Vulnerability information determination method, device, computer-readable storage medium and device

Abstract

The present disclosure provides a vulnerability information determination method, a vulnerability information determination device, a computer-readable storage medium, and an electronic device; and relates to the field of computer technology. The vulnerability information determination method includes: dividing the acquired text information into a plurality of phrases; calculating the information entropy of each phrase, and determining the information entropy of the text information according to the information entropy of each phrase; if the information entropy of the text information meets a preset condition, the text information is determined as vulnerability information. The vulnerability information determination method in the present disclosure can overcome the problem of resource waste caused by processing a large amount of redundant information to a certain extent, and then timely obtain effective vulnerability information from the majority of captured vulnerability information, so as to reduce resource waste and improve resource utilization.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a vulnerability information determination method, a vulnerability information determination device, a computer-readable storage medium, and an electronic device. Background Art

[0002] With the development of Internet technology, Internet security has become one of the most important issues. As hackers' attack methods tend to be diversified, if vulnerabilities can be detected in time, the security of the network can be improved.

[0003] The traditional vulnerability perception method is to capture vulnerability information from major vulnerability release platforms and determine the response method based on the captured vulnerability information. However, due to the large amount of vulnerability information, there is a lot of redundant information in the vulnerabilities determined by this vulnerability perception method, which will lead to the problem of resource waste due to processing containing a lot of redundant information.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] The purpose of the present disclosure is to provide a vulnerability information determination method, a vulnerability information determination device, a computer-readable storage medium and an electronic device, which can overcome the problem of resource waste caused by processing a lot of redundant information to a certain extent, and then obtain effective vulnerability information in a timely manner from the majority of captured vulnerability information, so as to reduce resource waste and improve resource utilization.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0007] According to a first aspect of the present disclosure, a vulnerability information determination method is provided, comprising:

[0008] Divide the acquired text information into multiple phrases;

[0009] Calculate the information entropy of each phrase, and determine the information entropy of the text information based on the information entropy of each phrase;

[0010] If the information entropy of the text information meets the preset conditions, the text information is determined to be vulnerability information.

[0011] In an exemplary embodiment of the present disclosure, calculating the information entropy of each phrase includes:

[0012] Determine respectively a pre-stored phrase in the corpus that matches each phrase; wherein the pre-stored phrase and the corresponding phrase have the same vocabulary;

[0013] The information entropy of each phrase is determined based on the number of pre-stored phrases.

[0014] In an exemplary embodiment of the present disclosure, determining the information entropy of each phrase according to the number of pre-stored phrases includes:

[0015] Determine the proportion of the number of pre-stored phrases corresponding to each phrase in the total number of phrases in the corpus;

[0016] The information entropy of each phrase is determined based on the proportion.

[0017] In an exemplary embodiment of the present disclosure, after the acquired text information is segmented into a plurality of phrases, the method further includes:

[0018] Determine the cohesion of each phrase;

[0019] Filter phrases whose cohesion is lower than the preset cohesion.

[0020] In an exemplary embodiment of the present disclosure, after the acquired text information is segmented into a plurality of phrases, the method further includes:

[0021] Format processing is performed on the multiple phrases so that the storage formats of the multiple phrases are the same.

[0022] In an exemplary embodiment of the present disclosure, the preset condition is that the information entropy of the text information is higher than a preset information entropy.

[0023] In an exemplary embodiment of the present disclosure, the vulnerability information determination method further includes:

[0024] Update the vulnerability database based on vulnerability information.

[0025] According to a second aspect of the present disclosure, a vulnerability information determination device is provided, comprising a phrase segmentation unit, an information entropy determination unit, and a vulnerability information determination unit, wherein:

[0026] A phrase segmentation unit, used to segment the acquired text information into multiple phrases;

[0027] An information entropy determination unit, used to calculate the information entropy of each phrase, and determine the information entropy of the text information according to the information entropy of each phrase;

[0028] The vulnerability information determination unit is used to determine the text information as vulnerability information when the information entropy of the text information meets a preset condition.

