Network security vulnerability scanning method and priority evaluation method thereof

Abstract

The invention relates to the technical field of network security, and discloses a network security vulnerability scanning method and a priority evaluation method thereof, and the network security vulnerability scanning method comprises the steps: obtaining internal and external information of a target system, generating a preliminary vulnerability list through matching, screening a target vulnerability according to a preset rule, and verifying vulnerability existence. According to the priority evaluation method for network security vulnerability scanning, the hazard index and the system state quantized value of the vulnerability are comprehensively evaluated, the final priority score is generated, the vulnerability needing to be processed preferentially is determined according to the priority ranking list, and the repair work is guided. By adopting the method and the device, efficient and accurate vulnerability scanning and priority evaluation are realized, the scanning efficiency and the detection precision are remarkably improved, the false alarm rate and the repair cost are effectively reduced, meanwhile, the dynamic adaptability is relatively high, the strategy can be optimized in real time according to the system load and the network environment change, and a comprehensive guarantee is provided for the network security.

Description

Technical Field

[0001] This application relates to the field of network security technology, and specifically to a network security vulnerability scanning method and its priority evaluation method. Background Art

[0002] With the rapid development of network technology, the need for detecting and fixing network security vulnerabilities has become increasingly urgent. In the prior art, Patent CN119172181B proposed a vulnerability scanning system that combines internal and external scanning. It jointly checks for vulnerabilities through an external scanning engine and an internal monitoring module. However, it lacks a mechanism for dynamically adjusting the scanning priority, resulting in high-priority vulnerabilities that may not be processed in a timely manner in a complex network environment, and the resource allocation efficiency is relatively low. Another patent, CN117318988B, discloses an automated scanning and early warning management system based on big data. It optimizes resource allocation by evaluating the similarity of network components and the scanning time coefficient, but lacks a comprehensive analysis of multi-dimensional data, resulting in incomplete scanning results, difficulty in adapting to a real-time changing network environment, and insufficient accuracy and timeliness of vulnerability matching. In addition, the existing methods generally have the following problems:

[0003] Scanning efficiency issue: Traditional methods usually conduct a comprehensive scan of all components, consuming a large amount of time and computing resources, which affects the normal operation of the business.

[0004] Insufficient priority evaluation: The existing technology is relatively simple in evaluating the priority of vulnerabilities and does not fully consider the real-time state of the system, the severity of the vulnerabilities, and environmental factors, making it difficult to effectively guide the repair work.

[0005] Poor dynamic adaptability: Most solutions fail to dynamically adjust the scanning strategy according to changes in system load and network environment, resulting in unreasonable scanning timing.

[0006] Therefore, there is an urgent need for a network security vulnerability scanning method and evaluation mechanism that can dynamically adjust the priority, integrate internal and external scanning data, and optimize resource allocation. Summary of the Invention

[0007] The purpose of this application is to provide a network security vulnerability scanning method and its priority evaluation method, aiming to overcome the defects in the prior art and optimize the scanning process through intelligent evaluation and dynamic adjustment.

[0008] To achieve the above purpose, this application discloses the following technical solutions:

[0009] In a first aspect, this application discloses a network security vulnerability scanning method, which includes the following steps:

[0010] Step S1: Obtain the internal and external information of the target system, including the external information provided by the external scanning engine and the internal information provided by the internal scanning engine;

[0011] Step S2: Match the collected internal and external information with the known vulnerability information in the vulnerability database to generate a preliminary vulnerability list;

[0012] Step S3: Screen out the target vulnerabilities that need to be further verified from the preliminary vulnerability list according to the preset rules;

[0013] Step S4: Verify the screened target vulnerabilities, confirm the existence of the vulnerabilities, and record the verification results.

[0014] Preferably, in the step S1, the obtaining of the internal and external information of the target system specifically includes:

[0015] Obtain the network traffic, port opening status, and service version information of the target system through an external scanning engine;

[0016] Obtain the configuration file, log record, and runtime status information of the target system through an internal scanning engine;

[0017] When matching the internal and external information with the known vulnerability information in the vulnerability database in the step S2, the matching degree is calculated by the following formula:

[0018] S match = w 1 * S func + w 2 * S target

[0019] where S match is the calculated matching degree, S func is the functional module similarity, S target is the target similarity, w 1 and w 2 are weight coefficients.

