Software vulnerability prediction method, device, computer equipment and storage medium

Abstract

The embodiments of the present invention relate to a software vulnerability prediction method, apparatus, computer equipment and storage medium, the method comprising: obtaining at least one set of vulnerability data obtained by performing software testing on the software to be tested in the previous test cycle; inputting the at least one set of vulnerability data into a trained software vulnerability prediction model to obtain prediction parameters, the prediction parameters comprising at least a plurality of software vulnerabilities and the probability of each of the software vulnerabilities occurring in the software to be tested; determining the target software vulnerabilities that will occur in the software to be tested in the current test cycle according to the prediction parameters, by means of this method, it is possible to implement targeted and focused testing of possible vulnerabilities according to the prediction results of the model in the later software testing process, thereby improving the efficiency and effect of software testing.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of software testing, and in particular to a software vulnerability prediction method, device, computer equipment and storage medium. Background Art

[0002] In recent years, with the rapid development of computers, the scale and complexity of software development have increased, and software reliability has received more and more attention. Scholars have proposed a variety of software reliability prediction models to evaluate and predict software reliability.

[0003] However, the above software reliability prediction models all predict vulnerabilities from the software level. In software testing work, there is an increasing demand for vulnerability prediction at the software function level, that is, prediction of software vulnerabilities.

[0004] Currently, no effective solution has been proposed for the above technical problems. Summary of the invention

[0005] In view of this, in order to solve the above-mentioned technical problem of lack of prediction for software function vulnerabilities, the embodiments of the present invention provide a software vulnerability prediction method, apparatus, computer equipment and storage medium.

[0006] In a first aspect, an embodiment of the present invention provides a software vulnerability prediction method, comprising:

[0007] Obtain at least one set of vulnerability data obtained by performing software testing on the software to be tested in a previous testing cycle;

[0008] Inputting the at least one set of vulnerability data into a trained software vulnerability prediction model to obtain prediction parameters, wherein the prediction parameters include at least a plurality of software vulnerabilities and a probability of each of the software vulnerabilities occurring in the software to be tested;

[0009] The target software vulnerabilities that will appear in the software to be tested in the current test cycle are determined according to the prediction parameters.

[0010] In a possible implementation, the method further includes:

[0011] Selecting a software vulnerability with the largest corresponding probability value from the prediction parameters;

[0012] The selected software vulnerability is determined as a target software vulnerability that will appear in the software to be tested in the current test cycle.

[0013] In a possible implementation, the method further includes:

[0014] Obtaining sample data, the sample data comprising: multiple sets of vulnerability data obtained by performing software testing on the software to be tested during a historical testing cycle;

[0015] Based on a logistic regression algorithm and using the sample data for training, the software vulnerability prediction model is obtained.

[0016] In a possible implementation, the method further includes:

[0017] Obtaining multiple sets of vulnerability data obtained by performing software testing on the software to be tested within a historical testing cycle;

[0018] The multiple groups of vulnerability data are sorted in chronological order, and the vulnerability data ranked in the top N positions are used as sample data.

[0019] In a possible implementation, the method further includes:

[0020] Using vulnerability data other than sample data from the multiple sets of vulnerability data as test data;

[0021] When it is determined based on the test data that the software vulnerability prediction model is to be retrained, sample data is re-obtained, and based on a logistic regression algorithm, retraining is performed using the re-obtained sample data to obtain the software vulnerability prediction model.

[0022] In a possible implementation, the method further includes:

[0023] Inputting at least one set of test data into the trained software vulnerability prediction model to obtain test parameters;

[0024] Based on the test data and the test parameters, obtaining a prediction error rate of the software vulnerability prediction model;

[0025] If the prediction error rate is greater than or equal to a first threshold, it is determined to retrain the software vulnerability prediction model.

