Vulnerability finding device, vulnerability finding method, and vulnerability finding program

A vulnerability finding method executed by a vulnerability finding device, the vulnerability finding method including:

• an extracting process of extracting a first program code corresponding to a vulnerable part of software;
• a normalization process of performing normalization of a parameter included in the first program code extracted by the extracting process and a second program code of software to be inspected for a vulnerable part;
• and
• a detecting process of performing matching between the first program code after the normalization and the second program code after the normalization, and detecting a program code that is the same as or similar to the first program code, from the second program code.

A non-transitory computer readable storage medium having stored therein a vulnerability finding program for causing a computer to execute a process comprising:

• an extracting step of extracting a first program code corresponding to a vulnerable part of software;
• a normalization step of performing normalization of a parameter included in the first program code extracted by the extracting step and a second program code of software to be inspected for a vulnerable part;
• and
• a detecting step of performing matching between the first program code after the normalization and the second program code after the normalization, and detecting a program code that is the same as or similar to the first program code, from the second program code.