Vulnerability management system and vulnerability management method

A vulnerability management system calculates an impact factor based on vulnerability information, which indicates a magnitude of an impact of a vulnerability of a container in an application execution system on the application execution system. The vulnerability information is information in which the vulnerability and an evaluation value thereof are associated with each other. An access frequency factor is calculated based on access frequency information, the access frequency factor being an evaluation value of a vulnerability deriving from a form of communication performed by the container. The access frequency information is related to a transmission or reception range and a transmission or reception frequency of data of the container. A weighting determination value is calculated based on the impact factor and the access frequency factor, the weighting determination value indicating a priority of a measure against the vulnerability of the container; and the order of measures is determined.

CROSS-REFERENCE TO RELATED APPLICATION

This application claims priority pursuant to Japanese patent application No. 2021-202570, filed on Dec. 14, 2021, the entire disclosure of which is incorporated herein by reference.

BACKGROUND

Technical Field

The present invention relates to a vulnerability management system and a vulnerability management method.

Related Art

An application execution platform (for example, Kubernetes) using a container technology is widely used and, in the application execution platform, multiple applications operate in cooperation with one another. Moreover, in recent years, due to increasing interest in security measures, there is an attempt to incorporate existing continuous integration/continuous delivery (CI/CD) in the application execution platform to perform such an operation that security update of containers is performed with services stably running (so-called DevSecOps).

As a technique relating to update of containers, for example, Japanese Patent Application Publication No. 2019-56986 discloses the following configuration. A batch job analysis part of a verification apparatus analyzes a batch job assigned to a production server before execution of the batch job to identify a container image to be used, a container image information collection part refers to a container image registry to collect version information of the container image, a container image verification management part executes the batch job in a verification server when a new version of the container image to be used by the batch job is released, and a monitor verification part performs at least one of monitoring of performance information during execution of the batch job executed in the verification server and verification of the execution result.

However, in such an application execution platform, there is a case where vulnerabilities are found in multiple containers and security update needs to performed for these containers but the application execution platform has no free resources. In such a case, a security administrator needs to adjust a schedule of the update for the containers and there is a latency before start of the update for each container. Thus, there is a risk of occurrence a security incident due to delay in measures against the vulnerabilities.

SUMMARY

The present invention has been made in view of such backgrounds and an object thereof is to provide a vulnerability management system and a vulnerability management method that can efficiently resolve vulnerabilities when the vulnerabilities are present in multiple containers of an application execution system.

An aspect of the present invention to solve the above object is a vulnerability management system including a processor and a memory, comprising: an impact factor calculation part configured to calculate an impact factor based on vulnerability information, the impact factor being a parameter indicating a magnitude of an impact of a vulnerability of a container in an application execution system, in which an application is executed by one or a plurality of containers, on the application execution system, the vulnerability information being information in which the vulnerability and an evaluation value of the vulnerability are associated with each other; an access frequency factor calculation part configured to calculate an access frequency factor based on access frequency information, the access frequency factor being an evaluation value of a vulnerability deriving from a form of communication performed by the container, the access frequency information being information related to a transmission or reception range and a transmission or reception frequency of data transmitted or received by the container; a weighting determination value calculation part configured to calculate a weighting determination value based on the calculated impact factor and the calculated access frequency factor, the weighting determination value indicating a priority of a measure against the vulnerability of the container; and a scheduling processing part configured to determine the order of measures, respectively, for a plurality of the containers based on the weighting determination values calculated for the plurality of containers and execute the measures, respectively, for the plurality of containers according to the determined order.

Another aspect of the present invention to solve the above object is a vulnerability management method implemented by an information processing apparatus to execute processing comprising: impact factor calculation processing of calculating an impact factor based on vulnerability information, the impact factor being a parameter indicating a magnitude of an impact of a vulnerability of a container in an application execution system, in which an application is executed by one or a plurality of containers, on the application execution system, the vulnerability information being information in which the vulnerability and an evaluation value of the vulnerability are associated with each other; access frequency factor calculation processing of calculating an access frequency factor based on access frequency information, the access frequency factor being an evaluation value of a vulnerability deriving from a form of communication performed by the container, the access frequency information being information related to a transmission or reception range and a transmission or reception frequency of data transmitted or received by the container; weighting determination value calculation processing of calculating a weighting determination value based on the calculated impact factor and the calculated access frequency factor, the weighting determination value indicating a priority of a measure against the vulnerability of the container; and a scheduling processing of determining the order of measures, respectively, for a plurality of the containers based on the weighting determination values calculated for the plurality of containers and executing the measures, respectively, for the plurality of containers according to the determined order.

