improvement and redistribution may be done free of charge. The priority may be a priority (hereinafter referred to as a triage level) for which countermeasures against vulnerabilities of public software should be taken. The triage level may be considered an urgent need to take measures against vulnerabilities in public software.

[Embodiment]
(Processing system)
Hereinafter, the processing system according to the embodiment will be described. FIG. 1 is a diagram showing a processing system 100 according to an embodiment.

As shown in FIG. 1, the processing system 100 includes a processing device 10, a user terminal 20, a system server 30, and a vulnerability DB (Data Base) 40. The processing device 10, the user terminal 20, the system server 30, and the vulnerability DB 40 are connected by the network 200. Although not particularly limited, the network 200 may be configured by an internet network. The network 200 may include a local area network, a mobile communication network, or a VPN (Virtual Private Network).

The processing device 10 determines the vulnerability of the OSS in the system including the OSS built in the system server 30. The processing device 10 may be composed of two or more servers. At least a part of the processing device 10 may be realized by a cloud computing service. Details of the processing device 10 will be described later (see FIG. 2).

The user terminal 20 has a display 21 and is a terminal that uses a vulnerability determination function (hereinafter, triage function). The user terminal 20 may be a terminal that uses a system including OSS. For example, the user terminal 20 may be a personal computer, a smartphone, or a tablet terminal. For example, the display 21 may be a liquid crystal panel or an organic EL panel.

The system server 30 is a server on which a system including OSS is constructed. The system built on the system server 30 may include software other than OSS. For example, software other than OSS may be software developed by the user. The system server 30 may be composed of two or more servers. At least a part of the system server 30 may be realized by a cloud computing service. The system including OSS may include a public system that is open to the outside via a network 200 such as the Internet, or may include a private system that is not open to the outside via a network 200 such as the Internet. For example, the public system may include a system for exposing products, services or employment information to the outside. Private systems may include systems used for processing such as accounting or finance.

Vulnerability DB 40 is a database that stores information about vulnerabilities possessed by OSS (hereinafter referred to as vulnerability information). Vulnerability DB 40 may be a database that collects vulnerability information from one or more databases by periodically crawling one or more databases. One or more of the database, select from the CVE (Common Vulnerabilities and Exposures), ICAT (IPA Cyber security Alert Service) Metabase, NVD (National Vulnerability Database), JVN (Japan Vulnerability Notes), JVN iPedia, OSVDB (Open Source Vulnerability Database) It may include one or more databases that have been created.

(Processing device)
Hereinafter, the processing apparatus according to the embodiment will be described. FIG. 2 is a diagram showing a processing device 10 according to an embodiment.

As shown in FIG. 2, the processing device 10 includes a communication unit 11, a management unit 12, and a control unit 13.

The communication unit 11 is composed of a communication module. The communication module may be a wireless communication module conforming to a standard such as IEEE802.11a / b / g / n, LTE, 5G, or a wired communication module conforming to a standard such as IEEE802.3.

The communication unit 11 may provide the triage function to the user terminal 10 by communicating with the user terminal 10. The communication unit 11 may acquire information on software included in the system built on the system server 30 by communicating with the system server 30. The communication unit 11 may acquire the vulnerability information by communicating with the vulnerability DB 40.

For example, the vulnerability information may include a fourth information indicating the level of vulnerability set by a third party regarding the vulnerability. For example, the fourth information may be a score value (for example, Base Score) defined by CVSS (Comon Vulnerability Scoring System). The fourth information may include a version of CVSS. Further, the vulnerability information may include the attack code for the vulnerability of the OSS when the attack code for the vulnerability of the OSS is distributed.

The management unit 12 is composed of a memory such as a non-volatile memory and / and a storage medium such as an HDD (Hard disk drive), and stores various information.

