KR101893090B1 - Vulnerability information management method and apparastus thereof - Google Patents

Abstract

A method and apparatus for managing vulnerability information are provided. A vulnerability information management method according to an embodiment of the present invention includes a step of obtaining a vulnerability table including first vulnerability information by parsing and classifying data obtained from a vulnerability information source; a step of extracting a text associated with the first vulnerability information from the vulnerability table; a step of generating first vulnerability basic information from the text; and a step of storing the first vulnerability basic information in the vulnerability table.

Description

[0001] VULNERABILITY INFORMATION MANAGEMENT METHOD AND APPARATUS THEREOF [0002]

The present invention relates to a method and apparatus for managing vulnerability information. More particularly, the present invention relates to a method and apparatus for generating additional information from stored vulnerability information so as to more effectively utilize the vulnerability information.

The contents described in this section merely provide background information on the present embodiment, but do not describe a known art.

Security vulnerabilities inherent in software can easily be exploited to attack computer systems. Attackers can use Internet scanning tools to identify malicious Web services that are less secure. As a result, security administrators need to be aware of and respond quickly to open vulnerabilities. Especially, in recent years, as the Internet of Things (IoT) devices have become widespread, the number of devices connected to the Internet is rapidly increasing. Therefore, it is necessary to quickly identify vulnerabilities and perform vulnerability analysis on many computer systems connected to the Internet. Vulnerability analysis is the process of identifying and analyzing vulnerabilities in order to prevent security incidents arising from security vulnerabilities.

Vulnerability information is provided from multiple vulnerability information sources in order to easily share known security vulnerabilities in advance. For example, NVD (Natinoal Vulnerability Database) provides Common Vulnerabilities and Exposures (CVE) information. CVE information provides a way to reference security vulnerability information in software packages. The CVE information includes the Common Vulnerabilities and Exposures Identifier (CVE-ID), Overview of the Vulnerability Scoring System (CVSS), Common Platform Enumeration (CPE), Common Weakness Enumeration ). (see http://nvd.nist.gov/)

Vulnerability information can also be found at http://vuldb.com/(VulDB) or at http://www.securityfocus.com/bid/ (Bugtraq). In addition, manufacturers of devices connected to the Internet are also displaying device firmware version information and security patch information in various forms through a web page (http://iptime.com/iptime/?page_id=126 and http: //netiskorea.com/atboard.php?grp1=support&grp2=download).

Therefore, in order to quickly identify and analyze vulnerability information provided from various vulnerability information sources, vulnerability information provided from various vulnerability information sources should be collected and integrated. However, the types of information contained in the vulnerability information provided for each vulnerability information source are different, and the types of information stored are often different. For example, there is a vulnerability information source that provides vulnerability information including CPE (Common Platform Enumeration) information indicating the name of the product where the vulnerability occurs, but there is also a vulnerability information source that does not include CPE information. Therefore, in order to quickly identify and analyze vulnerability information provided from various vulnerability information sources, it is necessary to process the vulnerability information.

The technical problem to be solved by the present invention is to manage vulnerability information so that more useful vulnerability information can be shared and analyzed by collecting vulnerability information from various vulnerability information sources and generating additional information from the collected vulnerability information And a device therefor.

The technical objects of the present invention are not limited to the above-mentioned technical problems, and other technical subjects not mentioned can be clearly understood by those skilled in the art from the following description.

According to an aspect of the present invention, there is provided a method of managing vulnerability information according to an embodiment of the present invention includes parsing and classifying data obtained from a vulnerability information source to obtain a vulnerability table including a first vulnerability information Extracting a text associated with the first vulnerability information from the vulnerability table; generating first vulnerability basic information from the text; and storing the first vulnerability basic information in the vulnerability table. . ≪ / RTI >

According to another embodiment, the first vulnerability basic information may include a title, a keyword, a corpus, and a summary of the first vulnerability information.

According to still another embodiment, the step of generating the first vulnerability basic information includes extracting a representative sentence or a representative word from the text and generating a title composed of the representative sentence or the representative word can do.

According to another embodiment of the present invention, the step of extracting the representative sentence or the representative word includes the step of inputting the text into a text rank algorithm to return the sentence or word as the representative sentence or the representative word .

According to another embodiment of the present invention, the step of generating the title includes the steps of: determining a word corresponding to a manufacturer name, a product name, and a vulnerability type from the representative sentence or the representative word; And generating a title composed of the product name and the vulnerability type.

According to still another embodiment, the step of generating the first vulnerability basic information includes a step of inputting the text into a text rank algorithm and a word-by-word (Word2Vec) algorithm, .