[0029] In an exemplary embodiment of the present disclosure, the information entropy determination unit calculates the information entropy of each phrase in the following manner:

[0030] The information entropy determination unit determines the pre-stored phrases in the corpus that match each phrase, respectively; wherein the pre-stored phrases and the corresponding phrases have the same vocabulary;

[0031] The information entropy determination unit determines the information entropy of each word group according to the number of pre-stored word groups.

[0032] In an exemplary embodiment of the present disclosure, the information entropy determination unit determines the information entropy of each phrase according to the number of pre-stored phrases in the following manner:

[0033] The information entropy determination unit determines the proportion of the number of pre-stored phrases corresponding to each phrase in the total number of phrases in the corpus;

[0034] The information entropy determination unit determines the information entropy of each phrase according to the proportion.

[0035] In an exemplary embodiment of the present disclosure, the vulnerability information determination device further includes a cohesion determination unit and a phrase filtering unit, wherein:

[0036] a cohesion determination unit, configured to determine the cohesion of each phrase after the phrase segmentation unit segments the acquired text information into a plurality of phrases;

[0037] The phrase filtering unit is used to filter phrases whose cohesion is lower than a preset cohesion.

[0038] In an exemplary embodiment of the present disclosure, the vulnerability information determination device further includes a format processing unit, wherein:

[0039] The format processing unit is used to perform format processing on the multiple phrases after the phrase segmentation unit segments the acquired text information into multiple phrases, so that the storage formats of the multiple phrases are the same.

[0040] In an exemplary embodiment of the present disclosure, the preset condition is that the information entropy of the text information is higher than a preset information entropy.

[0041] In an exemplary embodiment of the present disclosure, the vulnerability information determination device further includes a vulnerability updating unit, wherein:

[0042] The vulnerability update unit is used to update the vulnerability database according to the vulnerability information.

[0043] According to a third aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any one of the above-mentioned methods by executing the executable instructions.

[0044] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, any one of the methods described above is implemented.

[0045] The exemplary embodiments of the present disclosure may have some or all of the following beneficial effects:

[0046] In a vulnerability information determination method provided in an example implementation of the present disclosure, the acquired text information is divided into a plurality of phrases, wherein the text information may be vulnerability information captured from a platform; the information entropy of each phrase is calculated, and the information entropy of the text information is determined according to the information entropy of each phrase, the information entropy is used to characterize the frequency of occurrence of information, the higher the information entropy, the lower the frequency of occurrence of the vulnerability information; if the information entropy of the text information meets the preset conditions, the text information is determined as vulnerability information, the vulnerability information is different from the vulnerability information captured from the platform, the vulnerability information can be considered as valid vulnerability information determined from a large number of vulnerability information containing redundant information, wherein the valid vulnerability information can be understood as new vulnerability information, and the redundant information can be understood as vulnerability information already existing in the vulnerability database. According to the above scheme description, the present disclosure can, on the one hand, overcome the problem of resource waste caused by processing more redundant information to a certain extent, and then obtain valid vulnerability information from most of the captured vulnerability information in a timely manner, so as to reduce resource waste and improve resource utilization; on the other hand, it can determine that the text information is vulnerability information (i.e., valid vulnerability information, new vulnerability information) according to the information entropy, and improve the accuracy and effectiveness of vulnerability perception.

[0047] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0049] Figure 1 A schematic diagram showing an exemplary system architecture of a vulnerability information determination method and a vulnerability information determination device to which the embodiments of the present disclosure can be applied;

[0050] Figure 2 A schematic diagram showing the structure of a computer system suitable for implementing an electronic device of an embodiment of the present disclosure is shown;

[0051] Figure 3A flowchart of a vulnerability information determination method according to an embodiment of the present disclosure is schematically shown;

[0052] Figure 4 The following schematically shows an architecture diagram of a vulnerability information determination system according to an embodiment of the present disclosure;

[0053] Figure 5 A flowchart of a vulnerability information determination method according to another embodiment of the present disclosure is schematically shown;

[0054] Figure 6 The structure block diagram of a vulnerability information determination device according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0055] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as being limited to the examples set forth herein; on the contrary, these embodiments are provided so that the present disclosure will be more comprehensive and complete, and the concepts of the example embodiments are fully conveyed to those skilled in the art. The described features, structures, or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced while omitting one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known technical solutions are not shown or described in detail to avoid obscuring various aspects of the present disclosure.

