A method and device for determining the validity of a target vulnerability

Abstract

The present invention discloses a method and device for determining the validity of a target vulnerability, including: obtaining first vulnerability description information corresponding to each of a plurality of invalid vulnerabilities; based on the first vulnerability description information, obtaining multiple invalid label information corresponding to each of the plurality of invalid vulnerabilities and corresponding first feature information; determining multiple invalid types and second feature information corresponding to each of the plurality of invalid types according to the plurality of invalid label information and the first feature information; constructing a validity prediction model based on the plurality of invalid types and the second feature information; obtaining the validity information of the target vulnerability according to the second vulnerability description information of the target vulnerability and the validity prediction model. According to the technical solution of the present invention, the validity information of the target vulnerability is obtained according to the second vulnerability description information of the target vulnerability and the validity prediction model, the validity of the target vulnerability can be predicted, the invalid vulnerability can be identified, and the security risks brought by the invalid vulnerability to the database can be avoided.

Description

Technical Field

[0001] The present invention relates to the field of computer network technology, and in particular to a method and device for determining the validity of a target vulnerability. Background Art

[0002] Software vulnerabilities are exploitable flaws in software systems that pose a security threat to computing information systems. Users often suffer from software vulnerabilities because software is inevitably exposed to them. Once a vulnerability is discovered and verified, it is recorded and made public through a vulnerability database. One of the most influential vulnerability databases is CVE (Common Vulnerabilities & Exposures), which is designed to allow different vulnerability databases and other functions to be linked together. CVE provides a standardized identifier for a given vulnerability and maintains common identifiers for numerous known public network security vulnerabilities. Although CVE is a database, for convenience, it is also often used for references to vulnerability reports (i.e., every vulnerability report is a CVE or CVE entry).

[0003] In this work, we focus on invalid vulnerability reports (i.e., rejected CVEs or CVEs that were controversially accepted and then rejected), which are usually submitted with low-quality descriptions, and the corresponding vulnerabilities cannot be described in the report, are not easy to verify, cannot be reproduced, or do not really affect security. The reason for being interested in invalid vulnerability reports is that these reports may bring a lot of trouble to the CVE ecosystem. In fact, when a vulnerability report is submitted, a certain number of professionals need to be assigned to verify the vulnerability. If it turns out that the vulnerability is an invalid case, it is actually a waste of a lot of effort to confirm this invalidity. Even worse, CVEs may be rejected due to lack of sufficient description to reproduce the vulnerability, while these vulnerabilities are actually valid vulnerabilities.

[0004] These invalid CVEs (which will not be patched because they are judged invalid) will actually open opportunities for attackers to exploit them. Moreover, although invalid CVEs may not actually pose a security threat to the software, they may still affect the reputation of the software. Summary of the invention

[0005] The purpose of the present invention is to provide a method and device for determining the validity of a target vulnerability, by obtaining multiple invalid label information and corresponding first feature information corresponding to each of the multiple invalid vulnerabilities based on the first vulnerability description information corresponding to each of the multiple invalid vulnerabilities, determining multiple invalid types and second feature information corresponding to each invalid type according to the multiple invalid label information and the first feature information, constructing a validity prediction model based on the multiple invalid types and the second feature information, and obtaining the validity information of the target vulnerability according to the second vulnerability description information of the target vulnerability and the validity prediction model. The validity of the target vulnerability can be predicted, the invalid vulnerability can be identified, and the security risks caused by the invalid vulnerability to the database can be avoided.

[0006] To achieve the above object, the present invention provides the following solutions:

[0007] A method for determining the validity of a target vulnerability, the method comprising:

[0008] Obtain first vulnerability description information corresponding to each of the multiple invalid vulnerabilities;

[0009] Based on the first vulnerability description information, obtain multiple invalid label information and corresponding first feature information corresponding to each of the multiple invalid vulnerabilities;

[0010] Determine, according to the multiple invalid tag information and the first feature information, multiple invalid types and second feature information corresponding to each of the multiple invalid types;

[0011] Based on the multiple invalid types and the second feature information, construct a validity prediction model;

[0012] According to the second vulnerability description information of the target vulnerability and the validity prediction model, the validity information of the target vulnerability is obtained.

