US 12,147,543 B2
Vulnerability management system and vulnerability management method
Takafumi Takahashi, Tokyo (JP)
Assigned to HITACHI, LTD., Tokyo (JP)
Filed by Hitachi, Ltd., Tokyo (JP)
Filed on Sep. 22, 2022, as Appl. No. 17/950,609.
Claims priority of application No. 2021-202570 (JP), filed on Dec. 14, 2021.
Prior Publication US 2023/0185924 A1, Jun. 15, 2023
Int. Cl. G06F 21/57 (2013.01)
CPC G06F 21/577 (2013.01) [G06F 2221/034 (2013.01)] 6 Claims
OG exemplary drawing
 
1. A vulnerability management system including a processor and a memory, comprising:
an impact factor calculation part configured to calculate an impact factor based on vulnerability information, the impact factor being a parameter indicating a magnitude of an impact of a vulnerability of a container in an application execution system, in which an application is executed by one or a plurality of containers, on the application execution system, the vulnerability information being information in which the vulnerability and an evaluation value of the vulnerability are associated with each other;
an access frequency factor calculation part configured to calculate an access frequency factor based on access frequency information, the access frequency factor being an evaluation value of a vulnerability deriving from a form of communication performed by the container, the access frequency information being information indicating a transmission or reception range and a transmission or reception frequency of data transmitted or received by the container obtained by monitoring contents of transmission and reception of data transmitted and received by the container;
a weighting determination value calculation part configured to calculate a weighting determination value based on the calculated impact factor and the calculated access frequency factor, the weighting determination value indicating priorities of measures against the vulnerability of the container, the measures being security updates of the container to resolve the vulnerability; and
a scheduling processing part configured to determine the order of the measures, respectively, for a plurality of the containers based on the weighting determination values calculated for the plurality of containers and execute the measures, respectively, for the plurality of containers according to the determined order, and execute the measures, being the security updates, respectively, for the plurality of containers according to the determined order of measures.