JP7183858B2 - Information processing device, terminal device, information processing system, information processing method, and information processing program - Google Patents

Description

The present invention relates to an information processing device, a terminal device, an information processing system, an information processing method, and an information processing program. In particular, the present invention relates to an information processing device, a terminal device, an information processing system, an information processing method, and an information processing program for vulnerability research.

A vulnerability management system that investigates the vulnerabilities of the OS (operation system), middleware, and applications that run on IT (information technology) assets such as PCs (personal computers) and servers, and manages the security risks of terminals. exist. In addition, since vulnerability research imposes a large processing burden on terminals to be investigated, there are techniques for reducing the processing burden. For example, in Patent Document 1, when performing vulnerability research based on a second diagnostic rule on a terminal that has been subjected to vulnerability research based on a first diagnostic rule, vulnerability research based on the first diagnostic rule is performed. By using the survey results, the processing load on the surveyed terminals is reduced.

JP 2017-68691 A

The following analysis is made in light of the present invention. It should be noted that the disclosure of the prior art document mentioned above is incorporated herein by reference.

The technology disclosed in Patent Literature 1 has a problem that the processing load on the terminal to be investigated due to the vulnerability investigation cannot be efficiently reduced. That is, in Patent Literature 1, the number of vulnerability investigations itself cannot be reduced.

On the other hand, in order to reduce the number of vulnerability investigations, it is also possible to skip investigations for a certain period of time for vulnerabilities judged to have no security risk. However, with this method, there is a problem that the investigation is skipped for vulnerabilities with high importance of vulnerability investigation as well as for vulnerabilities with low importance. In addition, regarding vulnerabilities with low importance of vulnerability investigation, even if the importance of vulnerability investigation becomes high during the skipped period, the vulnerability investigation will may be skipped. In this way, the method of skipping investigation for a certain period of time for vulnerabilities judged to pose no security risk poses a problem in terms of security risk management.

Therefore, in the present invention, an information processing device, a terminal device, an information processing system, an information processing method, and an information processing device capable of efficiently reducing the processing load of a terminal to be investigated by investigating vulnerabilities while ensuring security. The purpose is to provide a program.

According to a first aspect of the present invention, an information processing device is provided that includes an effect level database, a rule database, a first counting section, a skip number detecting section, a second counting section, and an investigation instruction section. be. The effectiveness level database stores an effectiveness level indicating the degree of effectiveness of conducting vulnerability research for each vulnerability. The rule database stores rules that define the number of vulnerability investigation skips for each effect level in association with the number of investigations that indicate the number of vulnerability investigations. The effect level acquisition unit acquires the effect level of each vulnerability from the effect level database. The first counting unit counts the number of consecutive times that it is determined that there is no security risk in the terminals to be investigated for each vulnerability. The skip count detection unit detects the skip count corresponding to the effect level acquired by the effect level acquisition unit when applying the first count value by the first count unit to the number of investigations in the rule database for each vulnerability. . The second counting unit counts the number of consecutive skipped vulnerability investigations for each vulnerability. The investigation instructing unit skips the vulnerability investigation for vulnerabilities whose second count value by the second counting unit is less than the number of skips detected by the skip number detection unit, and executes vulnerability investigation for other vulnerabilities. The terminal to be investigated is instructed as follows.

According to the second aspect of the present invention, an effect level database, a rule database, a first counting unit, a skip number detecting unit, a second counting unit, an investigation instruction unit, and a vulnerability investigation execution unit are provided. A terminal device is provided comprising: The effectiveness level database stores an effectiveness level indicating the degree of effectiveness of conducting vulnerability research for each vulnerability. The rule database stores rules that define the number of vulnerability investigation skips for each effect level in association with the number of investigations that indicate the number of vulnerability investigations. The effect level acquisition unit acquires the effect level of each vulnerability from the effect level database. The first counting unit counts the number of consecutive times that it is determined that there is no security risk in the terminals to be investigated for each vulnerability. The skip count detection unit detects the skip count corresponding to the effect level acquired by the effect level acquisition unit when applying the first count value by the first count unit to the number of investigations in the rule database for each vulnerability. . The second counting unit counts the number of consecutive skipped vulnerability investigations for each vulnerability. The investigation instructing unit skips the vulnerability investigation for vulnerabilities whose second count value by the second counting unit is less than the number of skips detected by the skip number detection unit, and executes vulnerability investigation for other vulnerabilities. to do so. The vulnerability investigation execution unit conducts vulnerability investigation regarding the vulnerabilities indicated by the investigation instruction unit.

