WO2025009039A1 - Communication system, communication method, and communication program - Google Patents

Abstract

A communication system (100) includes: an agent (10) that is provided in an assessment target apparatus (20); and an assessment device (30) that carries out risk assessment for the assessment target apparatus (20). The assessment device (30) includes an assessment unit for carrying out, on the basis of the operation state of communication by the assessment target apparatus (20) acquired via the agent (10), risk assessment pertaining to vulnerability information transmitted to the assessment target apparatus (20).

Description

COMMUNICATION SYSTEM, COMMUNICATION METHOD, AND COMMUNICATION PROGRAM

The present invention relates to a communication system, a communication method, and a communication program.

In conventional vulnerability management work, when a vulnerability notification is received about a device, the operator checks the vulnerability information (e.g., attack source classification: network (NW)), checks the settings and operation of the device, and compares this information to confirm the risk of an attack being successful against the system.

Fujitsu Systems East Ltd., "Introducing vulnerability visualization service: Industry's first network security risk diagnosis service", July 20, 2016, [Retrieved May 26, 2023], Internet <URL: https://pr.fujitsu.com/jp/news/grp-archives/feast/feast20160720-1.html> NEC, "Cyber Attack Route Diagnosis Service", [Retrieved May 29, 2023], Internet <URL: https://jpn.nec.com/cybersecurity/professionalservice/vulnerability_diagnosis/attack_route.html> NEC, "Cyber Attack Risk Automatic Diagnosis Technology", [Retrieved May 29, 2023], Internet <URL: https://jpn.nec.com/rd/technologies/201804/index.html>

However, risk assessment technology based on network configuration has the problem that the risk assessment does not take into account the impact of the actual communication operations of the devices.

The present invention has been made in consideration of the above, and aims to provide a communication system, a communication method, and a communication program that enable risk assessment based on the actual communication operation of the device.

In order to solve the above-mentioned problems and achieve the objective, the communication system according to the present invention is a communication system having an agent provided in a device to be judged and a judgment device that performs a risk judgment on the device to be judged, and the judgment device is characterized in that it functions as a judgment unit that performs a risk judgment on vulnerability information sent to the device to be judged based on the communication operation status of the device to be judged obtained via the agent.

The present invention makes it possible to assess risk based on the actual communication behavior of devices.

FIG. 1 is a diagram for explaining an overview of the process according to the embodiment. FIG. 2 is a diagram illustrating a process flow according to the embodiment. FIG. 3 is a diagram illustrating an example of a configuration of a communication system according to an embodiment. FIG. 4 is a diagram showing an example of the configuration of the agent shown in FIG. FIG. 5 is a diagram illustrating an example of the configuration of the determination device illustrated in FIG. FIG. 6 is a diagram illustrating the communication information generation process. FIG. 7A is a diagram illustrating an example of communication operation information generated in the communication information generation process. FIG. 7B is a diagram illustrating an example of communication operation information generated in the communication information generation process. FIG. 7C is a diagram illustrating an example of communication operation information generated in the communication information generation process. FIG. 7D is a diagram illustrating an example of communication operation information generated in the communication information generation process. FIG. 8 is a diagram illustrating a method for acquiring software information from process information. FIG. 9 is a diagram illustrating a method for acquiring software information from process information. FIG. 10 is a diagram illustrating the device information updating process. FIG. 11A is a diagram for explaining the definition of the risk level generated in the device information updating process. FIG. 11B is a diagram for explaining the definition of the risk level generated in the device information updating process. FIG. 12 is a diagram illustrating an example of a data configuration of the device information. FIG. 13 is a diagram illustrating the risk threshold setting process. FIG. 14 is a diagram illustrating the risk determination process. FIG. 15 is a diagram illustrating a specific example of the risk assessment process. FIG. 16 is a diagram illustrating a specific example of the risk assessment process. FIG. 17 is a flowchart showing the procedure of the communication information generation process. FIG. 18 is a flowchart showing the procedure of the device information updating process. FIG. 19 is a flowchart showing the processing procedure of the risk threshold setting process. FIG. 20 is a flowchart showing the processing procedure of the risk determination process. FIG. 21 is a diagram illustrating an example of a computer in which an agent and a determination device are realized by executing a program.

Below, one embodiment of the present invention will be described in detail with reference to the drawings. Note that the present invention is not limited to this embodiment. In addition, in the drawings, the same parts are denoted by the same reference numerals.