[0020] Preferably, in the step S3, the preset rules at least include:

[0021] The scope of influence, exploitability, historical repair records, and the current load situation of the system of the vulnerability.

[0022] Preferably, the verification of the screened target vulnerabilities specifically includes:

[0023] Through dynamic taint analysis technology, track the propagation path of the suspicious data flow, and verify it in combination with the static code analysis results; and during the verification process, set a time window mechanism, where the expression of the time window mechanism is:

[0024]

[0025] where Tverify To verify the time, T interval,i is the time interval for the i-th verification, and n is the number of verifications.

[0026] Preferably, the network security vulnerability scanning method further includes: Step S5: anomaly detection; the anomaly detection specifically includes:

[0027] Monitoring whether there are potential attack behaviors or abnormal traffic during the operation of the system and issuing an alarm in a timely manner;

[0028] Among them, potential attack behaviors or abnormal traffic are identified by constructing a classification model based on machine learning. The input features of the classification model include network traffic statistics, system log keywords, and user behavior patterns. The output result of the classification model is an anomaly probability value; the calculation formula of the anomaly probability value is:

[0029] P anomaly = f(X traffic , X log , X behavior )

[0030] Among them, P anomaly is the calculated anomaly probability value, X traffic is the network traffic feature, X log is the log keyword feature, X behavior is the user behavior pattern feature, and f(·) is the classification function.

[0031] In a second aspect, the present application discloses a method for evaluating the priority of network security vulnerability scanning. The method includes the following steps:

[0032] Step T1: Access the vulnerabilities obtained by the network security vulnerability scanning method as described above;

[0033] Step T2: Obtain the status information of the system and network component information, including connection interruption frequency, network bandwidth utilization rate, interaction response duration, and component priority;

[0034] Step T3: Comprehensively evaluate the priority of the vulnerabilities and generate a priority ranking list;

[0035] Step T4: Determine the vulnerabilities that need to be processed preferentially according to the priority ranking list and generate corresponding repair suggestions.

[0036] Preferably, in the step T2, the obtaining of the status information of the system specifically includes:

[0037] Obtaining the real-time load situation of the system through a monitoring module, including CPU usage rate, memory occupancy rate, and disk I / O status;

[0038] Extract key event information through the log analysis module, including the number of failed logins, the number of illegal access attempts, and abnormal exit records;

[0039] Calculate the quantization result of the system's status information, and the quantization result of the status information is calculated through the following formula:

[0040] V state = α * U cpu + β * M memory + γ * D IO

[0041] where, V state is the calculated status quantization value, U cpu is the CPU usage rate, M memory is the memory occupancy rate, D IO is the disk I / O status, and α, β, and γ are weight coefficients respectively.

[0042] Preferably, in the step T3, the priority of comprehensively evaluating vulnerabilities specifically includes:

[0043] Calculate the hazard index H vnln , H vnln = λ 1 * R impact + λ 2 * E explotitability , where,

[0044] R impact is the vulnerability impact range, E explotitability is the vulnerability exploitability, and λ 1 and λ 2 are weight coefficients;

[0045] Combine the system status quantization value V state and the hazard index H vnln , and calculate the priority score P prioroty of the vulnerability, P prioroty = k 1 * H vnln + k 2 * (1 - V state ), where, k 1 and k 2 are weight coefficients.

[0046] Preferably, this priority evaluation method for network security vulnerability scanning further includes a dynamic adjustment mechanism, and the dynamic adjustment mechanism specifically includes:

[0047] Dynamically adjust the weight coefficients in the priority calculation of comprehensively evaluating vulnerabilities according to the real-time load situation of the system, and the adjusted weight coefficient λ i ' is:

[0048] λ i ' = λ i *(1 + δ * L load )

[0049] Wherein, L load is the system load factor, and δ is the adjustment ratio.

[0050] Preferably, the priority evaluation method for network security vulnerability scanning further includes risk assessment, and the risk assessment specifically includes:

[0051] Analyze the scope of influence, exploitability, and attack difficulty of the vulnerability through artificial intelligence to generate corresponding repair suggestions; the repair suggestions include specific repair steps, estimated repair time, and potential risk warnings.