[0013] Optionally, determining, according to the multiple invalid tag information and the first feature information, multiple invalid types and second feature information corresponding to each of the multiple invalid types includes:

[0014] Perform classification processing according to the multiple invalid label information to obtain the multiple invalid types;

[0015] Obtaining first vulnerability description information corresponding to a target invalid type, where the target invalid type is any one of the multiple invalid types;

[0016] Based on the first vulnerability description information corresponding to the target invalid type, second feature information corresponding to the target invalid type is obtained.

[0017] Optionally, obtaining the validity information of the target vulnerability according to the second vulnerability description information of the target vulnerability and the validity prediction model includes:

[0018] Perform feature extraction processing according to the second vulnerability description information to obtain third feature information of the target vulnerability;

[0019] The third feature information is input into the effectiveness prediction model to obtain the effectiveness information.

[0020] Optionally, performing feature extraction processing according to the second vulnerability description information to obtain third feature information of the target vulnerability includes:

[0021] Preprocessing the second vulnerability description information to obtain a plurality of second feature words and second information gains corresponding to the plurality of second feature words;

[0022] Based on the plurality of second feature words and the second information gain, a plurality of second target feature words are determined, and the plurality of second target feature words are used as the third feature information.

[0023] Optionally, constructing a validity prediction model based on the multiple invalid types and the second feature information includes:

[0024] Taking multiple second feature information as sample information, taking invalidity types corresponding to each of the multiple second feature information as label information, inputting the information into a preset machine learning model, performing validity prediction processing, and obtaining validity prediction information;

[0025] Obtaining validity loss information according to the validity prediction information and the label information;

[0026] The preset machine learning model is trained according to the effectiveness loss information to obtain the effectiveness prediction model.

[0027] Optionally, the acquiring, based on the first vulnerability description information, first feature information corresponding to each of the plurality of invalid vulnerabilities includes:

[0028] Preprocessing the first vulnerability description information to obtain a plurality of first feature words and first information gains corresponding to the plurality of first feature words;

[0029] Based on the multiple first feature words and the first information gain, multiple first target feature words are determined, and the multiple first target feature words are used as the first feature information.

[0030] Optionally, the obtaining first vulnerability description information corresponding to each of the multiple invalid vulnerabilities includes:

[0031] Use a crawler to crawl and obtain multiple vulnerabilities and their corresponding third vulnerability description information;

[0032] Obtaining vulnerabilities whose validity information is invalid from among the multiple vulnerabilities;

[0033] The vulnerabilities whose validity information is invalid are regarded as invalid vulnerabilities, and the third vulnerability description information corresponding to each of the vulnerabilities whose validity information is invalid is regarded as the first vulnerability description information.

[0034] On the other hand, the present invention also provides a device for determining the validity of a target vulnerability, the device comprising:

[0035] A first information acquisition module, used to acquire first vulnerability description information corresponding to each of the multiple invalid vulnerabilities;

[0036] A second information acquisition module, configured to acquire, based on the first vulnerability description information, a plurality of invalid label information corresponding to each of the plurality of invalid vulnerabilities and corresponding first feature information;

[0037] An information determination module, configured to determine a plurality of invalid types and second characteristic information corresponding to each of the plurality of invalid types according to the plurality of invalid tag information and the first characteristic information;

[0038] A model building module, used for building a validity prediction model based on the multiple invalid types and the second feature information;

[0039] The validity information acquisition module is used to obtain the validity information of the target vulnerability according to the second vulnerability description information of the target vulnerability and the validity prediction model.

[0040] On the other hand, the present invention also provides an electronic device, comprising: a processor; a memory for storing processor executable instructions; wherein the processor is configured to execute the above-mentioned method for determining the validity of the target vulnerability.

[0041] On the other hand, the present invention also provides a non-volatile computer-readable storage medium having computer program instructions stored thereon, wherein the computer program instructions, when executed by a processor, implement the method for determining the validity of the above-mentioned target vulnerability.