[Embodiment]
1 is a diagram for explaining an outline of the process according to the embodiment. As shown in FIG. 1, four processes are executed in the embodiment.

In the embodiment, first, in preparation for risk assessment in response to a vulnerability notification, a communication information generation process (first generation process), a device information updating process (second generation process), and a risk threshold setting process are executed in advance. The communication information generation process acquires packets generated by the device to be assessed, acquires information on the software performing the communication, and updates communication operation information. The device information updating process generates risk level information and registers the latest device information. The risk threshold setting process sets a threshold for risk assessment (hereinafter referred to as the risk threshold). This ensures that the assessment device always holds the latest risk level information.

Next, in the embodiment, when the determination device receives a vulnerability notification, it executes a risk determination process (determination process) for the vulnerability notification content. Note that in the risk determination process, if it determines that notification of the result of the determination is necessary, it executes a notification process to notify the determination result.

In this way, in the embodiment, risk level information generated from the communication operation of the device is used for the judgment. Therefore, according to the embodiment, unlike conventional risk judgment techniques based on the network configuration, it is possible to make a risk judgment based on the actual communication operation of the device.

FIG. 2 is a diagram explaining the process flow of an embodiment. In the embodiment, communication information generation process, device information updating process, and risk threshold setting process are executed at the timing shown in FIG. 2. Communication information generation process is a process that is performed continuously. Device information updating process is a process that is performed periodically. Risk threshold setting process and risk assessment process are processes that are performed irregularly.

[Communication system]
Next, a communication system according to an embodiment will be described with reference to FIG 3. FIG 3 is a diagram showing an example of the configuration of the communication system according to an embodiment.

As shown in FIG. 3, the communication system 100 according to the embodiment includes a device 20 to be assessed for risk, a determination device 30 that performs risk assessment for the device 20, a vulnerability information distribution service 40 that is suspected of having communication vulnerabilities, an external server 50, and an internal server 60 that communicates with the device 20 to be assessed.

The vulnerability information distribution service 40 and the external server 50 can communicate with the assessment target device 20 via the Internet.

A firewall is provided between the device 20 to be judged and the Internet to protect the internal device from external attacks. An agent 10 is provided in the device 20 to be judged. The agent 10 acquires the communication operation status of the device 20 to be judged. The agent 10 generates risk level information on a software basis based on the communication operation information of the device 20 to be judged, and registers it in the judgment device 30.

The determination device 30 performs risk determination for the vulnerability information sent to the device 20 to be determined based on the communication operation status of the device 20 to be determined acquired by the agent 10.

[agent]
Fig. 4 is a diagram showing an example of the configuration of the agent 10 shown in Fig. 3. The agent 10 is realized, for example, by loading a predetermined program into a computer or the like including a ROM (Read Only Memory), a RAM (Random Access Memory), a CPU (Central Processing Unit), etc., and having the CPU execute the predetermined program. The agent 10 is also capable of communicating with other devices via a communication interface that is included in the device to be determined and that transmits and receives various information to and from other devices connected via a network or the like.

As shown in FIG. 4, the agent 10 has a packet capture result 11, a communication behavior information DB 12, a packet capture acquisition unit 13, a software information acquisition unit 14, a communication behavior information generation unit 15, a risk level information generation unit 16, a device information generation unit 17, and a device information transmission unit 18.

The packet capture result 11 stores the packet capture acquired by the packet capture acquisition unit 13.

The communication action information DB12 stores the communication action information generated by the communication information generation process.

The packet capture acquisition unit 13 acquires packets generated in the device 20 to be determined. The packet capture acquisition unit 13 captures packets generated by communication from inside to outside or communication from outside to inside. The packet capture acquisition unit 13 stores the captured packets in the packet capture result 11.

The software information acquisition unit 14 acquires software information about the software that communicated the packet acquired by the packet capture acquisition unit 13 during the communication information generation process. If the captured packet does not have a known communication pattern, the software information acquisition unit 14 acquires software information about the software that communicated this packet. The software information acquisition unit 14 acquires software information on a software-by-software basis.

The communication operation information generating unit 15 generates communication operation information indicating the communication operation of the packet in the communication information generating process. The communication operation information includes at least the software that performed the communication of the packet acquired by the packet capture acquiring unit 13.

