A vulnerability deduplication processing method, device, equipment and storage medium

Abstract

Embodiments of the present application disclose a kind of duplicate processing method, device and equipment of vulnerability and storage medium.The method includes obtaining the vulnerability set to be detected, and filtering out the vulnerability containing vulnerability number in the vulnerability set to be detected, to obtain the first duplicate vulnerability set;According to the vulnerability type corresponding to each vulnerability in the first duplicate vulnerability set, obtain the vulnerability description information corresponding to each vulnerability respectively;According to the vulnerability description information corresponding to each vulnerability respectively and the duplicate algorithm matched with vulnerability type, secondary duplicate is carried out, to obtain the second duplicate vulnerability set.The technical scheme of the embodiments of the present application realizes the effect of saving labor and time, and effectively developing vulnerability management mode.

Description

Technical Field

[0001] The embodiments of the present invention relate to computer technology, and in particular to a method, apparatus, device and storage medium for deduplication of vulnerabilities. Background Technology

[0002] Cybersecurity vulnerabilities are unprotected entry points left by restricted computers, components, applications, or other online resources. They are any factors existing in a computer network system that can potentially harm the system's components and data. To standardize the discovery, reporting, patching, and disclosure of cybersecurity vulnerabilities, prevent cybersecurity risks, promote the timely patching of vulnerabilities in network products, services, and systems, and improve cybersecurity protection levels, vulnerability management platforms have been established for oversight. Enterprises have also established their own vulnerability management platforms to manage vulnerabilities in their products and assets.

[0003] Currently, the number of vulnerabilities is increasing exponentially, leading to a proliferation of vulnerability collection platforms and consequently, a higher rate of vulnerability duplication. Vulnerability deduplication is mostly done manually, which not only wastes a significant amount of time for platform operators and is inefficient, but also requires operators to have a thorough understanding of existing vulnerabilities. This situation further limits the development of vulnerability management methods. Summary of the Invention

[0004] This invention provides a method, apparatus, device, and storage medium for deduplication of vulnerabilities, thereby saving manpower and time and effectively developing vulnerability management methods.

[0005] In a first aspect, embodiments of the present invention provide a method for deduplication of vulnerabilities, the method comprising:

[0006] Obtain the set of vulnerabilities to be detected, and filter out vulnerabilities in the set of vulnerabilities to be detected that contain vulnerability numbers to obtain the first deduplicated vulnerability set;

[0007] Based on the vulnerability type corresponding to each vulnerability in the first deduplication vulnerability set, obtain the vulnerability description information corresponding to each vulnerability.

[0008] Based on the vulnerability description information corresponding to each vulnerability and the deduplication algorithm matching the vulnerability type, a second deduplication is performed to obtain a second deduplicated vulnerability set.

[0009] Secondly, embodiments of the present invention also provide a vulnerability deduplication processing device, the device comprising:

[0010] The first deduplication vulnerability set acquisition module is used to acquire the vulnerability set to be detected and filter out the vulnerabilities in the vulnerability set to be detected that contain vulnerability numbers, so as to obtain the first deduplication vulnerability set.

[0011] The vulnerability description information acquisition module is used to acquire vulnerability description information corresponding to each vulnerability according to the vulnerability type corresponding to each vulnerability in the first deduplicated vulnerability set.

[0012] The second deduplication vulnerability set acquisition module is used to perform secondary deduplication based on the vulnerability description information corresponding to each vulnerability and the deduplication algorithm matching the vulnerability type, so as to obtain the second deduplication vulnerability set.

[0013] Thirdly, embodiments of the present invention also provide a computer device, the device comprising:

[0014] One or more processors;

[0015] Storage device for storing one or more programs;

[0016] When the one or more programs are executed by the one or more processors, the one or more processors implement the deduplication method for vulnerabilities as described in any embodiment of the present invention.

[0017] Fourthly, embodiments of the present invention also provide a computer-readable storage medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the deduplication method for vulnerabilities as described in any embodiment of the present invention.

[0018] This invention addresses the problem in existing technologies where deduplication of exponentially increasing vulnerabilities across various management platforms is expended, resulting in significant manpower and time consumption. This approach saves manpower and time while effectively developing a more efficient vulnerability management method. It involves acquiring a set of vulnerabilities to be detected and filtering out vulnerabilities with vulnerability numbers, thus obtaining a first deduplicated vulnerability set. Based on the vulnerability type corresponding to each vulnerability in the first deduplicated vulnerability set, vulnerability description information corresponding to each vulnerability and a deduplication algorithm matching the vulnerability type are obtained. Attached Figure Description

[0019] Figure 1A A flowchart of a vulnerability deduplication method provided in Embodiment 1 of the present invention;

[0020] Figure 1B This is a specific application scenario diagram of vulnerability deduplication in a vulnerability management platform provided in Embodiment 1 of the present invention;

[0021] Figure 1C This is a schematic diagram of the original vulnerability duplicate confirmation process interface for a system vulnerability provided in Embodiment 1 of the present invention;

[0022] Figure 1DA schematic diagram of an original vulnerability duplicate confirmation process interface for a product vulnerability provided in Embodiment 1 of the present invention;

[0023] Figure 1E This is a specific application scenario diagram of vulnerability deduplication in an enterprise vulnerability management platform provided in Embodiment 1 of the present invention;

[0024] Figure 2A A flowchart of another method for deduplication of vulnerabilities provided in Embodiment 2 of the present invention;

[0025] Figure 2B This is a specific application scenario diagram of a vulnerability deduplication processing method executed by a vulnerability management platform, provided in Embodiment 2 of the present invention.

