Method, device, equipment and storage medium for determining the same vulnerability

Abstract

The embodiments of the present disclosure provide a method, device, equipment and storage medium for determining the same vulnerability. The method includes: obtaining vulnerability data in a target vulnerability library; comparing vulnerability-affected entities included in the vulnerability data, and classifying vulnerability data with the same vulnerability-affected entities into one category; comparing vulnerability description information included in vulnerability data of the same category, obtaining the vulnerability description similarity of every two vulnerability data in the same category, and determining whether the two vulnerabilities corresponding to every two vulnerability data in the same category are the same vulnerability. In this way, the vulnerability-affected entities included in the vulnerability data can be first classified by comparing them, and then it can be determined whether the two vulnerabilities corresponding to every two vulnerability data in the same category are the same vulnerability, thereby effectively improving the efficiency of determining the same vulnerability.

Description

Technical Field

[0001] The present disclosure relates to the field of network security, and in particular to a method, device, equipment and storage medium for determining identical vulnerabilities. Background Art

[0002] In recent years, with the rapid development of network and information technology, the number of vulnerabilities has increased year by year, posing a huge threat to society, enterprises and individuals. It has become increasingly important to collect and organize existing vulnerabilities to establish a unified vulnerability library.

[0003] However, currently, due to the different sources of vulnerability data in the vulnerability library, there are duplications and redundancies among the vulnerability data in the vulnerability library. When merging vulnerability data from different sources, it is impossible to effectively determine whether the vulnerabilities corresponding to multiple vulnerability data are the same vulnerability. Summary of the invention

[0004] The present disclosure provides a method, apparatus, device and storage medium for determining identical vulnerabilities, which can improve the efficiency of determining identical vulnerabilities.

[0005] In a first aspect, an embodiment of the present disclosure provides a method for determining the same vulnerability, the method comprising:

[0006] Obtain vulnerability data from the target vulnerability database;

[0007] Compare the vulnerability affected entities included in the vulnerability data, and classify the vulnerability data with the same vulnerability affected entities into one category;

[0008] The vulnerability description information included in the vulnerability data of the same category is compared to obtain the vulnerability description similarity of every two vulnerability data in the same category, and to determine whether the two vulnerabilities corresponding to every two vulnerability data in the same category are the same vulnerabilities.

[0009] In some implementations of the first aspect, vulnerability affected entities included in the vulnerability data are compared, and vulnerability data with the same vulnerability affected entities are classified into one category, including:

[0010] Compare the vulnerability affected entities included in the vulnerability data to obtain the similarity of vulnerability affected entities of every two vulnerability data;

[0011] If the vulnerability affected entity similarity of the two vulnerability data is greater than or equal to the preset vulnerability affected entity similarity threshold, then it is determined that the vulnerability affected entities of the two vulnerability data are the same;

[0012] Vulnerability data with the same affected entities are grouped into one category.

[0013] In some possible implementations of the first aspect, determining whether two vulnerabilities corresponding to each two vulnerability data in the same class are the same vulnerability includes:

[0014] According to the similarity of vulnerability descriptions and vulnerability affected entities of every two vulnerability data in the same class, it is determined whether the two vulnerabilities corresponding to every two vulnerability data are the same vulnerabilities.

[0015] In some implementations of the first aspect, the method further includes:

[0016] If the vulnerability data of the same category also includes CVSS information, then the CVSS information included in the vulnerability data of the same category is compared to obtain the CVSS similarity of every two vulnerability data in the same category;

[0017] Determine whether the two vulnerabilities corresponding to each two vulnerability data in the same class are the same vulnerability, including:

[0018] According to the vulnerability description similarity and CVSS similarity of every two vulnerability data in the same class, it is determined whether the two vulnerabilities corresponding to every two vulnerability data in the same class are the same vulnerability.