According to a third aspect of the present invention, the information processing device according to the first aspect; and an investigation target terminal including a vulnerability investigation execution unit that executes vulnerability investigation with respect to the vulnerability indicated by the information processing device. An information processing system is provided that includes:

A fourth aspect of the present invention provides an information processing method including an effect level acquisition step, a first counting step, a skip count detecting step, a second counting step, and an investigation instruction step. In the effect level acquisition step, the effect level of each vulnerability is acquired from an effect level database that stores an effect level indicating the degree of effect of conducting vulnerability research for each vulnerability. In the first counting step, for each vulnerability, the number of consecutive times that it is determined that there is no security risk in the terminal to be investigated is counted. In the skip count detection step, the skip count corresponding to the effect level acquired by the effect level acquisition step is detected when the first count value obtained by the first count step is applied to the investigation count in the rule database for each vulnerability. . Here, the rule database stores rules defining the number of skips of vulnerability investigation for each effect level in association with the number of investigations indicating the number of vulnerability investigations. In a second counting step, for each vulnerability, the number of consecutive skipped vulnerability investigations is counted. In the investigation instruction step, the terminal to be investigated skips the vulnerability investigation with respect to vulnerabilities less than the number of skips where the second count value in the second count step is detected, and executes the vulnerability investigation with respect to other vulnerabilities. give instructions to

According to a fourth aspect of the present invention, there is provided an information processing program that causes a computer to execute an effect level obtaining step, a first counting step, a skip number detecting step, a second counting step, and a survey instruction step. be. In the effect level acquisition step, the effect level of each vulnerability is acquired from an effect level database that stores an effect level indicating the degree of effect of conducting vulnerability research for each vulnerability. In the first counting step, for each vulnerability, the number of consecutive times it is determined that there is no security risk in the terminal to be investigated is counted. In the skip count detection step, the skip count corresponding to the effect level acquired by the effect level acquisition step is detected when the first count value obtained by the first counting step is applied to the investigation count in the rule database for each vulnerability. . Here, the rule database stores rules that define the number of skips of vulnerability investigation for each effect level in association with the number of investigations that indicate the number of vulnerability investigations. In a second counting step, for each vulnerability, the number of consecutive skipped vulnerability investigations is counted. In the investigation instructing step, the investigation target skips the vulnerability investigation for vulnerabilities less than the number of skips where the second count value in the second counting step is detected, and executes the vulnerability investigation for other vulnerabilities. Instruct the terminal.

According to each aspect of the present invention, an information processing device, a terminal device, an information processing system, and an information processing method that contribute to efficiently reducing the processing load of an investigation target terminal due to vulnerability investigation while ensuring security. and an information processing program are provided.

BRIEF DESCRIPTION OF THE DRAWINGS It is a figure for demonstrating the outline|summary of this invention. 4 is a diagram showing an example of information stored in an effect level database 110; FIG. 4 is a diagram showing an example of information stored in a rule database 120; FIG. 4 is a diagram showing an example of a first count value by a first counting section 140; FIG. 8 is a diagram showing an example of a second count value by a second counting section 160; FIG. It is a figure for demonstrating an example of the effect by this invention. It is a figure for explaining an example of composition of an information processing system of a 1st embodiment. 1 is a block diagram showing an example of the configuration of an information processing apparatus 100 according to a first embodiment; FIG. 4 is a diagram showing an example of information stored in a vulnerability information database 182; FIG. 4 is a flow chart showing the flow of processing by the information processing apparatus 100 of the first embodiment; FIG. 2 is a block diagram showing an example of the configuration of the investigation target terminal 200 according to the first embodiment; FIG. 3 is a block diagram showing an example of the configuration of a security administrator operation terminal 300 according to the first embodiment; FIG. It is a block diagram which shows an example of a structure of the vulnerability information delivery terminal 400 of 1st Embodiment. FIG. 11 is a block diagram showing another configuration example of the investigation target terminal 200. FIG.

Possible preferred embodiments of the present invention will be described in detail with reference to the drawings. It should be noted that the drawing reference numerals added to the following description are added to each element for convenience as an example to aid understanding, and are not intended to limit the present invention to the illustrated embodiments. Also, connection lines between blocks in each figure include bi-directional and uni-directional communication, and are shown or deleted as appropriate for the purpose of clarifying the drawings.

First, the basic concept of the present invention will be explained. As shown in FIG. 1, the information processing apparatus 100 is connected to an investigation target terminal 200 via a network, a bus, or the like. Indicate whether to run a vulnerability survey. Specifically, the information processing device 100 includes an effect level database 110, a rule database 120, an effect level acquisition unit 130, a first counting unit 140, a skip count detection unit 150, a second counting unit 160, and an investigation instruction unit 170. have.

The effect level database 110 stores an effect level indicating the degree of effect of conducting vulnerability research for each vulnerability. This effect level can also be considered as a high tendency to be determined to have a security risk by conducting vulnerability research. To give a specific example, the effect level database 110, as shown in FIG. Effect level "high" for 8 and 9 is stored.

The rule database 120 stores rules defining the number of vulnerability investigation skips for each effect level in association with the number of investigations indicating the number of vulnerability investigations. Specifically, the rule database 120 associates rules such as those shown in FIG. "Skip times" and "Examination execution" with a high effect level are stored. Here, "execution of investigation" corresponds to "skip 0 times" and means that the vulnerability investigation is executed without skipping.

The effect level acquisition unit 130 acquires the effect level of each vulnerability from the effect level database 110 . Here, it is assumed that the effect level acquisition unit 130 has acquired the effect level “low” for vulnerability 4 .