[0052] The network security vulnerability scanning method and its priority evaluation method of the present application have the following beneficial effects compared with the prior art:

[0053] 1. Improve scanning efficiency: By obtaining internal and external information and combining preset rules to screen target vulnerabilities, avoid comprehensive scanning of all components, and significantly improve scanning efficiency;

[0054] 2. Enhance scanning accuracy: Adopt a combination of dynamic taint analysis technology and static code analysis to verify vulnerabilities, ensuring the reliability of detection results;

[0055] 3. Scientific priority evaluation: By comprehensively evaluating the hazard index of the vulnerability and the system state quantification value, generate a reasonable priority ranking to ensure that high-risk vulnerabilities are processed first;

[0056] 4. Strong dynamic adaptability: Introduce a dynamic adjustment mechanism to optimize the scanning strategy in real time according to system load and network environment changes, adapting to the requirements in different scenarios;

[0057] 5. Reduce false positive rate: Through the anomaly detection module and risk assessment steps, reduce false positives and false negatives, and improve the overall scanning quality. Description of the Drawings

[0058] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, the drawings in the following description are only some embodiments of the present application. For those skilled in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0059] Figure 1 It is a flowchart of the network security vulnerability scanning method provided in this embodiment;

[0060] Figure 2Schematic flowchart of the priority evaluation method for network security vulnerability scanning provided in this embodiment. Detailed implementation manners

[0061] The technical solutions in the embodiments of the present application will be clearly and completely described below. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in the present application without creative efforts shall fall within the protection scope of the present application.

[0062] In this article, the term "including" is intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed, or further includes elements inherent to such process, method, article or device. Without more limitations, the elements defined by the statement "including..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0063] This embodiment provides a network security vulnerability scanning method as shown in Figure 1 The method includes the following steps:

[0064] Step S1: Obtain internal and external information of the target system, including external information provided by an external scanning engine and internal information provided by an internal scanning engine. Specifically, obtain the network traffic, port opening status, and service version information of the target system through the external scanning engine. For example, use the Nmap tool to scan all open ports of the target system and record the service version number. Obtain the configuration file, log record, and runtime status information of the target system through the internal scanning engine. For example, parse the system log file to extract the number of failed logins and abnormal exit records. At the same time, match the collected internal and external information with the known vulnerability information in the vulnerability database to generate a preliminary vulnerability list.

[0065] Step S2: Match the collected internal and external information with the known vulnerability information in the vulnerability database to generate a preliminary vulnerability list. The matching degree is calculated by the following formula:

[0066] Specifically, the matching degree is calculated by the following formula:

[0067] S match = w 1 * S func + w 2 * S target

[0068] Where S matchIt is the calculated matching degree, representing the similarity degree between internal and external information and the information in the vulnerability database. S func It is the similarity of function modules, representing the similarity between the target system and the affected function modules in the vulnerability database. S target It is the target similarity, representing the similarity between the target system and the affected target objects in the vulnerability database. w 1 and w 2 They are weight coefficients, representing the importance of the similarity of function modules and the target similarity respectively.

[0069] For example, the service version of a certain target system is Apache HTTP Server 2.4.50. There is a record in the vulnerability database. The affected function module is "HTTP request processing", and the affected target object is "Apache HTTP Server 2.4.x". Through comparison, S func = 0.8, S target = 0.9, w 1 = 0.6, w 2 = 0.4, then the matching degree is S match = 0.84.

[0070] Step S3: Screen out the target vulnerabilities that need to be further verified from the preliminary vulnerability list according to the preset rules. The preset rules include but are not limited to: the impact scope of the vulnerability, exploitability, historical repair records, and the current load situation of the system. For example, the set rule is "vulnerabilities with an impact scope greater than 5 need to be further verified".

