Vulnerability automatic classification method supporting vulnerability correlation mining

Abstract

The invention relates to a vulnerability automatic classification method supporting vulnerability correlation mining, and belongs to the technical field of information security. The method comprises the specific steps of 1, establishing a vulnerability database, and collecting vulnerability records; 2, determining a category of a privilege set; 3, training a classifier; and 4, testing data. Compared with an existing method, the vulnerability automatic classification method supporting the vulnerability correlation mining has the following advantages that (1) a vulnerability classification result is suitable for the vulnerability correlation mining; (2) categories have mutual exclusiveness and the classification is remarkable; and (3) vulnerability automatic classification is realized, so that the classification efficiency is improved and the labor cost is reduced.

Description

Technical field [0001] The invention relates to a method for automatically classifying vulnerabilities supporting vulnerabilities association mining, and belongs to the technical field of information security. Background technique [0002] Network security vulnerability refers to the existence of certain security vulnerabilities in the computer system that may be exploited by malicious subjects (attackers or attack programs), which may cause unauthorized access to system resources or cause other damage to the system. In recent years, mature vulnerability scanning technology and CVE (Common Vulnerabilities&Exposures) standards and Common Vulnerability Scoring System (CVSS) vulnerability rating methods have gradually developed, which can detect and discover vulnerabilities in the network, But it is impossible to analyze the correlation and mutual utilization of the vulnerabilities. The means of attack in network risk is often through related vulnerabilities, cut from one vulnerabi...

AI Technical Summary

Problems solved by technology

[0004] The current vulnerability classification mainly includes the Unix operating system classification method proposed by Aslam of Purdue University’s COAST Laboratory, which is divided into operational failure, environmental failure and coding failure. However, due to the lack of specific quantitative indicators, it is impossible to evaluate the harm level of vulnerabilities; The software vulnerability classification method proposed by Wang Lidong of Harbin Institute of Technology describes the impact of vulnerabilities on security such as confidentiality, integrity, and availability. The generalized classification method proposed by Knight et al. There are four types of vulnerabilities. Due t...

Images