[0026] Figure 2C This is a specific application scenario diagram of a vulnerability deduplication method executed by an enterprise vulnerability management platform, provided in Embodiment 2 of the present invention.

[0027] Figure 3 This is a schematic diagram of the structure of a vulnerability deduplication processing device provided in Embodiment 3 of the present invention;

[0028] Figure 4 This is a schematic diagram of the structure of a computer device provided in Embodiment 4 of the present invention. Detailed Implementation

[0029] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, the accompanying drawings show only the parts relevant to the present invention, and not all of the structures.

[0030] Example 1

[0031] Figure 1A This is a flowchart of a vulnerability deduplication method provided in Embodiment 1 of the present invention. This embodiment is applicable to situations where a large number of newly reported vulnerabilities are detected and deduplicated in a management platform. The method can be executed by a vulnerability deduplication device, which can be implemented by software and / or hardware, and is generally integrated into a server with data processing capabilities. Specifically, it includes the following steps:

[0032] S110. Obtain the set of vulnerabilities to be detected, and filter out vulnerabilities in the set of vulnerabilities to be detected that contain vulnerability numbers, to obtain the first deduplicated vulnerability set.

[0033] The set of vulnerabilities to be detected can refer to a collection containing multiple vulnerabilities to be detected. These vulnerabilities can be those that need to be checked for duplicates with vulnerabilities already stored in the public vulnerability management platform. The first deduplicated vulnerability set can be the set of vulnerabilities in the set to be detected that has been processed by vulnerability number filtering rules. The first deduplicated vulnerability set can be a subset of the set of vulnerabilities to be detected.

[0034] Specifically, for the set of vulnerabilities to be detected, we can first check whether each vulnerability in the set contains a vulnerability number, filter out the vulnerabilities that contain vulnerability numbers, and the remaining vulnerabilities constitute the first deduplicated vulnerability set.

[0035] In an optional implementation of this embodiment, filtering out vulnerabilities containing vulnerability numbers from the vulnerability set to be detected to obtain a first deduplicated vulnerability set may include: obtaining the vulnerability number field of each vulnerability in the vulnerability set to be detected; if it is determined that the field value of the vulnerability number field of the first target vulnerability is not empty, then filtering out the first target vulnerability from the vulnerability set to be detected.

[0036] The vulnerability number field can be a blank field for entering a vulnerability number. The first target vulnerability can be a vulnerability to be detected that includes a vulnerability number. The field value can be added content to the vulnerability number field, such as CVE (Common Vulnerabilities & Exposures), CNVD (China National Vulnerability Database), and CNNVD (China National Vulnerability Database of Information Security).

[0037] Specifically, the vulnerability number field of each vulnerability in the vulnerability set to be detected can be extracted, and it can be determined whether the field value of the vulnerability number field of the currently processed vulnerability has been added. If the field value of the vulnerability number field of the currently processed vulnerability has been added, that is, the field value is not empty, the vulnerability to be detected can be identified as the first target vulnerability, and the first target vulnerability can be filtered out from the vulnerability set to be detected, thereby obtaining the first deduplicated vulnerability set.

[0038] In another optional embodiment of this example, after filtering out the first target vulnerability from the set of vulnerabilities to be detected, the method may further include: classifying the first target vulnerability as a duplicate vulnerability based on the field value of the vulnerability number field of the first target vulnerability.

[0039] This can be understood as follows: for primary target vulnerabilities that have vulnerability numbers but are still uploaded to the management platform as vulnerabilities to be detected, the current primary target vulnerability can be categorized based on the value of its vulnerability number field. For example, if the value of the vulnerability number field of the primary target vulnerability is a CVE vulnerability number, it is categorized as a CVE vulnerability; if it is a CNVD vulnerability number, it is categorized as a CNVD vulnerability; if it has a CNNVD vulnerability number, it is categorized as a CNNVD vulnerability; if it has other platform vulnerability numbers, it is categorized as other platform vulnerabilities. Specifically, if a primary target vulnerability has two or more vulnerability numbers, it can be categorized as a duplicate vulnerability according to the priority of CVE, CNVD, CNNVD, and other platform vulnerabilities.

[0040] S120. Based on the vulnerability type corresponding to each vulnerability in the first deduplication vulnerability set, obtain the vulnerability description information corresponding to each vulnerability.

[0041] The vulnerability types can include system vulnerabilities provided by network operators to the management platform and product vulnerabilities provided by product providers to the management platform. The vulnerability type for each vulnerability can be determined based on its vulnerability type field. Vulnerability description information can refer to information describing the vulnerability's identity, and may refer to vulnerability characteristic fields. For example, the vulnerability description information for each vulnerability can be shown in Table 1:

[0042] Table 1

[0043]

[0044]

[0045] Specifically, the vulnerability description information of each vulnerability in the first deduplication vulnerability set can be obtained according to its vulnerability type.

