JP7111527B2 - Vulnerability diagnosis device, vulnerability diagnosis method and program - Google Patents

Description

The present invention relates to a vulnerability diagnosis device, a vulnerability diagnosis method, and a program.

Software called a web application scanner is conventionally known. The web application scanner detects the vulnerability of the web application by making a pseudo-attack on the web application. Further, a service for diagnosing vulnerabilities in web applications using such a web application scanner as a diagnosis engine (hereinafter, this service is also referred to as a "vulnerability diagnosis service") is provided as a cloud service.

On the other hand, there is known a technique of detecting vulnerability of a web application by transmitting inspection data to the web application (see, for example, Patent Document 1).

JP 2007-241906 A

By the way, Web application scanners are sold or distributed by various vendors or the like with various types of software, and their performance differs. Therefore, depending on the type of web application scanner, some vulnerabilities can be detected with higher accuracy than other web application scanners, while other vulnerabilities can be detected more accurately than other web application scanners. In some cases, the accuracy is inferior.

However, the conventional vulnerability diagnosis service uses a certain Web application scanner as a diagnosis engine, and detection accuracy may not always be high depending on the vulnerability to be diagnosed.

Embodiments of the present invention have been made in view of the above points, and it is an object of the present invention to detect vulnerabilities using a plurality of diagnosis engines.

In order to achieve the above object, an embodiment of the present invention is a vulnerability diagnosis device having a plurality of diagnosis engines for diagnosing the presence or absence of a vulnerability in a diagnosis target, wherein for each diagnosis item, the plurality of diagnosis engines Among them, creating means for creating mapping information associated with a diagnostic engine for diagnosing the presence or absence of vulnerability related to the diagnostic item, and based on the mapping information created by the creating means, the diagnostic and diagnostic means for diagnosing the vulnerability of the diagnostic target by a diagnostic engine associated with the item.

According to embodiments of the present invention, multiple diagnostic engines may be used to detect vulnerabilities.

BRIEF DESCRIPTION OF THE DRAWINGS It is a figure which shows an example of the whole vulnerability-diagnosis system structure which concerns on this embodiment. It is a figure showing an example of functional composition of a vulnerability diagnosis system concerning this embodiment. It is a figure which shows an example of diagnostic item information. It is a figure which shows an example of engine characteristic information. 6 is a flowchart illustrating an example of vulnerability diagnosis processing; It is a figure which shows an example of a diagnosis start screen. It is a figure which shows an example of mapping information. It is a figure which shows an example of a diagnostic result screen. FIG. 5 is a diagram showing another example of engine characteristic information; FIG. 11 is a diagram (part 1) showing another example of the diagnosis start screen; FIG. 12 is a diagram (part 2) showing another example of the diagnosis start screen; FIG. 10 is a diagram showing another example of mapping information;

Hereinafter, embodiments of the present invention (hereinafter referred to as "present embodiments") will be described. Hereinafter, a vulnerability diagnosis system 1 that diagnoses vulnerabilities in web applications using a plurality of diagnosis engines will be described. A diagnostic engine is software that is implemented by a web application scanner or the like and that detects vulnerabilities in web applications.

In this embodiment, the target of vulnerability diagnosis is a web application, but the target of vulnerability diagnosis is not limited to this. It is good as Examples of such middleware include software that functions as a web server and software that functions as a servlet container.

<Overall composition>
First, the overall configuration of a vulnerability diagnosis system 1 according to this embodiment will be described with reference to FIG. FIG. 1 is a diagram showing an example of the overall configuration of a vulnerability diagnosis system 1 according to this embodiment.

As shown in FIG. 1 , a vulnerability diagnosis system 1 according to this embodiment includes a vulnerability diagnosis device 10 , a terminal device 20 , and a diagnosis target server 30 . The vulnerability diagnosis device 10, the terminal device 20, and the diagnosis target server 30 are communicably connected via a network N such as the Internet.