[0042] The present invention provides a method and device for determining the validity of a target vulnerability. The method and device obtain multiple invalid label information and corresponding first feature information corresponding to each of the multiple invalid vulnerabilities based on the first vulnerability description information corresponding to each of the multiple invalid vulnerabilities, determine multiple invalid types and second feature information corresponding to each invalid type based on the multiple invalid label information and the first feature information, build a validity prediction model based on the multiple invalid types and the second feature information, obtain the validity information of the target vulnerability based on the second vulnerability description information of the target vulnerability and the validity prediction model, and predict the validity of the target vulnerability, thereby realizing the identification of invalid vulnerabilities and avoiding the security risks of invalid vulnerabilities to the database. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solution of the present invention, the following briefly introduces the drawings required for use in the embodiments or prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention, and those skilled in the art can obtain other drawings based on these drawings without creative work.

[0044] Figure 1 is a method flow chart of a method for determining the validity of a target vulnerability provided by an embodiment of the present invention;

[0045] Figure 2 It is a flow chart of a method for determining multiple invalid types and second characteristic information corresponding to each of the multiple invalid types according to multiple invalid tag information and first characteristic information provided by an embodiment of the present invention;

[0046] Figure 3 It is a flow chart of a method for obtaining validity information of a target vulnerability according to second vulnerability description information of the target vulnerability and a validity prediction model provided by an embodiment of the present invention;

[0047] Figure 4 It is a flow chart of a method provided by an embodiment of the present invention for performing feature extraction processing according to second vulnerability description information to obtain third feature information of a target vulnerability;

[0048] Figure 5 It is a flow chart of a method for constructing a validity prediction model based on multiple invalid types and second feature information provided by an embodiment of the present invention;

[0049] Figure 6 It is a flow chart of a method for obtaining first feature information corresponding to each of a plurality of invalid vulnerabilities based on first vulnerability description information provided by an embodiment of the present invention;

[0050] Figure 7 It is a flow chart of a method for obtaining first vulnerability description information corresponding to each of a plurality of invalid vulnerabilities provided by an embodiment of the present invention;

[0051] Figure 8 It is a structural block diagram of a device for determining the validity of a target vulnerability provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0052] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0053] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0054] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0055] The following describes an embodiment of a method for determining the validity of a target vulnerability of the present invention. Figure 1 It is a method flow chart of a method for determining the effectiveness of a target vulnerability provided by an embodiment of the present invention. It should be noted that this specification provides method operation steps as described in the embodiment or flow chart, but may include more or fewer operation steps based on conventional or non-creative labor. The order of steps listed in the embodiment is only one way of executing the steps among many orders, and does not represent the only order of execution. When the actual system product is executed, it can be executed in the order of the method shown in the embodiment or the accompanying drawings or in parallel (for example, in a parallel processor or multi-threaded processing environment). Figure 1 As shown, this embodiment provides a method for determining the validity of a target vulnerability, the method comprising:

[0056] S101. Obtain first vulnerability description information corresponding to each of a plurality of invalid vulnerabilities.

[0057] Among them, an invalid vulnerability may refer to a vulnerability whose validity information is invalid in the database; for example, it may be a rejected vulnerability or a vulnerability that caused controversy and was subsequently accepted. Specifically, invalid vulnerabilities are usually submitted with low-quality descriptions, and the corresponding vulnerabilities cannot be as described in the report, are not easy to verify, cannot be reproduced, or cannot truly affect security. The first vulnerability description information corresponding to each invalid vulnerability may refer to the original description information of the vulnerability. It should be noted that each vulnerability will be accompanied by the original description information when it is submitted to the database, and the database will attach comments when rejecting the vulnerability submission, and the first vulnerability description information and the second vulnerability description information in this application can both refer to the original description of the vulnerability.

[0058] In practical applications, after all vulnerabilities in the database are obtained through crawling, multiple vulnerabilities with invalid validity information can be extracted as invalid vulnerabilities, and the original description corresponding to each invalid vulnerability can be used as the first vulnerability description information of the invalid vulnerability.

[0059] S102. Based on the first vulnerability description information, obtain multiple invalid label information and corresponding first feature information corresponding to each of the multiple invalid vulnerabilities.