[0046] Optionally, based on the vulnerability type corresponding to each vulnerability in the first deduplication vulnerability set, obtaining vulnerability description information corresponding to each vulnerability may include: for the first type of vulnerability in the first deduplication vulnerability set that is a system vulnerability, obtaining the Uniform Resource Locator (URL) and the cause of the system vulnerability as the vulnerability description information; for the second type of vulnerability in the first deduplication vulnerability set that is a product vulnerability, obtaining the company name, product name, product model, product version number, and the cause of the product vulnerability as the vulnerability description information.

[0047] S130. Based on the vulnerability description information corresponding to each vulnerability and the deduplication algorithm matching the vulnerability type, perform secondary deduplication to obtain the second deduplicated vulnerability set.

[0048] The deduplication algorithm can be a deduplication algorithm that matches each vulnerability type. Specifically, the deduplication algorithm can include deduplication algorithms that match system vulnerabilities and deduplication algorithms that match product vulnerabilities. The second deduplication vulnerability set can be the vulnerability set obtained by performing secondary deduplication on the first deduplication vulnerability set according to the deduplication algorithm that matches the vulnerability type. The second deduplication vulnerability set can be a subset of the first deduplication vulnerability set.

[0049] Optionally, the vulnerabilities in the first deduplicated vulnerability set may belong to different vulnerability types. Therefore, the first deduplicated vulnerability set can be deduplicated a second time based on the vulnerability description information corresponding to each vulnerability and the deduplication algorithm that matches different vulnerability types, thereby obtaining the second deduplicated vulnerability set.

[0050] In one optional implementation of this embodiment, secondary deduplication is performed based on the vulnerability description information corresponding to each vulnerability and a deduplication algorithm matching the vulnerability type. This may include: obtaining the target URL corresponding to the target first type vulnerability currently being processed, and querying the management platform to see if there is a stored system vulnerability with the same target URL; if so, obtaining the target vulnerability cause corresponding to the target first type vulnerability, and querying the management platform to see if there is a stored system vulnerability with the same target vulnerability cause; if so, filtering out the target first type vulnerability from the first deduplicated vulnerability set.

[0051] Here, "target Category 1 vulnerability" can refer to one or more system vulnerabilities selected from Category 1 vulnerabilities. "Management platform" can refer to a specific platform used to manage vulnerabilities. The vulnerabilities managed by this platform can include system vulnerabilities and / or product vulnerabilities. For example, there are vulnerability management platforms and enterprise vulnerability management platforms. Vulnerability management platforms can manage both system and product vulnerabilities, while enterprise vulnerability management platforms can manage only product vulnerabilities.

[0052] Specifically, the system can obtain the target URL corresponding to the currently processed Type 1 vulnerability and query the management platform to see if any stored system vulnerabilities share the same target URL. If so, it can further obtain the target vulnerability cause of the current Type 1 vulnerability and similarly query the management platform to see if any stored system vulnerabilities share the same target vulnerability cause. If the cause still exists, it can be determined that the currently processed Type 1 vulnerability needs deduplication, thus filtering it out of the first deduplication vulnerability set. Furthermore, if the management platform does not show any stored system vulnerabilities sharing the same target URL, or if the management platform does not show any stored system vulnerabilities sharing the same target vulnerability cause, the current Type 1 vulnerability can be designated as a vulnerability in the second deduplication vulnerability set.

[0053] In another optional implementation of this embodiment, secondary deduplication is performed based on the vulnerability description information corresponding to each vulnerability and a deduplication algorithm matching the vulnerability type, which may further include:

[0054] Obtain the target company name corresponding to the currently processed target type 2 vulnerability, and query the management platform to see if there are any stored product vulnerabilities with the same target company name; if so, obtain the target product name corresponding to the currently processed target type 2 vulnerability, and query the management platform to see if there are any stored product vulnerabilities with the same target product name; if so, obtain the target product model corresponding to the currently processed target type 2 vulnerability, and query the management platform to see if there are any stored product vulnerabilities with the same target product model; if so, obtain the target product version number corresponding to the currently processed target type 2 vulnerability, and query the management platform to see if there are any stored product vulnerabilities with the same target product version number; if so, obtain the target product vulnerability cause corresponding to the currently processed target type 2 vulnerability, and query the management platform to see if there are any stored product vulnerabilities with the same target product vulnerability cause; if so, filter out the target type 2 vulnerability from the first deduplicated vulnerability set.

[0055] Among them, the target type 2 vulnerability can refer to one or more product vulnerabilities selected from the type 2 vulnerabilities.

[0056] In this embodiment, the vulnerability description information corresponding to the target second type vulnerability, including the target company name, target product name, target product model, target product version number, and target product vulnerability cause, can be queried through the product vulnerabilities stored in the management platform. If the aforementioned five types of vulnerability description information corresponding to the target second type vulnerability being processed are all the same as a certain product vulnerability stored in the management platform, it can be determined that the target second type vulnerability being processed needs to be deduplicated, thereby filtering out the current target second type vulnerability from the first deduplication vulnerability set.

[0057] Accordingly, if the vulnerability description information of a target type II vulnerability differs from at least one of the product vulnerabilities already stored in the management platform, then the current target type II vulnerability can be identified as one of the vulnerabilities in the second deduplication vulnerability set. Furthermore, during the process of querying the vulnerability description information of each target type II vulnerability, if there is a vulnerability description information that is completely different from all the product vulnerabilities already stored in the management platform, then the query for the current target type II vulnerability can be discontinued. The advantage of this setting is that it reduces the workload of vulnerability deduplication.