[0019] In some implementations of the first aspect, judging whether two vulnerabilities corresponding to each two vulnerability data in the same class are the same vulnerability according to the vulnerability description similarity and the CVSS similarity of each two vulnerability data in the same class includes:

[0020] According to the weights corresponding to the vulnerability description similarity and CVSS similarity of each two vulnerability data, the vulnerability description similarity and CVSS similarity of each two vulnerability data are weighted and summed to obtain the comprehensive similarity of each two vulnerability data;

[0021] Determine that the vulnerabilities corresponding to two vulnerability data whose comprehensive similarity is greater than or equal to a preset comprehensive similarity threshold are the same vulnerabilities;

[0022] It is determined that the vulnerabilities corresponding to two vulnerability data whose comprehensive similarity is less than a preset comprehensive similarity threshold are non-identical vulnerabilities.

[0023] In some implementations of the first aspect, the method further includes:

[0024] If the vulnerability data in the same class also includes vulnerability type information, then the vulnerability type information included in the vulnerability data in the same class is compared to obtain the vulnerability type similarity of every two vulnerability data in the same class;

[0025] Determine whether the two vulnerabilities corresponding to each two vulnerability data in the same class are the same vulnerability, including:

[0026] According to the vulnerability description similarity and vulnerability type similarity of each two vulnerability data in the same class, it is determined whether the two vulnerabilities corresponding to each two vulnerability data in the same class are the same vulnerabilities.

[0027] In some implementations of the first aspect, the method further includes:

[0028] Based on the judgment results, the vulnerability data of multiple identical vulnerabilities are merged and unified vulnerability description information is output.

[0029] In a second aspect, an embodiment of the present disclosure provides a device for determining the same vulnerability, the device comprising:

[0030] The acquisition module is used to obtain vulnerability data in the target vulnerability library;

[0031] A comparison module, used for comparing vulnerability affected entities included in the vulnerability data, and classifying vulnerability data with the same vulnerability affected entities into one category;

[0032] The judgment module is used to compare the vulnerability description information included in the vulnerability data of the same class, obtain the vulnerability description similarity of every two vulnerability data in the same class, and judge whether the two vulnerabilities corresponding to every two vulnerability data in the same class are the same vulnerability.

[0033] In a third aspect, an embodiment of the present disclosure provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the method described above.

[0034] In a fourth aspect, an embodiment of the present disclosure provides a non-transitory computer-readable storage medium storing computer instructions, where the computer instructions are used to enable a computer to execute the method described above.

[0035] In a fifth aspect, an embodiment of the present disclosure provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the method described above.

[0036] In the present disclosure, the vulnerability affected entities included in the vulnerability data can be first classified by comparison, and then based on the vulnerability description information included in each two vulnerability data in the same class, it can be determined whether the two vulnerabilities corresponding to each two vulnerability data are the same vulnerabilities, thereby effectively improving the efficiency of determining the same vulnerabilities.

[0037] It should be understood that the contents described in the summary of the invention are not intended to limit the key or important features of the embodiments of the present disclosure, nor are they intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements, among which:

[0039] Figure 1 A schematic diagram showing an exemplary operating environment in which embodiments of the present disclosure can be implemented;

[0040] Figure 2 A flowchart of a method for determining the same vulnerability provided by an embodiment of the present disclosure is shown;

[0041] Figure 3 A flowchart showing another method for determining the same vulnerability provided by an embodiment of the present disclosure is shown;

[0042] Figure 4 A structural diagram of a device for determining the same vulnerability provided by an embodiment of the present disclosure is shown;

[0043] Figure 5 A structural diagram of an exemplary electronic device capable of implementing an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solution and advantages of the embodiments of the present disclosure clearer, the technical solution in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0045] In addition, the term "and / or" in this article is only a description of the association relationship between the associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0046] In view of the problems in the background technology, the embodiments of the present disclosure provide a method, device, equipment and storage medium for determining the same vulnerability. Specifically, the vulnerability affected entities included in the vulnerability data can be first classified by comparing, and then based on the vulnerability description information included in each two vulnerability data in the same class, it can be determined whether the two vulnerabilities corresponding to each two vulnerability data are the same vulnerability, thereby effectively improving the efficiency of determining the same vulnerability.

[0047] The following is a detailed description of the method, device, equipment and storage medium for determining the same vulnerability provided by the embodiments of the present disclosure through specific embodiments in conjunction with the accompanying drawings.

