Risk-based vulnerability threat degree dynamic calculation method

Abstract

The invention discloses a risk-based vulnerability threat degree dynamic calculation method which specifically comprises the following steps: S1, directionally collecting vulnerability data in an NVDand CVE vulnerability database by adopting a crawler engine, carrying out timed incremental updating, taking the vulnerability data as a basic vulnerability database, and carrying out dissociation processing by taking a utilization mode and a CVSS score of the basic vulnerability database as classification directions to obtain a dissociated vulnerability database. The invention relates to the technical field of vulnerability risk level evaluation. Compared with a vulnerability rating standard in a general vulnerability scoring system, the risk-based vulnerability threat degree dynamic calculation method has the advantages that the RTS scoring mode judges the threat degree of the vulnerability according to the standard of 0-3000 scores, so that the threat degree of each vulnerability can bejudged more meticulously; The traditional high, medium and low levels are no longer used as the unique measurement standard of the vulnerability hazard degree.

Description

technical field [0001] The invention relates to the technical field of vulnerability risk level assessment, in particular to a risk-based dynamic calculation method of vulnerability threat degree. Background technique [0002] There are always defects and deficiencies in the design of computer systems. These deficiencies and deficiencies are called loopholes. Vulnerabilities can be exploited by illegal users to obtain system permissions, and then perform illegal operations on the system, causing serious consequences, such as hackers attacking corporate servers. , leading to the paralysis of the enterprise operating system, or stealing the core business, thereby causing economic losses to the enterprise. [0003] In order to better repair the vulnerabilities, it is necessary to perform vulnerability detection on the system, find and fix the vulnerabilities before they are exploited. Usually, a vulnerability scanner is used to detect the target, and the risk level of each vul...

AI Technical Summary

Problems solved by technology

[0004] However, these core features will not change over time, and they will not change in different business systems in different units, which causes the static vulnerability risk program to be incompatible with actual business scenarios and changing trends. The conclusion of the actual risk level, the final score of the vulnerability is not credible, the threat rating is not reliable, and security personnel cannot repair the vulnerability based on the actual data