[0071] Step S4: Verify the screened target vulnerabilities, confirm the existence of the vulnerabilities, and record the verification results. The verification process uses dynamic taint analysis technology to track the propagation path of suspicious data flows and combines the results of static code analysis for verification, clearly quantifying the time cost of the verification process, which helps to optimize the scanning efficiency and reduce the false positive rate. The expression for the verification time window is:

[0072]

[0073] Among them, T verify is the verification time, representing the time required to complete one vulnerability verification, T interval,i is the time interval of the i-th verification, representing the time difference between two verification operations, and n is the number of verifications, representing the number of operations performed during the verification process.

[0074] For example, a total of 5 operations are performed during a certain vulnerability verification process, and the time intervals of each operation are 2 seconds, 3 seconds, 2 seconds, 4 seconds, and 3 seconds respectively. Then the verification time is: T verify = 3 seconds.

[0075] Step S5: Anomaly detection; the specific anomaly detection includes:

[0076] Monitor whether there are potential attack behaviors or abnormal traffic during the operation of the system and issue an alarm in a timely manner;

[0077] Among them, potential attack behaviors or abnormal traffic are identified by constructing a classification model based on machine learning. The input features of the classification model include network traffic statistics, system log keywords, and user behavior patterns. The output result of the classification model is an anomaly probability value; the calculation formula for the anomaly probability value is:

[0078] P anomaly = f(X traffic , X log , X behavior )

[0079] Among them, P anomaly is the calculated anomaly probability value, indicating the possibility of the system being abnormal. X traffic is the network traffic feature, such as network traffic features, including traffic size, connection frequency, etc. X log is the log keyword feature, such as the number of login failures, the number of illegal access attempts, etc. X behavior is the user behavior pattern feature, such as user operation frequency, operation type, etc. f(·) is a classification function for mapping input features to anomaly probability values. It should be noted that in this embodiment, a random forest is used as the classification model. Assuming that the input feature is in a vector form of X = [X traffic , X log , X behavior , the classification function is Among them, N represents the number of decision trees in the random forest, and h i (X) represents the prediction result of the i-th decision tree (usually a binary classification label or probability value). The output of the classification function is an anomaly probability value in the range of [0,1]. When the anomaly probability value is greater than the preset threshold, it indicates that there is a potential anomaly in the system.

[0080] For example, assume that the input features of a certain system are:

[0081] X traffic = 0.7

[0082] X log = 0.8

[0083] X behavior = 0.6

[0084] Use the random forest model for classification. The model consists of 5 decision trees, and the prediction results of each tree are:

[0085] h 1(X) = 0.8, h 2 (X) = 0.9, h 3 (X) = 0.75, h 4 (X) = 0.85, h 5 (X) = 0.95

[0086] Then the final abnormal probability value is: P anomaly = 0.85

[0087] If the preset threshold is 0.8, it is determined that the system has an abnormality.

[0088] Based on the above, the network security vulnerability scanning method of this embodiment has the following technical features:

[0089] (1) Improve scanning efficiency

[0090] By obtaining the internal and external information of the target system and combining preset rules to screen for target vulnerabilities, it avoids comprehensive scanning of all components and significantly improves the scanning efficiency.

[0091] Dynamically adjust the scanning strategy, optimize the scanning process according to system load and network environment changes, and reduce resource waste.

[0092] (2) Enhance scanning accuracy

[0093] Combine dynamic taint analysis technology and static code analysis results to verify vulnerabilities, ensuring the reliability of detection results.

[0094] Introduce a time window mechanism to precisely control the time cost of the verification process and reduce the false positive rate.

[0095] (3) Reduce the false positive rate

[0096] Monitor potential attack behaviors or abnormal traffic during the system operation through the anomaly detection module, and issue alerts in a timely manner to reduce the possibility of false positives and missed detections.

[0097] Comprehensively analyze internal and external information and vulnerability database data to generate a more accurate preliminary vulnerability list.

[0098] (4) Support multi-dimensional data analysis

[0099] Collect external information provided by the external scanning engine and internal information provided by the internal scanning engine simultaneously, realize the comprehensive analysis of multi-dimensional data, and improve the comprehensiveness of scanning results.

[0100] Therefore, the network security vulnerability scanning method of this embodiment realizes efficient and accurate network security vulnerability scanning through steps such as comprehensive collection of internal and external information, vulnerability matching, target screening, dynamic verification, and anomaly detection. Its working principle is based on multi-dimensional data analysis and intelligent evaluation, which can significantly improve the scanning efficiency and accuracy, and at the same time effectively reduce the false alarm rate, providing reliable guarantee for system security.