The present invention can efficiently resolve vulnerabilities when the vulnerabilities are present in multiple containers of an application execution system.

Problems, configurations, and effects other than those described above will be made apparent by the description of the following embodiment.

DETAILED DESCRIPTION OF EMBODIMENTS

One embodiment of the present invention is described below.

FIG.1is a diagram illustrating an example of a configuration of an application management system1according to the present embodiment. The application management system1is configured to include information processing apparatuses of an application execution platform10, an application monitoring system20, a CD server30, a vulnerability management system40, a CI system50, a host apparatus60, and a vulnerability information providing system70.

The application execution platform10is an application execution system in which various applications are executed by a container technology. Specifically, the application execution platform10includes programs including one or multiple applications12that are each formed of one or multiple containers11and a load balancer13that is used to distribute loads of the respective applications12. Moreover, the application execution platform10stores an operating system (OS)14for executing these applications (programs). The application execution platform10is, for example, Kubernetes. Note that the container herein refers in general to data in which an execution environment of an application (program) is stored.

The application monitoring system20monitors the states of the applications12and the containers11in the application execution platform10. The application monitoring system20includes a traffic management server21, a statistics management server22, and an access record management server23.

The traffic management server21monitors contents of communications (exchange of data) performed by the applications12and the containers11, for example, communications performed in the applications12and between the applications12and communications performed with application execution systems other than the application execution platform10, and accumulates information (hereinafter, referred to as traffic information) on histories of these communications. The statistics management server22performs various types of statistical processing in the application monitoring system20. The access record management server23accumulates a history on a total number of accesses of each container (hereinafter, simply referred to as container access number) in a predetermined period, repeatedly at a predetermined timing (for example, predetermined time or predetermined time interval).

The CD server30(CD: continuous delivery) deploys the containers11(applications12) to the application execution platform10based on resources created by the CI system50.

The vulnerability management system40performs management against vulnerability of the applications12(containers11). The vulnerability management system40includes a weighting determination server41and a scheduling server42. The weighting determination server41calculates weighting determination values that are parameters used to determine priority ranks of measures against vulnerabilities found in the applications12(containers11). The scheduling server42performs vulnerability resolving measure processing on the containers11according to the weighting determination values. Details of the vulnerability management system40are described later.

The CI system50(CI: continuous integration) is an information processing system that creates resources forming the applications12and that can monitor the vulnerability of each of containers11in the host apparatus60. The CI system50includes a source code library management server51and a CI server52. The source code library management server51stores the resources (source codes, libraries, and the like) of the containers. The CI server52monitors presence or absence of the vulnerability of each container in the host apparatus60. Moreover, the CI server52obtains the resources from the source code library management server51and creates (builds) images of the containers based on the obtained resources. Note that the building of the containers by the CI system50may be performed automatically or performed based on an operation on the CI system50by an administrator.

The host apparatus60is an apparatus used by a user using the applications12in the application execution platform10. The host apparatus60stores a container61of the applications provided by the application execution platform10. Multiple host apparatuses60may be present.

The vulnerability information providing system70accumulates and manages various pieces of vulnerability information on the containers. The vulnerability information providing system70includes a vulnerability disclosure server71and a vulnerability management server72. The vulnerability disclosure server71stores information (hereinafter, referred to as vulnerability disclosure information) on the vulnerabilities of the containers. Moreover, the vulnerability management server72can transmit the vulnerability disclosure information to the vulnerability management system40. Note that the vulnerability disclosure server71may be a server that provides the vulnerability disclosure information to an information processing system outside the application management system1.

The aforementioned information processing apparatuses in the application management system1can communicate with one another via a wired or wireless communication network such as, for example, the Internet, local area network (LAN), wide area network (WAN), or an exclusive line.

Next, details of the vulnerability management system40are described.

FIG.2is a diagram for explaining an example of functions included in the weighting determination server41. The weighting determination server41includes an impact factor calculation part411, an access frequency factor calculation part412, and a weighting determination value calculation part413.