According to still another embodiment, the step of generating the first vulnerability basic information may include generating a word cluster having a similar meaning using the text and the keyword using a topic model, And generating the corpus based on the corpus.

According to another embodiment, the step of generating the first vulnerability basic information may include a step of combining the data of the keyword and the corpora, and generating the combined information by eliminating the redundant information .

According to still another embodiment, generating the first vulnerability basic information may include generating the summary by abbreviating the text.

According to another embodiment of the present invention, there is provided a vulnerability information management method comprising the steps of: obtaining a CPE (Common Platform Enumeration) dictionary through a network; obtaining a CPE name corresponding to the first vulnerability basic information based on the CPE dictionary , And the step of storing may further include storing the CPE name in the vulnerability table.

According to another embodiment of the present invention, the step of determining the CPE may include performing CPE tree-based keyword analysis on the CPE dictionary using the first vulnerability basic information as a keyword, As the name.

According to another embodiment of the present invention, the vulnerability information management method includes generating a vulnerability information classification model by learning vulnerability information training data, and inputting the vulnerability basic information into the vulnerability information classification model, Generating vulnerability category information, and storing the first vulnerability category information in the vulnerability table.

According to another embodiment of the present invention, the vulnerability information training data may include summary information of the previously-known vulnerability information obtained by parsing a file containing known vulnerability information and second vulnerability type information have.

According to another embodiment of the present invention, the vulnerability information classification model outputs the first vulnerability category information in the form of a Common Weakness Enumeration (CWE) code as the vulnerability basic information is input can do.

According to another embodiment of the present invention, the vulnerability information management method further comprises the step of calculating the similarity of the second vulnerability basic information generated from the second vulnerability information of the vulnerability table to the first vulnerability basic information, And storing the vulnerability ID of the second vulnerability information as an associated vulnerability ID in the vulnerability table if the similarity is the highest value or more than the threshold value.

According to an aspect of the present invention, there is provided a vulnerability information management apparatus comprising: a storage unit for storing a vulnerability table including first vulnerability information by parsing and classifying data obtained from a vulnerability information source; An information extracting unit for extracting a text related to the first vulnerability information from the vulnerability table and a vulnerability information managing unit for generating first vulnerability basic information from the text and storing the first vulnerability basic information in the vulnerability table .

According to an aspect of the present invention, there is provided a computer program recorded on a non-transitory computer readable medium, wherein when instructions of the computer program are executed by a processor of a server, The method comprising: obtaining a vulnerability table including first vulnerability information by parsing and classifying data obtained from the vulnerability information source; extracting text associated with the first vulnerability information from the vulnerability table; Generating vulnerability basic information, and storing the first vulnerability basic information in the vulnerability table.

According to an aspect of the present invention, there is provided a vulnerability information management system comprising: a vulnerability information collection system for obtaining first vulnerability information by parsing and classifying data obtained from a vulnerability information source; A vulnerability table storing a vulnerability table including vulnerability information and a text associated with the first vulnerability information from the vulnerability table, generating first vulnerability basic information from the text, And a vulnerability information management apparatus that stores the vulnerability information in a table.

1 is a diagram illustrating an example for explaining types of information included in vulnerability information provided from various vulnerability information sources.
2 is a diagram illustrating a structure of a vulnerability information management apparatus according to an embodiment.
3 is a diagram illustrating a process for managing vulnerability information according to an embodiment.
4 is a diagram illustrating an example of code for generating titles and keywords in accordance with one embodiment.
5 is an illustration of an example of code executed to generate a corpus according to one embodiment.
6 is a diagram illustrating a process for generating a CPE name from vulnerability basic information according to an embodiment.
7 is a diagram illustrating a process for generating a CWE code according to one embodiment.
8 is a diagram showing an example of CVE information.
9 is a diagram illustrating types of vulnerabilities classified according to one embodiment.
10 is a diagram illustrating a process of generating a vulnerability information classification model according to an embodiment.
11 is a diagram illustrating a process for storing an association vulnerability ID according to an embodiment.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS The advantages and features of the present invention and the manner of achieving them will become apparent with reference to the embodiments described in detail below with reference to the accompanying drawings. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. Is provided to fully convey the scope of the invention to those skilled in the art, and the invention is only defined by the scope of the claims. Like reference numerals refer to like elements throughout the specification.

Unless defined otherwise, all terms (including technical and scientific terms) used herein may be used in a sense commonly understood by one of ordinary skill in the art to which this invention belongs. Also, commonly used predefined terms are not ideally or excessively interpreted unless explicitly defined otherwise. The terminology used herein is for the purpose of illustrating embodiments and is not intended to be limiting of the present invention. In the present specification, the singular form includes plural forms unless otherwise specified in the specification.

