WO2022153412A1

WO2022153412A1 - Score integration device, score integration method, and score integration program

Info

Publication number: WO2022153412A1
Application number: PCT/JP2021/000919
Authority: WO
Inventors: 麿与山嵜; 満春佐々木
Original assignee: 日本電信電話株式会社
Priority date: 2021-01-13
Filing date: 2021-01-13
Publication date: 2022-07-21

Abstract

This score integration device (10) comprises a model which calculates, with respect to two or more scores of different viewpoints, a score obtained by integrating the two or more scores. This score integration device (10) searches for, by using an evaluation function that evaluates the degree of sameness between priorities ranked by the scores of the two or more different viewpoints for vulnerability and prioritization ranked by scores output by the model, parameters of a model that maintains the priorities ranked by the two or more scores for respective vulnerabilities as much as possible. In addition, the score integration device (10) sets the found parameters to the model, and calculates and outputs the prioritization scores of the respective vulnerabilities.

Description

Score integration device, score integration method, and score integration program

The present invention relates to a score integration device, a score integration method, and a score integration program for prioritizing countermeasures against vulnerabilities.

In recent years, the number of software vulnerabilities published has been on the rise, but organizations need to deal with vulnerabilities with limited resources. For this reason, it is important to prioritize the response to vulnerabilities.

Conventionally, prioritization of countermeasures against vulnerabilities has been performed based on the CVSS value calculated by CVSS (Common Vulnerability Scoring System). This CVSS value takes a value of 0-10, and the higher the CVSS value of the vulnerability, the higher the severity of exploitation.

In addition, a technique has been proposed in which the probability of an attack occurring against a vulnerability is predicted by an attack prediction model obtained by machine learning, and the predicted probability is used to prioritize countermeasures against the vulnerability. There is. Here, since the above prediction model has limitations such as being applicable only to a specific product, a serious vulnerability (vulnerability with a high CVSS value) may be ignored. Therefore, in practice, prioritization is required that combines the viewpoints of both the severity of the vulnerability and the probability that an attack will occur.

Here, as a method of prioritizing by combining the viewpoints of both the severity of the vulnerability and the probability that an attack will occur, for example, a method of obtaining the sum of the scores obtained from each viewpoint and the product of the scores are used. The method of obtaining it can be considered.

However, the distribution of score values differs between the vulnerability severity score and the probability of attack score. Therefore, for example, in the method of obtaining the sum of the scores obtained from each viewpoint, the severity of the vulnerability tends to be extremely emphasized. Further, the method using the product of the scores obtained from each viewpoint has a problem that the score output by the prediction model tends to be extremely emphasized.

Therefore, it is an object of the present invention to solve the above-mentioned problems and to obtain an integrated score for scores having different distributions of values, such as scores obtained from different viewpoints, in consideration of ranking by each score.

In order to solve the above-mentioned problems, for a set of vulnerabilities to which two or more scores of different viewpoints are given, the priority ranked by the score of each viewpoint and the score obtained by integrating the scores of each viewpoint are integrated. Using an evaluation function that evaluates how much the priority is ranked based on the score calculated by the model that calculates the vulnerability, the priority is ranked according to the score of each of the above viewpoints. It is characterized by including a parameter search unit that searches for parameters of the model that calculates a score that is maintained as much as possible, and a parameter setting unit that sets the searched parameters in the model.

According to the present invention, for scores having different distribution of values, such as scores obtained from different viewpoints, it is possible to obtain an integrated score in consideration of ranking by each score.

FIG. 1 is a diagram showing a configuration example of a score integration device of each embodiment. FIG. 2 is a flowchart showing an example of a processing procedure of the score integration device of each embodiment. FIG. 3 is a diagram for explaining an outline of operation of the score integration device of the first embodiment. FIG. 4 is a diagram for explaining an outline of operation of the score integration device of the second embodiment. FIG. 5 is a diagram showing a configuration example of a computer that executes a score integration program.

Hereinafter, embodiments (embodiments) for carrying out the present invention will be described separately for the first embodiment and the second embodiment with reference to the drawings. The present invention is not limited to each embodiment.