The first counting unit 140 counts the number of times it has been determined that there is no security risk in the terminal 200 under investigation. Here, the number of times counted by the first counting unit 140 is called a 'first count value'. Specifically, the first counting unit 140 has respective counters for vulnerabilities 1 to 9, and assumes the first count values shown in FIG. 4, for example.

The skip count detection unit 150 detects the skip count corresponding to the effect level acquired by the effect level acquisition unit 130 when applying the first count value to the investigation count in the rule database 120 for each vulnerability. As a specific example, the case of vulnerability 4 will be described. Then, the skip count detection unit 150 applies the first count value to the number of surveys in the rule database 120 and refers to the column of the number of surveys “50 times to 99 times”. Here, since the effect level acquisition unit 130 acquires the effect level “low” for the vulnerability 4 as described above, the skip count detection unit 150 detects the effect Detect "three skips" corresponding to level "low".

The second counting unit 160 counts the number of consecutive skipped vulnerability investigations for each vulnerability. Here, the number of times counted by the second counting unit 160 is called a "second count value". Specifically, the second counting unit 160 has respective counters for vulnerabilities 1 to 9, and assumes the second count values shown in FIG. 5, for example. As an example, the meaning of the second count value “1” for vulnerability 4 is that the terminal 200 under investigation skips the most recent past vulnerability investigation for vulnerability 4 .

The investigation instructing unit 170 instructs the investigation target terminal 200 to skip the vulnerability investigation for vulnerabilities for which the second count value by the second counting unit 160 is less than the number of skips detected by the skip number detecting unit 150. do. On the other hand, the investigation instruction unit 170 executes the vulnerability investigation for other vulnerabilities, that is, vulnerabilities for which the second count value of the second counting unit 160 is greater than or equal to the number of skips detected by the skip number detection unit 150. The terminal 200 to be investigated is instructed to do so.

As a specific example, the case of vulnerability 4 will be described. Here, since the skip count detection unit 150 detects “three skips” for the vulnerability 4 as described above, the investigation instruction unit 170 skips the vulnerability investigation for the vulnerability 4. The target terminal 200 is instructed.

Further, in the case of vulnerability 5, the investigation instruction unit 170 acquires the second count value “2” of vulnerability 5 from the second counting unit 160 . Here, in the above example, the skip count detection unit 150 detects “twice skip” for vulnerability 5 . Therefore, the investigation instruction unit 170 instructs the investigation target terminal 200 to conduct a vulnerability investigation regarding the vulnerability 5 .

FIG. 6 summarizes the detection result by the skip count detection unit 150, the second count value, and the instruction content of the investigation instruction unit 170 based thereon in the above example. That is, the information processing apparatus 100 skips the vulnerability investigation for the vulnerabilities 1, 2, 4, and 8 of the terminal 200 to be investigated, and executes the vulnerability investigation for the vulnerabilities 3, 5 to 7, and 9. to do so.

In other words, there is a tendency for the vulnerability survey to be skipped more times for vulnerabilities with an effect level of "low". However, vulnerability 3 with an effect level of "low" has a first count value of "0", that is, it is determined that there is a security risk in the previous vulnerability investigation, so the investigation target terminal 200 executes the vulnerability investigation. It will be. On the other hand, for vulnerabilities with an effect level of "high", the frequency of skipping vulnerability surveys tends to decrease. However, the vulnerability 8 with the effect level "high" has a first count value of "100", that is, since it has been determined that there is no security risk continuously in the past 100 vulnerability investigations, the investigation target terminal 200 Every other vulnerability survey will be performed.

As described above, according to the present invention, it is possible to efficiently reduce the processing load of the investigation target terminal 200 due to vulnerability investigation while ensuring security.

[First embodiment]
Preferred embodiments of the present invention based on the basic concept described above will be described below with specific examples.

In the first embodiment, as shown in FIG. 7, an information processing system in which an information processing apparatus 100, an investigation target terminal 200, a security administrator operation terminal 300, and a vulnerability information distribution terminal 400 are connected via a network. will be explained. Note that the first embodiment assumes a regular survey model in which the information processing apparatus 100 instructs the survey target terminal 200 to execute the vulnerability survey at 18:00 every day.

The information processing apparatus 100 is implemented as a computer including a storage unit, a processing unit, and an interface, as shown in FIG. The storage unit is a ROM (read only memory), a RAM (random access memory), a cache memory, or the like, and stores programs and the like for controlling the information processing apparatus 100 as a whole. In the first embodiment, the storage unit includes a terminal information database 181 and a vulnerability information database 182 in addition to the effect level database 110 and rule database 120 described above.

The information stored in the effectiveness level database 110 is exemplified by FIG. 2, similar to the above basic concept, but in the first embodiment, the effectiveness level of each vulnerability is stored by the effectiveness level calculation unit 183, which will be described later. be done.

The information stored in the rule database 120 is illustrated by FIG. 3, similar to the basic concept described above, but in the first embodiment, the number of vulnerability investigation skips for each effectiveness level was defined by the security administrator. rules are stored.