Throughout this specification, the vulnerability information source refers to the source of the vulnerability information. For example, the vulnerability information source may be a server that provides a vulnerability information database or a web page, but the present invention is not limited thereto.

Also, throughout this specification, the vulnerability table refers to data stored and structured in the collected vulnerability information. Generally, the vulnerability table may be configured in the form of a table in which information is classified and stored in a plurality of fields, but is not limited thereto.

Vulnerabilities are threats to unauthorized user access to computer systems, threats to disrupt normal service of computer systems, threats to leakage, tampering, and deletion of critical data managed by computer systems. Specifically, (i) system security vulnerabilities such as Race Condition environment variables, account and password, access rights, system configuration, network configuration, buffer overflow, backdoor, etc., (ii) unnecessary services and information provision, Network vulnerabilities such as attacks, RPC, HTTP, SMTP, FTP, BIND, FINER, buffer overflows, and (iii) application vulnerabilities such as Web servers, firewall servers, IDS servers, database servers, and source code vulnerabilities.

Some embodiments of the present invention will now be described with reference to the drawings.

1 is a diagram illustrating an example for explaining types of information included in vulnerability information provided from various vulnerability information sources. However, FIG. 1 is only an example for explaining the present invention, and actual vulnerability information may be different from that shown in FIG.

Vulnerability information is disclosed through a variety of vulnerability information sources in order to share vulnerability information on products connected to networks such as the Internet. Referring to FIG. 1, the field indicates a type of information in which the vulnerability information is classified. In addition, the field may indicate a classification of a data field in which the vulnerability information is classified and stored in the vulnerability table.

In FIG. 1, the vulnerability identifier indicates an ID that allows the vulnerability information to be identified. For example, the vulnerability identifier in the vulnerability information provided in NVD may be a CVE-ID such as 'CVE-2016-2222'. Title means the name representing the vulnerability. In general, a title may be a single sentence or a combination of words, but is not limited thereto. Overview refers to information that describes the content of a vulnerability through text or the like. The product name refers to information indicating the product in which the vulnerability exists. For example, the product name may be a CPE name. The CPE name is information configured in a predetermined form so that the type, name, etc. of the device can be known. The type of vulnerability is information indicating the nature of the vulnerability such as whether the vulnerability relates to information leakage, external source code execution, source code insertion by external attack, or buffer error . For example, Common Vulnerabilities and Exposures (CVE) information provided by the NVD includes information on the types of vulnerabilities and Common Weakness Enumeration Code (CWE code), which is a code for classifying vulnerabilities. Vulnerability score means the degree of vulnerability of computer system due to vulnerability. For example, CVE information, which is vulnerability information provided by NVD, is a vulnerability score and includes Common Vulnerability Scoring System (SVSS) information. A release is the date or time at which the vulnerability information was posted. Remote / local means information about whether the vulnerability information is a remote related vulnerability or a local related vulnerability. The solution is information about a solution to the vulnerability. Reference refers to information that can be referenced in connection with the vulnerability.

2 is a diagram illustrating a structure of a vulnerability information management apparatus according to an embodiment.

The computing device 10 according to one embodiment may include a storage unit 210 and a vulnerability information management unit 220. In addition, the computing device 10 may further include a vulnerability information collection system 20. The vulnerability information collection system 20 may be provided separately from the computing device 10.

According to one embodiment, the vulnerability information collection system 20 can collect vulnerability information from a plurality of vulnerability information sources 30 and generate the vulnerability table 1 based on the collected vulnerability information. The vulnerability information collection system 20 can extract vulnerability information by parsing the data received from the vulnerability information sources 30. For example, when a vulnerability file containing vulnerability information is downloaded from the vulnerability information sources 30, the vulnerability information collection system 20 performs file parsing on the downloaded vulnerability file, Can be extracted. For example, the vulnerability information collection system 20 can extract vulnerability information by performing a web language (e.g., HyperText Markup Language (HTML) parsing) on a source code of a web page provided through a server The vulnerability information collection system 20 may classify the vulnerability information and store the vulnerability information in the vulnerability table according to the classification result, that is, for example, the vulnerability information classified as the vulnerability identifier stores the vulnerability identifier And the vulnerability information classified as the vulnerability category can be stored in an item for storing the vulnerability category. Each item may be configured as a field of the vulnerability table, but is not limited thereto.