[0026] In a second aspect, an embodiment of the present invention provides a software vulnerability prediction device, comprising:

[0027] An acquisition module, used to acquire at least one set of vulnerability data obtained by performing software testing on the software to be tested in a previous test cycle;

[0028] A prediction module, used for inputting the at least one set of vulnerability data into a trained software vulnerability prediction model to obtain prediction parameters, wherein the prediction parameters include at least a plurality of software vulnerabilities and a probability of each of the software vulnerabilities occurring in the software to be tested;

[0029] The determination module is used to determine the target software vulnerabilities that will appear in the software to be tested in the current test cycle according to the prediction parameters.

[0030] In a possible implementation, the determination module is specifically configured to select a software vulnerability with the largest corresponding probability value from the prediction parameters; and determine the selected software vulnerability as a target software vulnerability that will appear in the software to be tested in a current test cycle.

[0031] In a third aspect, an embodiment of the present invention provides a computer device, comprising: a processor and a memory, wherein the processor is used to execute a software vulnerability prediction program stored in the memory to implement the software vulnerability prediction method described in the first aspect above.

[0032] In a fourth aspect, an embodiment of the present invention provides a storage medium, including: the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the software vulnerability prediction method described in the first aspect above.

[0033] The software vulnerability prediction method provided by the embodiment of the present invention obtains at least one set of vulnerability data obtained by performing software testing on the software to be tested in the previous test cycle, inputs at least one set of vulnerability data into a trained software vulnerability prediction model, and obtains prediction parameters, wherein the prediction parameters include at least multiple software vulnerabilities and the probability of each of the software vulnerabilities occurring in the software to be tested, and determines the target software vulnerabilities that will occur in the software to be tested in the current test cycle based on the prediction parameters, thereby realizing the prediction of software functional vulnerabilities. This helps testers to focus on testing possible software functional vulnerabilities in the later software testing process, thereby improving testing efficiency and effectiveness. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 A flowchart of a software vulnerability prediction method provided by an embodiment of the present invention;

[0035] Figure 2 A flowchart of a method for training a software vulnerability prediction model provided by an embodiment of the present invention;

[0036] Figure 3 It is the curve graph of the sigmoid function;

[0037] Figure 4 A schematic diagram of the structure of a software vulnerability prediction device provided by an embodiment of the present invention;

[0038] Figure 5 A schematic diagram of the structure of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0040] To facilitate understanding of the embodiments of the present invention, specific embodiments will be further explained below in conjunction with the accompanying drawings. The embodiments do not constitute a limitation on the embodiments of the present invention.

[0041] Figure 1 A flowchart of a software vulnerability prediction method provided by an embodiment of the present invention is shown in FIG. Figure 1 As shown, the method may include the following steps:

[0042] S11. Obtain at least one set of vulnerability data obtained by performing software testing on the software to be tested in the previous test cycle.

[0043] At present, in the process of software development and maintenance, software version updates are often involved. Each time a software version is updated, a software test is required. In the embodiment of the present invention, the process of performing software testing on a version of software is referred to as a test cycle. Furthermore, in each test cycle, multiple test cases can be used to test the software to obtain corresponding vulnerability data. Optionally, vulnerability data includes but is not limited to: software vulnerabilities, the number of times software vulnerabilities occur, the time when software vulnerabilities occur, the type of vulnerability, etc., wherein the number of times software vulnerabilities occur may include the number of times each type of vulnerability occurs.

[0044] As an embodiment, before starting a test cycle, at least one set of vulnerability data obtained when testing the software to be tested in the previous test cycle can be obtained by executing step S11. Subsequently, the software vulnerabilities that may appear in the current test cycle can be predicted based on the vulnerability data obtained in the previous test cycle.

[0045] S12: Inputting the at least one set of vulnerability data into a trained software vulnerability prediction model to obtain prediction parameters.

[0046] First, it is explained that in an embodiment of the present invention, a software vulnerability prediction model can be trained in advance, and the software vulnerability prediction model can be used to predict software vulnerabilities that may appear in the future based on vulnerability data in a historical test cycle.