The management unit 12 manages (stores) the vulnerability information acquired from the vulnerability DB 40. The vulnerability information managed by the management unit 12 may be information processed based on the vulnerability information acquired from the vulnerability DB 40. The processing may be a process of adding third information (hereinafter, also referred to as a type) indicating the type of vulnerability. The processing may be a process of manually adding a type by an engineer, or may be a process of automatically adding a type by text analysis or the like.

For example, the management unit 12 manages the information shown in FIG. Vulnerability is the identification information of the vulnerability possessed by OSS. The OSS is the identification information (for example, a name) of the OSS included in the system constructed on the system server 30. As described above, the type is information indicating the type of the vulnerability. The description is a description of the vulnerability and may include a version of CVSS and a score value. The impact is the expected impact of the vulnerability, and may include the cause of the vulnerability, the attack method for the vulnerability, and the problem caused by the attack against the vulnerability.

The control unit 13 may include at least one processor. At least one processor may be composed of a single integrated circuit (IC) or may be composed of a plurality of communicablely connected circuits (such as integrated circuits and / or discrete circuits).

The control unit 13 is at least one of the first information indicating whether or not the OSS is accessible from the outside and the second information indicating whether or not the attack code for the vulnerability of the OSS is distributed. Outputs the triage level of the vulnerability based on.

Specifically, the control unit 13 sets a higher triage level for the vulnerabilities of the OSS that can be accessed from the outside than the vulnerabilities of the OSS that cannot be accessed from the outside, or the attack code is distributed. Set a higher triage level for the vulnerabilities that are open than those for which the attack code is not distributed.

Here, the control unit 13 may configure an output unit that outputs a user interface for inputting whether or not the OSS having a vulnerability can be accessed from the outside. The control unit 13 may output a user interface for inputting whether or not it is accessible from the outside in a system unit including an OSS having a vulnerability. The user interface is transmitted from the communication unit 11 to the user terminal 20. The user interface may be displayed on the display 21 of the user terminal 20.

For example, the user interface displayed on the display 21 is as shown in FIG. As shown in FIG. 4, the user interface includes identification information of the system including software (system A in FIG. 4) and identification information of software included in the system (SSS, TTT, UUU in FIG. 4). In addition, the user interface includes a check box to enter whether it is accessible from the outside.

In such a case, if a check is entered in the check box located on the right side of the A system, the check box may be automatically entered in the check box located on the right side of all the software included in the system. Similarly, when a check is removed from the check box located on the right side of the A system, the check box may be automatically removed from the check box placed on the right side of all the software included in the system. That is, it is possible to input whether or not it is accessible from the outside on a system-by-system basis. However, individual checks may be entered in the check boxes located on the right side of the software. Similarly, the checks may be individually removed from the checkboxes located on the right side of the software.

In the example shown in FIG. 4, the system means a system built on the system server 30, and the software included in the system includes at least one OSS.

As described above, the control unit 13 can acquire the first information based on the information input using the user interface (whether or not the check box is checked). On the other hand, the control unit 13 can acquire the second information based on whether or not the attack code is included in the vulnerability information.

In the embodiment, the control unit 13 may output the triage level of the vulnerability based on both the first information and the second information. The control unit 13 may output the triage level of the vulnerability based on the third information indicating the type of the vulnerability in addition to the first information and the second information. Since the control unit 13 adds the third information to the vulnerability information managed by the management unit 12, the control unit 13 can acquire the third information based on the vulnerability information. In addition to the first information, the second information, and the third information, the control unit 13 outputs the triage level of the vulnerability based on the fourth information indicating the level of the vulnerability set by the third party regarding the vulnerability. You may. Since the fourth information is included in the vulnerability information acquired from the vulnerability DB 40, the control unit 13 can acquire the fourth information based on the vulnerability information.

In such a case, the triage level output method (determination method) will be described with reference to FIG. In FIG. 5, “◯” means that each condition is satisfied, and “−” means that each condition is not satisfied.