[0056] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0057] Figure 1 A schematic diagram of a system architecture of an exemplary application environment in which a vulnerability information determination method and apparatus according to an embodiment of the present disclosure can be applied is shown.

[0058] like Figure 1As shown, the system architecture 100 may include one or more of terminal devices 101, 102, 103, a network 104, and a server 105. The network 104 is used to provide a medium for communication links between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc. The terminal devices 101, 102, 103 may be various electronic devices with display screens, including but not limited to desktop computers, portable computers, smart phones, tablet computers, etc. It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. According to the implementation requirements, there may be any number of terminal devices, networks and servers. For example, the server 105 may be a server cluster composed of multiple servers.

[0059] The vulnerability information determination method provided in the embodiment of the present disclosure is generally executed by the server 105, and accordingly, the vulnerability information determination device is generally set in the server 105. However, it is easy for those skilled in the art to understand that the vulnerability information determination method provided in the embodiment of the present disclosure can also be executed by the terminal devices 101, 102, and 103, and accordingly, the vulnerability information determination device can also be set in the terminal devices 101, 102, and 103, which is not particularly limited in this exemplary embodiment. For example, in an exemplary embodiment, the server 105 can divide the acquired text information into multiple phrases, calculate the information entropy of each phrase, and determine the information entropy of the text information according to the information entropy of each phrase, and when the information entropy of the text information meets the preset conditions, the text information is determined as vulnerability information, and then, the server 105 can transmit the vulnerability information to the terminal device 101, 102, or 103, so that the vulnerability information can be displayed on the terminal device 101, 102, or 103.

[0060] Figure 2 A schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present disclosure is shown.

[0061] It should be noted that Figure 2 The computer system 200 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0062] like Figure 2As shown, the computer system 200 includes a central processing unit (CPU) 201, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 202 or a program loaded from a storage part 208 into a random access memory (RAM) 203. Various programs and data required for system operation are also stored in the RAM 203. The CPU 201, the ROM 202, and the RAM 203 are connected to each other via a bus 204. An input / output (I / O) interface 205 is also connected to the bus 204.

[0063] The following components are connected to the I / O interface 205: an input section 206 including a keyboard, a mouse, etc.; an output section 207 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 208 including a hard disk, etc.; and a communication section 209 including a network interface card such as a LAN card, a modem, etc. The communication section 209 performs communication processing via a network such as the Internet. A drive 210 is also connected to the I / O interface 205 as needed. A removable medium 211, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 210 as needed, so that a computer program read therefrom is installed into the storage section 208 as needed.

[0064] In particular, according to an embodiment of the present disclosure, the process described below with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 209, and / or installed from the removable medium 211. When the computer program is executed by the central processing unit (CPU) 201, the various functions defined in the method and apparatus of the present application are executed. In some embodiments, the computer system 200 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0065] It should be noted that the computer-readable medium shown in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0066] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0067] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware, and the units described may also be arranged in a processor. The names of these units do not, in some cases, constitute limitations on the units themselves.

[0068] As another aspect, the present application also provides a computer-readable medium, which may be included in the electronic device described in the above embodiment; or may exist independently without being installed in the electronic device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by an electronic device, the electronic device implements the method described in the following embodiment. For example, the electronic device may implement the following method. Figure 3 and Figure 5 The various steps shown, etc.

[0069] The technical solution of the embodiment of the present disclosure is described in detail below:

[0070] The traditional vulnerability perception method is to capture vulnerability information from major vulnerability release platforms and determine the response method based on the captured vulnerability information. However, due to the large amount of vulnerability information, there is a lot of redundant information in the vulnerabilities determined by this vulnerability perception method, which will lead to the problem of resource waste due to processing containing a lot of redundant information.

[0071] Based on one or more of the above problems, this exemplary embodiment provides a vulnerability information determination method. The vulnerability information determination method can be applied to the above server 105, and can also be applied to one or more of the above terminal devices 101, 102, 103, which is not particularly limited in this exemplary embodiment. Figure 3 As shown, the vulnerability information determination method may include the following steps S310 to S330:

[0072] Step S310: Divide the acquired text information into multiple phrases.

[0073] Step S320: Calculate the information entropy of each phrase, and determine the information entropy of the text information according to the information entropy of each phrase.