The vulnerability diagnosis device 10 is a computer or computer system that provides a vulnerability diagnosis service as a cloud service. The vulnerability diagnosis device 10 diagnoses the vulnerability of a diagnosis target (web application) specified by the user of the terminal device 20 in response to a diagnosis start operation on the terminal device 20 . At this time, the vulnerability diagnosis device 10 according to this embodiment diagnoses the vulnerability of the web application using a plurality of diagnosis engines.

The terminal device 20 is a computer used by a user of the vulnerability diagnosis service. By using the terminal device 20 to specify a URL (Uniform Resource Locator) or the like to be diagnosed, the user can diagnose the vulnerability of the Web application indicated by the URL. As the terminal device 20, for example, a PC (personal computer), a smartphone, a tablet terminal, or the like can be used.

The diagnosis target server 30 is a web application server whose vulnerability is diagnosed by the vulnerability diagnosis device 10 .

Note that the configuration of the vulnerability diagnosis system 1 shown in FIG. 1 is an example, and other configurations may be used. For example, the vulnerability diagnosis device 10 and the terminal device 20 may be integrally configured. In addition, the vulnerability diagnosis device 10 is not limited to providing a vulnerability diagnosis service as a cloud service, and may be installed in the same network as the terminal device 20 and the diagnosis target server 30, for example. That is, the vulnerability diagnosis device 10 may be installed on-premise.

<Functional configuration>
Next, the functional configuration of the vulnerability diagnosis system 1 according to this embodiment will be described with reference to FIG. FIG. 2 is a diagram showing an example of the functional configuration of the vulnerability diagnosis system 1 according to this embodiment.

As shown in FIG. 2, the vulnerability diagnosis device 10 included in the vulnerability diagnosis system 1 according to this embodiment includes an input/output unit 101, a mapping creation unit 102, an engine control unit 103, and a plurality of diagnosis engines 104. , and a diagnostic result generation unit 105 . Each of these functional units is realized by processing executed by one or more programs installed in the vulnerability diagnosis device 10 by a CPU (Central Processing Unit).

The vulnerability diagnosis device 10 according to the present embodiment also has a diagnostic item information storage unit 110 and an engine characteristic information storage unit 120 . Each of these storage units can be implemented using an auxiliary storage device such as a HDD (Hard Disk Drive) or an SSD (Solid State Drive). At least one of these storage units may be implemented using a storage device or the like connected to the vulnerability diagnosis device 10 via the network N.

The input/output unit 101 displays various screens on the terminal device 20 and receives various operations on the terminal device 20 . Various operations in the terminal device 20 include, for example, a diagnosis start operation for starting vulnerability diagnosis of Web applications.

The mapping creation unit 102 refers to the diagnostic item information stored in the diagnostic item information storage unit 110 and the engine characteristic information stored in the engine characteristic information storage unit 120 to determine which diagnostic item related to vulnerability and which diagnosis. Mapping information indicating whether to diagnose by the engine 104 is created.

The engine control unit 103 controls the plurality of diagnostic engines 104 using the mapping information, thereby causing the plurality of diagnostic engines 104 to diagnose the vulnerability of the Web application.

The diagnosis engine 104 is an engine for diagnosing vulnerabilities in web applications. The diagnosis engine 104 is realized by a web application scanner or the like. For example, the diagnosis engine 104 performs a pseudo-attack according to the diagnostic item against the web application to be diagnosed, and by verifying the response from the web application to this attack, the web application is verified with respect to the diagnostic item. Diagnose vulnerabilities.

Here, when each of the plurality of diagnosis engines 104 is distinguished, it is expressed as "first diagnosis engine 104A", "second diagnosis engine 104B", and the like. Note that when each of the plurality of diagnostic engines 104 is distinguished, each diagnostic engine 104 is realized by a different type of web application scanner or the like. For example, the first diagnostic engine 104A and the second diagnostic engine 104B are assumed to be implemented by different types of web application scanners or the like.

A diagnostic result creation unit 105 creates a final diagnostic result from the diagnostic results of each of the plurality of diagnostic engines 104 . The diagnostic result created by the diagnostic result creating unit 105 is output to the terminal device 20 by the input/output unit 101 and displayed on the terminal device 20 as a diagnostic result screen.