[0058] For example, Figure 1B This diagram illustrates a specific application scenario of vulnerability deduplication in a vulnerability management platform provided in Embodiment 1 of the present invention.

[0059] The vulnerability management platform can manage system vulnerabilities and product vulnerabilities. After obtaining the vulnerability data source (i.e., the set of vulnerabilities to be detected), it can determine whether each vulnerability has a vulnerability number. For vulnerabilities containing vulnerability numbers, it can classify them as duplicate vulnerabilities. For vulnerabilities that do not contain vulnerability numbers (i.e., the first set of deduplicated vulnerabilities), it can execute a matching deduplication algorithm according to the vulnerability type.

[0060] For system vulnerabilities, the corresponding URL can be obtained, and the vulnerability management platform can be queried to see if there are any stored system vulnerabilities with the same URL. If not, the current system vulnerability can be identified as a non-duplicate vulnerability (i.e., a second deduplication vulnerability). If it exists, the corresponding system vulnerability cause can be obtained, and the vulnerability management platform can be queried to see if there are any stored system vulnerabilities with the same cause. If it exists, it means that the system vulnerability being processed can be found in the vulnerability management platform as a stored vulnerability with the same URL and cause. Therefore, the system vulnerability can be confirmed as an original vulnerability duplication, and an association annotation operation can be performed. If it does not exist, the current system vulnerability can be identified as a non-duplicate vulnerability. The association annotation operation can refer to associating the vulnerability number field of the system vulnerability with the vulnerability number of a stored vulnerability that is identical to the system vulnerability, thereby confirming the original duplicate vulnerability.

[0061] For product vulnerabilities, similar to system vulnerabilities, the vulnerability management platform can be used to check if there are any existing vulnerabilities with the same company name, product name, product model, product version number, and vulnerability cause as the current product vulnerability. If no existing vulnerabilities with the same information can be found, the product vulnerability can be identified as a non-duplicate vulnerability. If existing vulnerabilities with completely identical vulnerability descriptions can be found, the product vulnerability can be confirmed as an original vulnerability duplication, just like system vulnerabilities.

[0062] in, Figure 1C This is a schematic diagram of an original vulnerability duplication confirmation process interface provided in Embodiment 1 of the present invention. The program automatically inputs the name of the current vulnerability, the URL involved, the cause of the vulnerability, and the name, URL involved, and cause of existing vulnerabilities to facilitate comparison by operations personnel. Figure 1C As shown, vulnerability operators fill in review comments based on the details of the vulnerability, such as "This vulnerability is a duplicate vulnerability after review" or "This vulnerability is a non-duplicate vulnerability after review", and perform the "duplicate vulnerability", "non-duplicate vulnerability" or "cancel" operation on this vulnerability.

[0063] Correspondingly, Figure 1DThis invention provides a schematic diagram of an original vulnerability duplication confirmation process interface for product vulnerabilities in Embodiment 1. The program automatically inputs the name of the current vulnerability, the product model involved, the product version number involved, the cause of the vulnerability, as well as the name, product model involved, product version number involved, and cause of existing vulnerabilities, facilitating comparison by operations personnel. Figure 1D As shown, vulnerability operators fill in review comments based on the details of the vulnerability, such as "This vulnerability is a duplicate vulnerability after review" or "This vulnerability is a non-duplicate vulnerability after review", and perform the "duplicate vulnerability", "non-duplicate vulnerability" or "cancel" operation on this vulnerability.

[0064] For example, Figure 1E This diagram illustrates a specific application scenario of vulnerability deduplication in an enterprise vulnerability management platform according to Embodiment 1 of the present invention. The enterprise vulnerability management platform can manage product vulnerabilities. After obtaining the vulnerability data source (i.e., the set of vulnerabilities to be detected), it can determine whether each vulnerability has a vulnerability number. For vulnerabilities containing vulnerability numbers, duplicate vulnerabilities are categorized. For vulnerabilities not containing vulnerability numbers (i.e., the first set of deduplicated vulnerabilities), a matching deduplication algorithm can be executed on the product vulnerabilities. This deduplication algorithm is similar to the deduplication algorithm for product vulnerabilities described above by the vulnerability management platform.

[0065] The technical solution of this embodiment obtains a set of vulnerabilities to be detected and filters out vulnerabilities containing vulnerability numbers in the set to be detected to obtain a first deduplicated vulnerability set; according to the vulnerability type corresponding to each vulnerability in the first deduplicated vulnerability set, obtain vulnerability description information corresponding to each vulnerability; and perform secondary deduplication according to the vulnerability description information corresponding to each vulnerability and a deduplication algorithm matching the vulnerability type to obtain a second deduplicated vulnerability set. This solves the problem in the prior art where deduplication of vulnerabilities with an exponentially increasing number is carried out by operators of various management platforms, resulting in a large amount of manpower and time consumption. This achieves the effect of saving manpower and time and effectively developing a vulnerability management method.

[0066] Example 2

[0067] Figure 2A This is a flowchart of another vulnerability deduplication method provided in Embodiment 2 of the present invention. Based on the above embodiments, this embodiment preferably adds further operations after performing secondary deduplication based on the vulnerability description information corresponding to each vulnerability and a deduplication algorithm matching the vulnerability type to obtain a second deduplicated vulnerability set. This method is executed by a vulnerability management platform or an enterprise vulnerability management platform, and specifically includes the following steps:

[0068] S210. Obtain the set of vulnerabilities to be detected, and filter out vulnerabilities in the set of vulnerabilities to be detected that contain vulnerability numbers, to obtain the first deduplicated vulnerability set.