[0048] Figure 1 A schematic diagram of an exemplary operating environment 100 in which embodiments of the present disclosure can be implemented is shown. Figure 1 As shown, the operating environment 100 may include an electronic device 110 and a target vulnerability library 120 .

[0049] The electronic device 110 may be a mobile electronic device or a non-mobile electronic device. For example, the mobile electronic device may be a tablet computer, a laptop computer, a PDA, or an ultra-mobile personal computer (UMPC), and the non-mobile electronic device may be a personal computer (PC) or a server.

[0050] The target vulnerability library 120 is a vulnerability library that is selected to perform the same vulnerability judgment, such as a national vulnerability library, a security vendor vulnerability library, a security company vulnerability library, an open source vulnerability library, etc. A large amount of vulnerability data from different sources and heterogeneity is stored therein, for example, a large amount of vulnerability data without Common Vulnerabilities & Exposures (CVE) numbers or with duplicate CVE numbers. Since it is currently impossible to effectively determine whether the vulnerabilities corresponding to multiple vulnerability data are the same, it is not conducive to the normal execution of vulnerability operation management processes such as vulnerability discovery, vulnerability verification, and vulnerability disposal.

[0051] As an example, the electronic device 110 can obtain vulnerability data in the target vulnerability library 120, such as partial or full vulnerability data, and then compare the vulnerability-affected entities included in the vulnerability data, classify the vulnerability data with the same vulnerability-affected entities into one category, and then compare the vulnerability description information included in the vulnerability data of the same category to obtain the vulnerability description similarity of every two vulnerability data in the same category, and then determine whether the two vulnerabilities corresponding to every two vulnerability data in the same category are the same vulnerabilities based on the vulnerability description similarity of every two vulnerability data in the same category, thereby effectively improving the efficiency of determining the same vulnerabilities.

[0052] The following is a detailed description of the same vulnerability determination method provided by the embodiment of the present disclosure, wherein the execution subject of the determination method can be Figure 1 An electronic device 110 is shown.

[0053] Figure 2 A flowchart of a method for determining the same vulnerability provided by an embodiment of the present disclosure is shown. Figure 2As shown, the determination method 200 may include the following steps:

[0054] S210, obtaining vulnerability data in a target vulnerability database.

[0055] Among them, the target vulnerability library is a vulnerability library that is selected to perform the same vulnerability judgment, for example, a national vulnerability library, a security vendor vulnerability library, a security company vulnerability library, an open source vulnerability library, etc., without any restriction here.

[0056] S220, comparing vulnerability-affected entities included in the vulnerability data, and classifying vulnerability data with the same vulnerability-affected entities into one category.

[0057] Specifically, the vulnerability affected entities included in the vulnerability data can be compared to obtain the vulnerability affected entity similarity of each two vulnerability data. Exemplarily, if the vulnerability data does not have a CVE number, the affected vendors and affected components & versions included in the vulnerability data can be compared to obtain the vulnerability affected entity similarity of each two vulnerability data, where the affected vendors and affected components & versions are the vulnerability affected entities. If the vulnerability data has a CVE number, a comparison can be performed based on the CPE field included in the vulnerability data to obtain the vulnerability affected entity similarity of each two vulnerability data, where the CPE field includes the vulnerability affected entity.

[0058] If the vulnerability affected entity similarity of the two vulnerability data is greater than or equal to the preset vulnerability affected entity similarity threshold, it is determined that the vulnerability affected entities of the two vulnerability data are the same, and the vulnerability data with the same vulnerability affected entity are classified into one category. For example, a unified label can be set for the vulnerability data with the same vulnerability affected entity to identify them and classify them into one category.

[0059] In this way, based on the similarity of vulnerability affected entities between each two vulnerability data, vulnerability data with the same vulnerability affected entities can be accurately determined, thereby improving the classification effect.

[0060] S230, comparing vulnerability description information included in vulnerability data of the same class, obtaining vulnerability description similarity of every two vulnerability data of the same class, and determining whether two vulnerabilities corresponding to every two vulnerability data of the same class are the same vulnerability.