If the packet captured by the packet capture acquisition unit 13 is of a known communication pattern, the communication operation information generation unit 15 updates the last communication time of the communication operation information of this known communication pattern. If the packet captured by the packet capture acquisition unit 13 is not of a known communication pattern, the communication operation information generation unit 15 generates communication operation information for the communication of this packet based on the software information acquired by the software information acquisition unit 14. The communication operation information generation unit 15 generates communication operation information on a software basis.

The risk level information generating unit 16 uses the communication operation information in the device information updating process to generate risk level information based on the communication operation. The risk level information generating unit 16 generates risk level information for each piece of software.

The risk level information generating unit 16 generates risk level information for software based on whether or not the software has had its communication information changed since the previous execution, and whether or not software that was not present during the previous execution has been added to the communication information. The risk level information generating unit 16 generates risk level information for external communication and risk level information for internal communication. As described below, risk levels are defined, for example, in four stages, depending on the state of connectivity and communication operation.

If there is software whose communication information has changed since the last time it was executed, the risk level information generating unit 16 updates the risk level of this software according to the communication status and communication operation status, and generates risk level information including the updated risk level. In addition, even if there is no software whose communication information has changed since the last time it was executed, if software that was not present at the last time it was executed has been added to the communication information, the risk level information generating unit 16 determines the risk level of the added software according to the communication status and communication operation status, and generates risk level information indicating the determined risk level.

The device information generating unit 17 generates the latest device information of the device 20 to be determined in the device information updating process. The device information generating unit 17 registers device information in which software is associated with risk level information corresponding to the software in the determination device 30. The device information has a configuration in which software identification information is associated with external communication risk level information and internal communication risk level information for each piece of software.

The device information transmission unit 18 transmits the latest device information of the device 20 to be determined, generated by the device information generation unit 17, to the determination device 30, and requests registration of the latest device information.

[Determination device]
Fig. 5 is a diagram showing an example of the configuration of the determination device 30 shown in Fig. 3. The determination device 30 is realized, for example, by loading a predetermined program into a computer or the like including a ROM, a RAM, a CPU, etc., and having the CPU execute the predetermined program. In addition, the determination device 30 is capable of communicating with other devices via a communication interface that is included in the device to be determined and that transmits and receives various information to and from other devices connected via a network or the like.

As shown in FIG. 5, the determination device 30 has a device information DB 31, risk threshold setting information 32, a device information registration unit 33, a risk threshold setting unit 34, a vulnerability information receiving unit 35, a risk determination unit 36, and a result notification unit 37.

The device information DB31 stores the device information sent from the agent 10.

Risk threshold setting information 32 is a DB that stores setting information for risk thresholds. Risk thresholds are set for both external and internal communications, and are expressed as risk level values.

The device information registration unit 33, for example, receives device information sent from the agent 10 and stores it in the device information DB 31.

The risk threshold setting unit 34 accepts input of threshold information (risk threshold information) for risk judgment, including a risk threshold, and registers the risk threshold as risk threshold setting information 32 based on the input risk threshold information. For example, the risk threshold is set by the operator for each of external communication and internal communication.

The vulnerability information receiving unit 35 receives vulnerability information sent from the vulnerability information distribution service 40.

The risk assessment unit 36 assesses the risk of the vulnerability information received by the vulnerability information receiving unit 35. The risk assessment unit 36 performs risk assessment on the vulnerability information sent to the assessment target device 20 based on the communication operation state of the assessment target device 20 acquired by the agent 10. When the risk assessment unit 36 receives notification of the distribution of vulnerability information to the assessment target device 20, it assesses the risk of the vulnerability information based on the device information registered by the agent 10 and a preset threshold value (risk threshold) for risk assessment. As described above, the risk threshold is set for each software for both external communication and internal communication.

Specifically, the risk determination unit 36 determines the risk of the received vulnerability information based on the attack source classification of the vulnerability information, the risk level of the software corresponding to the vulnerability information, and the risk threshold. The risk determination unit 36 determines the risk of the vulnerability information based on predetermined determination rules. For example, if the risk level is equal to or greater than the predetermined risk threshold, the risk determination unit 36 determines the risk to be high, and if the risk level is less than the predetermined risk threshold, the risk determination unit 36 determines the risk to be low.