[0074] Step S330: If the information entropy of the text information meets the preset conditions, the text information is determined to be vulnerability information.

[0075] In a vulnerability information determination method provided in an example implementation of the present disclosure, the acquired text information is divided into a plurality of phrases, wherein the text information may be vulnerability information captured from a platform; the information entropy of each phrase is calculated, and the information entropy of the text information is determined according to the information entropy of each phrase, the information entropy is used to characterize the frequency of occurrence of information, the higher the information entropy, the lower the frequency of occurrence of the vulnerability information; if the information entropy of the text information meets the preset conditions, the text information is determined as vulnerability information, the vulnerability information is different from the vulnerability information captured from the platform, the vulnerability information can be considered as valid vulnerability information determined from a large number of vulnerability information containing redundant information, wherein the valid vulnerability information can be understood as new vulnerability information, and the redundant information can be understood as vulnerability information already existing in the vulnerability database. According to the above scheme description, the present disclosure can, on the one hand, overcome the problem of resource waste caused by processing more redundant information to a certain extent, and then obtain valid vulnerability information from most of the captured vulnerability information in a timely manner, so as to reduce resource waste and improve resource utilization; on the other hand, it can determine that the text information is vulnerability information (i.e., valid vulnerability information, new vulnerability information) according to the information entropy, and improve the accuracy and effectiveness of vulnerability perception.

[0076] Next, the above steps of this exemplary embodiment are described in more detail.

[0077] In step S310, the acquired text information is segmented into a plurality of phrases.

[0078] In this example implementation, the text information can be understood as the original vulnerability information that has not been analyzed. The text information may contain duplicate information or information that is already in the vulnerability database. For example, if the text information is "Gitlab version 4.5 has an XSS vulnerability", then the multiple phrases obtained by segmenting it may include "Gitlab", "version 4.5" and "XSS vulnerability".

[0079] In this example implementation, optionally, the method of segmenting the acquired text information into multiple phrases may be: segmenting the acquired text information into multiple phrases based on a dictionary-based word segmentation method, segmenting the acquired text information into multiple phrases based on a statistical word segmentation method, or segmenting the acquired text information into multiple phrases based on a sequence annotation method, which is not limited to the embodiments of the present disclosure.

[0080] Among them, the dictionary-based word segmentation method utilizes the forward / reverse maximum matching method, the two-way matching word segmentation method and the minimum segmentation method. The important idea is to match the phrase to be analyzed with the entries in the dictionary according to the strategy. If the phrase exists in the dictionary, the match is successful, and then the next phrase is guessed; in addition, the statistical-based word segmentation method utilizes the N-gram model and the frequent item set algorithm. The important idea is that in a large amount of text information, the more times certain adjacent characters / words appear, the more likely they are to form a phrase. The word segmentation result with the highest probability is obtained by counting or analyzing the frequency of adjacent occurrences of characters in sequence; in addition, the sequence labeling-based word segmentation method utilizes the conditional random field, the hidden Markov model and the maximum entropy algorithm. The important idea is to regard the word segmentation process as a labeling problem of characters in text information. For example, characters are labeled as the first character, the middle character and the last character. When the labeling is completed, the word segmentation is completed.

[0081] In this example implementation, optionally, the following steps may also be included:

[0082] The text information is captured from the vulnerability publishing platform by crawling. The text information may be one or more, which is not limited in the embodiments of the present disclosure.

[0083] In this example implementation, optionally, after the acquired text information is segmented into a plurality of phrases, the method further includes:

[0084] Format processing is performed on the multiple phrases so that the storage formats of the multiple phrases are the same.

[0085] In this example implementation, text information can be obtained from multiple vulnerability platforms, and the formats of text information obtained by different vulnerability platforms may be different. Unifying the formats can improve the efficiency of word segmentation for text information, thereby improving the efficiency of determining vulnerability information.

[0086] In step S320, the information entropy of each phrase is calculated, and the information entropy of the text information is determined according to the information entropy of each phrase.