The computing device 10 may store the obtained vulnerability table 1 in the storage unit 210. [ The storage unit 210 may include a storage medium or a system capable of storing data.

The vulnerability information management unit 220 can manage the vulnerability table 1 of the storage unit 210. [ The vulnerability information management unit 220 can generate vulnerability basic information based on the vulnerability information included in the vulnerability table 1. [ Here, the vulnerability basic information represents basic information describing the vulnerability. According to one embodiment, the vulnerability basic information includes a title representing a vulnerability, a keyword extracted from vulnerability information, a corpus, a word cluster having a similar meaning to a specific subject, And summary information that is reduced information.

In addition, according to another embodiment, the vulnerability information management unit 220 may further generate additional information using vulnerability basic information. The vulnerability information management unit 220 may store the generated additional information in the vulnerability table 1 if the same kind of information as the generated additional information does not exist in the vulnerability table 1. [ The vulnerability information management unit 220 can change the information stored in the vulnerability table 10 to the generated additional information if the same kind of information as the generated additional information exists in the vulnerability table 1 have.

However, FIG. 2 is intended to illustrate an embodiment, and the computing device 10 may be modified into other forms capable of performing the same operations. For example, the computing device may include a storage device for storing data, a memory for loading and storing operations, a hardware processor for executing operations stored in the memory, and a network interface for performing communication with the outside, As shown in FIG. Alternatively, the computing device 10 may be configured as a system other than a single device or a system including a plurality of devices.

Hereinafter, the operation of the vulnerability information management apparatus 10 will be described in more detail.

3 is a diagram illustrating a process for managing vulnerability information according to an embodiment.

First, the vulnerability information management apparatus 10 can acquire the vulnerability table 1 through the vulnerability information collection system 20 (S310). The vulnerability information collection system 20 can acquire vulnerability information by parsing the data received from the vulnerability information sources 30. The acquired vulnerability information can be classified to generate a structured vulnerability table (1) from the vulnerability information obtained from the various vulnerability information sources (30). In addition, when the vulnerability information is not formulated, the vulnerability information can be formatted and the vulnerability information collection system 20 can be configured in the vulnerability table 1 including the formalized vulnerability information. The acquired vulnerability table (1) can be stored in the storage unit (210).

Thereafter, the vulnerability information management unit 220 of the vulnerability information management apparatus 10 can extract text from the vulnerability information stored in the vulnerability table 1 (S320). For example, the vulnerability information management unit 220 can extract the text stored in the overview field of the vulnerability table. Here, the text is only a representative example of the information extracted from the vulnerability information, and the type of the information extracted from the vulnerability information may be changed according to the embodiment.

Thereafter, the vulnerability information management unit 220 of the vulnerability information management device 10 may generate vulnerability basic information using the extracted text (S330). The vulnerability information management unit 220 may use a text summary and an associated keyword generation algorithm to generate vulnerability basic information. According to an exemplary embodiment, the vulnerability basic information generated in step S330 may include at least one of a title, a keyword, a corpus, and summary information.

According to one embodiment, the vulnerability basic information may include a title. In this case, the vulnerability information management unit 220 may apply a textrank algorithm to the text extracted from the vulnerability information to generate a title. By applying a text rank algorithm to the extracted text, the vulnerability information management unit 220 can select a representative sentence among the sentences included in the text. Alternatively, the vulnerability information management unit 220 may extract keywords that are considered to represent the main contents in the text. The vulnerability information management unit 220 can determine a representative sentence by combining keywords. For example, the vulnerability information management unit 220 may extract keywords representing types of manufacturers, products, and vulnerabilities from the text, and determine sentences combining the manufacturer, product, and types of vulnerabilities as representative sentences. The vulnerability information management unit 220 can determine the text selected as the representative sentence as the title of the vulnerability basic information.

In addition, the vulnerability basic information may include a keyword for the vulnerability. In this case, the vulnerability information management unit 220 may apply a textrank algorithm and a word-by-word (Word2Vec) algorithm to the text extracted from the vulnerability information to determine the keyword. By applying a text rank algorithm and a word-by-word algorithm to the extracted text, the vulnerability information management unit 220 can extract keywords from the text.

4 is a diagram illustrating an example of code for generating titles and keywords in accordance with one embodiment. Referring to FIG. 4, the vulnerability information management unit 220 may generate a title by using a summarize () function to return a sentence representing the contents of the text among a plurality of sentences. In addition, the vulnerability information management unit 220 can generate a keyword for the text from the input value using the keywords () function. The example shown in FIG. 4 relates to a code for generating a title and a keyword from vulnerability information identified by v102674. The vulnerability information management unit 220 can generate a subject and a keyword for the vulnerability information by executing a code as shown in FIG.