The result notification unit 37 notifies the operator of the result of the risk assessment unit 36 depending on the degree of risk assessed by the risk assessment unit 36.

[Communication processing flow]
Next, a flow of communication processing according to the embodiment will be described. First, a communication information generation process will be described.

[Communication information generation process]
FIG. 6 is a diagram illustrating the communication information generation process.

As shown in FIG. 6, in the communication information generation process, the agent 10 captures and acquires packets generated in the device to be judged 20 ((1) in FIG. 6). The agent 10 captures packets generated by internal communication, internal to external communication, or external to internal communication. Internal communication includes communication from the device to be judged 20 to the host and communication from other hosts to the device to be judged.

If the captured packet is not of a known communication pattern in the device 20 to be judged, the agent 10 acquires information about the software that communicated the packet ((2) in FIG. 6). If the packet is of a known communication pattern in the device 20 to be judged, the agent 10 updates the last communication time in the communication operation information for the corresponding known communication pattern ((3) in FIG. 6).

FIGS. 7-1 to 7-4 are diagrams illustrating an example of communication operation information generated in the communication information generation process. For example, four pieces of communication operation information are generated by the communication information generation process: external communication information (communication from outside to inside) of the device to be determined 20 (FIG. 7-1), external communication information (communication from inside to outside) of the device to be determined 20 (FIG. 7-2), internal communication information of the device to be determined 20 (communication from another host to the device to be determined 20) (FIG. 7-3), and internal communication information of the device to be determined 20 (communication from the device to be determined 20 to another host) (FIG. 7-4).

Each piece of information has the following fields: source IP (srcIP), source port (srcPort), destination IP (dstIP), destination port (dstPort), software name, and last communication time, and is constantly updated.

For example, software information is obtained from process information, etc. Software information is obtained from packet header information.

FIGS. 8 and 9 are diagrams explaining a method for acquiring software information from process information. The agent 10 uses the information shown in FIG. 8 (listening port number, PID, executable file name) ((1) and (2) in FIG. 8) to identify the executable file of the process waiting for communication ((3) in FIG. 8).

In the example of Figure 8, a process in LISTEN is shown as an example, but even if the communication originates from the device 20 to be determined, software information can be obtained in the same way by referencing the information of the connection in the ESTABLISHED state. Note that if the executable file name is a command name, a process of referencing the actual file of the command is added.

Once the executable file name of the communicating process can be confirmed, the software name and version information can be obtained by referencing the package name that contains the executable file name ((1) in Figure 9), as shown in Figure 9. Figure 9 shows an example that uses information from a package management system. Another method is to use the device's SBOM (Software Bill of Materials).

[Device information update process]
FIG. 10 is a diagram illustrating the device information updating process.

As shown in FIG. 10, in the device information updating process, the agent 10 generates risk level information for the software based on whether or not the software has had its communication information changed since the previous execution of the device information updating process, and whether or not software that was not present in the previous execution of the process has been added to the communication information ((1) in FIG. 10).

Then, the agent 10 generates the latest device information of the device 20 to be judged ((2) in FIG. 10). The agent 10 transmits the generated latest device information of the device 20 to the judgment device 30 and requests registration of the latest device information ((3) in FIG. 10).

Note that although the device information updating process is a process that is performed periodically, the timing of its execution may be determined by the operator. For example, the timing of the device information updating process may be set to execute at one-minute intervals with an emphasis on updating the information, or to execute daily taking into account the load on the target device.

FIGS. 11-1 and 11-2 are diagrams explaining the definition of risk levels generated in the device information updating process. In FIG. 11-1 and 11-2, the risk level definition is explained by providing the following items as risk level, destination IP address, protocol/destination port, connectivity/communication operation, and remarks. Note that the definition of risk level is not limited to the examples in FIG. 11-1 and FIG. 11-2, and may be freely defined by the operator.

Figure 11-1 shows the definition of risk levels for external communications, and Figure 11-2 shows the definition of risk levels for internal communications. Figures 11-1 and 11-2 are examples in which risk is defined in increasing order as no communication possible, no communication, communication with a specific party, and communication with an unspecified party.