The terminal information database 181 stores information on the terminals 200 to be investigated. For example, the terminal information database 181 stores the above first count value and second count value in association with the identification information of the investigation target terminal 200 for each investigation target terminal 200 . Note that the first count value and the second count value are updated by the first count section 140 and the second count section 160, respectively, as described later.

The vulnerability information database 182 stores information for calculating the effect level of each vulnerability. Specifically, as shown in FIG. 9, the vulnerability information database 182 stores scores for the importance of vulnerability investigation, the date of publication of vulnerability information, and the load level due to vulnerability investigation. The vulnerability information database 182 also stores an effect level corresponding to the total score value. In the first embodiment, information stored in the vulnerability information database 182 is stored by a security administrator.

The processing unit includes a CPU (Central Processing Unit) and a chip, reads a program from the storage unit, and realizes a processing module necessary for the present invention. In the first embodiment, in addition to the effect level acquisition unit 130, the first count unit 140, the skip count detection unit 150, the second count unit 160, and the survey instruction unit 170, the effect level calculation unit 183 is used as a processing module. is realized.

The effect level acquisition unit 130 acquires the effect level of each vulnerability from the effect level database 110 as in the above basic concept. In the first embodiment, the effect level acquisition unit 130 acquires the effect level at 18:00 every day.

The first counting unit 140 counts the number of times it is determined that there is no security risk in the terminal 200 under investigation in succession, as in the above basic concept. Specifically, the first counting unit 140 analyzes the investigation result received from the investigation target terminal 200 and updates the first count value corresponding to the identification information of the investigation target terminal 200 . Here, the first count unit 140 adds “1” to the first count value for vulnerabilities determined to have no security risk, and adds “1” to the first count value for vulnerabilities determined to have a security risk. Reset the count value to "0". In addition, the first counting unit 140 does not update the first count value for vulnerabilities for which vulnerability investigation is skipped.

When the effect level is acquired by the effect level acquisition unit 130 , the skip count detection unit 150 reads and acquires the first count value corresponding to the identification information acquired from the survey target terminal 200 from the terminal information database 181 . Then, the skip count detection unit 150 detects the skip count in the same manner as the basic concept described above.

The second counting unit 160 counts the number of consecutive skipped vulnerability investigations for each vulnerability, similar to the basic concept described above. Specifically, the second counting unit 160 analyzes the investigation result received from the investigation target terminal 200 and updates the second count value corresponding to the identification information of the investigation target terminal 200 . Here, the second counting unit 160 adds “1” to the second count value for vulnerabilities for which vulnerability investigation is skipped, and adds “1” to the second count value for vulnerabilities for which vulnerability investigation is executed. Reset to "0".

When the skip count detection unit 150 detects the number of skips, the survey instruction unit 170 reads and acquires the second count value corresponding to the identification information acquired from the survey target terminal 200 from the terminal information database 181 . Then, the investigation instruction unit 170 determines whether or not to skip the vulnerability investigation of each vulnerability, and instructs the investigation target terminal 200 to execute the vulnerability investigation in the same manner as the basic concept described above. do.

The effect level calculator 183 analyzes the vulnerability information received from the vulnerability information distribution terminal 400 and calculates the effect level of each vulnerability. Specifically, from the vulnerability information received from the vulnerability information delivery terminal 400, the effect level calculation unit 183 extracts the importance of each vulnerability, the date of disclosure, and the load level by conducting vulnerability research. Then, the effect level calculation unit 183 reads out the scores corresponding to the extracted importance, disclosure date, and load from the vulnerability information database 182, adds them together, and sets the effect level corresponding to the total score as the effect level of each vulnerability. decide. Then, the effect level calculator 183 stores the determined effect level in the effect level database 110, or updates the effect level database 110 with the determined effect level.

To give a specific example, the vulnerability information received from the vulnerability information distribution terminal 400 includes the importance level “warning”, release date “2017”, and load “high” for vulnerability 10. It is assumed that there is In this case, the effect level calculation unit 183 adds the score “1” for the degree of importance “warning”, the score “2” for the release date “2017”, and the score “1” for the load “high” to obtain a score. Calculate the total "4". Then, the effect level calculation unit 183 determines the effect level “low” corresponding to the total score “4” as the effect level of the vulnerability 10 and stores it in the effect level database 110 .

The interface has a function for communicating with the investigation target terminal 200, the security administrator operation terminal 300, and the vulnerability information distribution terminal 400, and is also connected to other devices not shown (for example, display, mouse, keyboard, etc.). It has a function to

Here, the flow of processing by the information processing apparatus 100 will be described. The information processing apparatus 100 executes information processing for instructing the investigation target terminal 200 to execute vulnerability investigation and processing for calculating the effect level. Since the information processing for calculating the effect level is executed by the effect level calculation unit 183, the description thereof will be omitted.