[0047] Based on this, in this step S12, at least one set of test data in the previous test cycle is input into the trained software vulnerability prediction model to obtain prediction parameters, which at least include: multiple software vulnerabilities and the probability of each software vulnerability corresponding to the occurrence. Optionally, the above prediction parameters may also include but are not limited to: the total number of software vulnerabilities, the number of occurrences corresponding to each vulnerability, the occurrence time of each vulnerability, etc.

[0048] As for how to train the above software vulnerability prediction model, we will explain it in the following text. Figure 2 The embodiment shown is used for illustration only and will not be described in detail here.

[0049] S13: determining target software vulnerabilities that will appear in the software to be tested in the current test cycle according to the prediction parameters.

[0050] As an embodiment, a software vulnerability with the largest corresponding probability value may be selected from the prediction parameters, and the selected software vulnerability may be determined as the target software vulnerability that will appear in the software to be tested in the current test cycle.

[0051] For example, assuming that the prediction parameters include three types of software vulnerabilities, among which the probability of the first software vulnerability occurring is 90%, the probability of the second software vulnerability occurring is 60%, and the probability of the third software vulnerability occurring is 10%, then according to the above description, the first software vulnerability can be determined as the target software vulnerability that will appear in the current test cycle.

[0052] As another embodiment, if the prediction parameters include the number of occurrences of each vulnerability, the vulnerability with the highest number of occurrences may be selected as the target software vulnerability.

[0053] In addition, in the application, after executing the above step S13 to obtain the template software vulnerability, the target software vulnerability can be output to remind the tester to perform targeted testing on the software according to the target software vulnerability.

[0054] The software vulnerability prediction method provided by the embodiment of the present invention obtains at least one set of vulnerability data obtained by performing software testing on the software to be tested in the previous test cycle, inputs at least one set of vulnerability data into a trained software vulnerability prediction model, and obtains prediction parameters, wherein the prediction parameters include at least multiple software vulnerabilities and the probability of each of the software vulnerabilities occurring in the software to be tested, and determines the target software vulnerabilities that will occur in the software to be tested in the current test cycle based on the prediction parameters, thereby realizing the prediction of software functional vulnerabilities. This helps testers to focus on testing possible software functional vulnerabilities in the later software testing process, thereby improving testing efficiency and effectiveness.

[0055] Figure 2A flowchart of a method for training a software vulnerability prediction model provided by an embodiment of the present invention is shown in FIG. Figure 2 As shown, the method may include the following steps:

[0056] S21, obtaining multiple sets of vulnerability data obtained by performing software testing on the software to be tested within a historical testing cycle.

[0057] As an embodiment, the above historical test cycle is a historical test cycle closest to the current time.

[0058] S22. Sort the multiple sets of vulnerability data in chronological order, use the vulnerability data ranked in the first N positions as sample data, and use the vulnerability data in the multiple sets of vulnerability data except the sample data as test data.

[0059] As can be seen from the description in step S22, in the embodiment of the present invention, multiple groups of vulnerability data in a historical test cycle are divided into sample data and test data, so that the sample data can be used for model training later, and the test data can be used to perform performance testing on the trained model.

[0060] S23. Based on a logistic regression algorithm, the sample data is used for training to obtain the software vulnerability prediction model.

[0061] As an embodiment, the present invention uses a logistic regression algorithm for model training. The logistic regression algorithm is a typical supervised classification algorithm in machine learning algorithms. The process of training based on the logistic regression algorithm and using sample data generally includes: first, using the sigmoid function to map all sample data to the interval (0, 1), and then determining the optimal regression coefficient. As an optional implementation method, the stochastic gradient ascent algorithm has the advantage of occupying less computing resources than the gradient ascent algorithm and can complete parameter updates when data arrives, so the stochastic gradient ascent algorithm can be used to determine the optimal regression coefficient.

[0062] The above sigmoid function is shown in the following formula (I), and its corresponding curve graph is as follows Figure 3 shown.

[0063]

[0064] like Figure 3 As shown in the figure, when z is 0, the value of the sigmoid function is 0.5. As z increases, the value of the sigmoid function is infinitely close to 1. As z decreases, the value of the sigmoid function is infinitely close to 0, which is similar to a step function. Therefore, this function can be used to accept all inputs and then predict the category.