[0069] S220. Based on the vulnerability type corresponding to each vulnerability in the first deduplication vulnerability set, obtain the vulnerability description information corresponding to each vulnerability.

[0070] S230. Based on the vulnerability description information corresponding to each vulnerability and the deduplication algorithm matching the vulnerability type, perform secondary deduplication to obtain a second deduplicated vulnerability set.

[0071] S240. Send each vulnerability in the second deduplication vulnerability set to the audit platform for audit and verification, and obtain the audit and verification results corresponding to each vulnerability.

[0072] S250. If executed by the vulnerability management platform, each vulnerability described shall be archived, processed, and released in sequence according to the audit and verification results.

[0073] Specifically, the system can obtain the verification results of each vulnerability in the second deduplication vulnerability set, which can include pass or fail. When the vulnerability management platform executes the vulnerability deduplication process, if the verification result is pass, the currently processed vulnerability can be archived, handled, and published sequentially. Conversely, if the verification result is fail, the current vulnerability can be determined to be a non-vulnerable vulnerability, which can be understood as the current vulnerability being falsely reported to the vulnerability management platform.

[0074] For example, Figure 2B This diagram illustrates a specific application scenario of a vulnerability deduplication method executed by a vulnerability management platform, as provided in Embodiment 2 of the present invention. Vulnerabilities reported by network product providers or individuals, after passing a formal review, enter the vulnerability deduplication module for deduplication. Vulnerabilities with CVE numbers, CNVD numbers, CNNVD numbers, and other platform numbers are identified as duplicate vulnerabilities and archived. Duplicate original vulnerabilities undergo manual verification. If a vulnerability is determined to be non-duplicate, it undergoes vulnerability verification. If verification fails, the vulnerability is rejected; if verification passes, the non-duplicate vulnerability can proceed through the vulnerability management process, including archiving, handling, and publication. Regarding the handling process, if a non-duplicate vulnerability is not handled promptly, it can be announced through the vulnerability management platform; if it is handled promptly, it can be further published. Network operator vulnerabilities (i.e., system vulnerabilities) are not published, while product vulnerabilities are published and a vulnerability list is generated.

[0075] S260. If executed by the enterprise vulnerability management platform, each vulnerability shall be classified, repaired, and retested in sequence according to the audit and verification results.

[0076] Specifically, when the enterprise vulnerability management platform executes the vulnerability deduplication process, if the verification result is satisfactory, the currently processed vulnerability can be classified, patched, and retested sequentially. Conversely, if the verification result is unsatisfactory, the current vulnerability can be considered a non-vulnerability, meaning that the current vulnerability was mistakenly reported to the enterprise vulnerability management platform.

[0077] For example, Figure 2C This diagram illustrates a specific application scenario of a vulnerability deduplication method executed by an enterprise vulnerability management platform, as provided in Embodiment 2 of the present invention. Enterprises obtain vulnerabilities in their products or assets from various crowdsourcing platforms, vulnerability scanning, and vulnerability mining. After extracting vulnerability feature fields from these vulnerabilities, they are processed by a vulnerability deduplication module. Vulnerabilities with CVE numbers, CNVD numbers, CNNVD numbers, and other platform numbers are identified as duplicate vulnerabilities and archived. Duplicate original vulnerabilities are manually verified. If a vulnerability is determined to be non-duplicate, it undergoes vulnerability review. If the review fails, the vulnerability is considered a false alarm. If the review passes, the non-duplicate vulnerability can be sequentially classified, patched, and retested as part of the vulnerability management process. Specifically, for the vulnerability classification process, the vulnerability can be classified based on its impact on various dimensions, and real-time warnings can be issued based on the classification. For the vulnerability patching process, timeout warning rules can be set for vulnerabilities that are not patched in a timely manner, and timely patched vulnerabilities can undergo further retesting to close the vulnerability.

[0078] The technical solution of this embodiment obtains a set of vulnerabilities to be detected and filters out vulnerabilities containing vulnerability numbers from the set to be detected, thus obtaining a first deduplicated vulnerability set; based on the vulnerability type corresponding to each vulnerability in the first deduplicated vulnerability set, obtain vulnerability description information corresponding to each vulnerability; based on the vulnerability description information corresponding to each vulnerability and a deduplication algorithm matching the vulnerability type, perform secondary deduplication to obtain a second deduplicated vulnerability set; send each vulnerability in the second deduplicated vulnerability set to an auditing platform for audit verification and obtain the audit verification results corresponding to each vulnerability; if executed by a vulnerability management platform, archive, handle, and publish each vulnerability sequentially based on the audit verification results; if executed by an enterprise vulnerability management platform, classify, repair, and retest each vulnerability sequentially based on the audit verification results. This technical means solves the problem in the prior art where deduplication of an exponentially increasing number of vulnerabilities is carried out by operators of various management platforms, resulting in a large amount of manpower and time consumption, thus achieving the effect of saving manpower and time and effectively developing vulnerability management methods.