The vulnerability basic information may include a corpus for vulnerability information. The vulnerability information management unit 220 can generate word clusters having a similar meaning using a topic model by using the text and keywords extracted from the vulnerability information to generate a corpus. Here, the subject model is a statistical model for finding the subject of a document set. The subject created by subject modeling is a word cluster of similar meaning. The vulnerability information management unit 220 can generate a corpus by selecting the generated word cluster.

Also, according to one embodiment, the vulnerability information management apparatus 10 may combine the keyword and corpus data, and then generate the combination information by removing redundant data from the integrated data. By generating the combination information, the keyword and the corpus can be integrally used.

5 is an illustration of an example of code executed to generate a corpus according to one embodiment. The vulnerability information management unit 220 according to an embodiment performs pre-processing on text extracted from the vulnerability information by executing the code shown in FIG. 5, and acquires a corpus by generating a word cluster can do.

The vulnerability basic information may include summary information on the vulnerability information. The vulnerability basic information can be generated by abbreviating the text extracted from the vulnerability information. For example, when 30 bytes (bytes) of text are extracted from vulnerability basic information, it can be generated by shortening the extracted text into 4 bytes of text. The vulnerability information management unit 220 may use the seq2seq algorithm to shorten the text.

Referring back to FIG. 3, the vulnerability information management unit 220 may store the generated vulnerability basic information in the vulnerability table (S340). Here, the vulnerability information management unit 220 may store the vulnerability basic information in a field separate from the field shown in FIG.

According to another embodiment, the vulnerability information management unit 220 may further generate additional information using vulnerability basic information. According to one embodiment, the vulnerability information management unit 220 uses the vulnerability basic information to identify a name of a CPE (Common Platform Enumeration) indicating a product in which a vulnerability occurs, a Common Weakness Enumeration (CWE) An additional Common Vulnerabilities and Exposures (IDs) can be created that are identifiers that identify vulnerabilities related to information.

6 is a diagram illustrating a process for generating a CPE name from vulnerability basic information according to an embodiment. 6A is a process performed when the CPE name corresponding to the vulnerability basic information exists in the CPE dictionary 720-1. According to one embodiment, the vulnerability information management unit 220 can search the CPE dictionary 720-1 for the CPE keywords matched with the keyword 710 included in the vulnerability basic information. The vulnerability information management unit 220 may generate a CPE name 730 conforming to the CPE format of the CPE dictionary 720-1 from the CPE keyword retrieved from the CPE dictionary 720-1.

The vulnerability information management unit 220 may generate the CPE tree using the CPE dictionary to convert the product name into the CPE format based on the CPE dictionary 920. According to one embodiment, the CPE tree may have six levels.

A CPE tree having a plurality of levels and a plurality of nodes includes (i) a node corresponding to a first level, a vendor information, (ii) a node corresponding to a second level, product name information, The node corresponding to the fifth level is the distribution (Edition) information, the node corresponding to the sixth level is the product language ( Language) information.

The generated CPE tree may include at least three levels from the first level to the sixth level. The information of the node corresponding to the first level and the information of the node corresponding to the second level may be the same. That is, the product name may be the same as the manufacturer.

The CPE tree includes at least one of a parent node, a child node, and a sibling node. And is connected between the parent node and the child node. Among the plurality of levels, the node corresponding to the upper level corresponds to the parent node, the node corresponding to the lower level among the plurality of levels corresponds to the child node, and the nodes corresponding to the same level among the plurality of levels correspond to the sibling nodes .

If an intermediate level is omitted from a plurality of levels, the nodes corresponding to the upper level node of the omitted intermediate level and the nodes corresponding to the lower level of the omitted intermediate level are connected.

The vulnerability information management unit 220 generates a plurality of levels by separating the character string of the CPE dictionary on the basis of the character ':'. The vulnerability information management unit 220 separates the character string based on the character '~' in the fifth level of the CPE dictionary.

The vulnerability information management unit 220 combines the keywords included in the product name information among the keywords of the CPE tree into one or more CPEs conforming to the format of the CPE dictionary from the CPE tree.