The diagnostic item information storage unit 110 stores diagnostic item information indicating diagnostic items related to vulnerability. Here, diagnostic item information stored in the diagnostic item information storage unit 110 will be described with reference to FIG. FIG. 3 is a diagram showing an example of diagnostic item information.

As shown in FIG. 3, the diagnostic item information storage unit 110 stores a plurality of pieces of diagnostic item information (14 pieces of diagnostic item information in the example shown in FIG. 3). Each piece of diagnostic item information includes an “item number” and a “diagnostic item”. "Item number" is a number that identifies each piece of diagnostic item information. "Diagnosis item" is the content of the diagnostic item related to vulnerability.

For example, the diagnostic item information of item number “1” includes “check regarding file upload” as a diagnostic item. This indicates that the diagnostic item information of item number "1" is diagnostic item information for diagnosing vulnerability related to file upload.

Similarly, the diagnostic item information of item number "2" includes "check regarding exposure of internal data/log data" as a diagnostic item. This indicates that the diagnostic item information of item number “2” is diagnostic item information for diagnosing vulnerabilities related to exposure of internal data/log data. The same applies to diagnostic item information of other item numbers.

In this manner, the diagnostic item information storage unit 110 stores diagnostic item information indicating the diagnostic item for each diagnostic item. In the example shown in FIG. 3, 14 pieces of diagnostic item information are stored in the diagnostic item information storage unit 110, but this is just an example. The number of diagnostic items can be arbitrarily changed, for example, by an administrator of the vulnerability diagnostic device 10 or the like. Also, the content of each diagnosis item can be arbitrarily changed by, for example, the administrator of the vulnerability diagnosis device 10 or the like.

The engine characteristic information storage unit 120 stores engine characteristic information indicating characteristics of each diagnostic engine 104 . Here, the engine characteristic information stored in the engine characteristic information storage unit 120 will be described with reference to FIG. FIG. 4 is a diagram showing an example of engine characteristic information.

As shown in FIG. 4, the engine characteristic information storage unit 120 stores a plurality of pieces of engine characteristic information (two pieces of engine characteristic information in the example shown in FIG. 4). Each engine characteristic information includes "engine name" and "engine characteristic".

“Engine Name” is the name of the diagnosis engine 104 . For example, the engine name "Engine A" is the name of the first diagnostic engine 104A. Similarly, for example, the engine name "Engine B" is the name of the second diagnostic engine 104B.

"Engine characteristics" is set with item numbers of diagnostic items that can be diagnosed with high accuracy as characteristics of the diagnostic engine 104 corresponding to the engine name.

For example, the engine characteristics of the engine name "engine A" are "item numbers 1, 2, 4". This means that the first diagnosis engine 104A can diagnose the item number "1", the item number "2", and the item number "4" with high accuracy. is shown.

Similarly, for example, the engine characteristics of the engine name "engine B" are "item numbers 3, 6, 9". This means that the second diagnosis engine 104B can diagnose the item number "3", the item number "6", and the item number "9" with high accuracy. is shown.

In this manner, the engine characteristic information storage unit 120 stores engine characteristic information indicating characteristics of the diagnostic engine 104 for each diagnostic engine 104 . In the example shown in FIG. 4, two items of engine characteristic information are stored in the engine characteristic information storage unit 120, but the engine characteristic information storage unit 120 stores the same number of engine characteristic information as the number of diagnostic engines 104. remembered. Therefore, when the number of diagnostic engines 104 increases or decreases, the number of pieces of engine characteristic information stored in the engine characteristic information storage unit 120 also increases or decreases. The increase or decrease in the engine characteristic information associated with the increase or decrease in the number of diagnosis engines 104 can be performed by, for example, the administrator of the vulnerability diagnosis device 10 or the like.

<Vulnerability diagnosis processing>
Next, the details of the processing (vulnerability diagnosis processing) executed by the vulnerability diagnosis device 10 will be described with reference to FIG. FIG. 5 is a flowchart illustrating an example of vulnerability diagnosis processing.