First, the control unit 13 identifies a vulnerability that satisfies the fourth condition based on the fourth information, and targets the identified vulnerability based on the first information, the second information, and the third information. , You may output the triage level of the vulnerability. The fourth condition is that the level of vulnerability meets the level condition. For example, when the fourth information is the Base Score of CVSS, the fourth condition is that the Base Score is higher than the predetermined threshold. The control unit 13 may omit the triage level determination using the first information, the second information, and the third information for the vulnerability that does not satisfy the fourth condition. Here, as shown in FIG. 5, the control unit 13 may output the lowest triage level (for example, level 4) for the vulnerability that does not satisfy the fourth condition. Level 4 may be a level at which no special measures need to be taken.

Second, the control unit 13 identifies a vulnerability that satisfies the second condition based on the second information, and outputs the triage level of the vulnerability based on the first information for the identified vulnerability. You may. The second condition is that the attack code is in circulation. The control unit 13 may omit the determination of the triage level using the first information for the vulnerability in which the second condition is not satisfied. Here, as shown in FIG. 5, the control unit 13 may output the second lowest triage level (for example, level 3) for the vulnerability that does not satisfy the second condition. Level 3 is a level where it is more necessary to take measures than level 4.

Third, the control unit 13 identifies a vulnerability that satisfies the third condition based on the third information, and outputs the triage level of the vulnerability based on the first information for the identified vulnerability. You may. The third condition is that the type of vulnerability satisfies the type condition. The type condition may be that the above-mentioned type is managed as the vulnerability information managed by the management unit 12. Alternatively, the type condition may be that the type managed by the management unit 12 is a predetermined type. The predetermined type is a type in which it is relatively necessary to take measures against the vulnerability. The control unit 13 may omit the determination of the triage level using the first information for the vulnerability in which the third condition is not satisfied. Here, as shown in FIG. 5, the control unit 13 may output the second lowest triage level (for example, level 3) for the vulnerability that does not satisfy the third condition. Level 3 is a level where it is more necessary to take measures than level 4.

Here, the control unit 13 outputs level 3 as a triage level for a vulnerability in which both the second condition and the third condition are not satisfied. However, the embodiments are not limited to this. The control unit 13 may output level 3 as a triage level for a vulnerability in which any one of the second condition and the third condition is not satisfied. Similarly, the control unit 13 outputs the triage level of the vulnerability based on the first information, targeting the vulnerability that satisfies at least one of the second condition and the third condition. However, the embodiments are not limited to this. The control unit 13 may output the triage level of the vulnerability based on the first information, targeting the vulnerability in which both the second condition and the third condition are satisfied.

Fourth, the control unit 13 determines whether or not the first condition is satisfied based on the first information, targeting the vulnerability that satisfies at least one of the second condition and the third condition. May be good. The first condition is that the OSS having a vulnerability or the system including the OSS having a vulnerability can be accessed from the outside. As shown in FIG. 5, the control unit 13 outputs the highest triage level (for example, level 1) for the vulnerability in which the first condition is satisfied. The control unit 13 outputs the second highest triage level (for example, level 2) for the vulnerability that does not satisfy the first condition. Level 2 is a level that requires more measures than Level 3. Level 1 is a level that requires more measures than Level 2.

(Display mode)
Hereinafter, the display mode according to the embodiment will be described. FIG. 6 is a diagram showing a display mode displayed on the display 21 of the user terminal 20 according to the embodiment. The display mode shown in FIG. 6 is only an example, and other display modes may be displayed on the display 21.

As shown in FIG. 6, the display 21 displays a list of vulnerabilities as a triage function. The ID is the identification information assigned to the vulnerability. The triage level is information that indicates the priority for which countermeasures against vulnerabilities should be taken. The status is information indicating whether or not a countermeasure against the vulnerability has been taken. The repository is information indicating the location where the software is stored in the system server 30. Software is software identification information. The scan date and time is information indicating the date and time when the vulnerability was scanned.

(Processing method)
Hereinafter, the processing method according to the embodiment will be described. FIG. 7 is a diagram showing a processing method according to the embodiment.