[0087] In this example implementation, information entropy can be used to measure the expected value of a random variable. The larger the information entropy value, the greater the change in the variable and the stronger the randomness. In addition, information entropy can be used as a quantitative indicator of the information content of a system, and can further be used as a goal for optimizing system equations or a criterion for parameter selection. The expression of information entropy is as follows:

[0088]

[0089] Among them, p iIt is used to represent the probability of the i-th phrase appearing in the vulnerability database, and H is used to represent the information entropy. The above expression can be used to determine the information entropy of each phrase, and then the information entropy of all phrases is summed up, and the result can be used as the information entropy of the text information.

[0090] In this example implementation, optionally, calculating the information entropy of each phrase includes:

[0091] Determine respectively a pre-stored phrase in the corpus that matches each phrase; wherein the pre-stored phrase and the corresponding phrase have the same vocabulary;

[0092] The information entropy of each phrase is determined based on the number of pre-stored phrases.

[0093] Further, the information entropy of each phrase is determined according to the number of pre-stored phrases, including:

[0094] Determine the proportion of the number of pre-stored phrases corresponding to each phrase in the total number of phrases in the corpus;

[0095] The information entropy of each phrase is determined based on the proportion.

[0096] In this example implementation, the corpus is used to store phrases for comparison with the phrases obtained by segmentation to determine the frequency of occurrence of related phrases of the phrase. For example, if the phrase is "eggplant" and the pre-stored phrase is "plant eggplant", both contain the word "eggplant", so the phrase "eggplant" matches the pre-stored phrase "plant eggplant".

[0097] In this example implementation, if the total number of phrases in the corpus is 1000, and the number of pre-stored phrases matching the phrase "eggplant", "plant eggplant", "eat eggplant", "fry eggplant", and "braised eggplant" is 4, then the number of phrases "eggplant" accounts for 4 / 1000 of the total number of phrases. The word frequency of each phrase can be determined based on 4 / 1000, and the information entropy of each phrase can be determined based on the word frequency and the information entropy expression.

[0098] It can be seen that by implementing this optional implementation method, the frequency of phrase occurrence can be determined through information entropy to determine that the text information is existing vulnerability information or to determine that the text information is new vulnerability information. This can reduce the repetition rate of vulnerability information in the vulnerability database, thereby improving the problem of low resource utilization caused by analyzing repeated vulnerability information.

[0099] In step S330, if the information entropy of the text information meets the preset conditions, the text information is determined to be vulnerability information.

[0100] In this example implementation, the preset condition may be that the information entropy of the text information is higher than the preset information entropy. If the information entropy of the text information is higher than the preset information entropy, the text information may be determined as vulnerability information. The vulnerability information here may be determined to have a low frequency of occurrence or have never occurred, and its information entropy is higher.

[0101] In this example implementation, optionally, after the acquired text information is segmented into a plurality of phrases, the method further includes:

[0102] Determine the cohesion of each phrase;

[0103] Filter phrases whose cohesion is lower than the preset cohesion.

[0104] In this example implementation, cohesion is used to measure whether a phrase can form a word. A phrase can form a phrase only if its cohesion satisfies a preset condition, such as being higher than a preset cohesion. For the text "abc", the cohesion C can be expressed as:

[0105]

[0106] According to the above schematic expression of the cohesion degree C, the cohesion degree of each phrase can be determined.

[0107] It can be seen that by implementing this optional implementation, phrases with a cohesion degree lower than a preset cohesion degree can be filtered to improve the accuracy of the information entropy of the determined text information.

[0108] In this example implementation, optionally, the vulnerability information determination method further includes:

[0109] Update the vulnerability database based on vulnerability information.

[0110] In this example implementation, the vulnerability database is used to store vulnerability information. By continuously determining new vulnerability information, the vulnerability database can be updated to enrich the data in the vulnerability database.

[0111] In this example implementation, optionally, the vulnerability information determination method further includes:

[0112] Evaluate the severity level of vulnerability information based on the preset mapping relationship, and sort the vulnerability information based on the time it was captured;

[0113] Output the sorting results, severity levels, and message reminders used to indicate that new vulnerability information (i.e., valid vulnerability information) has been captured.

[0114] Among them, the vulnerability information can be one or more; the preset mapping relationship is used to represent the correspondence between the consequences caused by the vulnerability information and the severity level; the sorting result can be obtained by sorting in ascending chronological order or in descending chronological order, which is not limited by the embodiments of the present disclosure.