First, the input/output unit 101 of the vulnerability diagnosis device 10 displays, for example, a diagnosis start screen G100 shown in FIG. (step S101). The terminal device 20 can make a request to start using the vulnerability diagnosis service, for example, by inputting a URL for starting the use of the vulnerability diagnosis service into the Web browser.

A diagnosis start screen G100 shown in FIG. 6 includes a URL input field G110 and a diagnosis start button G120. The URL input field G110 is an input field for inputting a URL indicating a Web application to be diagnosed (a Web application provided by the diagnosis target server 30). The user of the terminal device 20 inputs the URL indicating the Web application to be diagnosed in the URL input field G110, and then presses the diagnosis start button G120. A start operation can be performed.

Next, the input/output unit 101 of the vulnerability diagnosis device 10 receives a diagnosis start operation in the terminal device 20 (step S102).

Next, the mapping creation unit 102 of the vulnerability diagnosis device 10 refers to the diagnostic item information stored in the diagnostic item information storage unit 110 and the engine characteristic information stored in the engine characteristic information storage unit 120, Mapping information is created (step S103). The mapping information is information indicating which diagnosis item is to be diagnosed by which diagnosis engine 104, as described above.

Here, for example, for each diagnostic item indicated by each diagnostic item information, the mapping creation unit 102 creates a diagnostic item and the engine name of the diagnostic engine 104 capable of diagnosing the vulnerability related to the diagnostic item with the highest accuracy. Create by associating (mapping).

For example, referring to the engine characteristic information stored in the engine characteristic information storage unit 120, the engine name "Engine A" can be diagnosed with high accuracy for the diagnosis item of the item number "1". Therefore, the mapping creation unit 102 associates the diagnosis item with the item number “1” with the engine name “Engine A”.

Similarly, for example, referring to the engine characteristic information stored in the engine characteristic information storage unit 120, the engine name "Engine B" can be diagnosed with high accuracy for the diagnosis item of the item number "3". Therefore, the mapping creation unit 102 associates the diagnostic item with item number "3" with the engine name "Engine B".

Here, there may be cases where there is no diagnostic engine 104 capable of diagnosing a certain diagnostic item with high accuracy. In this case, for example, the engine name of one predetermined diagnosis engine 104 (default diagnosis engine 104, etc.) may be associated with the diagnosis item, or the engine names of all or part of the diagnosis engines 104 may be associated with the diagnosis item. It may be associated with a diagnostic item.

Similarly, there may be a plurality of diagnostic engines 104 capable of diagnosing a certain diagnostic item with high accuracy. In this case, for example, the engine name of one predetermined diagnosis engine 104 (for example, the diagnosis engine 104 capable of diagnosing with particularly high accuracy) among the plurality of diagnosis engines 104 may be associated with the diagnosis item. .

In this way, the mapping creation unit 102 creates mapping information by associating, with each diagnostic item, the engine name of the diagnostic engine 104 capable of diagnosing the vulnerability of the diagnostic item with the highest accuracy. An example of mapping information created by the mapping creating unit 102 is shown in FIG. As shown in FIG. 7, in the mapping information, each diagnostic item is associated with the engine name of the diagnostic engine 104 that diagnoses the vulnerability of the diagnostic item.

In the present embodiment, the mapping information is created by the mapping creation unit 102 after accepting the diagnosis start operation (after step S102). Information may be created in advance and stored in a predetermined storage area. Also, at this time, the mapping information may be created, for example, for each user who uses the vulnerability diagnosis service and stored in a predetermined storage area.

Next, the engine control unit 103 of the vulnerability diagnosis device 10 controls a plurality of diagnosis engines 104 using the mapping information, and diagnoses the Web application by these plurality of diagnosis engines 104 (step S104).

That is, for each diagnostic item included in the mapping information, the engine control unit 103 issues a diagnostic request to the diagnostic engine 104 having the engine name associated with the diagnostic item. Run a vulnerability diagnosis on an item.