Regarding the information processing instructing execution of vulnerability investigation, as shown in FIG. 10, the effect level acquisition unit 130 acquires the effect level at 18:00 every day (step S01, Yes) (step S02). Subsequently, the skip count detection unit 150 detects the skip count of each vulnerability (step S03). Then, the investigation instruction unit 170 determines whether or not to skip the vulnerability investigation of each vulnerability (step S04), and instructs the investigation target terminal 200 to execute the vulnerability investigation (step S05). After that, it waits until the investigation result is received from the investigation target terminal 200 (step S06, No). When the survey result is received from the survey target terminal 200 (step S06, Yes), the first counting unit 140 and the second counting unit 160 analyze the survey result and update the first count value and the second count value (step S07), the process ends.

The research target terminal 200 is, for example, an IT (information technology) asset such as a PC (personal computer) or a server, but any device that executes vulnerability research can be applied. For example, as shown in FIG. 11, the investigation target terminal 200 includes a vulnerability investigation program 210 in the storage unit, and the processing unit reads the vulnerability investigation program 210 to implement a processing module as the vulnerability investigation execution unit 220. .

The vulnerability investigation execution unit 220 executes vulnerability investigation regarding vulnerabilities instructed by the information processing apparatus 100 . For example, the vulnerability research execution unit 220 skips vulnerability research for vulnerabilities 1, 2, 4, and 8 from the information processing device 100, and executes vulnerability research for vulnerabilities 3, 5 to 7, and 9. Only perform vulnerability research for vulnerabilities 3, 5-7, and 9 when instructed to do so. Then, the vulnerability investigation executing unit 220 returns the investigation result to the information processing device 100 . This investigation result includes information on vulnerabilities for which vulnerability investigation is skipped, and the result of determining whether or not there is a security risk with respect to vulnerabilities for which vulnerability investigation is executed.

The security administrator operation terminal 300 is a terminal for operation by the security administrator. A security administrator means an organization-side personnel who manages the investigation target terminal 200 using the information processing system of the present invention. For example, as shown in FIG. 12, the security administrator operation terminal 300 is a PC (personal computer) equipped with a storage section, a processing section, and an interface. The storage unit includes a management setting program 310 , and the processing unit reads the management setting program 310 to implement a processing module as a management setting unit 320 .

The management setting unit 320 is a program for the security administrator to input information (including parameters) related to vulnerability investigation, such as displaying information on a display via an interface or accepting input operations from a keyboard, mouse, etc. to run. For example, in the first embodiment, the information stored in the rule database 120 of the information processing device 100 and the information stored in the vulnerability information database 182 are input and set.

The vulnerability information distribution terminal 400 is a terminal operated by a vulnerability information issuer who generates vulnerability information. The vulnerability information issuer means a security vendor side personnel who implements the information processing system of the present invention. To give a specific example of this point of view, if the research target terminal 200 is a PC, the security administrator is the manufacturer of the PC, and the vulnerability information issuer is the provider of programs and applications that run on the PC. is.

The vulnerability information delivery terminal 400 is, for example, a PC (personal computer) having a storage unit, a processing unit, and an interface as shown in FIG. The storage unit includes a vulnerability information distribution program 410 , and the processing unit reads the vulnerability information distribution program 410 to realize a processing module as a vulnerability information distribution unit 420 .

Vulnerability information distribution unit 420 executes a program for the vulnerability information issuer to issue vulnerability information, such as displaying information on the display via an interface or accepting input operations from a keyboard, mouse, etc. . Here, the vulnerability information includes the vulnerability research program 210 and information indicating the importance of the vulnerability research, the release date, and the load level. That is, the vulnerability investigation program 210 is stored in the storage unit of the terminal 200 to be investigated, and the vulnerability information is analyzed by the effect level calculation unit 183 of the information processing device 100 . The effect level is stored in the effect level database 110 after the effect level calculation unit 183 determines the effect level based on the degree of importance, the release date, and the load level.

As described above, according to the information processing system of the present invention, it is possible to efficiently reduce the processing load of the investigation target terminal 200 due to vulnerability investigation while ensuring security.

Further, in the first embodiment, the information processing apparatus 100 automatically analyzes the vulnerability information delivered from the vulnerability information delivery terminal 400 to determine the effect level, so the security administrator determines the effect level. do not have to. That is, according to the first embodiment, the security administrator only needs to set the information stored in the rule database 120 and the vulnerability information database 182, so the burden on the security administrator can be reduced.

In addition, in the first embodiment, the investigation target terminal 200 can be applied as long as it is a device that executes vulnerability investigation.

In the first embodiment, the rules stored in the rule database 120 may be selected by the security administrator from several types of rules presented by the vulnerability information issuer.

Also, the effect level is not limited to three stages of "low", "middle", and "high", but can be set to any number of stages.

In addition, the information processing apparatus 100 does not have to trigger the vulnerability investigation. For example, the terminal 200 to be investigated may request the information processing apparatus 100 for information on vulnerabilities for which vulnerability investigation should be executed/skipped.

Part of the functions of the information processing device 100 can also be transferred to another device. For example, the survey target terminal 200 has functions corresponding to the terminal information database 181, the first counting unit 140, and the second counting unit 160, and provides the first count value and the second count value to the information processing apparatus 100. You can do it.