[0061] Specifically, text preprocessing can be performed on vulnerability description information of the same category, that is, the vulnerability description information can be segmented according to the semantic dictionary. For example, tools such as Python Jieba can be used to segment the vulnerability description information, and irrelevant words such as onomatopoeia, prepositions, conjunctions, etc. in the segmentation results can be cleaned.

[0062] The text preprocessing results are subjected to text mining analysis, that is, the text preprocessing results can be compared with the metadata database contents such as manufacturer, product, component & version, vulnerability exploitation method, vulnerability hazard description, etc., to obtain the vulnerability affected entity, vulnerability exploitation method, and vulnerability hazard description of the vulnerability description information.

[0063] The text mining analysis results are compared, that is, the text mining analysis results of the vulnerability description information of the same category can be compared to obtain the vulnerability description similarity of every two vulnerability data in the same category. Optionally, text preprocessing, text mining analysis, and text comparison of the vulnerability description information can be implemented based on natural language processing (NLP).

[0064] According to the similarity of vulnerability descriptions of every two vulnerability data in the same class, it is determined whether the two vulnerabilities corresponding to every two vulnerability data in the same class are the same vulnerabilities.

[0065] For example, the vulnerabilities corresponding to two vulnerability data whose vulnerability description similarity is greater than or equal to a preset vulnerability description similarity threshold can be determined to be the same vulnerability, and the vulnerabilities corresponding to two vulnerability data whose comprehensive similarity is less than a preset vulnerability description similarity threshold can be determined to be non-identical vulnerabilities.

[0066] It is also possible to determine whether the two vulnerabilities corresponding to each two vulnerability data are the same vulnerability based on the vulnerability description similarity and vulnerability affected entity similarity of each two vulnerability data in the same class. In this way, the vulnerability affected entity similarity can be introduced on the basis of the vulnerability description similarity, and whether the two vulnerabilities corresponding to each two vulnerability data are the same vulnerability can be accurately determined from the two dimensions of vulnerability description and vulnerability affected entity.

[0067] Furthermore, the vulnerability description similarity and the vulnerability affected entity similarity of each two vulnerability data can be weighted and summed according to the weights corresponding to the vulnerability description similarity and the vulnerability affected entity similarity of each two vulnerability data, so as to obtain the comprehensive similarity of each two vulnerability data, and determine that the vulnerabilities corresponding to two vulnerability data with a comprehensive similarity greater than or equal to a preset comprehensive similarity threshold are the same vulnerabilities, and determine that the vulnerabilities corresponding to two vulnerability data with a comprehensive similarity less than the preset comprehensive similarity threshold are different vulnerabilities.

[0068] According to the embodiments of the present disclosure, the vulnerability-affected entities included in the vulnerability data can be first classified by comparison, and then based on the vulnerability description information included in each pair of vulnerability data in the same class, it can be determined whether the two vulnerabilities corresponding to each pair of vulnerability data are the same vulnerability, thereby effectively improving the efficiency of determining the same vulnerability.

[0069] In some embodiments, if the vulnerability data of the same class also includes CVSS information, the CVSS information included in the vulnerability data of the same class can be compared to obtain the CVSS similarity of every two vulnerability data in the same class. The CVSS information may include CVSS scores and CVSS vectors, wherein the CVSS vectors include attack, confidentiality impact, attack complexity, integrity impact, required permission availability impact, user interaction, scope, exploitability, and other vectors.

[0070] Then, we can judge whether the two vulnerabilities corresponding to each two vulnerability data in the same class are the same vulnerabilities according to the vulnerability description similarity and CVSS similarity of each two vulnerability data in the same class. In this way, we can introduce CVSS similarity based on the vulnerability description similarity, and accurately judge whether the two vulnerabilities corresponding to each two vulnerability data are the same vulnerabilities from the two dimensions of vulnerability description and CVSS.