The impact factor calculation part411calculates an impact factor based on vulnerability information (vulnerability information management DB100to be described later), impact factor being a parameter indicating a magnitude of an impact of the vulnerability of each container11in the application execution platform10, in which applications are executed by one or multiple containers, on the application execution platform10, the vulnerability information being information in which the vulnerability and a predetermined evaluation value of the vulnerability are associated with each other. The impact factor is recorded in an impact factor DB130to be described later.

The access frequency factor calculation part412calculates an access frequency factor based on access frequency information (recorded in an access frequency management DB140to be described later), the access frequency factor being an evaluation value of a vulnerability deriving from a form of communication performed by each container11, the access frequency information being information related to either a transmission or reception range and a transmission or reception frequency of data transmitted or received by the container11. The access frequency factor is recorded in an access frequency factor management DB160to be described later. Note that the access frequency information is created by using the traffic information of the traffic management server21. The traffic information is recorded in a traffic management DB120to be described later.

The weighting determination value calculation part413calculates the weighting determination values indicating the priorities of measures against the vulnerabilities of the containers11, based on the impact factors and the access frequency factors. The weighting determination values are recorded in a weighting determination DB150to be described later.

Moreover, the weighting determination server41stores databases of a category-by-category risk impact factor DB110and a severity management DB170.

The category-by-category risk impact factor DB110stores weight parameters (hereinafter, referred to as category-by-category risk impact factors) used to calculate the impact factors. The severity management DB170stores information (hereinafter, referred to as severity) obtained by categorizing the impact factors. Details of the category-by-category risk impact factor DB110and the severity management DB170are described later.

FIG.3is a diagram for explaining an example of functions included in the scheduling server42. The scheduling server42includes a process priority factor determining part421and a scheduling processing part422.

The process priority factor determining part421determines a process priority that is information on a priority rank of a process performed by each container11in the application execution platform10, based on the container access number in the access record management server23.

The scheduling processing part422determines the order of measures for the respective multiple containers11based on the weighting determination values calculated for the multiple containers11and executes the measures for the respective multiple containers11according to the determined order.

Moreover, the scheduling server42stores databases of an access recording DB200and a priority recording DB210.

The access recording DB200stores histories of accesses of the respective processes by the containers11in each application12of the application execution platform10. Moreover, the priority recording DB210stores the priorities of the processes executed by the containers11in each application12. Details of the access recording DB200and the priority recording DB210are described later.

FIG.4is a diagram illustrating an example of hardware included in each of the information processing apparatuses of the application management system1. Each information processing apparatus includes a processing device91(processor) such as a central processing unit (CPU), a digital signal processor (DSP), a graphics processing unit (GPU), or a field-programmable gate array (FPGA), a main storage device92(memory) such as a read only memory (ROM) or a random access memory (RAM), an auxiliary storage device93such as a hard disk drive (HDD) or a solid state drive (SSD), an input device94formed of a mouse, a keyboard, and the like, an output device95formed of a liquid crystal display or an organic electro-luminescence (EL) display, and a communication device96formed of a network interface card (NIC), a wireless communication module, a Universal Serial Interface (USB) module, a serial communication module, or the like.

The processing device91reads and executes a program stored in the main storage device92or the auxiliary storage device93to implement functions of each information processing apparatus. Moreover, this program may be, for example, recorded in a recording medium and distributed. Note that each information processing apparatus may be, for example, an apparatus that is entirely or partially implemented by using virtual information processing resources provided by using virtualization techniques, process space isolation techniques, and the like such as a virtual server provided by a cloud system. Moreover, all or some of the functions provided by each information processing apparatus may be implemented by, for example, a service provided by a cloud system via an application programming interface (API) or the like.

Next, an outline of processing performed by the application management system1is described.

FIG.5is a flowchart for explaining the outline of the processing performed by the application management system1.

First, the vulnerability management system40executes weighting determination value determining processing s1in which the weighting determination value related to the vulnerability of each container11(application12) is determined, as needed. Moreover, the vulnerability management system40executes process priority factor determining processing s3in which a process priority factor of the process of each container11is determined, as needed.