Alternatively, the information processing apparatus 100 may execute only the process of calculating the effect level of each vulnerability, and the investigation target terminal 200 may execute the determination of vulnerabilities to be executed/skipped. That is, as shown in FIG. 14, the storage unit of the information processing device 100 stores information stored in the effect level database 110 and the rule database 120 . Then, the processing unit performs the functions of the effect level acquiring unit 130 , the first counting unit 140 , the skip number detecting unit 150 , the second counting unit 160 and the investigation instructing unit 170 of the information processing apparatus 100 . In this way, the investigation target terminal 200 can independently determine vulnerabilities to be executed/skipped.

Some or all of the above embodiments may also be described in the following additional remarks, but are not limited to the following.

(Appendix 1)
an effect level database that stores an effect level indicating the degree of effect of conducting vulnerability research for each vulnerability;
a rule database that stores rules defining the number of vulnerability investigation skips for each effect level in association with the number of investigations that indicate the number of vulnerability investigations;
an effect level acquisition unit that acquires the effect level of each vulnerability from the effect level database;
a first counting unit that counts the number of times that the terminal under investigation is continuously judged to have no security risk with respect to each vulnerability;
A skip count for detecting a skip count corresponding to the effect level acquired by the effect level acquisition unit when a first count value by the first counting unit is applied to the investigation count in the rule database for each vulnerability. a detection unit;
a second counting unit that counts, for each vulnerability, the number of times the vulnerability investigation is skipped consecutively;
The vulnerability investigation is skipped with respect to vulnerabilities whose second count value by the second counting unit is less than the number of skips detected by the skip number detection unit, and the vulnerability investigation is executed for other vulnerabilities. an investigation instruction unit that instructs the investigation target terminal;
Information processing equipment including.

(Appendix 2)
The information processing apparatus according to appendix 1, further comprising an effect level calculation unit that calculates an effect level of each vulnerability based on the importance and load level of vulnerability research in the terminal to be investigated and stores the effect level in the effect level database.

(Appendix 3)
Supplementary note 2, wherein the effect level calculation unit analyzes vulnerability information issued by a distributor of a vulnerability research program executed on the terminal to be investigated, and extracts the importance and load level of vulnerability research. information processing equipment.

(Appendix 4)
The first counting unit analyzes the investigation results returned from the investigation target terminal, adds "1" to the first count value for vulnerabilities judged to have no security risk, and 4. The information processing apparatus according to any one of appendices 1 to 3, wherein the first count value is returned to "0" for vulnerabilities determined to have a risk.

(Appendix 5)
The second counting unit analyzes the investigation results returned from the investigation target terminal, adds "1" to the second count value for vulnerabilities for which vulnerability investigation is skipped, 5. The information processing apparatus according to any one of appendices 1 to 4, wherein the second count value is reset to "0" for vulnerabilities for which investigation has been performed.

(Appendix 6)
an effect level database that stores an effect level indicating the degree of effect of conducting vulnerability research for each vulnerability;
a rule database that stores rules defining the number of vulnerability investigation skips for each effect level in association with the number of investigations that indicate the number of vulnerability investigations;
an effect level acquisition unit that acquires the effect level of each vulnerability from the effect level database;
a first counting unit that counts the number of consecutive times that each vulnerability is determined to have no security risk;
A skip count for detecting a skip count corresponding to the effect level acquired by the effect level acquisition unit when a first count value by the first counting unit is applied to the investigation count in the rule database for each vulnerability. a detection unit;
a second counting unit that counts, for each vulnerability, the number of times the vulnerability investigation is skipped consecutively;
Instructing to skip the vulnerability investigation for vulnerabilities whose second count value by the second counting unit is less than the number of skips detected by the skip number detection unit, and to execute the vulnerability investigation for other vulnerabilities. an investigation direction department to
a vulnerability investigation execution unit that executes a vulnerability investigation with respect to the vulnerability instructed by the investigation instruction unit;
terminal equipment including

(Appendix 7)
an effect level database that stores an effect level indicating the degree of effect of conducting vulnerability research for each vulnerability;
a rule database that stores rules defining the number of vulnerability investigation skips for each effect level in association with the number of investigations that indicate the number of vulnerability investigations;
an effect level acquisition unit that acquires the effect level of each vulnerability from the effect level database;
a first counting unit that counts the number of times that the terminal under investigation is continuously judged to have no security risk with respect to each vulnerability;
A skip count for detecting a skip count corresponding to the effect level acquired by the effect level acquisition unit when a first count value by the first counting unit is applied to the investigation count in the rule database for each vulnerability. a detection unit;
a second counting unit that counts, for each vulnerability, the number of times the vulnerability investigation is skipped consecutively;
The vulnerability investigation is skipped with respect to vulnerabilities whose second count value by the second counting unit is less than the number of skips detected by the skip number detection unit, and the vulnerability investigation is executed for other vulnerabilities. an investigation instruction unit that instructs the investigation target terminal;
an information processing device including
an investigation target terminal including a vulnerability investigation execution unit that executes vulnerability investigation with respect to the vulnerability instructed by the information processing device;
Information processing system including;

(Appendix 8)
Supplementary note 7 wherein the information processing device further includes an effect level calculation unit that calculates an effect level of each vulnerability based on the importance and load level of vulnerability investigation in the terminal to be investigated and stores the effect level in the effect level database. The information processing system according to .