[0060] Among them, each invalid label information in the multiple invalid label information corresponding to the invalid vulnerability can be information used to characterize the root cause of the invalidity of the vulnerability; specifically, the invalid label information can include keywords related to the root cause of the invalidity of the vulnerability and the associated vulnerability description content; for example, it can be repeated or misdescribed, etc. There can be multiple invalid label information corresponding to each invalid vulnerability. The first feature information corresponding to each invalid vulnerability can include multiple first feature words. The first feature information corresponding to each invalid vulnerability can reflect the general content of the original description information of the invalid vulnerability.

[0061] In practical applications, the invalid label information may be obtained through manual annotation. Specifically, the original description of the invalid vulnerability may be displayed based on the first vulnerability description information of the invalid vulnerability, and multiple groups of technicians may label the invalid vulnerability based on the displayed original description of the invalid vulnerability. Each label content may include keywords related to the root cause of the invalid vulnerability and description content associated with the keyword, and the keyword and the description content associated with the keyword are used as an invalid label information corresponding to the invalid vulnerability. By performing text mining processing based on the first vulnerability description information, multiple first feature words can be obtained. Specifically, this embodiment adopts random forest as a specific text mining method, and in other embodiments, methods such as naive Bayes and multinomial naive Bayes may also be used, which are not limited in the present disclosure.

[0062] S103. Determine multiple invalid types and second characteristic information corresponding to each of the multiple invalid types according to the multiple invalid tag information and the first characteristic information.

[0063] Among them, the invalid type can be used to classify multiple vulnerabilities based on the invalid reasons. Specifically, the invalid type may include a duplicate type, a withdrawn type after investigation, a description error type, a lack of detailed information type, an out-of-range type, an unreproducible type, a not a vulnerability type, or a no serious impact type. The second characteristic information corresponding to each invalid type may include multiple first characteristic words. Each second characteristic information can generally reflect the root cause corresponding to its corresponding invalid type; it can be understood that the meanings represented by multiple first characteristic words are similar, and are all used to reflect the invalid reasons represented by their invalid types.

[0064] In practical applications, based on multiple invalid label information, invalid label information with similar meanings can be classified as a group to obtain multiple groups of classification results; according to the meanings of multiple invalid label information in each group, the invalid type corresponding to the group can be established, such as a repeated type, and multiple invalid types can be obtained; according to the invalid label information corresponding to the invalid type, multiple description contents corresponding to each invalid type can be obtained, and the first feature words contained in each of the multiple description contents can be used as the second feature information.

[0065] S104. Construct a validity prediction model based on multiple invalidity types and the second feature information.

[0066] Among them, the effectiveness prediction model can be used to determine the effectiveness information of the target vulnerability.

[0067] In practical applications, multiple invalid types can be used as label information, and the second feature information can be used as sample information to input into a classifier for training, and the trained classifier can be used as a validity prediction model.

[0068] S105. Obtain validity information of the target vulnerability according to the second vulnerability description information of the target vulnerability and the validity prediction model.

[0069] The target vulnerability may refer to a vulnerability whose validity information is to be predicted. Specifically, the target vulnerability may be a vulnerability newly added to the database. The second vulnerability description information of the target vulnerability may refer to the original description information of the target vulnerability. The validity information of the target vulnerability may be valid or invalid.

[0070] In practical applications, the second vulnerability description information of the target vulnerability is input into the effectiveness prediction model to obtain the effectiveness information of the target vulnerability.

[0071] Specifically, invalid vulnerabilities in the database can be obtained at preset intervals, and an effectiveness prediction model can be constructed based on the above method. Each newly-emerged vulnerability is used as a target vulnerability for effectiveness prediction, and effectiveness information of the target vulnerability is obtained. Valid vulnerabilities can be focused on in the future, and invalid vulnerabilities can be ignored.

[0072] By obtaining multiple invalid label information and corresponding first feature information corresponding to multiple invalid vulnerabilities based on the first vulnerability description information corresponding to each of the multiple invalid vulnerabilities, determining multiple invalid types and second feature information corresponding to each invalid type based on the multiple invalid label information and the first feature information, building a validity prediction model based on the multiple invalid types and the second feature information, and obtaining the validity information of the target vulnerability based on the second vulnerability description information of the target vulnerability and the validity prediction model, the validity of the target vulnerability can be predicted, the invalid vulnerability can be identified, and the security risks brought by the invalid vulnerability to the database can be avoided.