When a vulnerability is found in one or multiple containers11, the vulnerability management system40executes scheduling processing s5. Specifically, the vulnerability management system40determines the order of vulnerability resolving processing by using the weighting determination values determined in the weighting determination value determining processing s1and performs measures (security update) against the vulnerabilities of the respective containers11while increasing free resources based on the weighting determination values and the process priority factors determined in the process priority factor determining processing s3as necessary.

Note that the processing described above is repeatedly executed.

Next, this processing is described.

FIG.6is a flowchart for explaining an example of the weighting determination value determining processing s1. The weighting determination value determining processing s1is executed at a timing specified by the user or a predetermined timing (for example, predetermined time or predetermined time interval).

First, the weighting determination server41creates the vulnerability information management DB100(s11).

Specifically, first, the weighting determination server41receives the vulnerability disclosure information from the vulnerability management server72. Then, the weighting determination server41stores the received vulnerability disclosure information in the vulnerability information management DB100.

The vulnerability disclosure information includes, for example, an evaluation value of each vulnerability (in the present embodiment, the evaluation value is assumed to be a common vulnerability scoring system (CVSS) score that is an evaluation value of a vulnerability calculated by a predetermined CVSS), a host category-by-host category impact degree (varying depending on the category of the host apparatus60as described later) that is an index of a magnitude of an impact of the vulnerability on the application execution platform10, and information on a method of handling the vulnerability.

The weighting determination server41may display the vulnerability disclosure information received from the vulnerability management server72on a predetermined screen and receive an input of data related to the vulnerability information management DB100from the user or automatically create the vulnerability information management DB100by using a predetermined algorithm based on the received vulnerability disclosure information.

FIG.7is a diagram illustrating an example of the vulnerability information management DB100. The vulnerability information management DB100stores the vulnerability information created based on the vulnerability disclosure information. Specifically, the vulnerability information management DB100includes data items of vulnerability101, CVSS score102, host category-by-host category impact degree103, and handling method104.

Information on the types of vulnerabilities is set in the vulnerability101. Information on the CVSS scores of the vulnerabilities are set in the CVSS score102. The host category-by-host category impact degrees of the vulnerabilities are set in the host category-by-host category impact degree103. Information identifying methods of handling the vulnerabilities (methods of update) are set in the handling method104.

One or multiple host category-by-host category impact degrees are set in the host category-by-host category impact degree103. Each of the host category-by-host category impact degrees is information indicating a magnitude of an impact of a vulnerability on the application execution platform10in levels. Moreover, the host category-by-host category impact degree is set for each of categories of the host apparatus60. The categories include, for example, a “public server” that exchanges data with a container system other than the application execution platform10and an “internal server” that exchanges data only with an application or a container in the application execution platform10.

Next, as illustrated inFIG.6, the weighting determination server41creates the traffic management DB120(s13).

Specifically, the weighting determination server41receives a history of communication (traffic information) related to each container11in the application execution platform10from the access record management server23and creates the traffic management DB120based on the received traffic information.

FIG.8is a diagram illustrating an example of the traffic management DB120. The traffic management DB120includes data items of application121, inbound communication122, and outbound communication123.

Information identifying each of the containers in each of the applications is set in the application121.

Various pieces of information are set in the inbound communication122when the container indicated by the application121performs inbound communication. Specifically, the inbound communication122includes data sub-items of out-of-company1221, in-company1222, cluster1223, and local1224. A symbol of “∘” is set in the out-of-company1221when the container indicated by the application121performs out-of-company communication of receiving data from the outside of the company (container system other than the application execution platform10) as the inbound communication. A symbol of “∘” is set in the in-company1222when the container indicated by the application121performs in-company communication of receiving data from another application in the company (in the application execution platform10) as the inbound communication. A symbol of “∘” is set in the cluster1223when the container indicated by the application121performs in-cluster communication of receiving data from another application in the company as the inbound communication. A symbol of “∘” is set in the local1224when the container indicated by the application121performs local communication of receiving data from the same application as the inbound communication.

Various pieces of information are set in the outbound communication123when the container indicated by the application121performs outbound communication. Specifically, the outbound communication123includes data sub-items of out-of-company1231, in-company1232, cluster1233, and local1234. A symbol of “∘” is set in the out-of-company1231when the container indicated by the application121performs out-of-company communication as the outbound communication. A symbol of “∘” is set in the in-company1232when the container indicated by the application121performs in-company communication as the outbound communication. A symbol of “∘” is set in the cluster1233when the container indicated by the application121performs in-cluster communication as the outbound communication. A symbol of “∘” is set in the local1234when the container indicated by the application121performs local communication as the outbound communication.