[0115] It can be seen that the implementation Figure 3 The vulnerability information determination method shown can, to a certain extent, overcome the problem of resource waste caused by processing information containing a lot of redundant information, and thus timely obtain effective vulnerability information from the majority of captured vulnerability information, so as to reduce resource waste and improve resource utilization; and, can determine that the text information is vulnerability information (i.e., effective vulnerability information, new vulnerability information) based on information entropy, thereby improving the accuracy and effectiveness of vulnerability perception.

[0116] See also Figure 4 , Figure 4 The following schematically shows an architecture diagram of a vulnerability information determination system according to an embodiment of the present disclosure. Figure 4 As shown, the vulnerability information determination system includes a vulnerability information capture module 401, a synchronous message queue module 402, a data combing module 403, a word segmentation analysis module 404, a comparison module 405, a corpus 406, a phrase 407 that has been determined in the queue, a search engine 408, new vulnerability information 409, and a message reminder module 410. Among them, the vulnerability information capture module 401 (App Server) is used to capture public vulnerability information from a variety of vulnerability disclosure websites, that is, the acquired text information mentioned in the above embodiments of the present disclosure. It can be seen that the above text information can be obtained from a variety of vulnerability disclosure websites. The capture method can be manual capture or automatic capture by the server, which is not limited by the embodiments of the present disclosure; Figure 4As shown, there are three vulnerability information capture modules 401 in the vulnerability information determination system, and each vulnerability information capture module 401 can capture vulnerability information from the corresponding vulnerability disclosure website, and each vulnerability information capture module 401 can correspond to one or more vulnerability disclosure websites. Optionally, each vulnerability information capture module 401 can also obtain vulnerability information of a specific product from a search engine 408; wherein, the product can be an application, and the specific product can be an application specified by relevant personnel; the synchronous message queue module 402 (Async Message Queue) is used to synchronize the captured vulnerability information (i.e., text information) to the message queue; the data combing module 403 (Kafka Message) is used to format the data so that the format of vulnerability information from different websites is unified, which can be understood as formatting multiple text messages and converting them into a unified preset format to facilitate word segmentation processing, wherein Kafka is a high-throughput distributed publish-subscribe message system that can be used to process all action flow data in consumer-scale websites; the word segmentation analysis module 404 (Word AbstractorAlgorithm) is used to divide the vulnerability information into phrases (equivalent to the above-mentioned, dividing the acquired text information into multiple phrases) to obtain indexable phrases, that is, vulnerability keywords, so as to analyze them in combination with the corpus; the comparison module 405 is used to compare the phrases with the corpus 406, and then determine that the vulnerability information is new vulnerability information 409, which is equivalent to determining that the text information is vulnerability information. In addition, when there are multiple phrases, each time a phrase is compared, the phrase is determined to be a phrase that has been determined in the queue 407; further, after it is determined that new vulnerability information 409 is obtained, a message reminder module 410 can output a message reminder indicating that new vulnerability information has been obtained.

[0117] In addition, it should be noted that the vulnerability information determination method can be implemented by designing two versions of the algorithm, Batch and Streaming, through the MapReduce parallel computing capability provided by Spark. Among them, the Batch version algorithm is used to process the corpus documents provided on HDFS; Spark Streaming performs new word discovery tasks for text fragments within a specific time window, which is suitable for real-time application scenarios. It should be noted that Spark is a fast and general computing engine designed for large-scale data processing, which can provide users with interactive queries and optimize iterative workloads; MapReduce: is a software architecture, specifically used for parallel computing of large-scale data sets (greater than 1TB), namely "Map" and "Reduce"; HDFS is the Hadoop distributed file system.

[0118] based on Figure 4For the architecture diagram of the vulnerability information determination system shown in Figure 5 , Figure 5 The flowchart of the vulnerability information determination method according to another embodiment of the present disclosure is schematically shown. Figure 5 As shown, a vulnerability information determination method of an embodiment includes steps S510, S520, S530, S540, S550, S560 and S570, wherein:

[0119] Step S510: Capture text information.

[0120] Step S520: Segment the text information into basic words of different lengths.

[0121] Step S530: The basic words are randomly combined into phrases.