[Overview]
First, an outline of the score integration device of each embodiment will be described. For example, a score integration device is given a set of vulnerabilities given two or more prioritized scores from different perspectives (eg, the CVSS value of a vulnerability and the probability that the vulnerability will be attacked). When it is done, a new score is calculated so as to maintain the priority based on the score of each viewpoint as much as possible. As a result, the score integration device considers the priority based on the score from each viewpoint for the scores with different distribution of values, such as the CVSS value of the vulnerability and the value of the probability that an attack will occur in the vulnerability. And the scores can be integrated.

For example, a model M (V, V,) that gives a score integration device a set of vulnerabilities v _n ∈ V and a set of prioritization functions f _m ∈ F and outputs an integrated prioritization score r _n ∈ R. Consider the case of constructing F). In this case, the score integration device searches for a parameter set Φ of the model _M that maintains the priority based on fm as much as possible. Here, the value of fm is, for example, a value calculated by a predetermined calculation formula such as _CVSS , a value calculated by a machine learning model, or a value of a probability that an attack will occur.

For example, the score integration device is based on a score between the score of _fm , or the true score, which is the teacher data of learning if _fm is a machine learning model, and the score R output by the model M. Define an evaluation function that evaluates how much the prioritization is the same. Then, the score integration device searches for the optimum parameter set Φ of the model M using the defined evaluation function. As the model M, for example, a linear model, a generalized additive model, a deep learning model, or the like can be used.

Here, let sm _{, n ∈ S m} _be the score of f _m or the true score of f _m for the vulnerability set V. In addition, the evaluation value of the ordering between the integrated score R and S _m is set to E (S _m , R) using the evaluation function E. Furthermore, the function H that integrates the values of the evaluation function is defined as the objective function.

The score integration device searches the parameter set Φ of the model M that maximizes H by using the objective function H defined by using the evaluation function E. For the search, for example, a method according to the model M is used from the error back propagation method, the gradient descent method, and the like.

For the evaluation function E, an evaluation function used in information retrieval such as nDCG (normalized Discounted Cumulative Gain) or a differentiateable approximation of these evaluation functions can be used. For the integrated function that is the objective function H, for example, harmonic mean, arithmetic mean, geometric mean, and the like can be used, but the integrated function is not limited thereto. In addition, nDCG is described in the following document 1.

Reference 1: https://en.wikipedia.org/wiki/Discounted_cumulative_gain

According to such a score integration device, it is possible to obtain an integrated score for vulnerabilities by considering the ranking of scores obtained from different viewpoints from each viewpoint.

[Configuration example]
A configuration example of the score integration device 10 will be described with reference to FIG. The score integration device 10 includes an input / output unit 11, a storage unit 12, and a control unit 13.

The input / output unit 11 controls the input / output of various information. The input / output unit 11 receives, for example, input of a set of vulnerabilities, a prioritization function for each vulnerability, and the like. Further, the input / output unit 11 outputs a score (prioritizing score) for each vulnerability calculated by the control unit 13.

The storage unit 12 stores information referred to when the control unit 13 executes various processes. For example, the storage unit 12 stores a model M for calculating a score obtained by integrating the scores of the two or more viewpoints for a set of vulnerabilities to which the scores of the two or more viewpoints are given. In this model M, for example, initial values of parameters are set in the initial state, and when the parameters of the model are searched by the control unit 13, the searched parameters are set.

The control unit 13 controls the entire score integration device 10. The control unit 13 includes a parameter search unit 131, a parameter setting unit 132, and a score calculation unit 133.

The parameter search unit 131 searches for the parameters of the model M that maintain the priority of the set of vulnerabilities as much as possible, which is ranked by the scores of two or more viewpoints. For example, the parameter search unit 131 evaluates how much the priority ranked by the scores of two or more viewpoints for the vulnerability is the same as the priority ranked by the score calculated by the model M. Prepare the evaluation function E. Then, the parameter search unit 131 searches for the parameters of the model M that maximizes the objective function H, with the function defined by the evaluation function E as the objective function H (E).