[0079] Example 3

[0080] Figure 3This is a schematic diagram of a vulnerability deduplication processing device provided in Embodiment 3 of the present invention. This device can execute the vulnerability deduplication processing method provided in any embodiment of the present invention. (See reference...) Figure 3 The device includes: a first deduplication vulnerability set acquisition module 310, a vulnerability description information acquisition module 320, and a second deduplication vulnerability set acquisition module 330. Wherein:

[0081] The first deduplication vulnerability set acquisition module 310 is used to acquire the vulnerability set to be detected and filter out the vulnerabilities in the vulnerability set to be detected that contain vulnerability numbers, so as to obtain the first deduplication vulnerability set.

[0082] The vulnerability description information acquisition module 320 is used to acquire vulnerability description information corresponding to each vulnerability according to the vulnerability type corresponding to each vulnerability in the first deduplicated vulnerability set.

[0083] The second deduplication vulnerability set acquisition module 330 is used to perform secondary deduplication based on the vulnerability description information corresponding to each vulnerability and the deduplication algorithm matching the vulnerability type, so as to obtain the second deduplication vulnerability set.

[0084] The technical solution of this embodiment obtains a set of vulnerabilities to be detected and filters out vulnerabilities containing vulnerability numbers in the set to be detected to obtain a first deduplicated vulnerability set; according to the vulnerability type corresponding to each vulnerability in the first deduplicated vulnerability set, obtain vulnerability description information corresponding to each vulnerability; and perform secondary deduplication according to the vulnerability description information corresponding to each vulnerability and a deduplication algorithm matching the vulnerability type to obtain a second deduplicated vulnerability set. This solves the problem in the prior art where deduplication of vulnerabilities with an exponentially increasing number is carried out by operators of various management platforms, resulting in a large amount of manpower and time consumption. This achieves the effect of saving manpower and time and effectively developing a vulnerability management method.

[0085] Optionally, in the above-mentioned apparatus, the first deduplication vulnerability set acquisition module 310 may include:

[0086] The vulnerability number field acquisition unit is used to acquire the vulnerability number field of each vulnerability in the vulnerability set to be detected;

[0087] The first target vulnerability filtering unit is used to filter out the first target vulnerability from the set of vulnerabilities to be detected if the field value of the vulnerability number field of the first target vulnerability is determined to be non-empty.

[0088] Optionally, the above-described apparatus may further include a first target vulnerability classification module, used after filtering out the first target vulnerability from the set of vulnerabilities to be detected:

[0089] Based on the field value of the vulnerability number field of the first target vulnerability, the first target vulnerability is classified as a duplicate vulnerability.

[0090] Optionally, in the above-mentioned device, the vulnerability description information acquisition module 320 can be used for:

[0091] For the first type of vulnerability in the first deduplication vulnerability set that is a system vulnerability, the Uniform Resource Locator URL and the cause of the system vulnerability are obtained as the vulnerability description information.

[0092] For the second type of vulnerability in the first deduplication vulnerability set that is a product vulnerability, the company name, product name, product model, product version number, and product vulnerability cause are obtained as the vulnerability description information.

[0093] Optionally, in the above-mentioned device, the second deduplication vulnerability set acquisition module 330 can be used for:

[0094] Obtain the target URL corresponding to the first type of vulnerability currently being processed, and query the management platform to see if there are any stored system vulnerabilities that are the same as the target URL;

[0095] If so, obtain the cause of the target vulnerability corresponding to the first type of target vulnerability, and query the management platform to see if there is a stored system vulnerability with the same cause as the target vulnerability.

[0096] If so, then the target first type of vulnerability will be filtered out from the first deduplication vulnerability set.

[0097] Optionally, the second deduplication vulnerability set acquisition module 330 in the above-mentioned device can also be used for:

[0098] Obtain the target company name corresponding to the currently processed Type II vulnerability, and query the management platform to see if there are any stored product vulnerabilities with the same target company name;

[0099] If so, obtain the target product name corresponding to the target second type vulnerability currently being processed, and query the management platform to see if there is a stored product vulnerability with the same target product name;

[0100] If so, obtain the target product model corresponding to the target second type vulnerability currently being processed, and query the management platform to see if there is a stored product vulnerability with the same target product model;

[0101] If so, obtain the target product version number corresponding to the target second type vulnerability currently being processed, and query the management platform to see if there is a stored product vulnerability with the same target product version number;

[0102] If so, obtain the cause of the target product vulnerability corresponding to the target second type vulnerability currently being processed, and query in the management platform whether there are any stored product vulnerabilities with the same cause of the target product vulnerability.

[0103] If so, then the target second type of vulnerability will be filtered out from the first deduplication vulnerability set.

[0104] Optionally, the above-mentioned device also includes a vulnerability processing module, which is executed by a vulnerability management platform or an enterprise vulnerability management platform to perform secondary deduplication based on the vulnerability description information corresponding to each vulnerability and a deduplication algorithm matching the vulnerability type, to obtain a second deduplicated vulnerability set:

[0105] Each vulnerability in the second deduplication vulnerability set is sent to the auditing platform for auditing and verification, and the auditing and verification results corresponding to each vulnerability are obtained.

[0106] If executed by the vulnerability management platform, each vulnerability will be archived, processed, and released sequentially based on the audit and verification results.

[0107] If executed by the enterprise vulnerability management platform, each vulnerability will be classified, repaired, and retested in sequence according to the audit and verification results.