In step S10, the processing device 10 scans the OSS included in the system built on the system server 30. Specifically, the processing device 10 scans the vulnerability of the OSS based on the vulnerability information managed by the management unit 12.

In step S11, the processing apparatus 10 determines whether or not the fourth condition is satisfied for the vulnerability found in step S10. The details of the fourth condition are as described above. If the fourth condition is satisfied, the process of step S12 is performed, and if the fourth condition is not satisfied, the process of step S18 is performed.

In step S12, the processing device 10 determines whether or not the third condition is satisfied for the vulnerability in which the fourth condition is satisfied. The details of the third condition are as described above. If the third condition is satisfied, the process of step S14 is performed, and if the third condition is not satisfied, the process of step S13 is performed.

In step S13, the processing device 10 determines whether or not the second condition is satisfied for the vulnerability in which the fourth condition is satisfied. The details of the second condition are as described above. If the second condition is satisfied, the process of step S14 is performed, and if the second condition is not satisfied, the process of step S17 is performed.

In step S14, the processing device 10 determines whether or not the first condition is satisfied for the vulnerability in which any one of the second condition and the third condition is satisfied. The details of the first condition are as described above. If the first condition is satisfied, the process of step S15 is performed, and if the first condition is not satisfied, the process of step S16 is performed.

In step S15, the processing device 10 determines that the triage level of the vulnerability is level 1. The details of Level 1 are as described above.

In step S16, the processing device 10 determines that the triage level of the vulnerability is level 2. The details of Level 2 are as described above.

In step S17, the processing device 10 determines that the triage level of the vulnerability is level 3. The details of level 3 are as described above.

In step S18, the processing device 10 determines that the triage level of the vulnerability is level 4. The details of level 4 are as described above.

The processes of steps S11 to S18 are individually performed for all the vulnerabilities found in step S10. Further, the order of steps S12 and S13 may be changed.

(Action and effect)
In the embodiment, the processing device 10 sets a higher triage level for the vulnerability of the OSS that can be accessed from the outside than that of the OSS that is not accessible from the outside. Alternatively, the processing device 10 sets a higher triage level for the vulnerability in which the attack code is distributed than in the vulnerability in which the attack code is not distributed. That is, since it is less urgent to take countermeasures against the vulnerability of OSS that is not accessible from the outside, it can be determined that it is not necessary to take countermeasures immediately even if the influence is large. The same determination can be made for vulnerabilities for which attack codes are not distributed. Therefore, according to the above-mentioned configuration, an appropriate triage level is set as an index for determining the handling of OSS having a vulnerability when countermeasures such as not using OSS or upgrading the OSS are assumed. be able to.

In the embodiment, the processing device 10 may output a user interface for inputting whether or not the OSS having a vulnerability can be accessed from the outside. According to such a configuration, the processing device 10 can acquire the first information with a simple configuration. Further, the user interface may be a user interface for inputting whether or not it is accessible from the outside in a system unit including an OSS having a vulnerability. With such a configuration, it is possible to suppress the complexity of user input.

In the embodiment, the processing device 10 identifies a vulnerability that satisfies the fourth condition based on the fourth information, and targets the identified vulnerability based on the first information, the second information, and the third information. , You may output the triage level of the vulnerability. According to such a configuration, it is possible to omit the determination using the first information, the second information, and the third information for the vulnerability that does not satisfy the fourth condition, and the processing load of the processing device 10 is reduced. can do.

In the embodiment, the processing device 10 targets a vulnerability that satisfies at least one of the second condition and the third condition, and determines whether or not the first condition is satisfied based on the first information. May be good. According to such a configuration, it is possible to omit the determination using the first information for the vulnerability in which both the second condition and the third condition are not satisfied, and it is possible to reduce the processing load of the processing apparatus 10. ..

[Other embodiments]
Although the invention has been described by embodiments described above, the statements and drawings that form part of this disclosure should not be understood as limiting the invention. This disclosure will reveal to those skilled in the art various alternative embodiments, examples and operational techniques.