[0065] The above z is shown in formula (II):

[0066] z=w0x0+w1x1+w2x2+…+w n x n Formula (II)

[0067] Where x is the input data of the classifier, and vector w is the optimal regression coefficient required.

[0068] S24. Input at least one set of test data into the trained software vulnerability prediction model to obtain test parameters.

[0069] S25. Obtaining a prediction error rate of the software vulnerability prediction model based on the test data and the test parameters.

[0070] The above test parameters include but are not limited to: multiple software vulnerabilities and the probability of each software vulnerability occurring. Optionally, the above test parameters may also include but are not limited to: the total number of software vulnerabilities, the number of occurrences of each type of vulnerability, the occurrence time of each vulnerability, etc.

[0071] As an embodiment, the proportion of each type of vulnerability in the test data can be determined, the difference between the proportion of each type of vulnerability and the corresponding probability in the test parameters can be calculated, and then the average of all the differences can be calculated, and the average value can be used as the prediction error rate of the software vulnerability prediction model.

[0072] As another embodiment, the number of vulnerability types in the test data may be determined, and the prediction error rate of the software vulnerability prediction model may be determined according to the number of vulnerability types and the number of vulnerability types in the test parameters.

[0073] S26: If the prediction error rate is greater than or equal to a first threshold, determine to retrain the software vulnerability prediction model.

[0074] As an embodiment, if the prediction error rate of the software vulnerability prediction model is greater than or equal to a first threshold (for example, 10%), it means that the performance of the currently trained software vulnerability prediction model is poor and the prediction result is not accurate enough. Therefore, it can be determined to retrain the current software vulnerability prediction model.

[0075] In addition, if the prediction error rate is less than the first threshold, it means that the prediction result of the software vulnerability prediction model is relatively reliable, so it can be determined that the software vulnerability prediction model is successfully trained.

[0076] S27. When it is determined based on the test data that the software vulnerability prediction model needs to be retrained, sample data is re-obtained, and based on a logistic regression algorithm, retraining is performed using the re-obtained sample data to obtain the software vulnerability prediction model.

[0077] When it is determined to retrain the software vulnerability prediction model, the sample data can be re-obtained, and the initial model can be trained based on the logistic regression algorithm and the re-obtained sample data until a software vulnerability prediction model with reliable prediction results is obtained.

[0078] The training method of the software vulnerability prediction model provided in the embodiment of the present invention obtains a software vulnerability prediction model by training with the test data of the software in the historical testing cycle, which can realize the prediction of software function vulnerabilities. This helps testers to focus on testing possible software function vulnerabilities in the later software testing process, thereby improving testing efficiency and effectiveness.

[0079] Figure 4 A schematic diagram of the structure of a software vulnerability prediction device provided by an embodiment of the present invention specifically includes:

[0080] The acquisition module 401 is used to acquire at least one set of vulnerability data obtained by performing software testing on the software to be tested in the previous test cycle;

[0081] A prediction module 402 is used to input the at least one set of vulnerability data into a trained software vulnerability prediction model to obtain prediction parameters, wherein the prediction parameters at least include a plurality of software vulnerabilities and a probability of each of the software vulnerabilities occurring in the software to be tested;

[0082] The determination module 403 is used to determine the target software vulnerabilities that will appear in the software to be tested in the current test cycle according to the prediction parameters.

[0083] In a possible implementation, the acquisition module 401 is specifically used to obtain sample data, and the sample data includes: multiple sets of vulnerability data obtained by performing software testing on the software to be tested during a historical testing cycle; based on a logistic regression algorithm, and using the sample data for training, to obtain the software vulnerability prediction model.

[0084] In a possible implementation, the acquisition module 401 is further used to obtain multiple sets of vulnerability data obtained by performing software testing on the software to be tested within a historical test cycle; sort the multiple sets of vulnerability data in chronological order, and use the vulnerability data ranked in the top N positions as sample data.