[0073] Figure 2 It is a flow chart of a method for determining multiple invalid types and second characteristic information corresponding to each of the multiple invalid types according to multiple invalid tag information and first characteristic information provided by an embodiment of the present invention.

[0074] In a possible implementation, Figure 2 As shown, the above step S103 may include:

[0075] S201. Perform classification processing according to multiple invalid label information to obtain multiple invalid types.

[0076] In practical applications, based on multiple invalid label information, invalid label information with similar content can be grouped together using a clustering algorithm to obtain multiple groups of classification results; according to the meaning of multiple invalid label information in each group, the invalid type corresponding to the group can be established, such as a repeated type.

[0077] S202. Obtain first vulnerability description information corresponding to a target invalid type, where the target invalid type is any one of multiple invalid types.

[0078] In actual applications, multiple description contents corresponding to each invalid type can be obtained according to the invalid tag information corresponding to the invalid type, that is, the first vulnerability description information corresponding to the target invalid type.

[0079] S203. Based on the first vulnerability description information corresponding to the target invalid type, obtain second feature information corresponding to the target invalid type.

[0080] In actual applications, based on the first vulnerability description information corresponding to the target invalid type, multiple description contents corresponding to the target invalid type can be obtained, and the first characteristic words contained in each of the multiple description contents are used as the second characteristic information. Specifically, each invalid type can correspond to multiple invalid label information, each invalid label information contains a keyword and the description content corresponding to the keyword; according to the above correspondence, each invalid type can correspond to multiple description contents. The multiple first characteristic words that can be extracted from the multiple description contents corresponding to each invalid type are used as the second characteristic information.

[0081] Figure 3 is a flow chart of a method for obtaining validity information of a target vulnerability according to the second vulnerability description information and validity prediction model of the target vulnerability provided by an embodiment of the present invention. Figure 3 As shown, the above step S105 may include:

[0082] S301. Perform feature extraction processing according to the second vulnerability description information to obtain third feature information of the target vulnerability.

[0083] Among them, the third characteristic information of the target vulnerability can represent the general content of the target vulnerability.

[0084] In practical applications, such as Figure 4 As shown, the above step S301 may include:

[0085] S401. Preprocess the second vulnerability description information to obtain a plurality of second feature words and second information gains corresponding to the plurality of second feature words.

[0086] Among them, information gain is an important indicator of feature selection. The second information gain corresponding to each second feature word can reflect the degree to which the information complexity (uncertainty) of the second feature word is reduced under certain conditions. It can be understood that how much information a feature word can bring to the classification system, the more information it brings, the more important the feature word is, and the greater its corresponding information gain is.

[0087] In practical applications, the second vulnerability description information is tokenized, stop words (such as a, the) are deleted, the description information is restored to its root form, and then represented in the form of a bag of words, multiple second feature words can be obtained, and the second information gain corresponding to each second feature word can be calculated. Specifically, the calculation process of the second information gain corresponding to each feature word is as follows:

[0088] 1) Count the number of documents in positive and negative classifications (positive and negative means whether the classification documents correspond): N1, N2;

[0089] 2) Count the frequency of each word appearing in positive documents (A), negative documents (B), positive documents not appearing (C), and negative documents not appearing (D);

[0090] 3) Calculate information entropy:

[0091]

[0092] 4) Calculate the information gain of each word:

[0093]

[0094] S402. Based on the plurality of second feature words and the second information gain, determine a plurality of second target feature words, and use the plurality of second target feature words as the third feature information.

[0095] In practical applications, the second information gains corresponding to the multiple second feature words are sorted from large to small, and the top k words can be selected as the multiple second target feature words; wherein k can refer to a preset feature dimension. After determining the second target feature words, the multiple second target feature words are used as the third feature information.

[0096] S302. Input the third feature information into the effectiveness prediction model to obtain effectiveness information.

[0097] In practical applications, the third feature information corresponding to the target vulnerability is input into the effectiveness prediction model to perform effectiveness prediction, and the effectiveness information corresponding to the target vulnerability can be obtained.

