Vulnerability type identification method and device

Abstract

The invention discloses a loophole type recognition method and device, and relates to field of information safety. The loophole type recognition method and device mainly aim at accurately detecting types of loopholes in malware samples, so that a corresponding repair mode is rapidly selected, and the safety of a computer system is protected. According to the main technical scheme, the method comprises the steps of obtaining the type of a file to be detected; according to the type of the file to be detected, inquiring a loophole basic database to obtain loophole detection logic corresponding to the file of the type, wherein the loophole basic database is a known loophole database, each piece of loophole information in the database comprises the file type of the file with a loophole, a loophole serial number and the loophole detection logic, and the loophole serial number and the loophole detection logic are unique and correspond to each other; detecting the file to be detected according to the obtained loophole detection logic; if the loophole is detected, determining the loophole serial number according to the loophole detection logic to obtain the unique loophole. The loophole type recognition method and device are mainly applied to the loophole type recognition process.

Description

technical field [0001] The invention relates to the field of information security, in particular to a vulnerability type identification method and device. Background technique [0002] With the continuous development of computer technology, the degree of informatization of human society is getting higher and higher, and the whole society is more and more dependent on computer information. At the same time, the loopholes of computer programs are constantly increasing, and the security risks have reached unprecedented heights. Once the loopholes are discovered, attackers can use these loopholes to obtain additional permissions of the computer system, enabling the attacker to access or destroy the system without authorization, thus endangering the security of the computer system. [0003] In order to be able to identify the types of vulnerabilities in time so as to perform timely repairs, various solutions have been devised. The currently commonly used technical solution is: ...

AI Technical Summary

Problems solved by technology

However, since the currently set vulnerability detection rules are relatively broad rules, one rule can identify dozens or even hundreds of vulnerability types, and cannot accurately detect the types of vulnerabilities in malicious samples, so that it is impossible to quickly select the corresponding repair method , the security of the computer system cannot be guaranteed

Images