6B is a process performed when the CPE name corresponding to the vulnerability basic information does not exist in the CPE dictionary 720-1. When the CPE keyword corresponding to the keyword 740 of the vulnerability basic information is retrieved from the CPE dictionary 720-2 as a result of searching the CPE keyword corresponding to the keyword 740 as a result of searching for the keyword 740, RTI ID = 0.0 > 740). ≪ / RTI >

First, the vulnerability information management unit 220 can classify keywords by analyzing the meaning of each keyword 740. Here, in order to classify keywords, the vulnerability information management unit 220 may use a text classification model generated through machine learning. Here, the text classification model may be a model trained by using CPE name and overview information included in known vulnerability information (for example, CVE information) as learning data. The vulnerability information management unit 220 may generate a CPE name 760 that conforms to the CPE format by inserting each of the classified keywords 750 into each position of the CPE format. Thereafter, the vulnerability information management unit 220 may register the CPE name 760 in the CPE dictionary 720-2.

7 is a diagram illustrating a process for generating a CWE code according to one embodiment.

First, in step S810, the vulnerability information management apparatus 10 may generate a vulnerability information classification model capable of classifying the vulnerability information according to the vulnerability basic information. Here, the vulnerability information classification model can classify the vulnerability information by selecting one or more of the predetermined vulnerability types. Here, the predetermined types of vulnerabilities can be determined such that each vulnerability type has previously known vulnerability information exceeding the threshold value. For example, a vulnerability type could be defined to have more than 1000 CVE information for each type of vulnerability. In addition, each type of vulnerability can have a corresponding CWE code.

According to one embodiment, the vulnerability information management apparatus 10 can learn vulnerability information training data to generate a vulnerability information classification model. Here, the vulnerability information training data is known vulnerability information in advance and may include information on the vulnerability type.

Thereafter, in step S820, the vulnerability information management apparatus 10 can generate vulnerability type information by inputting vulnerability basic information into the vulnerability information classification model. Here, the vulnerability type information may include a CWE code. When the vulnerability basic information is input to the vulnerability information classification model, the vulnerability information classification model can return the CWE code corresponding to the vulnerability basic information. For example, if the keywords and summary information of the vulnerability basic information include words related to a buffer error, the vulnerability information classification model may return a CWE code for a buffer error. In step S830, the vulnerability information management apparatus 10 may store the generated vulnerability type information.

8 is a diagram showing an example of CVE information. 8, the CVE information includes all or part of a CVE-ID 910, an overview 920, a CVSS 930, a CPE 940, a CWE 950, and a Reference 960 . The vulnerability outline information 920 includes information on the vulnerability outcome 920 and the vulnerability outcome 930. The vulnerability outline information 920 includes information on the vulnerability outcome 930, , "(aka) vulnerability title in the reference site", "(a) different vulnerability than other CVE-IDs". Vulnerability summary information 920 may be expressed in terms such as Description or the like. The vulnerability information management unit 220 extracts texts constituting the subject, keyword, and summary information based on words or strings such as 'allow', 'to', 'via', 'aka', 'a different vulnerability than' .

In order to create the vulnerability classifying model, the vulnerability information managing device 10 removes information commonly used in the vulnerability outline information from the strings constituting the vulnerability outline information. That is, the vulnerability information management unit 220 selects meaningful information from a character string constituting the outline information. For example, the first explanatory information, the second explanatory information, and the third explain information may be classified into (i) Attacker Type, (ii) Results of Attack, (iii) Means of Attack, And (iv) a Vulnerability Title in the Reference Site. 8, "epan / dissectors / packet-hiqnet.c in the HiQnet dissector in Wireshark 2.0.x before 2.0.2 does not validate the data type, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet. " The remote attackers', 'cause a denial of service (out-of-bounds read and application crash)', and 'a crafted packet' based on 'allows',' to ' .

The vulnerability information management apparatus 10 can extract the predetermined vulnerability type information from the vulnerability information as shown in FIG. For example, 'CWE-20' shown in FIG. 8 can be extracted.

The vulnerability information management apparatus 10 can generate vulnerability information classification models by learning based on the first explanatory information, the second explanatory information, the third explanatory information, and the vulnerability type information. The vulnerability information classification models are not associated between the first description information, the second description information, and the third description information, so that the first description information, the second description information, and the third description information are independent . The vulnerability information classification models represent the first explanatory information, the second explanatory information, and the third explanatory information as a vector, and the vulnerability information classification models having the maximum probability for the first explanatory information, the second explain information, Which is a conditional probability model. For example, a Naive Bayes classifier may be applied, but this is merely an example, and it goes without saying that various classification models may be used according to the design of the vulnerability information classification models.

The vulnerability information management apparatus 10 can generate each vulnerability information classification model by learning based on the first explanatory information, the second explanatory information, the third explanatory information, and the pre-classified vulnerability type information.

As described above, when the vulnerability basic information includes information matching the explanatory information using the vulnerability information classification models, the vulnerability type can be determined.