[0071] Furthermore, the vulnerability description similarity and CVSS similarity of each two vulnerability data can be weighted and summed according to the weights corresponding to the vulnerability description similarity and CVSS similarity of each two vulnerability data, to obtain the comprehensive similarity of each two vulnerability data, and determine that the vulnerabilities corresponding to the two vulnerability data with a comprehensive similarity greater than or equal to a preset comprehensive similarity threshold are the same vulnerabilities, and determine that the vulnerabilities corresponding to the two vulnerability data with a comprehensive similarity less than the preset comprehensive similarity threshold are non-identical vulnerabilities. In this way, based on the comprehensive similarity, it is possible to accurately determine whether the two vulnerabilities corresponding to each two vulnerability data are the same vulnerability.

[0072] In some embodiments, if the vulnerability data in the same class also includes vulnerability type information, the vulnerability type information included in the vulnerability data in the same class can be compared to obtain the vulnerability type similarity of every two vulnerability data in the same class. The vulnerability type information may include CWE number, CWE name, and CWE description.

[0073] Then, we can judge whether the two vulnerabilities corresponding to each two vulnerability data in the same class are the same vulnerabilities according to the vulnerability description similarity and vulnerability type similarity of each two vulnerability data in the same class. In this way, we can introduce vulnerability type similarity based on vulnerability description similarity, and accurately judge whether the two vulnerabilities corresponding to each two vulnerability data are the same vulnerabilities from the two dimensions of vulnerability description and vulnerability type.

[0074] Furthermore, the vulnerability description similarity and vulnerability type similarity of each two vulnerability data can be weighted and summed according to the weights respectively corresponding to the vulnerability description similarity and vulnerability type similarity of each two vulnerability data to obtain the comprehensive similarity of each two vulnerability data, and the vulnerabilities corresponding to two vulnerability data with a comprehensive similarity greater than or equal to a preset comprehensive similarity threshold are determined to be the same vulnerabilities, and the vulnerabilities corresponding to two vulnerability data with a comprehensive similarity less than the preset comprehensive similarity threshold are determined to be different vulnerabilities.

[0075] In some embodiments, the vulnerability data of the same multiple vulnerabilities can be merged according to the judgment result, for example, the vulnerability data of the same multiple vulnerabilities can be associated with a unified identifier, and then a unified vulnerability description information can be output. In this way, the duplication and redundancy of vulnerability data can be effectively solved, which is convenient for vulnerability management.

[0076] Figure 3 A flowchart of another method for determining the same vulnerability provided by an embodiment of the present disclosure is shown. Figure 3 As shown, the determination method 300 may include the following steps:

[0077] S310, obtaining vulnerability data in a target vulnerability database.

[0078] S321, comparing vulnerability affected entities included in the vulnerability data to obtain the similarity of vulnerability affected entities between every two vulnerability data.

[0079] S322, if the vulnerability affected entity similarity of the two vulnerability data is greater than or equal to a preset vulnerability affected entity similarity threshold, it is determined that the vulnerability affected entities of the two vulnerability data are the same, and the vulnerability data with the same vulnerability affected entities are classified into one category.

[0080] S331: If the vulnerability data of the same category includes CVSS information, the CVSS information included in the vulnerability data of the same category is compared to obtain the CVSS similarity between every two vulnerability data of the same category.

[0081] S332: If the vulnerability data in the same class also includes vulnerability type information, the vulnerability type information included in the vulnerability data in the same class is compared to obtain the vulnerability type similarity between every two vulnerability data in the same class.

[0082] S333, comparing the vulnerability description information included in the vulnerability data of the same category to obtain the vulnerability description similarity between every two vulnerability data of the same category.

[0083] S334, judging whether two vulnerabilities corresponding to each two vulnerability data in the same class are the same vulnerability according to the vulnerability affected entity similarity, CVSS similarity, vulnerability type similarity and vulnerability description similarity of each two vulnerability data in the same class.

[0084] Specifically, the vulnerability affected entity similarity, CVSS similarity, vulnerability type similarity and vulnerability description similarity of each two vulnerability data can be weighted and summed according to the weights corresponding to the vulnerability affected entity similarity, CVSS similarity, vulnerability type similarity and vulnerability description similarity of each two vulnerability data, to obtain the comprehensive similarity of each two vulnerability data, and determine that the vulnerabilities corresponding to two vulnerability data with a comprehensive similarity greater than or equal to a preset comprehensive similarity threshold are the same vulnerabilities, and determine that the vulnerabilities corresponding to two vulnerability data with a comprehensive similarity less than the preset comprehensive similarity threshold are different vulnerabilities.