More specifically, for example, the engine name "Engine A" is associated with the diagnosis item of item number "1" in the mapping information shown in FIG. Therefore, the engine control unit 103 makes a diagnosis request for the diagnosis item to the first diagnosis engine 104A. As a result, diagnosis of the diagnostic item is performed by the first diagnostic engine 104A.

Similarly, for example, the engine name "Engine B" is associated with the diagnosis item of item number "3" in the mapping information shown in FIG. Therefore, the engine control unit 103 makes a diagnosis request for the diagnosis item to the second diagnosis engine 104B. As a result, diagnosis of the diagnostic item is performed by the second diagnostic engine 104B.

In this manner, the engine control unit 103 makes a diagnosis request to the diagnosis engine 104 corresponding to each diagnosis item for each diagnosis item. As a result, vulnerability diagnosis can be performed by the diagnosis engine 104 corresponding to the diagnosis item (that is, the diagnosis engine 104 capable of diagnosing the diagnosis item with high accuracy).

When the same diagnostic engine 104 diagnoses a plurality of diagnostic items, the engine control unit 103 may repeatedly request diagnosis for each diagnostic item to the diagnostic engine 104. A single diagnostic request may be issued collectively.

Here, each diagnosis engine 104 outputs a diagnosis result when the execution of the vulnerability diagnosis is completed. These diagnostic results include, for example, diagnostic items and vulnerability detection results related to the diagnostic items. However, the format (data format, etc.) of these diagnostic results may differ depending on the diagnostic engine 104 . For example, the diagnostic result output from the first diagnostic engine 104A and the diagnostic result output from the second diagnostic engine 104B may have different formats.

Next, the diagnosis result creation unit 105 of the vulnerability diagnosis device 10 creates a final diagnosis result from the diagnosis results output from each diagnosis engine 104 (step S105). As described above, diagnostic results output from each diagnostic engine 104 may have different formats. Therefore, the diagnostic result creation unit 105 creates a final diagnostic result in a predetermined format based on diagnostic items included in these diagnostic results and vulnerability detection results related to these diagnostic items. As a result, even if the format of the diagnosis result output by each diagnosis engine 104 is different, the user of the terminal device 20 can confirm the diagnosis result of each diagnosis item in a predetermined format in step S106, which will be described later. will be able to

At this time, the diagnostic result creation unit 105 creates a final diagnostic result that includes, for example, an overview of the diagnostic items and countermeasures to be taken when vulnerability is detected.

Next, the input/output unit 101 of the vulnerability diagnosis device 10 causes the terminal device 20 to display, for example, a diagnosis result screen G200 shown in FIG. 8 (step S106).

The diagnosis result screen G200 shown in FIG. 8 includes a diagnosis result display field G210 and a details button G220. A diagnosis result including the diagnosis result created by the diagnosis result creating unit 105 is displayed in the diagnosis result display field G210. The user of the terminal device 20 refers to the diagnosis result display field G210, and for each diagnosis item, the number of detections for notifying the user of the number of vulnerabilities detected, the outline explanation of the diagnosis item, and the vulnerability detected. It is possible to check countermeasures, etc. in the case. Thereby, the user of the terminal device 20 can know the vulnerability of the Web application to be diagnosed and the countermeasures against it.

Here, when the user presses the details button G220, the terminal device 20 displays a more detailed diagnosis result. A more detailed diagnosis result is, for example, information indicating which diagnosis engine 104 has diagnosed each diagnosis item. This allows the user of the terminal device 20 to know which diagnostic item was diagnosed by which diagnostic engine 104 . As more detailed diagnosis results, other than the above, for example, for each diagnosis item, the time required for diagnosis, data used for diagnosis (data for performing a pseudo-attack), etc. may be displayed. .

As described above, the vulnerability diagnosis device 10 according to the present embodiment can diagnose the vulnerability of a diagnosis target such as a Web application using a plurality of diagnosis engines 104 . As a result, in the vulnerability diagnosis device 10 according to the present embodiment, each diagnosis item can be diagnosed by the diagnosis engine 104 capable of diagnosing the diagnosis item with high accuracy according to the characteristics of the diagnosis engine 104. Become.