[0122] Step S540: Calculate phrase information entropy.

[0123] Step S550: retaining phrases based on information entropy and word frequency.

[0124] Step S560: Calculate the information entropy of the text information.

[0125] Step S570: Determine the text information corresponding to the information entropy that meets the preset conditions.

[0126] Specifically, the captured text information (e.g., camera takes photos) can be divided into basic words of different lengths, such as "photo", "shoot" and "camera"; then, the basic words can be randomly combined into phrases, which is equivalent to dividing the acquired text information into multiple phrases in the embodiment of the present disclosure; wherein, dividing the acquired text information into multiple phrases includes: now dividing the acquired text information into basic words, and then randomly combining the basic words to obtain multiple phrases. For example, the phrases obtained can be "take photos" and "camera takes photos"; then, the information entropy of each phrase can be calculated, and the phrases that meet the preset conditions can be stored according to the information entropy (or, information entropy and word frequency); then, the information entropy of the text information (e.g., camera takes photos) can also be calculated based on the stored phrases to determine the text information corresponding to the information entropy that meets the preset conditions.

[0127] Visible, combined Figure 4 and Figure 5 , can overcome the problem of resource waste caused by processing more redundant information to a certain extent, and then timely obtain effective vulnerability information from the majority of captured vulnerability information to reduce resource waste and improve resource utilization; and, can determine that the text information is vulnerability information (i.e., effective vulnerability information, new vulnerability information) based on information entropy, thereby improving the accuracy and effectiveness of vulnerability perception.

[0128] Furthermore, in this exemplary embodiment, a vulnerability information determination device is also provided. The vulnerability information determination device can be applied to a server or a terminal device. Figure 6 As shown, the vulnerability information determination device may include a phrase segmentation unit 601, an information entropy determination unit 602, and a vulnerability information determination unit 603, wherein:

[0129] A phrase segmentation unit 601 is used to segment the acquired text information into multiple phrases;

[0130] An information entropy determination unit 602 is used to calculate the information entropy of each phrase, and determine the information entropy of the text information according to the information entropy of each phrase;

[0131] The vulnerability information determination unit 603 is used to determine the text information as vulnerability information when the information entropy of the text information meets a preset condition.

[0132] Optionally, the preset condition is that the information entropy of the text information is higher than a preset information entropy.

[0133] It can be seen that the implementation Figure 6 The vulnerability information determination device shown can, to a certain extent, overcome the problem of resource waste caused by processing information containing a lot of redundant information, and thus timely obtain effective vulnerability information from the majority of captured vulnerability information to reduce resource waste and improve resource utilization; and, can determine that the text information is vulnerability information (i.e., effective vulnerability information, new vulnerability information) based on information entropy, thereby improving the accuracy and effectiveness of vulnerability perception.

[0134] In an exemplary embodiment of the present disclosure, the information entropy determination unit 602 calculates the information entropy of each phrase in the following manner:

[0135] The information entropy determination unit 602 determines the pre-stored phrases in the corpus that match each phrase, respectively; wherein the pre-stored phrases and the corresponding phrases have the same vocabulary;

[0136] The information entropy determination unit 602 determines the information entropy of each word group according to the number of pre-stored word groups.

[0137] Furthermore, the information entropy determination unit 602 determines the information entropy of each phrase according to the number of pre-stored phrases in the following manner:

[0138] The information entropy determination unit 602 determines the proportion of the number of pre-stored phrases corresponding to each phrase in the total number of phrases in the corpus;

[0139] The information entropy determination unit 602 determines the information entropy of each phrase according to the proportion.

[0140] It can be seen that by implementing this exemplary embodiment, the frequency of phrase occurrence can be determined through information entropy to determine that the text information is existing vulnerability information or to determine that the text information is new vulnerability information. This can reduce the repetition rate of vulnerability information in the vulnerability database, thereby improving the problem of low resource utilization caused by analyzing repeated vulnerability information.

[0141] In an exemplary embodiment of the present disclosure, the vulnerability information determination device further includes a cohesion determination unit (not shown) and a phrase filtering unit (not shown), wherein:

[0142] A cohesion determination unit, configured to determine the cohesion of each phrase after the phrase segmentation unit 601 segments the acquired text information into a plurality of phrases;

[0143] The phrase filtering unit is used to filter phrases whose cohesion is lower than a preset cohesion.