[0085] In one possible implementation, the prediction module 402 is specifically used to use the vulnerability data other than the sample data in the multiple groups of vulnerability data as test data; when it is determined to retrain the software vulnerability prediction model based on the test data, the sample data is re-obtained, and based on a logistic regression algorithm, the re-obtained sample data is used for retraining to obtain the software vulnerability prediction model.

[0086] In a possible implementation, the determination module 403 is specifically configured to select a software vulnerability with the largest corresponding probability value from the prediction parameters; and determine the selected software vulnerability as a target software vulnerability that will appear in the software to be tested in the current test cycle.

[0087] In one possible implementation, the determination module 403 is further used to input at least one set of test data into a trained software vulnerability prediction model to obtain test parameters; based on the test data and the test parameters, obtain a prediction error rate of the software vulnerability prediction model; if the prediction error rate is greater than or equal to a first threshold, determine to retrain the software vulnerability prediction model.

[0088] The software vulnerability prediction device provided in this embodiment can be as follows Figure 4 The software vulnerability prediction device shown in , can execute as follows Figure 1-2 All steps of the software vulnerability prediction method in Figure 1-2 For details, please refer to Figure 1-2 For the sake of brevity, the relevant description is not repeated here.

[0089] Figure 5 A schematic diagram of the structure of a computer device provided by an embodiment of the present invention, Figure 5 The computer device 500 shown includes: at least one processor 501, a memory 502, at least one network interface 504 and other user interfaces 503. The various components in the computer device 500 are coupled together via a bus system 505. It is understood that the bus system 505 is used to achieve connection and communication between these components. In addition to the data bus, the bus system 505 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, the bus system 505 is not described in detail. Figure 5 Various buses are labeled as bus system 505 .

[0090] The user interface 503 may include a display, a keyboard, or a pointing device (eg, a mouse, a trackball, a touch pad, or a touch screen).

[0091] It can be understood that the memory 502 in the embodiment of the present invention can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct memory bus random access memory (DRRAM). The memory 502 described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0092] In some implementations, the memory 502 stores the following elements, executable units or data structures, or a subset thereof, or an extended set thereof: an operating system 5021 and an application program 5022 .

[0093] The operating system 5021 includes various system programs, such as a framework layer, a core library layer, a driver layer, etc., which are used to implement various basic services and process hardware-based tasks. The application 5022 includes various application programs, such as a media player (MediaPlayer), a browser (Browser), etc., which are used to implement various application services. The program for implementing the method of the embodiment of the present invention can be included in the application 5022.

[0094] In the embodiment of the present invention, by calling the program or instruction stored in the memory 502, specifically, the program or instruction stored in the application 5022, the processor 501 is used to execute the method steps provided by each method embodiment, for example, including:

[0095] Acquire at least one set of vulnerability data obtained by performing software testing on the software to be tested in the previous test cycle; input the at least one set of vulnerability data into a trained software vulnerability prediction model to obtain prediction parameters, wherein the prediction parameters include at least a plurality of software vulnerabilities and the probability of each of the software vulnerabilities occurring in the software to be tested; determine the target software vulnerabilities that will occur in the software to be tested in the current test cycle based on the prediction parameters.

[0096] In a possible implementation, a software vulnerability with the largest corresponding probability value is selected from the prediction parameters; and the selected software vulnerability is determined as a target software vulnerability that will appear in the software to be tested in the current test cycle.

[0097] In a possible implementation, sample data is obtained, the sample data including: multiple sets of vulnerability data obtained by performing software testing on the software to be tested during a historical testing cycle; based on a logistic regression algorithm, the software vulnerability prediction model is obtained by training using the sample data.

[0098] In a possible implementation, multiple sets of vulnerability data obtained by performing software testing on the software to be tested within a historical test cycle are obtained; the multiple sets of vulnerability data are sorted in chronological order, and the vulnerability data ranked in the top N positions are used as sample data.