In addition, the vulnerability diagnosis apparatus 10 according to the present embodiment maps each diagnostic item and each diagnostic engine 104 using mapping information, thereby managing which diagnostic item is to be diagnosed by which diagnostic engine 104 . Therefore, in the vulnerability diagnosis device 10 according to this embodiment, the diagnosis engine 104 can be added, deleted, or changed. When the diagnosis engine 104 is added, deleted, or changed, the vulnerability diagnosis device 10 according to the present embodiment recreates the mapping information so that the diagnosis using the diagnosis engine 104 after the addition, deletion, or change can be performed. be able to do

<Another example (Part 1)>
Here, another example (part 1) of the vulnerability diagnosis device 10 according to the present embodiment will be described. The vulnerability diagnosis device 10 according to this embodiment may use, for example, the engine characteristic information shown in FIG. 9 as the engine characteristic information stored in the engine characteristic information storage unit 120 .

In the engine characteristic information shown in FIG. 9, item numbers of diagnostic items that can be diagnosed with high accuracy and item numbers of diagnostic items that can be diagnosed at high speed are set as engine characteristics. At this time, for example, a diagnosis start screen G300 shown in FIG. 10 can be displayed as a screen displayed on the terminal device 20 in step S101 of FIG.

The diagnosis start screen G300 shown in FIG. 10 includes a priority selection field G310. The priority selection field G310 is a selection field for the user to select whether to perform diagnosis with priority given to accuracy or diagnosis with priority given to time. For example, when the user selects “time priority” in the priority selection field G310 and then presses the diagnosis start button G120, in S103 of FIG. Mapping information is created in which the engine name of the diagnostic engine 104 that can diagnose the vulnerability of the diagnostic item at the highest speed is associated with it.

For example, referring to the engine characteristic information shown in FIG. 9, the engine name "Engine B" can be diagnosed at high speed for the diagnosis item of the item number "3". Therefore, the mapping creation unit 102 associates the diagnostic item with item number "3" with the engine name "Engine B".

Similarly, referring to the engine characteristic information shown in FIG. 9, for example, the engine name "Engine A" can be diagnosed at high speed for the diagnosis item of the item number "4". Therefore, the mapping creation unit 102 associates the diagnosis item of the item number "4" with the engine name "Engine A".

Here, it is possible that there is no diagnostic engine 104 capable of diagnosing a certain diagnostic item at high speed. In this case, for example, the engine name of one predetermined diagnosis engine 104 (the default diagnosis engine 104 or the diagnosis engine 104 capable of diagnosing with high accuracy) may be associated with the diagnosis item. The engine name of the diagnostic engine 104 of the unit may be associated with the diagnostic item.

Similarly, there may be multiple diagnosis engines 104 capable of diagnosing a certain diagnosis item at high speed. In this case, for example, the engine name of one predetermined diagnostic engine 104 out of the plurality of diagnostic engines 104 (for example, the diagnostic engine 104 capable of diagnosing particularly at high speed or the diagnostic engine 104 capable of diagnosing with high accuracy) should be associated with the diagnostic item.

If the user selects "precision priority" in the priority selection field G310 and there is no diagnostic engine 104 capable of diagnosing a certain diagnostic item with high accuracy, for example, one predetermined diagnostic engine 104 (the default diagnosis engine 104 or the diagnosis engine 104 capable of high-speed diagnosis) may be associated with the diagnosis item, or all or part of the engine names of the diagnosis engine 104 may be associated with the diagnosis item. You can attach it. Similarly, when there are a plurality of diagnostic engines 104 capable of diagnosing with high accuracy, for example, one predetermined diagnostic engine 104 among the plurality of diagnostic engines 104 (for example, a diagnostic engine 104 capable of diagnosing with high accuracy 104 or a diagnosis engine 104 capable of diagnosis at high speed) may be associated with the diagnosis item.

In this way, the mapping creation unit 102 may create mapping information in which the engine name of the diagnostic engine 104 capable of diagnosing the vulnerability related to the diagnostic item at the highest speed is associated with each diagnostic item.