9 is a diagram illustrating types of vulnerabilities classified according to one embodiment.

According to one embodiment, the vulnerability information classification model can classify vulnerability information into any one of the vulnerability types shown in FIG. The type of vulnerability shown in FIG. 9 is composed of 16 kinds of vulnerability types by grouping Common Weakness Enumeration (CWE) provided by NVD in CVE information. The CWE item in FIG. 9 means the CWE number. The CWE code may include CWE code. For example, if the CWE number is '119', the CWE code may be 'CWE-119'.

10 is a diagram illustrating a process of generating a vulnerability information classification model according to an embodiment.

According to an embodiment, the vulnerability information processing apparatus 10 may perform pre-processing on text extracted from the vulnerability table, that is, vulnerability information (S1110). The vulnerability information processing apparatus 10 may remove a stop word (e.g., a comma or a period) included in the text (S1120).

Thereafter, the vulnerability information processing device 10 may extract stem from the text by performing stemming on the text (S1140). In addition, the vulnerability information processing apparatus 10 may remove the upper half word words of the extracted words (S1140).

The vulnerability information processing device 10 can select a feature for the preprocessed text as described above (S1150). Thereafter, the vulnerability information processing device 10 can generate a classification model that has learned the vulnerability information by creating a vulnerability information classification model based on the selected characteristic (S1160).

11 is a diagram illustrating a process for storing an association vulnerability ID according to an embodiment.

First, the vulnerability information processing apparatus 10 can calculate the degree of similarity between vulnerability basic information and other vulnerability basic information (S1210). That is, when the first vulnerability basic information generated from the first vulnerability information stored in the vulnerability table (1) and the second vulnerability basic information generated from the second vulnerability information exist, the vulnerability information processing device (10) The degree of similarity between the basic information and the second vulnerability basic information can be calculated. For example, the vulnerability information processing apparatus 10 may calculate summary information of vulnerability information stored in the vulnerability table 10 and summary information of other vulnerability information using a document similarity determination algorithm.

Thereafter, the vulnerability information processing device 10 can compare the similarities of the vulnerability basic information with each other (S1220). For example, the vulnerability information processing device 10 can determine which of the vulnerability information is the most similar to the vulnerability information or the vulnerability information of the order of high similarity. In another example, the vulnerability information processing device 10 can determine what other vulnerability information with a degree of similarity to one vulnerability information is equal to or higher than a threshold value.

The vulnerability information processing device 10 may store the association vulnerability ID according to the comparison result (S1230). That is, the vulnerability information processing device 10 can determine vulnerability basic information having a high degree of similarity, and can identify vulnerability IDs (for example, CVE-ID) included in vulnerability information on vulnerability basic information having a high degree of similarity, Can be stored in an information table.

The methods according to the embodiments of the present invention described so far can be performed by the execution of a computer program embodied in computer readable code. The computer program may be transmitted from a first computing device to a second computing device via a network, such as the Internet, and installed in the second computing device, thereby enabling it to be used in the second computing device. The first computing device and the second computing device all include a server device, a physical server belonging to a server pool for cloud services, and a fixed computing device such as a desktop PC.

The computer program may be stored in a recording medium such as a DVD-ROM, a flash memory device, or the like.

While the present invention has been described in connection with what is presently considered to be practical exemplary embodiments, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, I can understand that. It is therefore to be understood that the above-described embodiments are illustrative in all aspects and not restrictive.

Claims (18)