[0108] The vulnerability deduplication processing device provided in the embodiments of the present invention can execute the vulnerability deduplication processing method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0109] Example 4

[0110] Figure 4 This is a schematic diagram of the structure of a computer device provided in Embodiment 4 of the present invention, as shown below. Figure 4 As shown, the device includes a processor 410, a storage device 420, an input device 430, and an output device 440; the number of processors 410 in the device can be one or more. Figure 4 Taking a processor 410 as an example; the processor 410, storage device 420, input device 430 and output device 440 in the device can be connected via a bus or other means. Figure 4 Taking the example of a connection between China and Israel via a bus.

[0111] Storage device 420, as a computer-readable storage medium, can be used to store software programs, computer-executable programs, and modules, such as the program instructions / modules corresponding to the vulnerability deduplication processing method in this embodiment of the invention (e.g., the first deduplication vulnerability set acquisition module 310, the vulnerability description information acquisition module 320, and the second deduplication vulnerability set acquisition module 330 in the vulnerability deduplication processing device). Processor 410 executes various functional applications and data processing of the device / terminal / server by running the software programs, instructions, and modules stored in storage device 420, thereby implementing the aforementioned vulnerability deduplication processing method, which may include:

[0112] Obtain the set of vulnerabilities to be detected, and filter out vulnerabilities in the set of vulnerabilities to be detected that contain vulnerability numbers to obtain the first deduplicated vulnerability set;

[0113] Based on the vulnerability type corresponding to each vulnerability in the first deduplication vulnerability set, obtain the vulnerability description information corresponding to each vulnerability.

[0114] Based on the vulnerability description information corresponding to each vulnerability and the deduplication algorithm matching the vulnerability type, a second deduplication is performed to obtain a second deduplicated vulnerability set.

[0115] Storage device 420 may primarily include a program storage area and a data storage area. The program storage area may store the operating system and at least one application program required for a given function; the data storage area may store data created based on terminal usage. Furthermore, storage device 420 may include high-speed random access memory and non-volatile memory, such as at least one disk storage device, flash memory, or other non-volatile solid-state storage device. In some instances, storage device 420 may further include memory remotely located relative to processor 410, which can be connected to the device via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0116] Input device 430 can be used to receive input digital or character information, and to generate key signal inputs related to user settings and function control of the device. Output device 440 may include display devices such as a display screen.

[0117] Example 5

[0118] Embodiment 5 of the present invention also provides a computer-readable storage medium having a computer program stored thereon. When executed by a computer processor, the program is used to perform a method for deduplication of vulnerabilities. This method may include:

[0119] Obtain the set of vulnerabilities to be detected, and filter out vulnerabilities in the set of vulnerabilities to be detected that contain vulnerability numbers to obtain the first deduplicated vulnerability set;

[0120] Based on the vulnerability type corresponding to each vulnerability in the first deduplication vulnerability set, obtain the vulnerability description information corresponding to each vulnerability.

[0121] Based on the vulnerability description information corresponding to each vulnerability and the deduplication algorithm matching the vulnerability type, a second deduplication is performed to obtain a second deduplicated vulnerability set.

[0122] Of course, the computer-readable storage medium provided in the embodiments of the present invention stores a computer program thereon. The program is not limited to the method operation described above, but can also perform related operations in the deduplication processing method for vulnerabilities provided in any embodiment of the present invention.

[0123] Based on the above description of the implementation methods, those skilled in the art can clearly understand that the present invention can be implemented using software and necessary general-purpose hardware, and of course, it can also be implemented using hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk, or optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0124] It is worth noting that in the embodiments of the above-mentioned deduplication processing device, the various units and modules included are only divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be achieved; in addition, the specific names of each functional unit are only for easy differentiation and are not used to limit the scope of protection of the present invention.

[0125] Note that the above description is merely a preferred embodiment of the present invention and the technical principles employed. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and various obvious changes, readjustments, and substitutions can be made without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in detail through the above embodiments, the present invention is not limited to the above embodiments, and may include many other equivalent embodiments without departing from the concept of the present invention, the scope of which is determined by the scope of the appended claims.