[0085] For example, the weights corresponding to the vulnerability affected entity similarity, CVSS similarity, vulnerability type similarity and vulnerability description similarity can be 20%, 20%, 10% and 50% respectively. Then, the vulnerability affected entity similarity, CVSS similarity, vulnerability type similarity and vulnerability description similarity of the two vulnerability data are weighted and summed to obtain the comprehensive similarity of the two vulnerability data, i.e., the similarity score. If the similarity score is between 0 and 60, it is judged that the vulnerabilities corresponding to the two vulnerability data are non-identical vulnerabilities, i.e., non-duplicate vulnerabilities. If the similarity score is between 60 and 80, it means that the vulnerabilities corresponding to the two vulnerability data are very likely to be the same. If the similarity score is between 80 and 100, it can be judged that the vulnerabilities corresponding to the two vulnerability data are the same vulnerabilities, i.e., duplicate vulnerabilities.

[0086] S340: Merge vulnerability data of the same multiple vulnerabilities according to the determination result, and output unified vulnerability description information.

[0087] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should be aware that the present disclosure is not limited by the order of the actions described, because according to the present disclosure, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present disclosure.

[0088] The above is an introduction to the method embodiment. The following is a further explanation of the scheme disclosed in the present invention through an apparatus embodiment.

[0089] Figure 4 FIG. 4 shows a structural diagram of a device for determining the same vulnerability according to an embodiment of the present disclosure, such as Figure 4 As shown, the judging device 400 may include:

[0090] The acquisition module 410 is used to acquire vulnerability data in the target vulnerability database.

[0091] The comparison module 420 is used to compare the vulnerability affected entities included in the vulnerability data, and classify the vulnerability data with the same vulnerability affected entities into one category.

[0092] The judgment module 430 is used to compare the vulnerability description information included in the vulnerability data of the same class, obtain the vulnerability description similarity of every two vulnerability data in the same class, and judge whether the two vulnerabilities corresponding to every two vulnerability data in the same class are the same vulnerability.

[0093] In some embodiments, the comparison module 420 is specifically used to:

[0094] The vulnerability affected entities included in the vulnerability data are compared to obtain the vulnerability affected entity similarity between every two vulnerability data.

[0095] If the vulnerability affected entities of two vulnerability data have a similarity greater than or equal to a preset vulnerability affected entity similarity threshold, it is determined that the vulnerability affected entities of the two vulnerability data are the same.

[0096] Vulnerability data with the same affected entities are grouped into one category.

[0097] In some embodiments, the determination module 430 is specifically used to:

[0098] According to the similarity of vulnerability descriptions and vulnerability affected entities of every two vulnerability data in the same class, it is determined whether the two vulnerabilities corresponding to every two vulnerability data are the same vulnerabilities.

[0099] In some embodiments, the comparison module 420 is further configured to:

[0100] If the vulnerability data of the same category also includes CVSS information, the CVSS information included in the vulnerability data of the same category is compared to obtain the CVSS similarity of every two vulnerability data in the same category.

[0101] The determination module 430 is specifically used for:

[0102] According to the vulnerability description similarity and CVSS similarity of every two vulnerability data in the same class, it is determined whether the two vulnerabilities corresponding to every two vulnerability data in the same class are the same vulnerability.

[0103] In some embodiments, the determination module 430 is specifically used to:

[0104] According to the weights corresponding to the vulnerability description similarity and CVSS similarity of each two vulnerability data, the vulnerability description similarity and CVSS similarity of each two vulnerability data are weighted and summed to obtain the comprehensive similarity of each two vulnerability data.

[0105] It is determined that the vulnerabilities corresponding to two vulnerability data whose comprehensive similarity is greater than or equal to a preset comprehensive similarity threshold are the same vulnerabilities.

[0106] It is determined that the vulnerabilities corresponding to two vulnerability data whose comprehensive similarity is less than a preset comprehensive similarity threshold are non-identical vulnerabilities.