The parameter setting unit 132 sets the parameters searched by the parameter search unit 131 in the model M. The score calculation unit 133 calculates and outputs the score of each vulnerability by the model M in which the searched parameters are set.

According to such a score integration device 10, it is possible to obtain an integrated score for vulnerabilities by considering the ranking of scores obtained from different viewpoints according to the scores from each viewpoint.

[Example of processing procedure]
Next, an example of the processing procedure of the score integration device 10 will be described with reference to FIG. For example, the parameter search unit 131 searches for a parameter of the model M that maintains the ranking of each viewpoint as much as possible for a set of vulnerabilities to which scores of two or more viewpoints are given (S1). After that, the parameter setting unit 132 sets the searched parameters in the model M (S2). Then, the score calculation unit 133 calculates and outputs the prioritization score of each vulnerability using the model M in which the parameter is set (S3).

[First Embodiment]
Here, when sm _{, n ∈ S m} _includes the true score of the prioritization function, a machine learning model can be used as the model M and a differentiable evaluation function can be used as the evaluation function E. The score integration device 10 in this case will be described as the score integration device 10 of the first embodiment. The process performed by the score integration device 10 is divided into a learning phase in which the parameters of the model M are searched and a score calculation phase in which the score of each vulnerability is calculated using the model M in which the parameters are set. The learning phase and the score calculation phase will be described with reference to FIG.

[Learning phase]
First, the learning phase will be described. Here, the case where the score integration device 10 is given a set of vulnerabilities v _n ∈ V, a set of prioritizing functions f _m ∈ F, and S, which is the true score of the prioritizing function f _m , think.

In this case, the parameter search unit 131 of the score integration device 10 calculates the prioritization score of the vulnerability V by the above F. Then, the parameter search unit 131 maximizes the objective function H by machine learning using the above-mentioned vulnerabilities V, F, S, and the score calculated by the above-mentioned F, and the evaluation function E and the objective function H. Search for the parameter Φ of the model M to be converted. Then, the parameter setting unit 132 sets the searched parameter Φ in the model M.

[Score calculation phase]
Next, the score calculation phase will be described. The score calculation unit 133 of the score integration device 10 calculates the prioritization score of the vulnerability V'by F. Then, the score calculation unit 133 calculates and outputs a score R that integrates the prioritized scores by F for the vulnerability V'using the calculated score and the model M in which the above parameter Φ is set. do.

By doing so, the score integration device 10 can set the parameter Φ for the model M learned by machine learning, and calculate the score R in which the prioritized scores by F are integrated for the vulnerability.

[Second Embodiment]
Further, when sm _{, n ∈ S m} _does not include the true score of the prioritization function f _m , the score integration device 10 may calculate the score for each vulnerability as follows.

Here, a case where a model M including a set C of constraint expressions (constraints) is defined will be described as an example. In this case, the score integration device 10 searches for the optimum parameter Φ of the model M by the mathematical programming method using a differentiable evaluation function as the evaluation function E. The constraint formula is a constraint formula in which the degree of influence of a specific fm of high importance such as _CVSS exceeds a predetermined level. The score integration device 10 described above will be described as the score integration device 10 of the second embodiment.

The outline of the operation of the score integrating device 10 will be described with reference to FIG. For example, the parameter search unit 131 of the score integration device 10 considers a case where a set of vulnerabilities v _n ∈ V and a set of prioritizing functions f _m ∈ F are given, as shown in FIG. In this case, the score integration device 10 calculates the prioritization score of the vulnerability V by F. Then, the score integration device 10 uses the above V, F, the score calculated by the above F, the evaluation function E, the objective function H, and the set C of the constraint equations, and uses the parameters of the model M by the mathematical programming method. Search for Φ. Then, the parameter setting unit 132 sets the searched parameter Φ in the model M.

After that, the score calculation unit 133 calculates a score R that integrates the prioritized scores by F for the vulnerability V by using the score calculated by F and the model M in which the above parameter Φ is set. ,Output.