Claims

1. A method for deduplication of vulnerabilities, characterized in that, include: Obtain the set of vulnerabilities to be detected, and filter out vulnerabilities in the set of vulnerabilities to be detected that contain vulnerability numbers to obtain the first deduplicated vulnerability set; Based on the vulnerability type corresponding to each vulnerability in the first deduplication vulnerability set, obtain the vulnerability description information corresponding to each vulnerability. Based on the vulnerability description information corresponding to each vulnerability and the deduplication algorithm matching the vulnerability type, a second deduplication is performed to obtain a second deduplicated vulnerability set. Specifically, based on the vulnerability type corresponding to each vulnerability in the first deduplication vulnerability set, vulnerability description information corresponding to each vulnerability is obtained, including: for the first type of vulnerability in the first deduplication vulnerability set that is a system vulnerability, obtaining the Uniform Resource Locator (URL) and the cause of the system vulnerability as vulnerability description information; for the second type of vulnerability in the first deduplication vulnerability set that is a product vulnerability, obtaining the company name, product name, product model, product version number, and the cause of the product vulnerability as vulnerability description information. Based on the vulnerability description information corresponding to each vulnerability and the deduplication algorithm matching the vulnerability type, a second deduplication is performed to obtain a second deduplicated vulnerability set. This includes: obtaining the target URL corresponding to the currently processed target type 1 vulnerability, and querying the management platform to see if there are any stored system vulnerabilities with the same target URL; if so, obtaining the target system vulnerability cause corresponding to the target type 1 vulnerability, and querying the management platform to see if there are any stored system vulnerabilities with the same target system vulnerability cause; if so, filtering out the target type 1 vulnerability from the first deduplicated vulnerability set; obtaining the target enterprise name corresponding to the currently processed target type 2 vulnerability, and querying the management platform to see if there are any stored product vulnerabilities with the same target enterprise name; if so, obtaining the target enterprise name corresponding to the currently processed target type 2 vulnerability. The system retrieves the target product name corresponding to the currently processed Type II vulnerability and checks the management platform to see if there are any stored product vulnerabilities with the same target product name. If so, it retrieves the target product model corresponding to the currently processed Type II vulnerability and checks the management platform to see if there are any stored product vulnerabilities with the same target product model. If so, it retrieves the target product version number corresponding to the currently processed Type II vulnerability and checks the management platform to see if there are any stored product vulnerabilities with the same target product version number. If so, it retrieves the target product vulnerability cause corresponding to the currently processed Type II vulnerability and checks the management platform to see if there are any stored product vulnerabilities with the same target product vulnerability cause. If so, the target Type II vulnerability is filtered out from the first deduplicated vulnerability set.

2. The method according to claim 1, characterized in that, After filtering out vulnerabilities containing vulnerability numbers from the vulnerability set to be detected, a first deduplicated vulnerability set is obtained, including: Obtain the vulnerability number field of each vulnerability in the set of vulnerabilities to be detected; If the value of the vulnerability number field of the first target vulnerability is determined to be non-empty, then the first target vulnerability is filtered out from the set of vulnerabilities to be detected.

3. The method according to claim 2, characterized in that, After filtering out the first target vulnerability from the set of vulnerabilities to be detected, the method further includes: Based on the field value of the vulnerability number field of the first target vulnerability, the first target vulnerability is classified as a duplicate vulnerability.

4. The method according to any one of claims 1-3, characterized in that, After the vulnerability management platform or enterprise vulnerability management platform performs secondary deduplication based on the vulnerability description information corresponding to each vulnerability and a deduplication algorithm matching the vulnerability type to obtain the second deduplicated vulnerability set, it also includes: Each vulnerability in the second deduplication vulnerability set is sent to the auditing platform for auditing and verification, and the auditing and verification results corresponding to each vulnerability are obtained. If executed by the vulnerability management platform, each vulnerability will be archived, processed, and released sequentially based on the audit and verification results. If executed by the enterprise vulnerability management platform, each vulnerability will be classified, repaired, and retested in sequence according to the audit and verification results.

5. A deduplication device for vulnerabilities, characterized in that, include: The first deduplication vulnerability set acquisition module is used to acquire the vulnerability set to be detected and filter out the vulnerabilities in the vulnerability set to be detected that contain vulnerability numbers, so as to obtain the first deduplication vulnerability set. The vulnerability description information acquisition module is used to acquire vulnerability description information corresponding to each vulnerability according to the vulnerability type corresponding to each vulnerability in the first deduplicated vulnerability set. The second deduplication vulnerability set acquisition module is used to perform secondary deduplication based on the vulnerability description information corresponding to each vulnerability and the deduplication algorithm matching the vulnerability type to obtain the second deduplication vulnerability set. Specifically, the vulnerability description information acquisition module is used to: for the first type of vulnerability in the first deduplication vulnerability set that is a system vulnerability, obtain the Uniform Resource Locator URL and the cause of the system vulnerability as vulnerability description information; for the second type of vulnerability in the first deduplication vulnerability set that is a product vulnerability, obtain the company name, product name, product model, product version number and the cause of the product vulnerability as vulnerability description information. The second deduplication vulnerability set acquisition module is specifically used for: acquiring the target URL corresponding to the target first type vulnerability currently being processed, and querying the management platform to see if there is a stored system vulnerability with the same target URL; if so, acquiring the target system vulnerability cause corresponding to the target first type vulnerability, and querying the management platform to see if there is a stored system vulnerability with the same target system vulnerability cause; if so, filtering out the target first type vulnerability from the first deduplication vulnerability set. Obtain the target company name corresponding to the currently processed target type 2 vulnerability, and query the management platform to see if there are any stored product vulnerabilities with the same target company name; if so, obtain the target product name corresponding to the currently processed target type 2 vulnerability, and query the management platform to see if there are any stored product vulnerabilities with the same target product name; if so, obtain the target product model corresponding to the currently processed target type 2 vulnerability, and query the management platform to see if there are any stored product vulnerabilities with the same target product model; if so, obtain the target product version number corresponding to the currently processed target type 2 vulnerability, and query the management platform to see if there are any stored product vulnerabilities with the same target product version number; if so, obtain the target product vulnerability cause corresponding to the currently processed target type 2 vulnerability, and query the management platform to see if there are any stored product vulnerabilities with the same target product vulnerability cause; if so, filter out the target type 2 vulnerability from the first deduplicated vulnerability set.

6. A computer device, characterized in that, The computer device includes: One or more processors; Storage device for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the deduplication method for the vulnerability as described in any one of claims 1-4.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the deduplication method for the vulnerability as described in any one of claims 1-4.

Images