(Appendix 9)
further comprising a vulnerability information distribution terminal for distributing vulnerability information including a vulnerability research program executed in the terminal to be investigated;
The information processing system according to appendix 8, wherein the effect level calculation unit analyzes the vulnerability information delivered from the vulnerability information delivery terminal and extracts the importance and load level of the vulnerability investigation.

(Appendix 10)
10. The information processing system according to any one of Appendices 7 to 9, further comprising a security administrator operation terminal for a security administrator to store rules stored in the rule database.

(Appendix 11)
an effect level acquisition step of acquiring the effect level of each vulnerability from an effect level database that stores an effect level indicating the degree of effect of conducting vulnerability research for each vulnerability;
a first counting step of counting the number of consecutive times when it is determined that there is no security risk in the terminal to be investigated for each vulnerability;
With respect to each vulnerability, the number of investigations indicating the number of vulnerability investigations is associated with the number of investigations in a rule database that stores a rule that defines the number of skips of vulnerability investigations for each effect level. a skip number detection step for detecting the number of skips corresponding to the effect level obtained by the effect level obtaining step when one count value is applied;
a second counting step of counting, for each vulnerability, the number of times the vulnerability investigation is skipped consecutively;
The second count value obtained by the second counting step skips the vulnerability investigation with respect to a vulnerability less than the number of skips detected by the skip number detecting step, and executes the vulnerability investigation with respect to other vulnerabilities. an investigation instruction step for instructing an investigation target terminal;
Information processing method including.

(Appendix 12)
An effect level acquisition step of acquiring the effect level of each vulnerability from an effect level database that stores an effect level indicating the degree of effect of conducting a vulnerability survey for each vulnerability;
a first counting step of counting the number of times it is continuously determined that there is no security risk in the terminal to be investigated for each vulnerability;
With respect to each vulnerability, the number of investigations indicating the number of vulnerability investigations is associated with the number of investigations in a rule database that stores a rule that defines the number of skips of vulnerability investigations for each effect level. a skip number detection step of detecting the number of skips corresponding to the effect level obtained by the effect level obtaining step when one count value is applied;
a second counting step of counting, for each vulnerability, the number of times the vulnerability investigation is skipped consecutively;
The second count value obtained by the second counting step skips the vulnerability investigation with respect to vulnerabilities whose number of skips is less than the number of skips detected by the skip number detection step, and executes the vulnerability investigation with respect to other vulnerabilities. an investigation instruction step of instructing an investigation target terminal;
An information processing program that causes a computer to execute

It should be noted that the disclosure of the above-mentioned patent document is incorporated herein by reference. Within the framework of the full disclosure of the present invention (including the scope of claims), modifications and adjustments of the embodiments and examples are possible based on the basic technical concept thereof. Also, various combinations or selections of various disclosure elements (including each element of each claim, each element of embodiments or variations, each element of each drawing, etc.) within the scope of the claims of the present invention ( at least partial selection and non-selection) are possible. That is, the present invention naturally includes various variations and modifications that can be made by those skilled in the art according to the entire disclosure including claims and technical ideas.

100: Information processing device 110: Effect level database 120: Rule database 130: Effect level acquisition unit 140: First count unit 150: Skip count detection unit 160: Second count unit 170: Survey instruction unit 181: Terminal information database 182: Vulnerability information database 183 : Effect level calculation unit 200 : Investigation target terminal 210 : Vulnerability research program 220 : Vulnerability investigation execution unit 300 : Security administrator operation terminal 310 : Management setting program 320 : Management setting unit 400 : Vulnerability Information distribution terminal 410: Vulnerability information distribution program 420: Vulnerability information distribution unit

Claims (10)