A method for a computing device to manage vulnerability information,
Obtaining a vulnerability table including first vulnerability information by parsing and classifying data obtained from the vulnerability information source;
Extracting a text associated with the first vulnerability information from the vulnerability table;
Generating first vulnerability basic information from the text;
Storing the first vulnerability basic information in the vulnerability table;
Calculating a degree of similarity of the second vulnerability basic information generated from the second vulnerability information of the vulnerability table with respect to the first vulnerability basic information; And
And storing the vulnerability ID of the second vulnerability information in the vulnerability table as an association vulnerability ID if the calculated similarity is the highest value or is greater than or equal to a threshold value.
How to Manage Vulnerability Information. The method according to claim 1,
Wherein the first vulnerability basic information comprises:
A title, a keyword, a corpus, and a summary of the first vulnerability information;
How to Manage Vulnerability Information. 3. The method of claim 2,
The step of generating the first vulnerability basic information includes:
Extracting a representative sentence or a representative word from the text; And
And generating a title composed of the representative sentence or the representative word.
How to Manage Vulnerability Information. The method of claim 3,
The step of extracting the representative sentence or the representative word includes:
And returning the sentence or word as the representative sentence or the representative word by inputting the text into a text rank algorithm.
How to Manage Vulnerability Information. The method of claim 3,
Wherein the step of generating the title comprises:
Determining a manufacturer name, a product name, and a word corresponding to the type of vulnerability from the representative sentence or the representative word; And
And generating a title composed of the manufacturer name, the product name, and the vulnerability type based on the determined word.
How to Manage Vulnerability Information. 3. The method of claim 2,
The step of generating the first vulnerability basic information includes:
And returning the keyword as an output word by inputting the text into a text rank algorithm and a word-by-word algorithm (Word2Vec)
How to Manage Vulnerability Information. The method according to claim 6,
The step of generating the first vulnerability basic information includes:
Generating a word cluster having a similar meaning using the text and the keyword using a topic model; And
And generating the corpus based on the word clusters.
How to Manage Vulnerability Information. 3. The method of claim 2,
The step of generating the first vulnerability basic information includes:
Integrating data of the keyword and the corpus, and generating combined information by eliminating redundant information.
How to manage vulnerability information 3. The method of claim 2,
The step of generating the first vulnerability basic information includes:
And generating the summary by abbreviating the text. ≪ RTI ID = 0.0 >
How to Manage Vulnerability Information. The method according to claim 1,
The vulnerability information management method includes:
Obtaining a Common Platform Enumeration (CPE) dictionary over the network;
Determining a CPE name corresponding to the first vulnerability basic information based on the CPE dictionary; And
Wherein the storing further comprises: storing the CPE name in the vulnerability table.
How to Manage Vulnerability Information. 11. The method of claim 10,
The step of determining the CPE comprises:
And a CPE tree based keyword analysis is performed on the CPE dictionary using the first vulnerability basic information as a keyword to determine the CPE name as a result having the highest matching rate.
How to Manage Vulnerability Information. The method according to claim 1,
The vulnerability information management method includes:
Generating a vulnerability information classification model by learning vulnerability information training data;
Generating first vulnerability category information by inputting the vulnerability basic information into the vulnerability information classification model; And
And storing the first vulnerability class information in the vulnerability table.
How to Manage Vulnerability Information. 13. The method of claim 12,
The vulnerability information training data includes:
Information including summary information of the previously-known vulnerability information obtained by parsing a file including information of known vulnerability information and information of the second vulnerability type,
How to Manage Vulnerability Information. 13. The method of claim 12,
The vulnerability information classification model includes:
And outputs the first vulnerability type information in the form of a Common Weakness Enumeration (CWE) code as the vulnerability basic information is input.
How to Manage Vulnerability Information. delete A storage unit for storing a vulnerability table including first vulnerability information by parsing and classifying data obtained from the vulnerability information source; And
An information extraction unit for extracting a text associated with the first vulnerability information from the vulnerability table; And
Generating basic information of the first vulnerability from the text, storing the first vulnerability basic information in the vulnerability table, generating second vulnerability basic information generated from the second vulnerability information of the first vulnerability basic information, And a vulnerability information management unit for storing the vulnerability ID of the second vulnerability information in the vulnerability table as an association vulnerability ID when the calculated similarity is the highest value or the threshold value or more.
Vulnerability information management device. A computer program recorded on a non-transitory computer readable medium, the instructions of the computer program being executed by a processor of the server,
Obtaining a vulnerability table including first vulnerability information by parsing and classifying data obtained from the vulnerability information source;
Extracting a text associated with the first vulnerability information from the vulnerability table;
Generating first vulnerability basic information from the text;
Storing the first vulnerability basic information in the vulnerability table;
Calculating a degree of similarity of the second vulnerability basic information generated from the second vulnerability information of the vulnerability table with respect to the first vulnerability basic information; And
And storing the vulnerability ID of the second vulnerability information in the vulnerability table as an associated vulnerability ID when the calculated similarity is the highest value or the threshold value or more.
Computer program. A vulnerability information collection system for acquiring first vulnerability information by parsing and classifying data obtained from the vulnerability information source;
A storage for storing a vulnerability table including the first vulnerability information; And
Extracting a text associated with the first vulnerability information from the vulnerability table, generating first vulnerability basic information from the text, storing the first vulnerability basic information in the vulnerability table, Wherein the degree of similarity of the second vulnerability basic information generated from the second vulnerability information of the vulnerability table is calculated, and when the calculated similarity is the highest value or the threshold value or more, And a vulnerability information management device that stores the vulnerability information in a vulnerability table.
Vulnerability Information Management System.

Images