[0107] In some embodiments, the comparison module 420 is further configured to:

[0108] If the vulnerability data in the same class also includes vulnerability type information, the vulnerability type information included in the vulnerability data in the same class is compared to obtain the vulnerability type similarity of every two vulnerability data in the same class.

[0109] The determination module 430 is specifically used for:

[0110] According to the vulnerability description similarity and vulnerability type similarity of each two vulnerability data in the same class, it is determined whether the two vulnerabilities corresponding to each two vulnerability data in the same class are the same vulnerabilities.

[0111] In some embodiments, the determining device 400 further includes:

[0112] The output module is used to merge the vulnerability data of multiple identical vulnerabilities according to the judgment results and output unified vulnerability description information.

[0113] Understandably, Figure 4 Each module / unit in the judgment device 400 shown has the function of implementing each step in the judgment method 200 or 300 provided in the embodiment of the present disclosure, and can achieve its corresponding technical effect. For the sake of brevity, it will not be repeated here.

[0114] Figure 5 A block diagram of an electronic device that can be used to implement an embodiment of the present disclosure is shown. Electronic device 500 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. Electronic device 500 can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0115] like Figure 5As shown, the electronic device 500 may include a computing unit 501, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 502 or a computer program loaded from a storage unit 508 into a random access memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the electronic device 500 can also be stored. The computing unit 501, the ROM 502, and the RAM 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0116] Multiple components in the electronic device 500 are connected to the I / O interface 505, including: an input unit 506, such as a keyboard, a mouse, etc.; an output unit 507, such as various types of displays, speakers, etc.; a storage unit 508, such as a disk, an optical disk, etc.; and a communication unit 509, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 509 allows the electronic device 500 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0117] The computing unit 501 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 501 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 501 performs the various methods and processes described above, such as method 200 or 300. For example, in some embodiments, method 200 or 300 may be implemented as a computer program product, including a computer program, which is tangibly contained in a computer-readable medium, such as a storage unit 508. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 500 via ROM 502 and / or communication unit 509. When the computer program is loaded into RAM 503 and executed by the computing unit 501, one or more steps of the method 200 or 300 described above may be performed. Alternatively, in other embodiments, the computing unit 501 may be configured to execute the method 200 or 300 in any other appropriate manner (eg, by means of firmware).

[0118] The various embodiments described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include: being implemented in one or more computer programs, which can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a dedicated or general programmable processor, which can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0119] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0120] In the context of the present disclosure, a computer-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. A computer-readable medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. A more specific example of a computer-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0121] It should be noted that the present disclosure also provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable a computer to execute method 200 or 300 and achieve the corresponding technical effect achieved by executing the method in the embodiment of the present disclosure. For the sake of concise description, they will not be repeated here.

[0122] In addition, the present disclosure also provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the method 200 or 300 is implemented.

[0123] To provide interaction with a user, the above-described embodiments may be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0124] The embodiments described above can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0125] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0126] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0127] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A method for determining the same vulnerability, characterized in that: The method comprises: Obtain vulnerability data from the target vulnerability database; Comparing vulnerability-affected entities included in the vulnerability data, and classifying vulnerability data with the same vulnerability-affected entities into one category; Compare the vulnerability description information included in the vulnerability data of the same category to obtain the vulnerability description similarity of every two vulnerability data in the same category, and determine whether the two vulnerabilities corresponding to every two vulnerability data in the same category are the same vulnerability; The vulnerability description information included in the vulnerability data of the same category is compared to obtain the vulnerability description similarity of every two vulnerability data in the same category, including: Perform text preprocessing on vulnerability description information of the same category, that is, segment the vulnerability description information according to the semantic dictionary and remove irrelevant words in the segmentation results; Perform text mining analysis on the text preprocessing results, that is, compare the text preprocessing results with the metadata database content to obtain vulnerability description information, including vulnerability affected entities, vulnerability exploitation methods, and vulnerability hazard descriptions; The text mining analysis results are compared, that is, the text mining analysis results of the vulnerability description information of the same category are compared to obtain the vulnerability description similarity of every two vulnerability data in the same category.