[0099] In one possible implementation, vulnerability data other than sample data in the multiple groups of vulnerability data are used as test data; when it is determined to retrain the software vulnerability prediction model based on the test data, the sample data is retrieved, and based on a logistic regression algorithm, retraining is performed using the retrieved sample data to obtain the software vulnerability prediction model.

[0100] In one possible implementation, at least one set of test data is input into a trained software vulnerability prediction model to obtain test parameters; based on the test data and the test parameters, a prediction error rate of the software vulnerability prediction model is obtained; if the prediction error rate is greater than or equal to a first threshold, it is determined to retrain the software vulnerability prediction model.

[0101] The method disclosed in the above embodiment of the present invention can be applied to the processor 501, or implemented by the processor 501. The processor 501 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit in the processor 501 or the instruction in the form of software. The above processor 501 can be a general processor, a digital signal processor (Digital Signal Processor, DSP), an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present invention can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiment of the present invention can be directly embodied as a hardware decoding processor to execute, or the hardware and software units in the decoding processor can be executed. The software unit can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 502, and the processor 501 reads the information in the memory 502 and completes the steps of the above method in combination with its hardware.

[0102] It is understood that the embodiments described herein can be implemented by hardware, software, firmware, middleware, microcode or a combination thereof. For hardware implementation, the processing unit can be implemented in one or more application specific integrated circuits (ASIC), digital signal processors (DSP), digital signal processing devices (DSPDevice, DSPD), programmable logic devices (PLD), field programmable gate arrays (FPGA), general-purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions described in the present application or a combination thereof.

[0103] For software implementation, the technology described herein can be implemented by a unit that performs the functions described herein. The software code can be stored in a memory and executed by a processor. The memory can be implemented in the processor or outside the processor.

[0104] The computer device provided in this embodiment may be Figure 5The computer device shown in , can execute Figure 1-2 All steps of the software vulnerability prediction method in Figure 1-2 For details, please refer to Figure 1-2 For the sake of brevity, the relevant description is not repeated here.

[0105] The embodiment of the present invention also provides a storage medium (computer-readable storage medium). The storage medium here stores one or more programs. The storage medium may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a read-only memory, a flash memory, a hard disk or a solid-state drive; the memory may also include a combination of the above-mentioned types of memory.

[0106] When one or more programs in the storage medium can be executed by one or more processors, the software vulnerability prediction method executed on the computer device side can be implemented.

[0107] The processor is used to execute the software vulnerability prediction program stored in the memory to implement the following steps of the software vulnerability prediction method executed on the computer device side:

[0108] Acquire at least one set of vulnerability data obtained by performing software testing on the software to be tested in the previous test cycle; input the at least one set of vulnerability data into a trained software vulnerability prediction model to obtain prediction parameters, wherein the prediction parameters include at least a plurality of software vulnerabilities and the probability of each of the software vulnerabilities occurring in the software to be tested; determine the target software vulnerabilities that will occur in the software to be tested in the current test cycle based on the prediction parameters.

[0109] In a possible implementation, a software vulnerability with the largest corresponding probability value is selected from the prediction parameters; and the selected software vulnerability is determined as a target software vulnerability that will appear in the software to be tested in the current test cycle.

[0110] In a possible implementation, sample data is obtained, the sample data including: multiple sets of vulnerability data obtained by performing software testing on the software to be tested during a historical testing cycle; based on a logistic regression algorithm, the software vulnerability prediction model is obtained by training using the sample data.

[0111] In a possible implementation, multiple sets of vulnerability data obtained by performing software testing on the software to be tested within a historical test cycle are obtained; the multiple sets of vulnerability data are sorted in chronological order, and the vulnerability data ranked in the top N positions are used as sample data.

[0112] In one possible implementation, vulnerability data other than sample data in the multiple groups of vulnerability data are used as test data; when it is determined to retrain the software vulnerability prediction model based on the test data, the sample data is retrieved, and based on a logistic regression algorithm, retraining is performed using the retrieved sample data to obtain the software vulnerability prediction model.

