Presentation Information
[A-7-01]A Proposal for Condition Extraction Technology to Assess the Vulnerability Impact on Products
〇Momoka Kasuya1, Fumiki Yamashita1, Hiroki Yamazaki1, Shugo Mikami1 (1. Hitachi, Ltd.)
Keywords:
Vulnerability Management,AI
The internet connectivity of products has increased the risk of cyberattacks. To ensure product security, it is essential to address newly discovered vulnerabilities during operation. As a common practice for addressing vulnerabilities in IT systems such as PCs, software updates are typically performed when a vulnerability is identified. However, for some products, software updates require significant costs and development man-hours. In such cases, the impact of the vulnerability must be appropriately assessed, and countermeasures should be implemented only for products judged to be genuinely affected. Assessing the impact of vulnerabilities on products requires both product-specific and security knowledge; however, operators may lack sufficient security expertise, leading to challenges in spending significant time interpreting vulnerability information. In this paper, we propose a technique that automatically extracts the conditions for determining the impact of vulnerabilities on products to reduce the time required for impact assessment. As the results, it showed that using GPT-5 provided the highest accuracy in terms of condition extraction.