[0101] This embodiment provides a priority evaluation method for network security vulnerability scanning as shown in Figure 2 the following, and this method includes the following steps:

[0102] Step T1: Access the vulnerabilities obtained through the network security vulnerability scanning method described above.

[0103] Step T2: Obtain the status information and network component information of the system, including connection interruption frequency, network bandwidth utilization rate, interaction response duration, and component priority. The specific acquisition of the system's status information includes:

[0104] Obtain the real-time load situation of the system through the monitoring module, including CPU usage rate, memory occupancy rate, and disk I / O status; for example, use the tool top to obtain the CPU usage rate of 70%, free to obtain the memory occupancy rate of 60%, and iostat to obtain the disk I / O status of 50%;

[0105] Extract key event information through the log analysis module, including the number of login failures, the number of illegal access attempts, and abnormal exit records; for example, parse the system log to find that the number of login failures is 10 times and the number of illegal access attempts is 5 times;

[0106] Calculate the quantization result of the system's status information, and the calculation of the status information quantization result is obtained through the following formula:

[0107] V state = α * U cpu + β * M memory + γ * D IO

[0108] where V state is the calculated status quantization value, representing the overall evaluation value of the current running state of the system, U cpu is the CPU usage rate, representing the occupancy ratio of CPU resources, M memory is the memory occupancy rate, representing the occupancy ratio of memory resources, D IO is the disk I / O status, representing the busy degree of disk read and write operations, and α, β, and γ are weight coefficients respectively, representing the importance of CPU usage rate, memory occupancy rate, and disk I / O status.

[0109] For example, assume that the CPU utilization rate of a certain system is 70%, the memory occupancy rate is 60%, and the disk I / O status is 50%, and the weight coefficients are α = 0.5, β = 0.3, and γ = 0.2 respectively. Then the state quantization value is: V state = 0.67.

[0110] Step T3: Comprehensively evaluate the priority of vulnerabilities and generate a priority ranking list. The comprehensive evaluation of the priority of vulnerabilities specifically includes:

[0111] Calculate the hazard index H vnln , indicating the degree of threat of the vulnerability to system security,

[0112] H vnln = λ 1 *R impact + λ 2 *E explotitability , where R impact is the scope of impact of the vulnerability, indicating the number of system components or business scope that the vulnerability may affect, and E explotitability is the exploitability of the vulnerability, indicating the difficulty for an attacker to exploit the vulnerability. λ 1 and λ 2 are weight coefficients, respectively representing the importance of the scope of impact and exploitability of the vulnerability.

[0113] For example, assume that the scope of impact of a certain vulnerability is 8 (full score is 10), the exploitability is 7, and the weight coefficients are λ 1 = 0.6, λ 2 = 0.4. Then the hazard index is: H vnln = 7.6.

[0114] Combining the system state quantization value V state and the hazard index H vnln , calculate the priority score P prioroty , P prioroty = k 1 *H vnln + k 2 *(1 - V state ). According to the final priority score, sort all vulnerabilities and generate a priority list. The higher the score, the higher the priority, indicating that the vulnerability needs to be processed preferentially. Among them, k 1 and k 2 are weight coefficients, respectively representing the importance of the vulnerability hazard index and the system state quantization value. In particular, the selection of the weight coefficients k 1 and k 2 depends on the actual application scenario. If more attention is paid to the degree of harm of the vulnerability, then k 1 > k 2 can be set; if more attention is paid to the real-time state of the system, then k2 > k 1 As a preferred implementation, in order to ensure that the range of the final priority score is within [0, 1], it is necessary to normalize all input parameters.

[0115] For example, assume that the state quantization value and vulnerability hazard index of a certain system are respectively:

[0116] V state = 0.7 (high load)

[0117] H vnln = 0.85 (high-risk vulnerability)

[0118] The weight coefficients are set as: k 1 = 0.6, k 2 = 0.4

[0119] Then the final priority score is: P prioroty = 0.63.