[0098] By determining multiple second target feature words based on multiple second feature words and second information gains, and using the multiple second target feature words as third feature information, it is possible to avoid validity prediction deviation caused by irrelevant words in the third feature information, thereby improving the accuracy of validity prediction.

[0099] Figure 5 is a flow chart of a method for constructing a validity prediction model based on multiple invalid types and second feature information provided by an embodiment of the present invention. In a possible implementation, Figure 5 As shown, the above step S104 may include:

[0100] S501. Use multiple second feature information as sample information, use the invalidity types corresponding to each of the multiple second feature information as label information, input them into a preset machine learning model, perform validity prediction processing, and obtain validity prediction information.

[0101] Among them, sample information of multiple second feature information and their corresponding invalid type label information can constitute a training sample set.

[0102] In practical applications, the preset machine learning model may include but is not limited to one of a neural network model, a regression model, a least squares model, a support vector machine, a Markov algorithm, etc., wherein the neural network model includes one or more of a deep neural network, a recurrent neural network, a convolutional neural network, etc. Deep learning is an algorithm for characterizing and learning a large amount of data. Deep learning is the inherent laws and representation levels of learning sample data. The information obtained in the learning process is of great help in the interpretation of data such as text, images, and sounds. Its ultimate goal is to enable machines to have analytical learning capabilities like humans, and to be able to recognize data such as text, images, and sounds. The feature extraction of deep learning does not rely on manual work, but is automatically extracted. It has very strong learning and adaptability, is data-driven, and has a high upper limit.

[0103] S502. Obtain validity loss information based on validity prediction information and label information.

[0104] The specific loss calculation process of the validity loss information is not limited in this disclosure.

[0105] S503. Train a preset machine learning model according to the effectiveness loss information to obtain an effectiveness prediction model.

[0106] The present disclosure does not limit the process of training the preset machine learning model. The use of deep learning methods to generate the effectiveness prediction model avoids complex calibration calculations and solutions.

[0107] Figure 6 is a flow chart of a method for obtaining first feature information corresponding to each of a plurality of invalid vulnerabilities based on first vulnerability description information provided by an embodiment of the present invention. In a possible implementation, Figure 6 As shown, the above step S102 may include:

[0108] S601. Preprocess the first vulnerability description information to obtain a plurality of first feature words and first information gains corresponding to the plurality of first feature words.

[0109] The first information gain corresponding to each first feature word may reflect the degree to which the information complexity (uncertainty) of the first feature word is reduced under certain conditions.

[0110] In practical applications, the calculation process of the first information gain corresponding to each first feature word may refer to the calculation process of the second information gain corresponding to the second feature word in the above step S401.

[0111] S602. Based on the multiple first feature words and the first information gain, determine multiple first target feature words, and use the multiple first target feature words as the first feature information.

[0112] In practical applications, the first information gains corresponding to the multiple first feature words are sorted from large to small, and the top k words can be selected as the multiple first target feature words; wherein k can refer to a preset feature dimension. After determining the first target feature word, the multiple first target feature words are used as the first feature information.

[0113] By determining multiple first target feature words based on multiple first feature words and first information gain, and using the multiple first target feature words as the first feature information, it is possible to avoid validity prediction deviation caused by irrelevant words in the first feature information, thereby improving the accuracy of validity prediction.

[0114] Figure 7 is a flow chart of a method for obtaining first vulnerability description information corresponding to each of a plurality of invalid vulnerabilities provided by an embodiment of the present invention. Figure 7 As shown, the above step S101 may include:

[0115] S701. Use a crawler to crawl and obtain multiple vulnerabilities and their corresponding third vulnerability description information.

[0116] In practical applications, crawlers can be used to crawl NVD (National Vulnerability Database) to collect all vulnerability data within a preset time range, and multiple vulnerabilities and their corresponding third vulnerability description information can be obtained; among them, NVD is the parent set of the CVE database.

[0117] S702. Obtain vulnerabilities whose validity information is invalid among multiple vulnerabilities.