By doing so, the score integration device 10 sets the parameter Φ for the model M even if sm _{, n ∈ S m} _does not contain the true score of the prioritization function, and the vulnerability depends on F. It is possible to calculate the score R by integrating the prioritized scores.

Next, a specific example of the processing procedure of the score integration device 10 will be described. For f _m , f _{cvss obtained} by normalizing CVSS to 0-1 and model f _exp for calculating the probability of an attack are used. For M, a model using the linear weighted sum defined by the following equation (1) is used. For S _m , the prioritized score calculated by f _m is used. The parameter λ in the equation (1) corresponds to the above parameter Φ.

For E, a differentiable approximation of RankDCG shown in Eq. (2) is used.

RankDCG is an evaluation function that improves nDCG and is described in Reference 2 below. Further, a differentiable approximation of nDCG is described in Document 3 below.

Reference 2: https://arxiv.org/pdf/1803.00719.pdf
Reference 3: https://www.microsoft.com/en-us/research/wp-content/uploads/2016/02/tr-2008-164.pdf

Further, rel'in the equation (2) is a value indicating the degree of relevance, and is the order of ascending order of the score given as S _m . Also, s _{x, y} = r _x -r _y , and α is a scale parameter.

The score integration device 10 introduces a constraint ((1-λ) / λ) ≤ L that _sets the weight of f _exp to L or less with respect to the weight of f _cvss in order to emphasize f cvss. Also, the harmonic mean is used as the objective function H (E). Since this is a nonlinear programming problem, the score integration device 10 uses the gradient descent method to find the parameter λ that maximizes the objective function H. Next, the score integration device 10 sets the above parameter λ in the model shown in the equation (1). Then, the score integration device 10 calculates and outputs the score R of each vulnerability using the model shown in the equation (1) in which the parameter λ is set.

In the above example, the case where the model M includes the set C of the constraint expressions has been described, but the model M does not have to include the set C of the constraint expressions.

[System configuration, etc.]
Further, each component of each of the illustrated parts is a functional concept, and does not necessarily have to be physically configured as shown in the figure. That is, the specific form of distribution / integration of each device is not limited to the one shown in the figure, and all or part of the device is functionally or physically distributed in arbitrary units according to various loads and usage conditions. Can be integrated and configured. Further, each processing function performed by each device may be realized by a CPU and a program executed by the CPU, or may be realized as hardware by wired logic.

Further, among the processes described in the above-described embodiment, all or a part of the processes described as being automatically performed can be manually performed, or the processes described as being manually performed. All or part of it can be done automatically by a known method. In addition, the processing procedure, control procedure, specific name, and information including various data and parameters shown in the above document and drawings can be arbitrarily changed unless otherwise specified.

[program]
The score integration device 10 described above can be implemented by installing a program as package software or online software on a desired computer. For example, by causing the information processing device to execute the above program, the information processing device can function as the score integration device 10 of each embodiment. The information processing device referred to here includes a desktop type or notebook type personal computer. In addition, information processing devices include smartphones, mobile communication terminals such as mobile phones and PHS (Personal Handyphone System), and terminals such as PDAs (Personal Digital Assistants).

Further, the score integration device 10 can be implemented as a server device in which the terminal device used by the user is a client and the service related to the above processing is provided to the client. In this case, the server device may be implemented as a Web server, or may be implemented as a cloud that provides services related to the above processing by outsourcing.

FIG. 10 is a diagram showing an example of a computer that executes a score integration program. The computer 1000 has, for example, a memory 1010 and a CPU 1020. The computer 1000 also has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. Each of these parts is connected by a bus 1080.

The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM (Random Access Memory) 1012. The ROM 1011 stores, for example, a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1090. The disk drive interface 1040 is connected to the disk drive 1100. For example, a removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to, for example, a mouse 1110 and a keyboard 1120. The video adapter 1060 is connected to, for example, the display 1130.