[0120] Feasibly, the priority evaluation method for this network security vulnerability scan further includes a dynamic adjustment mechanism, and the dynamic adjustment mechanism specifically includes:

[0121] Dynamically adjust the weight coefficients in the priority calculation of comprehensively evaluating vulnerabilities according to the real-time load situation of the system. The adjusted weight coefficient λ i ' is:

[0122] λ i ' = λ i * (1 + δ * L load )

[0123] where L load is the system load factor, representing the current load level of the system, and δ is the adjustment ratio, used to control the change range of the weight coefficient.

[0124] For example, assume that the original weight coefficient λ 1 = 0.5, the system load factor L load = 0.3, and the adjustment ratio δ = 0.2. Then the adjusted weight coefficient is:

[0125] λ 1 ' = 0.53. At this time, λ 2 ' is directly calculated by λ 2 ' = 1 - 0.53 = 0.47.

[0126] Step T4: According to the priority sorted list, determine the vulnerabilities that need to be processed preferentially and generate corresponding repair suggestions.

[0127] Optionally, the priority evaluation method for network security vulnerability scanning further includes risk assessment, and the risk assessment specifically includes:

[0128] Analyze the scope of impact, exploitability, and attack difficulty of the vulnerability through artificial intelligence to generate corresponding repair suggestions; the repair suggestions include specific repair steps, estimated repair time, and potential risk warnings. For example, for high-risk vulnerabilities, it is recommended to immediately upgrade the relevant software version and provide a detailed upgrade guide.

[0129] Based on the above, the priority evaluation method for network security vulnerability scanning in this embodiment has the following technical features:

[0130] (1) Scientific and reasonable priority ranking

[0131] Generate a reasonable priority ranking list by comprehensively evaluating the vulnerability hazard index and the system status quantification value to ensure that high-risk vulnerabilities can be processed preferentially.

[0132] (2) Strong dynamic adaptability

[0133] Introduce a dynamic adjustment mechanism to dynamically adjust the weight coefficient in the priority calculation of comprehensively evaluating vulnerabilities according to the real-time load situation of the system, so that the evaluation process can adapt to the requirements in different scenarios.

[0134] (3) Reduce repair costs

[0135] Generate repair suggestions according to the priority ranking list to guide users to quickly locate and repair high-priority vulnerabilities, reducing the time and resources wasted on repairing low-priority vulnerabilities.

[0136] (4) Enhance security guarantee

[0137] Evaluate by combining the vulnerability hazard index and the system operation status to avoid missing security hazards caused by relying on a single indicator only, and improve the security of the overall system.

[0138] Therefore, the priority evaluation method for network security vulnerability scanning in this embodiment generates a scientific and reasonable priority ranking list by comprehensively evaluating the vulnerability hazard index and the system status quantification value, and optimizes the evaluation process by combining a dynamic adjustment mechanism. Its working principle is based on multi-dimensional data analysis and intelligent evaluation, which can significantly improve the efficiency and accuracy of vulnerability repair, while reducing repair costs and providing comprehensive protection for system security.

[0139] Finally, it should be noted that the above are only the preferred embodiments of the present application and are not used to limit the present application. Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some of the technical features. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present application shall be included within the protection scope of the present application.

Claims

1. A network security vulnerability scanning method, characterized in that: The method comprises the following steps: Step S1: Acquire internal and external information of the target system, including external information provided by an external scanning engine and internal information provided by an internal scanning engine; Step S2: Match the collected internal and external information with the known vulnerability information in the vulnerability database to generate a preliminary vulnerability list; Step S3: Filter out target vulnerabilities that need further verification from the preliminary vulnerability list according to preset rules; Step S4: Verify the screened target vulnerabilities, confirm the existence of the vulnerabilities, and record the verification results.

2. The network security vulnerability scanning method according to claim 1, characterized in that: In the step S1, the acquisition of internal and external information of the target system specifically includes: Obtain the target system's network traffic, port openness, and service version information through an external scanning engine; Obtain target system configuration files, log records, and runtime status information through internal scanning engines; In step S2, when the internal and external information is matched with the known vulnerability information in the vulnerability database, the matching degree is calculated by the following formula: S match =w1*S func +w2*S target Among them, S match is the calculated matching degree, S func is the functional module similarity, S target is the target similarity, w1 and w2 are weight coefficients.