an effect level database that stores an effect level indicating the degree of effect of conducting vulnerability research for each vulnerability;
a rule database that stores rules defining the number of vulnerability investigation skips for each effect level in association with the number of investigations that indicate the number of vulnerability investigations;
an effect level acquisition unit that acquires the effect level of each vulnerability from the effect level database;
a first counting unit that counts the number of times that the terminal under investigation is continuously judged to have no security risk with respect to each vulnerability;
A skip count for detecting a skip count corresponding to the effect level acquired by the effect level acquisition unit when a first count value by the first counting unit is applied to the investigation count in the rule database for each vulnerability. a detection unit;
a second counting unit that counts, for each vulnerability, the number of times the vulnerability investigation is skipped consecutively;
The vulnerability investigation is skipped with respect to vulnerabilities whose second count value by the second counting unit is less than the number of skips detected by the skip number detection unit, and the vulnerability investigation is executed for other vulnerabilities. an investigation instruction unit that instructs the investigation target terminal;
Information processing equipment including. 2. The information processing apparatus according to claim 1, further comprising an effect level calculation unit that calculates an effect level of each vulnerability based on the importance and load level of vulnerability research in the terminal to be investigated and stores the effect level in the effect level database. . 3. The effect level calculation unit analyzes vulnerability information issued by a distributor of a vulnerability research program executed on the terminal to be investigated, and extracts the importance and load level of vulnerability research. The information processing device described. The first counting unit analyzes the investigation results returned from the investigation target terminal, adds "1" to the first count value for vulnerabilities judged to have no security risk, and 4. The information processing apparatus according to any one of claims 1 to 3, wherein the first count value is returned to "0" for vulnerabilities determined to have a risk. The second counting unit analyzes the investigation results returned from the investigation target terminal, adds "1" to the second count value for vulnerabilities for which vulnerability investigation is skipped, 5. The information processing apparatus according to any one of claims 1 to 4, wherein the second count value is returned to "0" for vulnerabilities for which investigation has been performed. an effect level database that stores an effect level indicating the degree of effect of conducting vulnerability research for each vulnerability;
a rule database that stores rules defining the number of vulnerability investigation skips for each effect level in association with the number of investigations that indicate the number of vulnerability investigations;
an effect level acquisition unit that acquires the effect level of each vulnerability from the effect level database;
a first counting unit that counts the number of consecutive times that each vulnerability is determined to have no security risk;
A skip count for detecting a skip count corresponding to the effect level acquired by the effect level acquisition unit when a first count value by the first counting unit is applied to the investigation count in the rule database for each vulnerability. a detection unit;
a second counting unit that counts, for each vulnerability, the number of times the vulnerability investigation is skipped consecutively;
Instructing to skip the vulnerability investigation for vulnerabilities whose second count value by the second counting unit is less than the number of skips detected by the skip number detection unit, and to execute the vulnerability investigation for other vulnerabilities. an investigation direction department to
a vulnerability investigation execution unit that executes a vulnerability investigation with respect to the vulnerability instructed by the investigation instruction unit;
terminal equipment including an effect level database that stores an effect level indicating the degree of effect of conducting vulnerability research for each vulnerability;
a rule database that stores rules defining the number of vulnerability investigation skips for each effect level in association with the number of investigations that indicate the number of vulnerability investigations;
an effect level acquisition unit that acquires the effect level of each vulnerability from the effect level database;
a first counting unit that counts the number of times that the terminal under investigation is continuously judged to have no security risk with respect to each vulnerability;
A skip count for detecting a skip count corresponding to the effect level acquired by the effect level acquisition unit when a first count value by the first counting unit is applied to the investigation count in the rule database for each vulnerability. a detection unit;
a second counting unit that counts, for each vulnerability, the number of times the vulnerability investigation is skipped consecutively;
The vulnerability investigation is skipped with respect to vulnerabilities whose second count value by the second counting unit is less than the number of skips detected by the skip number detection unit, and the vulnerability investigation is executed for other vulnerabilities. an investigation instruction unit that instructs the investigation target terminal;
an information processing device including
an investigation target terminal including a vulnerability investigation execution unit that executes vulnerability investigation with respect to the vulnerability instructed by the information processing device;
Information processing system including; 8. The information processing device includes an effect level calculation unit that calculates an effect level of each vulnerability based on the importance and load level of vulnerability investigation in the terminal to be investigated and stores the calculated effect level in the effect level database. The information processing system according to . an effect level acquisition step of acquiring the effect level of each vulnerability from an effect level database that stores an effect level indicating the degree of effect of conducting vulnerability research for each vulnerability;
a first counting step of counting the number of consecutive times when it is determined that there is no security risk in the terminal to be investigated for each vulnerability;
With respect to each vulnerability, the number of investigations indicating the number of vulnerability investigations is associated with the number of investigations in a rule database that stores a rule that defines the number of skips of vulnerability investigations for each effect level. a skip number detection step for detecting the number of skips corresponding to the effect level obtained by the effect level obtaining step when one count value is applied;
a second counting step of counting, for each vulnerability, the number of times the vulnerability investigation is skipped consecutively;
The second count value obtained by the second counting step skips the vulnerability investigation with respect to a vulnerability whose second count value is less than the number of skips detected by the skip number detection step, and executes the vulnerability investigation with respect to other vulnerabilities. an investigation instruction step for instructing an investigation target terminal;
An information processing method executed by an information processing device .
An effect level acquisition step of acquiring the effect level of each vulnerability from an effect level database that stores an effect level indicating the degree of effect of conducting a vulnerability survey for each vulnerability;
a first counting step of counting the number of times it is continuously determined that there is no security risk in the terminal to be investigated for each vulnerability;
With respect to each vulnerability, the number of investigations indicating the number of vulnerability investigations is associated with the number of investigations in a rule database that stores a rule that defines the number of skips of vulnerability investigations for each effect level. a skip number detection step of detecting the number of skips corresponding to the effect level obtained by the effect level obtaining step when one count value is applied;
a second counting step of counting, for each vulnerability, the number of times the vulnerability investigation is skipped consecutively;
The second count value obtained by the second counting step skips the vulnerability investigation with respect to vulnerabilities whose number of skips is less than the number of skips detected by the skip number detection step, and executes the vulnerability investigation with respect to other vulnerabilities. an investigation instruction step of instructing an investigation target terminal;
An information processing program that causes a computer to execute

Images