2. The method according to claim 1, characterized in that The vulnerability affected entities included in the vulnerability data are compared, and vulnerability data with the same vulnerability affected entities are classified into one category, including: Comparing the vulnerability affected entities included in the vulnerability data to obtain the similarity of vulnerability affected entities of every two vulnerability data; If the vulnerability affected entities of the two vulnerability data have a similarity greater than or equal to a preset vulnerability affected entity similarity threshold, it is determined that the vulnerability affected entities of the two vulnerability data are the same; Vulnerability data with the same affected entities are grouped into one category.

3. The method according to claim 2, characterized in that The determining whether two vulnerabilities corresponding to each two vulnerability data in the same class are the same vulnerabilities includes: According to the similarity of vulnerability descriptions and vulnerability affected entities of every two vulnerability data in the same class, it is determined whether the two vulnerabilities corresponding to every two vulnerability data are the same vulnerabilities.

4. The method according to claim 1, characterized in that The method further comprises: If the vulnerability data of the same category also includes CVSS information, then the CVSS information included in the vulnerability data of the same category is compared to obtain the CVSS similarity of every two vulnerability data in the same category; The determining whether two vulnerabilities corresponding to each two vulnerability data in the same class are the same vulnerabilities includes: According to the vulnerability description similarity and CVSS similarity of every two vulnerability data in the same class, it is determined whether the two vulnerabilities corresponding to every two vulnerability data in the same class are the same vulnerabilities.

5. The method according to claim 4, characterized in that The determining whether two vulnerabilities corresponding to each two vulnerability data in the same class are the same vulnerability according to the vulnerability description similarity and CVSS similarity of each two vulnerability data in the same class includes: According to the weights corresponding to the vulnerability description similarity and CVSS similarity of each two vulnerability data, the vulnerability description similarity and CVSS similarity of each two vulnerability data are weighted and summed to obtain the comprehensive similarity of each two vulnerability data; Determine that the vulnerabilities corresponding to two vulnerability data whose comprehensive similarity is greater than or equal to a preset comprehensive similarity threshold are the same vulnerabilities; It is determined that the vulnerabilities corresponding to two vulnerability data whose comprehensive similarity is less than a preset comprehensive similarity threshold are non-identical vulnerabilities.

6. The method according to claim 1, characterized in that The method further comprises: If the vulnerability data in the same class also includes vulnerability type information, then the vulnerability type information included in the vulnerability data in the same class is compared to obtain the vulnerability type similarity of every two vulnerability data in the same class; The determining whether two vulnerabilities corresponding to each two vulnerability data in the same class are the same vulnerabilities includes: According to the vulnerability description similarity and vulnerability type similarity of each two vulnerability data in the same class, it is determined whether the two vulnerabilities corresponding to each two vulnerability data in the same class are the same vulnerabilities.

7. The method according to claim 1, characterized in that The method further comprises: Based on the judgment results, the vulnerability data of multiple identical vulnerabilities are merged and unified vulnerability description information is output.

8. A device for determining the same vulnerability, characterized in that: The device comprises: The acquisition module is used to obtain vulnerability data in the target vulnerability library; A comparison module, used to compare vulnerability-affected entities included in the vulnerability data, and classify vulnerability data with the same vulnerability-affected entities into one category; A judgment module is used to compare the vulnerability description information included in the vulnerability data of the same class, obtain the vulnerability description similarity of every two vulnerability data in the same class, and judge whether the two vulnerabilities corresponding to every two vulnerability data in the same class are the same vulnerability; The judgment module is specifically used for: Perform text preprocessing on vulnerability description information of the same category, that is, segment the vulnerability description information according to the semantic dictionary and remove irrelevant words in the segmentation results; Perform text mining analysis on the text preprocessing results, that is, compare the text preprocessing results with the metadata database content to obtain vulnerability description information, including vulnerability affected entities, vulnerability exploitation methods, and vulnerability hazard descriptions; The text mining analysis results are compared, that is, the text mining analysis results of the vulnerability description information of the same category are compared to obtain the vulnerability description similarity of every two vulnerability data in the same category.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to make a computer execute the method according to any one of claims 1-7.

Images