[0118] In practical applications, multiple vulnerabilities can be classified into valid vulnerabilities and invalid vulnerabilities, where valid vulnerabilities include rejected vulnerabilities and controversial vulnerabilities, and deduplication processing can be performed to obtain invalid vulnerabilities among multiple vulnerabilities.

[0119] S703. The vulnerabilities whose validity information is invalid are regarded as invalid vulnerabilities, and the third vulnerability description information corresponding to the vulnerabilities whose validity information is invalid is regarded as the first vulnerability description information.

[0120] In practical applications, invalid vulnerabilities that only contain comments but no original descriptions can be eliminated, thereby avoiding using comments as descriptive information to add posterior information to the sample, which affects the training of the effectiveness prediction model.

[0121] Figure 8is a structural block diagram of a device for determining the validity of a target vulnerability provided by an embodiment of the present invention. On the other hand, the present invention also provides a device for determining the validity of a target vulnerability, such as Figure 8 As shown, the device comprises:

[0122] A first information acquisition module 10 is used to obtain first vulnerability description information corresponding to each of the multiple invalid vulnerabilities;

[0123] The second information acquisition module 20 is used to acquire multiple invalid label information and corresponding first feature information corresponding to each of the multiple invalid vulnerabilities based on the first vulnerability description information;

[0124] An information determination module 30, configured to determine a plurality of invalid types and second characteristic information corresponding to each of the plurality of invalid types according to the plurality of invalid tag information and the first characteristic information;

[0125] A model building module 40, for building a validity prediction model based on multiple invalid types and second feature information;

[0126] The validity information acquisition module 50 is used to obtain the validity information of the target vulnerability according to the second vulnerability description information of the target vulnerability and the validity prediction model.

[0127] On the other hand, an embodiment of the present invention further provides an electronic device, comprising: a processor; a memory for storing instructions executable by the processor; wherein the processor is configured to execute the above-mentioned method for determining the validity of a target vulnerability.

[0128] On the other hand, an embodiment of the present invention further provides a non-volatile computer-readable storage medium having computer program instructions stored thereon, wherein the computer program instructions, when executed by a processor, implement the method for determining the validity of the above-mentioned target vulnerability.

[0129] It should be noted that, for the convenience of description, the aforementioned method embodiments are all expressed as two series of action combinations, but those skilled in the art should be aware that the present invention is not limited by the described order of actions, because according to the present invention, certain steps can be performed in other orders or simultaneously. Similarly, the modules of the above-mentioned device for determining the effectiveness of the target vulnerability refer to computer programs or program segments for performing one or more specific functions. In addition, the distinction between the above-mentioned modules does not mean that the actual program code must also be separated. In addition, the above-mentioned embodiments can be arbitrarily combined to obtain other embodiments.

[0130] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in certain embodiments, please refer to the relevant description of other embodiments. Those skilled in the art may also understand that the various illustrative logical blocks, units, and steps listed in the embodiments of the present invention may be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly demonstrate the interchangeability of hardware and software, the various illustrative components, units, and steps mentioned above have generally described their functions. Whether such functions are implemented by hardware or software depends on the specific application and the design requirements of the entire system. Those skilled in the art may use various methods to implement the described functions for each specific application, but such implementation should not be understood as exceeding the scope of protection of the embodiments of the present invention.

[0131] The above description has fully disclosed the specific embodiments of the present invention. It should be pointed out that any changes made by those skilled in the art to the specific embodiments of the present invention do not deviate from the scope of the claims of the present invention. Accordingly, the scope of the claims of the present invention is not limited to the above specific embodiments.