For example, as shown in Figures 11-1 and 11-2, if communication is not possible, the risk is low because communication is not possible, and the risk level is "1." If communication is possible or communication is unknown and there is no communication when the device is operating normally, the risk is low as long as the device to be judged 20 itself is operating normally, and the risk level is "2." If communication is possible and the device to be judged communicates only with specific parties when operating normally, the risk is low as long as both the device to be judged 20 itself and the other party are operating normally, and the risk level is "3." If communication is possible and communication is with unspecified parties, there is a possibility of risk, and the risk level is "4."

In the agent 10, the risk level information generating unit 16 determines whether there is software whose communication information has changed since the previous execution, and whether software that was not present at the previous execution has been added to the communication information. The risk level information generating unit 16 then refers to Figures 11-1 and 11-2 to determine the risk level of the software and generate risk level information.

Note that the global IP address in Figure 11-1 may also include a local IP address (proxy, LB (Load Balancer), etc.) that relays communications with the outside world.

FIG. 12 is a diagram illustrating an example of the data configuration of device information. The agent 10 registers device information having the configuration shown in FIG. 12 in the determination device 30. As shown in FIG. 12, the device information has items such as software name, risk level of external communication, and risk level of internal communication. Therefore, by registering this device information, the determination device 30 holds a set of software configuration information and risk level information based on communication operations.

[Risk threshold setting process]
FIG. 13 is a diagram illustrating the risk threshold setting process.

The determination device 30 accepts risk threshold information input by the operator and sets a threshold value (risk threshold) for risk determination ((1) in FIG. 13). For example, the risk threshold is set to a risk level of "4" or higher for external communications and a risk level of "4" or higher for internal communications.

[Risk Judgment Processing]
FIG. 14 is a diagram illustrating the risk determination process.

When the determination device 30 receives vulnerability information sent from the vulnerability information distribution service 40 ((1) in FIG. 14), it determines the risk of the received vulnerability information ((2) in FIG. 14). If necessary, the determination device 30 notifies the operator of the result of the risk determination ((3) in FIG. 14).

FIG. 15 is a diagram explaining a specific example of risk assessment processing. As a premise, it is assumed that the risk threshold and device information described in box W1 (FIG. 15) are registered in the assessment device 30. In addition, in the example of FIG. 15, as shown in box W1, only vulnerability information corresponding to software that communicates with unspecified parties (risk level "4") is notified to the operator.

For example, if vulnerability information for the software "RRR" is distributed in this state ((1) in FIG. 15), the following judgment process is performed. The risk level based on the communication behavior of the software "RRR" is "2" for external communication and "3" for internal communication, which is less than the risk threshold (risk level "4") set by the operator. Therefore, the judgment device 30 judges that the vulnerability information for the software "RRR" is low risk ((2) in FIG. 15). Since the judgment device 30 has determined that the vulnerability information for the software "RRR" is low risk, it judges that notification processing to the operator is unnecessary and does not notify the operator of the judgment result ((3) in FIG. 15).

In the example of Figure 15, in the conventional method where the determination is made based only on the network configuration, the risk is determined to be high because the determination is not made based on the actual communication partner or communication operation, but in this embodiment, the risk can be determined to be low by making a determination based on the communication operation.

FIG. 16 is a diagram explaining a specific example of risk assessment processing. As a premise, it is assumed that the risk threshold and device information described in box W2 (FIG. 16) are registered in the assessment device 30. In addition, the example of FIG. 16 explains a case where, as shown in box W2, vulnerability information of communicating software (risk level "3" or higher) is notified regardless of whether the other party is unspecified or not.

For example, if vulnerability information for the software "RRR" is distributed in this state ((1) in FIG. 16), the following judgment process is performed. The risk level based on the communication behavior of the software "RRR" is "2" for external communication and "3" for internal communication, which is equal to or higher than the risk threshold (risk level "3") set by the operator. Therefore, the judgment device 30 judges that the vulnerability information for the software "RRR" is high risk ((2) in FIG. 16). Since the judgment device 30 has determined that the vulnerability information for the software "RRR" is high risk, it judges that notification processing to the operator is necessary and notifies the operator of the judgment result ((3) in FIG. 16).

In the example of FIG. 16, even if the operator mistakenly determines that the software "RRR" is unused and therefore has a low risk, this embodiment can correctly determine that the risk is high.

[Communication Processing Procedure]
Next, a process procedure of each step of the communication process according to the embodiment will be described.

[Processing procedure for communication information generation processing]
FIG. 17 is a flowchart showing the procedure of the communication information generation process.