<Another example (Part 2)>
Here, another example (part 2) of the vulnerability diagnosis device 10 according to the present embodiment will be described. The vulnerability diagnosis apparatus 10 according to this embodiment may display a diagnosis start screen G400 shown in FIG. 11 as the screen displayed on the terminal device 20 in step S101 of FIG.

The diagnosis start screen G400 shown in FIG. 11 includes a detail setting button G410. When the user presses the detailed setting button G410, the terminal device 20 displays a detailed setting screen G500 shown in FIG. 11, for example. The detailed setting screen G500 shown in FIG. 11 is a screen for performing detailed settings for diagnosis related to vulnerability, and includes, for example, a number-of-engines setting field G510 and a diagnostic item customizing field G520.

The number-of-engines setting field G510 is a setting field for setting the number of engines to be diagnosed. When "single" is set as the number of engines, mapping information is created in which one engine name is associated with one diagnostic item. On the other hand, when "multi (parallel execution)" is set as the number of engines and the number of engines is input, mapping information in which engine names of the input number of engines are associated with one diagnostic item is created.

For example, when the number of engines "2" is input, mapping information is created in which two engine names are associated with one diagnostic item. Therefore, in this case, vulnerabilities related to one diagnostic item are diagnosed by two diagnostic engines 104 .

Furthermore, the user may be able to set the number of diagnostic engines 104 that diagnose vulnerabilities related to the diagnostic item for each diagnostic item. Thereby, the user can, for example, diagnose a certain diagnostic item with one diagnostic engine 104, and diagnose another certain diagnostic item (for example, a diagnostic item considered to be particularly important) with a plurality of diagnostic engines 104. , can be set.

Also, the user may specify, for each diagnostic item, the diagnostic engine 104 that diagnoses the vulnerability associated with the diagnostic item. This enables the user to diagnose the vulnerability related to the desired diagnosis item by the desired diagnosis engine 104 .

The diagnostic item customizing field G520 is a setting field for customizing diagnostic items for diagnosing a diagnostic target. In the diagnostic item customization field G520, for example, selection items such as "Diagnose injection vulnerability" and "Diagnose data exposure vulnerability" can be selected. For example, when the user selects "Diagnose injection vulnerability", mapping information is created that includes only diagnostic items for diagnosing injection vulnerability. Similarly, for example, when the user selects "Diagnose vulnerability of data exposure system", mapping information is created that includes only diagnostic items for diagnosing vulnerability of data exposure system. This allows the user to make settings such as, for example, diagnosing only specific types of vulnerabilities (for example, injection, data exposure, etc.). The diagnostic items for diagnosing the vulnerability of the injection system include, for example, diagnostic items such as item number "5", item number "8", and item number "9". Diagnostic items for diagnosing the vulnerability of the data exposure system include, for example, diagnostic items such as item number "2" and item number "3".

The user can make desired settings in the number-of-engines setting field G510, the diagnostic item customizing field G520, etc., and then press the OK button G530 to confirm these settings.

Here, as an example, after selecting "Diagnose injection vulnerability" in the diagnostic item customization field G520, the number of engines for the diagnostic items with item numbers "5" and "8" is set to "2", FIG. 12 shows the mapping information created by the mapping creation unit 102 in step S103 of FIG. 5 when the user sets the number of engines for the diagnostic item with item number "9" to "1". In the mapping information shown in FIG. 12, the number of engine names set by the user is associated with each diagnostic item for diagnosing injection vulnerability. In this manner, mapping information corresponding to settings made by the user is created by the mapping creation unit 102 . As a result, in step S104 of FIG. 5, vulnerabilities related to the diagnostic items with item numbers "5" and "8" are diagnosed by the first diagnostic engine 104A and the second diagnostic engine 104B, and the item number " 9” diagnostic items are diagnosed by the second diagnostic engine 104B.

As described above, in the vulnerability diagnosis device 10 according to the present embodiment, the user can set which diagnosis item to diagnose the vulnerability, how many diagnosis engines 104 to execute diagnosis for one diagnosis item, and the like. Can be set in detail. As a result, for example, a user or the like who has knowledge about vulnerability diagnosis can create desired mapping information.