[0113] In one possible implementation, at least one set of test data is input into a trained software vulnerability prediction model to obtain test parameters; based on the test data and the test parameters, a prediction error rate of the software vulnerability prediction model is obtained; if the prediction error rate is greater than or equal to a first threshold, it is determined to retrain the software vulnerability prediction model.

[0114] The professionals should further realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to the function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0115] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0116] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A software vulnerability prediction method, characterized in that: include: Obtain at least one set of vulnerability data obtained by performing software testing on the software to be tested in a previous testing cycle; Inputting the at least one set of vulnerability data into a trained software vulnerability prediction model to obtain prediction parameters, wherein the prediction parameters include at least a plurality of software vulnerabilities and a probability of each of the software vulnerabilities occurring in the software to be tested; Determine, according to the prediction parameters, target software vulnerabilities that will appear in the software to be tested in the current test cycle; Among them, the method also includes obtaining training data, and obtaining training data includes: obtaining multiple sets of vulnerability data obtained by software testing of the software to be tested within a historical testing cycle; sorting the multiple sets of vulnerability data in chronological order, and using the vulnerability data ranked in the top N positions as sample data; and using the vulnerability data other than the sample data in the multiple sets of vulnerability data as test data.

2. The method according to claim 1, characterized in that The step of determining, according to the prediction parameters, a target software vulnerability that will appear in the software to be tested in the current test cycle includes: Selecting a software vulnerability with the largest corresponding probability value from the prediction parameters; The selected software vulnerability is determined as a target software vulnerability that will appear in the software to be tested in the current test cycle.

3. The method according to claim 1, characterized in that The method further includes: training the software vulnerability prediction model, specifically including: Obtaining sample data, the sample data comprising: multiple sets of vulnerability data obtained by performing software testing on the software to be tested during a historical testing cycle; Based on a logistic regression algorithm and using the sample data for training, the software vulnerability prediction model is obtained.

4. The method according to claim 1, characterized in that: The method further comprises: When it is determined based on the test data that the software vulnerability prediction model is to be retrained, sample data is re-obtained, and based on a logistic regression algorithm, retraining is performed using the re-obtained sample data to obtain the software vulnerability prediction model.

5. The method according to claim 4, characterized in that The determining to retrain the software vulnerability prediction model based on the test data includes: Inputting at least one set of the test data into a trained software vulnerability prediction model to obtain test parameters; Based on the test data and the test parameters, obtaining a prediction error rate of the software vulnerability prediction model; If the prediction error rate is greater than or equal to a first threshold, it is determined to retrain the software vulnerability prediction model.

6. A software vulnerability prediction device, characterized in that: include: An acquisition module, used to acquire at least one set of vulnerability data obtained by performing software testing on the software to be tested in a previous test cycle; A prediction module, used for inputting the at least one set of vulnerability data into a trained software vulnerability prediction model to obtain prediction parameters, wherein the prediction parameters include at least a plurality of software vulnerabilities and a probability of each of the software vulnerabilities occurring in the software to be tested; A determination module, used to determine the target software vulnerability that will appear in the software to be tested in the current test cycle according to the prediction parameters; Among them, the device is also used to obtain training data, and obtaining training data includes: obtaining multiple groups of vulnerability data obtained by software testing of the software to be tested within a historical testing cycle; sorting the multiple groups of vulnerability data in chronological order, and using the vulnerability data ranked in the top N positions as sample data; and using the vulnerability data other than the sample data in the multiple groups of vulnerability data as test data.

7. The device according to claim 6, characterized in that The determination module is specifically used to select a software vulnerability with the largest corresponding probability value from the prediction parameters; and determine the selected software vulnerability as the target software vulnerability that will appear in the software to be tested in the current test cycle.

8. A computer device, characterized in that: include: A processor and a memory, wherein the processor is used to execute a software vulnerability prediction program stored in the memory to implement the software vulnerability prediction method according to any one of claims 1 to 5.

9. A storage medium, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the software vulnerability prediction method according to any one of claims 1 to 5.

Images