The hard disk drive 1090 stores, for example, OS1091, application program 1092, program module 1093, and program data 1094. That is, the program that defines each process executed by the score integration device 10 is implemented as a program module 1093 in which a code that can be executed by a computer is described. The program module 1093 is stored in, for example, the hard disk drive 1090. For example, a program module 1093 for executing a process similar to the functional configuration in the score integration device 10 is stored in the hard disk drive 1090. The hard disk drive 1090 may be replaced by an SSD.

Further, each data used in the processing of the above-described embodiment is stored as program data 1094 in, for example, a memory 1010 or a hard disk drive 1090. Then, the CPU 1020 reads the program module 1093 and the program data 1094 stored in the memory 1010 and the hard disk drive 1090 into the RAM 1012 as needed, and executes the program.

The program module 1093 and the program data 1094 are not limited to those stored in the hard disk drive 1090, but may be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and the program data 1094 may be stored in another computer connected via a network (LAN (Local Area Network), WAN (Wide Area Network), etc.). Then, the program module 1093 and the program data 1094 may be read by the CPU 1020 from another computer via the network interface 1070.

10 Score integration device 11 Input / output unit 12 Storage unit 13 Control unit 131 Parameter search unit 132 Parameter setting unit 133 Score calculation unit

Claims

It is calculated by a model that calculates a score that integrates the priorities ranked by the scores of each viewpoint and the scores of the above viewpoints for a set of vulnerabilities to which two or more scores of different viewpoints are given. As much as possible, maintain the priorities ranked by the scores of the respective perspectives for the set of vulnerabilities using an evaluation function that evaluates how much the priorities are ranked based on the scores. A parameter search unit that searches for the parameters of the model that calculates the score, and
A parameter setting unit that sets the searched parameters in the model, and
A score integration device characterized by comprising.
The evaluation function is
Based on nDCG (normalized Discounted Cumulative Gain), evaluate how much the priority ranked by two or more scores for the vulnerability is the same as the priority ranked by the score calculated by the model. The score integration device according to claim 1, wherein the evaluation function is performed.
The parameter search unit
The score integration device according to claim 1, wherein a function defined by the evaluation function is used as an objective function, and parameters of the model that maximizes the objective function are searched.
The score integration device according to claim 1, further comprising a score calculation unit that calculates and outputs a score for each vulnerability by the model in which the searched parameters are set.
The score given to the vulnerability is
The score integration device according to claim 1, wherein the CVSS value of the vulnerability and the value of the probability that an attack will occur in the vulnerability calculated by a machine learning model.
When the score given to the vulnerability includes the score calculated by the machine learning model and its true score
The parameter search unit
The third aspect of claim 3, wherein the parameters of the model are searched by machine learning using the set of vulnerabilities, the score given to the set of vulnerabilities, and the evaluation function and the objective function. The score integration device described.
When the model includes a constraint condition that the degree of influence of the score of a predetermined viewpoint exceeds a predetermined level among the viewpoints.
The parameter search unit further
The score integration device according to claim 1, wherein the parameters of the model are searched by a mathematical programming method using the constraints.
A score integration method performed by a score integration device,
It is calculated by a model that calculates a score that integrates the priorities ranked by the scores of each viewpoint and the scores of the above viewpoints for a set of vulnerabilities to which two or more scores of different viewpoints are given. As much as possible, maintain the priorities ranked by the scores of the respective perspectives for the set of vulnerabilities using an evaluation function that evaluates how much the priorities are ranked based on the scores. The process of searching for the parameters of the model for calculating the score, and
The process of setting the searched parameters in the model and
A score integration method characterized by including.
It is calculated by a model that calculates a score that integrates the priorities ranked by the scores of each viewpoint and the scores of the above viewpoints for a set of vulnerabilities to which two or more scores of different viewpoints are given. As much as possible, maintain the priorities ranked by the scores of the respective perspectives for the set of vulnerabilities using an evaluation function that evaluates how much the priorities are ranked based on the scores. The process of searching for the parameters of the model for calculating the score, and
The process of setting the searched parameters in the model and
A score integration program that features a computer running.