3. The network security vulnerability scanning method according to claim 1, characterized in that: In step S3, the preset rules at least include: The scope of the vulnerability, its exploitability, its historical fixes, and the current load on the system.

4. The network security vulnerability scanning method according to claim 3, characterized in that: The verification of the screened target vulnerabilities specifically includes: Through dynamic taint analysis technology, the propagation path of suspicious data flow is tracked, and verification is performed in combination with static code analysis results; and during the verification process, a time window mechanism is set, wherein the expression of the time window mechanism is: Among them, T verify is the verification time, T interval,i is the time interval of the ith verification, and n is the number of verifications.

5. The network security vulnerability scanning method according to claim 1, characterized in that: The network security vulnerability scanning method further includes: step S5: abnormality detection; the abnormality detection specifically includes: Monitor whether there are potential attacks or abnormal traffic during system operation, and issue alarms in a timely manner; Among them, potential attack behaviors or abnormal traffic are identified by building a classification model based on machine learning. The input features of the classification model include network traffic statistics, system log keywords and user behavior patterns. The output result of the classification model is an abnormal probability value. The calculation formula of the abnormal probability value is: P anomaly =f(X traffic ,X log ,X behavior ) Among them, P anomaly is the calculated abnormal probability value, X traffic is the network traffic feature, X log is the log keyword feature, X behavior is the user behavior pattern feature, and f(·) is the classification function.

6. A priority assessment method for network security vulnerability scanning, characterized in that: The method comprises the following steps: Step T1: accessing the vulnerability obtained by the network security vulnerability scanning method according to any one of claims 1 to 5; Step T2: Obtain system status information and network component information, including connection interruption frequency, network bandwidth utilization, interaction response time, and component priority; Step T3: Comprehensively evaluate the priority of vulnerabilities and generate a priority list; Step T4: According to the priority list, determine the vulnerabilities that need to be addressed first and generate corresponding repair suggestions.

7. The method for evaluating the priority of network security vulnerability scanning according to claim 6, characterized in that: In step T2, the obtaining of system status information specifically includes: Obtain the real-time load status of the system through the monitoring module, including CPU usage, memory usage and disk I / O status; Extract key event information through the log analysis module, including the number of failed logins, the number of illegal access attempts, and abnormal logout records; The state information quantization result of the computing system is calculated by the following formula: V state =α*U cpu +β*M memory +γ*D IO Among them, V state is the calculated state quantization value, U cpu is the CPU usage, M memory is the memory usage, D IO is the disk I / O status, and α, β, and γ are weight coefficients respectively.

8. The method for evaluating the priority of network security vulnerability scanning according to claim 7, characterized in that: In step T3, the comprehensive assessment of vulnerability priorities specifically includes: Calculate the vulnerability's severity index H vnln , H vnln =λ1*R impact +λ2*E explotitability ,in, R impact is the impact range of the vulnerability, E explotitability is the exploitability of the vulnerability, λ1 and λ2 are weight coefficients; Combined with the system state quantization value V state and hazard index H vnln , calculate the vulnerability priority score P prioroty , P prioroty =k1*H vnln +k2*(1-V state ), where k1 and k2 are weight coefficients.

9. The method for evaluating the priority of network security vulnerability scanning according to claim 8, characterized in that: The priority assessment method of network security vulnerability scanning also includes a dynamic adjustment mechanism, which specifically includes: Dynamically adjust the weight coefficient in the priority calculation of the comprehensive evaluation vulnerability according to the real-time load of the system. The adjusted weight coefficient λ i 'for: l i '=λ i *(1+δ*L load ) Among them, L load is the system load factor, and δ is the adjustment ratio.

10. The method for evaluating the priority of network security vulnerability scanning according to claim 6, characterized in that: The priority assessment method of network security vulnerability scanning also includes risk assessment, which specifically includes: Through artificial intelligence analysis of the impact scope, exploitability and attack difficulty of the vulnerability, corresponding repair suggestions are generated; the repair suggestions include specific repair steps, estimated repair time and potential risk warnings.

Images