The agent 10 captures and acquires packets generated in the device 20 to be judged (step S1).

The agent 10 determines whether the captured packet is a known communication pattern (step S2).

If the captured packet is a known communication pattern (step S2: Yes), the agent 10 updates the last communication time of the communication operation information for the corresponding known communication pattern (step S3) and ends the communication information generation process for the captured packet.

If the captured packet does not have a known communication pattern (step S2: No), the agent 10 acquires information about the software that performed the communication of this packet (step S4). The agent 10 then generates communication operation information for that communication (step S5) and ends the communication information generation process for the captured packet.

[Device information update process procedure]
FIG. 18 is a flowchart showing the procedure of the device information updating process.

The agent 10 determines whether there is any software whose communication information has changed since the last time it was executed (step S11).

If there is software whose communication information has changed since the last time it was executed (step S11: Yes), the agent 10 updates the risk level information of the software whose communication information has changed since the last time it was executed in accordance with the change in the communication information (step S12), and generates the latest device information for the device 20 to be assessed.

The agent 10 transmits the latest device information of the device 20 to be judged to the judgment device 30 (step S13). The judgment device 30 registers the latest device information (step S14) and ends the device information updating process.

If there is no software whose communication information has changed since the previous execution (step S11: No), the agent 10 determines whether software that was not present during the previous execution has been added to the communication information (step S15).

If software that was not present the last time the program was executed has not been added to the communication information (step S15: No), the device information update process ends.

On the other hand, if software that was not present at the time of the previous execution has been added to the communication information (step S15: Yes), the agent 10 generates risk level information for the software that has been added to the communication information (step S16).

The agent 10 transmits the latest device information of the device 20 to be determined to the determination device 30 (step S17). The determination device 30 registers the latest device information (step S14) and ends the device information updating process.

[Risk threshold setting process procedure]
FIG. 19 is a flowchart showing the processing procedure of the risk threshold setting process.

The determination device 30 accepts the input of risk threshold information (step S21) and registers risk threshold setting information 32 based on the input risk threshold information (step S22).

[Risk Judgment Processing Procedure]
FIG. 20 is a flowchart showing the processing procedure of the risk determination process.

When the determination device 30 receives vulnerability information sent from the vulnerability information distribution service 40 (step S31), it determines whether the attack source category of the received vulnerability information is a network (step S32).

If the attack source category of the received vulnerability information is NW (step S32: Yes), the determination device 30 determines whether the risk level of the software corresponding to the vulnerability information is equal to or greater than the risk threshold (step S33).

If the risk level of the software corresponding to the vulnerability information is equal to or greater than the risk threshold (step S33: Yes), the determination device 30 determines that the risk is high and notifies the operator (step S34).

If the risk level of the software corresponding to the vulnerability information is less than the risk threshold (step S33: No), the determination device 30 determines that the risk is low (step S35).

If the attack source category of the received vulnerability information is not NW (step S32: No), after step S34 or step S35 is completed, the determination device 30 ends the risk determination process.

[Effects of the embodiment]
As described above, in the embodiment, the determination device 30 performs risk determination for the vulnerability information transmitted to the determination target device 20, based on the actual communication operation state of the determination target device 20 acquired via the agent 10. Specifically, the determination device 30 performs risk determination for the determination target device 20, using risk level information generated by the agent 10 from the actual communication operation of the determination target device 20. Therefore, in the embodiment, risk determination based on the actual communication operation of the device is possible.

In the embodiment, the agent 10 and the determination device 30 perform communication information generation processing, device information updating processing, and risk threshold setting processing in advance. As a result, the determination device 30 always holds the latest risk level information. When the determination device 30 receives a vulnerability notification, it performs risk determination processing based on the latest risk level information, making it possible to perform risk determination quickly and appropriately.

[System Configuration of the Embodiment]
Each component of the agent 10 and the determination device 30 is a functional concept, and does not necessarily have to be physically configured as shown in the figure. In other words, the specific form of distribution and integration of the functions of the agent 10 and the determination device 30 is not limited to that shown in the figure, and all or part of them can be functionally or physically distributed or integrated in any unit depending on various loads, usage conditions, etc.

Furthermore, each process performed by the agent 10 and the determination device 30 may be realized, in whole or in part, by a CPU, a GPU (Graphics Processing Unit), and a program analyzed and executed by the CPU and GPU. Furthermore, each process performed by the agent 10 and the determination device 30 may be realized as hardware using wired logic.