In the embodiment, a case where the number of triage level levels is four is illustrated. However, the embodiments are not limited to this. The number of triage level levels may be 5 or more, and the number of triage level levels may be 3 or less.

In the embodiment, a case where the importance of the second condition and the third condition are the same is illustrated. However, the embodiments are not limited to this. The importance of the second condition may be higher than the importance of the third condition. In such cases, the triage level of the vulnerability for which the second condition is satisfied may be higher than the triage level for which the third condition is satisfied. Similarly, the importance of the third condition may be higher than the importance of the second condition. In such cases, the triage level of the vulnerability for which the third condition is satisfied may be higher than the triage level for which the second condition is satisfied.

In the embodiment, a case where a user interface for inputting whether or not the OSS having a vulnerability is accessible from the outside is output is illustrated. However, the embodiments are not limited to this. The processing device 10 may automatically determine whether or not the OSS is accessible from the outside by learning the system built on the system server 30 (for example, deep learning). Further, the user interface may include the automatically determined result as an initial value.

In the embodiment, a case where the processing device 10 is one device is exemplified. However, the embodiments are not limited to this. The function of the processing device 10 may be realized by two or more entities. Two or more entities may include an entity that provides a cloud computing service. Further, the management unit 12 may be a database on the cloud provided separately from the processing device 10.

Although not particularly mentioned in the embodiment, a program for causing a computer to execute each process performed by the processing device 10 may be provided. The program may also be recorded on a computer-readable medium. Computer-readable media can be used to install programs on a computer. Here, the computer-readable medium on which the program is recorded may be a non-transient recording medium. The non-transient recording medium is not particularly limited, but may be, for example, a recording medium such as a CD-ROM or a DVD-ROM.

Alternatively, a chip composed of a memory for storing a program for executing each process performed by the processing device 10 and a processor for executing the program stored in the memory may be provided.

10 ... Processing device, 11 ... Communication unit, 12 ... Management unit, 13 ... Control unit, 20 ... User terminal, 21 ... Display, 30 ... System server, 40 ... Vulnerability DB, 100 ... Processing system

Claims (5)

A processing device for determining the vulnerability of the public software in a system including the public software.
The vulnerability is based on the second information indicating whether or not the attack code for the vulnerability of the public software is distributed and the fourth information indicating the level of the vulnerability set by a third party for the vulnerability. Equipped with a control unit that outputs the priority of gender
The control unit identifies a vulnerability whose level satisfies the level condition based on the fourth information, and targets the vulnerability identified based on the fourth information based on the second information. A processing device that outputs the priority of the vulnerability. The processing device according to claim 1, wherein a higher priority is set for the vulnerability for which the attack code is distributed than for the vulnerability for which the attack code is not distributed. It is equipped with a receiving unit that receives the vulnerability information from the database that stores the vulnerability information related to the vulnerability of the public software.
The control unit targets the vulnerability identified based on the fourth information, and in addition to the second information, sets the priority of the vulnerability based on the third information indicating the type of the vulnerability. Output and
The processing device according to claim 1 or 2, wherein the type of the vulnerability is obtained by processing the vulnerability information received from the database and indicates the necessity of taking measures against the vulnerability. The control unit identifies a vulnerability in which the type of the vulnerability satisfies the type condition based on the third information, targeting the vulnerability identified based on the fourth information.
The processing device according to claim 3, wherein the control unit outputs a priority of the vulnerability based on the second information, targeting a vulnerability whose type does not satisfy the type condition. It is a processing method for determining the vulnerability of the public software in the system including the public software.
The vulnerability is based on the second information indicating whether or not the attack code for the vulnerability of the public software is distributed and the fourth information indicating the level of the vulnerability set by a third party for the vulnerability. With step A to output the priority of sex,
In step A , the processing device identifies a vulnerability whose level satisfies the level condition based on the fourth information, and targets the vulnerability identified based on the fourth information, the second step. A processing method comprising the step of outputting the priority of the vulnerability based on the information.

Images