Next, as illustrated inFIG.6, the weighting determination server41calculates the impact factor of each container based on the traffic management DB120created in s13and the vulnerability information management DB100created in s11(s15).

Specifically, the weighting determination server41identifies the form of communication performed by each container based on the traffic management DB120to identify the category of the host apparatus60. Then, the weighting determination server41identifies the host category-by-host category impact degree based on the vulnerability information management DB100and the category-by-category risk impact factor DB110. The weighting determination server41calculates the impact factor of each container by referring to the vulnerability information management DB100and multiplying the CVSS score of the vulnerability of the container by the category-by-category risk impact factor of this container calculated as described above (s17). The weighting determination server41sets information on the calculated impact factor in the impact factor DB130.

For example, the weighting determination server41refers to the traffic management DB120and refers to the pieces of data of the out-of-company1221of the inbound communication122and the out-of-company1231of the outbound communication123in records related to a certain container and identifies that this container performs the out-of-company communication. Then, the weighting determination server41obtains the content of the host category-by-host category impact degree103in a record related to a certain vulnerability A in the vulnerability information management DB100. The weighting determination server41thereby identifies that the category of the host apparatus60related to this container is the “public server” that performs the out-of-company communication and that the host category-by-host category impact degree for the “public server” is “high”. The weighting determination server41refers to the category-by-category risk impact factor DB110(described in the next section) to identify that the host category-by-host category impact factor corresponding to the host category-by-host category impact degree “high” is “1.5”. Then, the weighting determination server41obtains a CVSS score “6.3” from the CVSS score102of the record in the vulnerability information management DB100described above. The weighting determination server41multiplies the CVSS score “6.3” by the category-by-category risk impact factor “1.5” to calculate the impact factor related to the vulnerability A of this container.

(Category-by-Category Risk Impact Factor DB)

FIG.9is a diagram illustrating an example of the category-by-category risk impact factor DB110. The category-by-category risk impact factor DB110includes data items of number111, risk impact degree112, and factor113. Record numbers are set in the number111. The host category-by-host category impact degrees are set in the risk impact degree112. Information on the category-by-category risk impact factors corresponding to the respective host category-by-host category impact degrees is set in the factor113.

FIG.10is a diagram illustrating an example of the impact factor DB130. The impact factor DB130includes data items of application131and vulnerability132.

Information identifying each container in each application is set in the application131. The vulnerability132includes data sub-items of total1321and category1322. A total of the impact factors of all vulnerabilities of each container is set in the total1321. The impact factors related to the respective vulnerabilities of each container are set in the category1322.

Next, as illustrated inFIG.6, the weighting determination server41creates the access frequency factor management DB160(s17).

Specifically, the weighting determination server41first receives the history of communication (container access number) related to each container11in the application execution platform10from the access record management server23and creates the access frequency management DB140based on the received container access number.

FIG.11is a diagram illustrating an example of the access frequency management DB140. The access frequency management DB140includes data items of application141, inbound communication142, and outbound communication143and data sub-items for these data items similar to those in the traffic management DB120. Note that the access frequency information on the inbound communication or the outbound communication is set in each data sub-item of the access frequency management DB140. For example, an average value of frequency of communication that has occurred in the past seven days is set in each data sub-item.

Then, the weighting determination server41refers to the created access frequency management DB140to identify the form of communication performed by each container and calculates the access frequency factor of the container based on the identified form of communication and the access frequency information.

For example, the weighting determination server41classifies the containers into a category of containers that perform the inbound communication and a category of containers that perform the outbound communication and sets the access frequency factors such that the access frequency factor of the containers that perform the inbound communication is smaller than the access frequency factor of the containers that perform the outbound communication (set the rank of the category of the inbound communication higher than that of the outbound communication). Moreover, the weighting determination server41further categorizes the containers in each category into a sub-category of containers that perform the out-of-company communication, a sub-category of containers that perform the in-company communication, a sub-category of containers that perform the in-cluster communication, and a sub-category of containers that perform the local communication and sets the access frequency factors of the respective sub-categories such that the sub-category of the out-of-company communication has the smallest access frequency factor, the in-company communication the second, the in-cluster communication the third, and the local communication the largest (the sub-category of the out-of-company communication has the highest rank, the in-company communication the second, the in-cluster communication the third, and the local communication the lowest). The weighting determination server41sets the access frequency factors in each sub-category in such an order that the higher the access frequency is, the smaller the access frequency factor is (the higher the rank is). As described above, the priority ranks are set such that 1. “inbound communication>outbound communication”, 2. “out-of-company communication>in-company communication>in-cluster communication>local communication”, and 3. in the order of access frequency.