Furthermore, among the processes described in the embodiments, all or part of the processes described as being performed automatically can be performed manually. Alternatively, all or part of the processes described as being performed manually can be performed automatically using known methods. In addition, the information including the processing procedures, control procedures, specific names, various data, and parameters described above and illustrated can be modified as appropriate unless otherwise specified.

[program]
21 is a diagram showing an example of a computer in which an agent 10 and a determination device 30 are realized by executing a program. The computer 1000 has, for example, a memory 1010 and a CPU 1020. The computer 1000 also has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

The memory 1010 includes a ROM 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

The hard disk drive 1090 stores, for example, an OS (Operating System) 1091, application programs 1092, program modules 1093, and program data 1094. That is, the programs that define the processes of the agent 10 and the determination device 30 are implemented as program modules 1093 in which code executable by the computer 1000 is written. The program modules 1093 are stored, for example, in the hard disk drive 1090. For example, the program modules 1093 for executing processes similar to the functional configurations of the agent 10 and the determination device 30 are stored in the hard disk drive 1090. The hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

Furthermore, the setting data used in the processing of the above-mentioned embodiment is stored as program data 1094, for example, in memory 1010 or hard disk drive 1090. Then, the CPU 1020 reads the program module 1093 or program data 1094 stored in memory 1010 or hard disk drive 1090 into RAM 1012 as necessary and executes it.

The program module 1093 and program data 1094 may not necessarily be stored in the hard disk drive 1090, but may be stored in a removable storage medium, for example, and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (such as a LAN (Local Area Network), WAN (Wide Area Network)). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070.

The above describes an embodiment of the invention made by the inventor, but the present invention is not limited to the descriptions and drawings that form part of the disclosure of the present invention according to this embodiment. In other words, other embodiments, examples, operational techniques, etc. made by those skilled in the art based on this embodiment are all included in the scope of the present invention.

10 Agent 11 Packet capture result 12 Communication operation information DB
REFERENCE SIGNS LIST 13 Packet capture acquisition unit 14 Software information acquisition unit 15 Communication operation information generation unit 16 Risk level information generation unit 17 Device information generation unit 18 Device information transmission unit 20 Judgment target device 30 Judgment device 31 Device information DB
32 Risk threshold setting information 33 Device information registration unit 34 Risk threshold setting unit 35 Vulnerability information receiving unit 36 Risk determination unit 37 Result notification unit 40 Vulnerability information distribution service 50 External server 60 Internal server

Claims (7)

A communication system having an agent provided in a device to be judged and a judgment device that judges a risk of the device to be judged,
The agent acquires an operation status of communication of the determination target device,
A communication system characterized in that the judgment device performs a risk judgment on vulnerability information sent to the judgment target device based on the communication operation status of the judgment target device acquired by the agent. The communication system according to claim 1, characterized in that the agent acquires packets generated in the device to be determined, acquires software information that communicated the acquired packets, and generates communication operation information indicating the communication operation of the packets, including at least the acquired software. The communication system according to claim 2, characterized in that the agent uses the communication behavior information to generate risk level information based on the communication behavior for each piece of software, and registers device information in which the software and the risk level information corresponding to the software are associated with each other in the determination device. The communication system according to claim 3, characterized in that, when the determination device receives notification of the distribution of vulnerability information to the device to be determined, the determination device determines the risk of the vulnerability information based on the device information and a preset threshold value for risk determination. The communication system according to claim 3, characterized in that the agent constantly generates the communication operation information and periodically registers the device information in the determination device. A communication method executed by a communication system having an agent provided in a device to be judged and a judgment device that judges a risk of the device to be judged, comprising:
The agent acquires a communication operation status of the determination target device;
a step of performing a risk judgment on vulnerability information transmitted to the determination target device based on the communication operation state of the determination target device acquired in the acquiring step by the determination device;
A communication method comprising: A communication program for causing a computer to execute a method,
A computer as an agent installed in the device to be judged
acquiring an operation status of the communication of the determination target device;
The computer as a judgment device,
a step of performing a risk judgment on the vulnerability information to be transmitted to the judgment target device based on the communication operation state of the judgment target device acquired in the acquiring step;
A communication program characterized by causing the program to execute the above steps.

Images