Claims

1. A method for determining the validity of a target vulnerability, characterized in that: The method comprises: Obtain first vulnerability description information corresponding to each of the multiple invalid vulnerabilities; Based on the first vulnerability description information, obtain multiple invalid label information and corresponding first feature information corresponding to each of the multiple invalid vulnerabilities; Determining, according to the multiple invalid label information and the first feature information, multiple invalid types and second feature information corresponding to each of the multiple invalid types, including: performing classification processing according to the multiple invalid label information to obtain the multiple invalid types; obtaining first vulnerability description information corresponding to the target invalid type, the target invalid type being any one of the multiple invalid types; obtaining second feature information corresponding to the target invalid type based on the first vulnerability description information corresponding to the target invalid type; Based on the multiple invalid types and the second feature information, constructing a validity prediction model, including: taking the multiple second feature information as sample information, taking the invalid types corresponding to each of the multiple second feature information as label information, inputting them into a preset machine learning model, performing validity prediction processing, and obtaining validity prediction information; obtaining validity loss information according to the validity prediction information and the label information; training the preset machine learning model according to the validity loss information to obtain the validity prediction model; According to the second vulnerability description information of the target vulnerability and the validity prediction model, obtaining the validity information of the target vulnerability, including: performing feature extraction processing according to the second vulnerability description information to obtain third feature information of the target vulnerability; inputting the third feature information into the validity prediction model to obtain the validity information; The method of performing feature extraction processing based on the second vulnerability description information to obtain the third feature information of the target vulnerability includes: preprocessing the second vulnerability description information to obtain multiple second feature words and second information gains corresponding to the multiple second feature words; determining multiple second target feature words based on the multiple second feature words and the second information gain, and using the multiple second target feature words as the third feature information.

2. The method according to claim 1, characterized in that The acquiring, based on the first vulnerability description information, first feature information corresponding to each of the plurality of invalid vulnerabilities includes: Preprocessing the first vulnerability description information to obtain a plurality of first feature words and first information gains corresponding to the plurality of first feature words; Based on the multiple first feature words and the first information gain, multiple first target feature words are determined, and the multiple first target feature words are used as the first feature information.

3. The method according to claim 1, characterized in that The obtaining first vulnerability description information corresponding to each of the plurality of invalid vulnerabilities includes: Use a crawler to crawl and obtain multiple vulnerabilities and their corresponding third vulnerability description information; Obtaining vulnerabilities whose validity information is invalid from among the multiple vulnerabilities; The vulnerabilities whose validity information is invalid are regarded as invalid vulnerabilities, and the third vulnerability description information corresponding to each of the vulnerabilities whose validity information is invalid is regarded as the first vulnerability description information.

4. A device for determining the validity of a target vulnerability, characterized in that: The device comprises: A first information acquisition module, used to acquire first vulnerability description information corresponding to each of the multiple invalid vulnerabilities; A second information acquisition module, configured to acquire, based on the first vulnerability description information, a plurality of invalid label information corresponding to each of the plurality of invalid vulnerabilities and corresponding first feature information; An information determination module, used to determine multiple invalid types and second feature information corresponding to each of the multiple invalid types according to the multiple invalid label information and the first feature information, including: performing classification processing according to the multiple invalid label information to obtain the multiple invalid types; obtaining first vulnerability description information corresponding to the target invalid type, the target invalid type is any one of the multiple invalid types; based on the first vulnerability description information corresponding to the target invalid type, obtaining second feature information corresponding to the target invalid type; A model building module, for building a validity prediction model based on the multiple invalid types and the second feature information, including: taking the multiple second feature information as sample information, taking the invalid types corresponding to the multiple second feature information as label information, inputting them into a preset machine learning model, performing validity prediction processing, and obtaining validity prediction information; obtaining validity loss information according to the validity prediction information and the label information; training the preset machine learning model according to the validity loss information to obtain the validity prediction model; The validity information acquisition module is used to obtain the validity information of the target vulnerability according to the second vulnerability description information of the target vulnerability and the validity prediction model, including: performing feature extraction processing according to the second vulnerability description information to obtain the third feature information of the target vulnerability; inputting the third feature information into the validity prediction model to obtain the validity information; performing feature extraction processing according to the second vulnerability description information to obtain the third feature information of the target vulnerability, including: preprocessing the second vulnerability description information to obtain multiple second feature words and second information gains corresponding to the multiple second feature words; determining multiple second target feature words based on the multiple second feature words and the second information gain, and using the multiple second target feature words as the third feature information.

5. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; Wherein, the processor is configured to execute the executable instructions to implement the method for determining the validity of a target vulnerability as described in any one of claims 1 to 3.

6. A non-volatile computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method for determining the validity of a target vulnerability as described in any one of claims 1 to 3 is implemented.

Images