The invention is not limited to the specifically disclosed embodiments above, but various modifications and changes are possible without departing from the scope of the claims.

1 vulnerability diagnosis system 10 vulnerability diagnosis device 20 terminal device 30 diagnosis target server 101 input/output unit 102 mapping creation unit 103 engine control unit 104 diagnosis engine 104A first diagnosis engine 104B second diagnosis engine 105 diagnosis result creation unit 110 Diagnosis item information storage unit 120 Engine characteristic information storage unit

Claims (7)

A vulnerability diagnosis device having a plurality of diagnosis engines for diagnosing the presence or absence of a vulnerability to be diagnosed,
creating means for creating mapping information in which, for each diagnostic item, a diagnostic engine for diagnosing the presence or absence of vulnerabilities related to the diagnostic item among the plurality of diagnostic engines is associated with the diagnostic engine according to the characteristics of the diagnostic engine;
diagnostic means for diagnosing the vulnerability of the diagnosis target by a diagnostic engine associated with each diagnostic item based on the mapping information created by the creating means;
has
The characteristic of the diagnosis engine is at least one of information indicating a diagnostic item capable of diagnosing the presence or absence of a vulnerability with high accuracy and information indicating a diagnostic item capable of diagnosing the presence or absence of a vulnerability at high speed,
The creation means is
By associating with each diagnostic item a diagnostic engine capable of diagnosing the presence or absence of vulnerabilities related to the diagnostic item with the highest accuracy or a diagnostic engine capable of diagnosing the presence or absence of vulnerabilities related to the diagnostic item at the highest speed, the mapping information creating a vulnerability diagnosis device. The creation means is
creating the mapping information according to characteristics of the diagnostic engine and settings made by a user;
The vulnerability diagnosis device according to claim 1 , characterized by: The setting content includes at least one of setting content indicating a diagnostic item for diagnosing the presence or absence of the vulnerability and setting content indicating the number of diagnostic engines for diagnosing the presence or absence of the vulnerability related to the diagnostic item.
The vulnerability diagnosis device according to claim 2 , characterized by: The creation means is
For each diagnostic item, creating mapping information in which one or more diagnostic engines for diagnosing the presence or absence of vulnerabilities related to the diagnostic item are associated.
The vulnerability diagnosis device according to any one of claims 1 to 3 , characterized by: result creation means for creating a second diagnosis result in a predetermined format based on the first diagnosis results respectively output from the plurality of diagnosis engines;
display means for displaying the second diagnosis result created by the result creation means on a terminal device connected to the vulnerability assessment device via a network;
The vulnerability diagnosis device according to any one of claims 1 to 4 , comprising: A computer having a plurality of diagnostic engines for diagnosing the presence or absence of vulnerabilities to be diagnosed,
a creation procedure for creating mapping information in which, for each diagnostic item, a diagnostic engine for diagnosing the presence or absence of vulnerabilities related to the diagnostic item, among the plurality of diagnostic engines, is associated with the diagnostic engine according to the characteristics of the diagnostic engine;
a diagnostic procedure for diagnosing the vulnerability of the diagnostic target by a diagnostic engine associated with the diagnostic item for each diagnostic item based on the mapping information created by the creation procedure;
and run
The characteristic of the diagnosis engine is at least one of information indicating a diagnostic item capable of diagnosing the presence or absence of a vulnerability with high accuracy and information indicating a diagnostic item capable of diagnosing the presence or absence of a vulnerability at high speed,
The creation procedure includes:
By associating with each diagnostic item a diagnostic engine capable of diagnosing the presence or absence of vulnerabilities related to the diagnostic item with the highest accuracy or a diagnostic engine capable of diagnosing the presence or absence of vulnerabilities related to the diagnostic item at the highest speed, the mapping information creating a vulnerability diagnosis method. A program for causing a computer to function as each means in the vulnerability diagnosis device according to any one of claims 1 to 5 .

Images