(Access Frequency Factor Management DB)

FIG.12is a diagram illustrating an example of the access frequency factor management DB160. The access frequency factor management DB160includes data items of application161, inbound communication162, and outbound communication163and data sub-items for these data items similar to those in the access frequency management DB140. Information on the access frequency factor is set in each data sub-item of the access frequency factor management DB160. In the embodiment, the access frequency factor is assumed to be expressed as a numerical value of priority rank and indicate that the smaller numerical value is, the more preferentially the measure against the vulnerability is to be performed.

Next, as illustrated inFIG.6, the weighting determination server41calculates the weighting determination value of each container based on the impact factor calculated in s15and the access frequency factor calculated in s17for the container (s19). The weighting determination server41records information on the weighting determination value of each container in the weighting determination DB150.

Specifically, first, for each container, the weighting determination server41refers to the severity management DB170to identify the category of the severity corresponding to each of the impact factors (impact factors related to all vulnerabilities of the container) calculated in s15. Then, the weighting determination server41classifies the containers depending on the severity and sets the weighting determination values such that a container with a higher severity has a smaller weighting determination value (higher priority rank).

Then, the weighting determination server41refers to the access frequency factor management DB160and sets the weighting determination values such that, in each category of severity, a container with a smaller access frequency factor (higher priority rank) has a smaller weighting determination value (higher priority rank).

FIG.13is a diagram illustrating an example of the severity management DB170. The severity management DB170includes data items of severity171and score172. Information on the categories of the severity is set in the severity171. Information on ranges of the impact factor corresponding to the severity171is set in the score172. Note that, in the present embodiment, one of “urgent”, “serious”, “alert”, “caution”, and “none” which are in the descending order of severity (descending order of priority of measures against vulnerability) is assumed to be set in the severity171.

FIG.14is a diagram illustrating an example of the weighting determination DB150. The weighting determination DB150includes data items of application151, weighting determination value152, and category153.

Information identifying each container in each application is set in the application151. The weighting determination values of the respective containers are set in the weighting determination value152. Information on the categories of the severity of the respective containers is set in the category153. In the present embodiment, the weighting determination values of the respective containers are set such that a container in a category with a higher severity has a smaller weighting determination value (higher priority) and, in each category, a container with a larger access frequency factor has a smaller weighting determination value. When there are vulnerabilities in multiple containers, the weighting determination values are reflected as the order of vulnerability resolving processing.

Next, processing performed by the scheduling server is described.

FIG.15is a flowchart for explaining an example of the process priority factor determining processing s3. The process priority factor determining processing s3is executed at a timing specified by the user or a predetermined timing (for example, predetermined time or predetermined time interval).

The process priority factor determining part421of the scheduling server42obtains information on the container access numbers stored in the access record management server23and creates or updates the access recording DB200based on the obtained information (s31).

FIG.16is a diagram illustrating an example of the access recording DB200. The access recording DB200includes one or multiple records having data items of record number201, process202, and access number203.

Numbers assigned to the records are set in the record number201. Information identifying the processes of the respective containers is set in the process202. A history of the access numbers related to each of the processes are set in the access number203. Specifically, the container access numbers in the last predetermined times of recording among the container access numbers recorded at the respective timings by the access record management server23are set in the access number203.

Moreover, as illustrated inFIG.15, the process priority factor determining part421creates or updates the priority recording DB210based on the access recording DB200created or updated in s31(s33). The process priority factor determining processing s3is thus completed.

Specifically, the process priority factor determining part421creates or updates the priority recording DB210by increasing the process priority factor of a process of a container whose access number is statistically large at the present moment or in the near future and decreasing the process priority factor of a process of a container whose access number is statistically small at the present moment or in the near future.