[0144] It can be seen that by implementing this exemplary embodiment, phrases with a cohesion degree lower than a preset cohesion degree can be filtered to improve the accuracy of the information entropy of the determined text information.

[0145] In an exemplary embodiment of the present disclosure, the vulnerability information determination device further includes a format processing unit (not shown), wherein:

[0146] The format processing unit is used to perform format processing on the multiple phrases after the phrase segmentation unit segments the acquired text information into multiple phrases, so that the storage formats of the multiple phrases are the same.

[0147] It can be seen that the implementation of this exemplary embodiment can improve the efficiency of word segmentation for text information, thereby improving the efficiency of determining vulnerability information.

[0148] In an exemplary embodiment of the present disclosure, the vulnerability information determination device further includes a vulnerability updating unit (not shown), wherein:

[0149] The vulnerability update unit is used to update the vulnerability database according to the vulnerability information.

[0150] It can be seen that by implementing this exemplary embodiment, the vulnerability database can be updated by continuously determining new vulnerability information to enrich the data in the vulnerability database.

[0151] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0152] Since the various functional modules of the vulnerability information determination device of the example embodiment of the present disclosure correspond to the steps of the example embodiment of the vulnerability information determination method described above, for details not disclosed in the embodiment of the device of the present disclosure, please refer to the embodiment of the vulnerability information determination method described above in the present disclosure.

[0153] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the following claims.

[0154] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A vulnerability information determination method, characterized in that: include: Divide the acquired text information into multiple phrases, wherein the text information is vulnerability information captured from a vulnerability publishing platform; Calculating the information entropy of each of the phrases, and determining the information entropy of the text information according to the information entropy of each of the phrases; If the information entropy of the text information does not meet the preset condition, determining that the text information is vulnerability information already existing in the vulnerability database; If the information entropy of the text information meets the preset condition, the text information is determined to be new vulnerability information, the vulnerability database is updated according to the new vulnerability information, and the severity level of the new vulnerability information is evaluated according to the preset mapping relationship, and the severity level and a message reminder indicating that the new vulnerability information has been captured are output; wherein the preset condition is that the information entropy of the text information is higher than the preset information entropy.

2. The method according to claim 1, characterized in that Calculating the information entropy of each of the phrases, including: Determine respectively a pre-stored phrase in the corpus that matches each of the phrases; wherein the pre-stored phrases and the corresponding phrases contain the same vocabulary; The information entropy of each of the phrases is determined according to the number of the pre-stored phrases.

3. The method according to claim 2, characterized in that Determining the information entropy of each of the pre-stored phrases according to the number of the pre-stored phrases includes: Determine the proportion of the number of pre-stored phrases corresponding to each of the phrases in the total number of phrases in the corpus; The information entropy of each of the phrases is determined according to the proportion.

4. The method according to claim 1, characterized in that: After the acquired text information is divided into multiple phrases, it also includes: determining a cohesion level for each of said phrases; Filter phrases whose cohesion is lower than the preset cohesion.

5. The method according to claim 1, characterized in that After the acquired text information is divided into multiple phrases, it also includes: The plurality of phrases are formatted so that the storage formats of the plurality of phrases are the same.

6. A vulnerability information determination device, characterized in that: include: A phrase segmentation unit, used to segment the acquired text information into a plurality of phrases, wherein the text information is vulnerability information captured from a vulnerability publishing platform; an information entropy determination unit, configured to calculate the information entropy of each of the phrases, and determine the information entropy of the text information according to the information entropy of each of the phrases; A vulnerability information determination unit is used to determine that the text information is vulnerability information already existing in a vulnerability database when the information entropy of the text information does not meet a preset condition; when the information entropy of the text information meets the preset condition, determine the text information as new vulnerability information, update the vulnerability database according to the new vulnerability information, and evaluate the severity level of the new vulnerability information according to a preset mapping relationship, and output the severity level and a message reminder for indicating that the new vulnerability information has been captured; wherein the preset condition is that the information entropy of the text information is higher than the preset information entropy.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

8. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to perform the method of any one of claims 1 to 5 by executing the executable instructions.

Images