For example, the process priority factor determining part421identifies a process with the largest access number and a process with the smallest access number for each of the last predetermined number of times of access recording recorded in the access record management server23to identify a process (hereinafter, referred to as highest frequency process) whose access number has been the largest the most number of times in the last predetermined number of times of access recording and a process (hereinafter, referred to as lowest frequency process) whose access number has been the smallest the most number of times in the last predetermined number of times of access recording. The process priority factor determining part421replaces the process priority factor of the highest frequency process identified in the previous same processing with the process priority factor of the highest frequency process identified in the present processing. Moreover, the process priority factor determining part421replaces the process priority factor of the lowest frequency process in the previous processing with the process priority factor of the lowest frequency process identified in the present processing.

FIG.17is a diagram illustrating an example of the priority recording DB210. The priority recording DB210includes data items of record number211, process212, and priority factor213. Information on numbers assigned to records is set in the record number211. Information identifying each process of each container is set in the process212. Information on a history of the process priority factor of each process is set in the priority factor213.

Next,FIG.18is a flowchart for explaining an example of the scheduling processing s5. The scheduling processing s5is executed, for example, when a vulnerability is detected in one or multiple containers in the application. Note that, in this example, the scheduling server42is assumed to have identified the priorities (processing order) of the containers for which vulnerabilities are to be resolved by referring to the weighting determination DB150created in the weighting determination value determining processing s1.

The scheduling processing part422of the scheduling server42determines whether there are currently enough free resources in the application execution platform10to perform processing of resolving the vulnerabilities of the containers (application) (s51). For example, the scheduling processing part422obtains information on the resources of the application execution platform10at the moment and determines whether the resources exceed a predetermined threshold. Note that this threshold may be a constant value or a value that varies depending on various elements such as resources currently operating in the application execution platform10or the number of containers with vulnerabilities.

When there are enough free resources (s51: YES), the scheduling processing part422executes processing of s53. When there are not enough free resources (s51: NO), the scheduling processing part422executes processing of s57.

In s57, the scheduling processing part422obtains the process priority factor of each process of each container from the priority recording DB210.

Then, the scheduling processing part422determines whether each process is to be degenerated (the number of redundancies of the process is to be reduced) based on the process priority factor of the process obtained in s57(s59). Specifically, the scheduling processing part422determines whether the process priority factor obtained in s57is equal to or smaller than a predetermined threshold (for example, 30) for each process.

When there is a process to be degenerated (the number of redundancies of the process is to be reduced) (s59: YES), the scheduling processing part422executes processing of s61for this process. When there is no process to be degenerated (the number of redundancies of the process is not to be reduced) (s59: NO), the scheduling processing part422repeats the processing of s51.

In s61, the scheduling processing part422reduces the number of redundancies of the process to achieve degeneration. Note thatFIG.19illustrates an example of an application programming interface (API) command for causing the application execution platform10to execute the degeneration. Free resources in the application execution platform10are thereby increased. Note that the scheduling processing part422may later return the number of redundancies of the degenerated process to the original number when the resolving of the vulnerability is completed.

Then, the scheduling processing part422reflects the configuration of the container for which the process is degenerated, in the application execution platform10(s63). For example, the CD server30executes processing of deploying the container to the application execution platform10, processing of executing a verification of the application related to the deployed container, and processing of switching the original application to the application for which the verification is successfully executed, based on instructions from the scheduling processing part422. Procedures of the processing of container deploying, the processing of verification execution, and the processing of switching are described in processing of s53to be described next. Thereafter, the processing of s51is repeated.

Meanwhile, in s53, the scheduling processing part422executes the processing of deploying, the processing of verification execution, and the processing of switching for the container of the application that has vulnerability as described below.

Specifically, first, the scheduling processing part422obtains contents (handling method) of update processing for resolving the vulnerability of the container of the application, from the vulnerability information management DB100.

Then, the scheduling processing part422instructs the CI server52to obtain resources necessary for achieving the obtained handling method. The CI server52obtains the resources from the source code library management server51and builds (creates) an image of the container based on the obtained resources. Note that this processing may be executed in advance before the execution of the scheduling processing s5(for example, when the vulnerability is detected).

The CD server30deploys the built image of the container to the application execution platform10. For example, the CD server30temporarily moves an application (for example, Pod) operating on an OS to be updated to another OS and then executes update of the OS. Update can be thereby executed without stopping services of the application execution platform10.

After completion of this deploying, the CD server30executes a verification of each application on the application execution platform10for a predetermined time. After the execution of the verification, when the CD server30determines that the verification is successfully executed, the CD server30switches an image of a currently-present container to the image of the container deployed to the application execution platform10.

Then, the scheduling processing part422determines whether there is an image of a container for which a vulnerability is to be resolved next (container with the next highest priority rank) (s55). Next, when there is an image of a container for which a vulnerability is to be resolved next (s55: YES), the scheduling processing part422repeats the processing of s51. When there is no image of a container for which a vulnerability is to be resolved next (s55: NO), the scheduling processing s5is terminated (s65).

Although methods of updating, deploying, and releasing the containers11of the application execution platform10are not limited to particular methods, the CD server30is assumed to execute the verification and the deploying based on dark canary release (DCR) and progressive delivery (PD) in the present embodiment. DCR is a method of performing update and release only for predetermined developers. This allows release to be performed surely and safely without an impact on the application execution platform10. PD is a deploying method in which, as a step subsequent to the continuous delivery (CD), predetermined analysis (analysis such as verification of accuracy rate and performance) is performed and automatic rollback is performed depending on a result of the predetermined analysis (result of the verification performed by some users) before release to all users.FIG.20illustrates an example of DCR. Note that the methods of updating and releasing may be other methods such as, for example, A/B test or canary release (CR).

As described above, the vulnerability management system40of the present embodiment calculates the impact factor that indicates the magnitude of the impact of the vulnerability of each container11in the application execution platform10on the application execution platform10, based on the vulnerability information, calculates the access frequency factor based on the access frequency information of each container, calculates the weighting determination value that indicates the priority of the measure against the vulnerability of each container based on the impact factor and the access frequency factor, determines the order of measures for the respective multiple containers based on the weighting determination values calculated for the respective multiple containers, and executes the measures for the respective multiple containers according to the determined order.

Specifically, the vulnerability management system40of the present embodiment determines the priorities of resolving the vulnerabilities of the respective containers (application) from the viewpoint of the impact on the system and the priorities of the processes (weighting determination values) and resolves the vulnerabilities of the respective containers according to the order determined by using the weighting determination values.

As described above, when there are multiple vulnerabilities in the application execution system, the vulnerability management system40according to the present embodiment can efficiently resolve these vulnerabilities.

Moreover, the vulnerability management system40of the present embodiment calculates the process priority of each container based on the data access frequency of the container and, when the calculated process priority is equal to or smaller than the predetermined threshold, degenerates a process of the container related to this process priority and then executes the measures for the respective containers according to the order determined as described above by using the weighting determination values.

Increasing free resources of the application execution platform10by degenerating a process with a low priority (reducing the number of redundancies) as described above enables the processing of resolving the vulnerabilities of the respective containers to be performed quickly.

Moreover, the vulnerability management system40of the present embodiment calculates the access frequency factor by setting the priority ranks for data transmission and data reception of the container (priority ranks for the inbound communication and the outbound communication) and by setting the priority ranks according to whether the range in which the container transmits or receives data is in the same application (local communication), another application in the application execution platform10(in-cluster communication), or another application execution system (out-of-company communication).

Calculating the access frequency factor based on the form of communication in the application execution platform10and the application allows the priority ranks of the measures against vulnerabilities to be determined according to magnitudes of risks of data communication.

The present invention is not limited to the aforementioned embodiment and can be carried out by using any component within a scope not departing from the gist of the present invention. The embodiment and modified examples described above are merely examples and the present invention is not limited to the contents of these embodiment and modified examples as long as the features of the invention are not impaired. Moreover, although various embodiment and modified examples are described above, the present embodiment is not limited to the contents of these embodiment and modified examples. Other modes conceivable within the scope of the technical idea of the present invention are also included in the scope of the present invention.

Moreover, some of functions included in each apparatus in the present embodiment may be provided in another apparatus and functions included in separate apparatuses may be provided in the same apparatus.

Moreover, the formulae for calculating the impact factor and the access frequency factor described in the present embodiment are examples, and any formula or parameter may be added or modified. Furthermore, the evaluation value of vulnerability may be an evaluation value other than the CVSS score.