Network vulnerability monitoring and management method, device, medium and electronic equipment

Abstract

The present disclosure provides a monitoring and management method, device, medium and electronic device for network vulnerabilities. The method includes: distributed collection of network vulnerability intelligence to be monitored from at least two intelligence data sources, and standardized analysis and processing of the collected network vulnerability intelligence to be monitored to obtain target vulnerability intelligence data; standardized storage and storage of the target vulnerability intelligence data to build a network vulnerability database; intelligence extraction and automatic parsing of the target vulnerability intelligence data that has been standardized and stored in the database using preset or customized network vulnerability extraction rules to generate network vulnerability intelligence to be reported; advanced analysis and automatic information completion processing of the network vulnerability intelligence to be reported, and automatic generation of vulnerability monitoring reports in a preset or customized output form. The present disclosure realizes the linkage of data collection and data reporting, while avoiding manual analysis and participation in the reporting and monitoring management process.

Description

Technical Field

[0001] The present disclosure relates to the technical field of network security, and in particular to a network vulnerability monitoring and management method, a network vulnerability monitoring and management device, a computer-readable medium, and an electronic device. Background Art

[0002] With the development of the Internet, network service software, specific implementation of protocols, and defects in system security policies will frequently lead to vulnerabilities. Rapid and accurate reporting of security vulnerability intelligence is of vital importance to the maintenance of network security.

[0003] The current reporting of security vulnerability intelligence is simply to collect vulnerability data on the Internet and then monitor and manage it manually. This not only greatly wastes human resources, but also cannot guarantee the accuracy and efficiency of vulnerability data monitoring and management.

[0004] In view of this, there is an urgent need in the art to develop a new network vulnerability monitoring and management method and device.

[0005] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the technical background of the present application, and therefore may include information that does not constitute prior art known to ordinary technicians in the field. Summary of the invention

[0006] The purpose of the present disclosure is to provide a network vulnerability monitoring and management method, a network vulnerability monitoring and management device, a computer-readable medium and an electronic device, thereby overcoming the technical problems of waste of human resources and low management efficiency at least to a certain extent.

[0007] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0008] According to one aspect of an embodiment of the present disclosure, a method for monitoring and managing network vulnerabilities is provided, the method comprising: collecting network vulnerability intelligence to be monitored from at least two intelligence data sources in a distributed manner, and performing standardized analysis and processing on the collected network vulnerability intelligence to be monitored to obtain target vulnerability intelligence data;

[0009] The target vulnerability intelligence data is standardized and stored in a database to build a network vulnerability database;

[0010] Using preset or customized network vulnerability extraction rules, the target vulnerability intelligence data that has been standardized and stored in the database is extracted and automatically parsed to generate network vulnerability intelligence to be reported;

[0011] The network vulnerability intelligence to be reported is automatically completed and analyzed, and a vulnerability monitoring report is automatically generated in a preset or customized output format.

[0012] According to one aspect of an embodiment of the present disclosure, a network vulnerability monitoring and management device is provided, the device comprising:

[0013] An intelligence collection module is configured to collect network vulnerability intelligence to be monitored from at least two intelligence data sources in a distributed manner, and perform standardized analysis and processing on the collected network vulnerability intelligence to be monitored to obtain target vulnerability intelligence data;

[0014] The intelligence storage module is configured to perform standardized storage processing on the target vulnerability intelligence data to build a network vulnerability database;

[0015] An intelligence parsing module is configured to extract intelligence and automatically parse the target vulnerability intelligence data that has been standardized and stored in the database according to preset or customized network vulnerability extraction rules to generate network vulnerability intelligence to be reported;

[0016] The intelligence reporting module is configured to automatically complete and perform advanced analysis on the network vulnerability intelligence to be reported, and automatically generate a vulnerability monitoring report in a preset or customized output format.

[0017] In some embodiments of the present disclosure, based on the above technical solution, the intelligence parsing module includes: an intelligence extraction submodule, configured to extract intelligence from the target vulnerability intelligence data that has been standardized and stored in the library according to a preset or customized network vulnerability extraction rule to obtain vulnerability intelligence to be identified;

[0018] The intelligence identification submodule is configured to perform reporting intelligence source identification processing on the vulnerability intelligence to be identified to obtain reportable vulnerability intelligence, and automatically parse the reportable vulnerability intelligence to generate network vulnerability intelligence to be reported.

[0019] In some embodiments of the present disclosure, based on the above technical solution, the intelligence identification submodule includes: an identification processing unit configured to perform network vulnerability keyword identification processing on the reportable vulnerability intelligence using a network vulnerability keyword library to obtain a network vulnerability keyword;

[0020] The parsing processing unit is configured to perform keyword parsing processing on the network vulnerability keyword to obtain network product vulnerability intelligence.

[0021] In some embodiments of the present disclosure, based on the above technical solution, the intelligence identification submodule includes: an identification processing unit configured to perform network vulnerability keyword identification processing on the reportable vulnerability intelligence using a network vulnerability keyword library to obtain a network vulnerability keyword;

[0022] The component identification unit is configured to perform component identification processing on the network vulnerability keyword to obtain network product vulnerability intelligence when the network vulnerability keyword is subjected to keyword parsing processing and no network product vulnerability intelligence is obtained.

[0023] In some embodiments of the present disclosure, based on the above technical solution, the intelligence identification submodule includes: a regular matching unit, configured to use preset or customized name regular matching rules to perform name regularization matching processing on the reportable vulnerability intelligence to obtain network name vulnerability intelligence.

[0024] In some embodiments of the present disclosure, based on the above technical solution, the intelligence report module includes: a completion processing submodule, configured to automatically complete the information of the network vulnerability intelligence to be reported to obtain completed vulnerability intelligence;

[0025] The advanced analysis submodule is configured to perform advanced analysis on the completed vulnerability intelligence to obtain global vulnerability intelligence to be reported.

[0026] In some embodiments of the present disclosure, based on the above technical solution, the advanced analysis submodule includes: a vector recognition unit configured to perform a universal vulnerability scoring vector recognition process on the completed vulnerability intelligence to obtain a vector recognition process result;

[0027] The vector parsing unit is configured to perform vulnerability vector parsing processing on the completed vulnerability intelligence based on the vector identification processing result to obtain global vulnerability intelligence.

[0028] In some embodiments of the present disclosure, based on the above technical solution, the advanced analysis submodule includes: a number identification unit configured to perform a general vulnerability number identification process on the completed vulnerability intelligence to obtain a number identification process result;

[0029] The matching processing unit is configured to perform number regularization matching processing on the network name vulnerability intelligence or the completed vulnerability intelligence based on the number identification processing result using a preset or customized number regular matching rule to obtain the global vulnerability intelligence to be reported including the universal vulnerability disclosure number.

[0030] In some embodiments of the present disclosure, based on the above technical solution, the advanced analysis submodule includes: a vector recognition unit configured to perform a universal vulnerability scoring vector recognition process on the completed vulnerability intelligence to obtain a vector recognition process result;

[0031] The number association unit is configured to perform number association search and identification processing on the universal vulnerability disclosure number based on the vector identification processing result to obtain a universal vulnerability scoring vector, and perform vulnerability vector parsing processing on the universal vulnerability scoring vector to obtain global vulnerability intelligence to be reported.

[0032] In some embodiments of the present disclosure, based on the above technical solution, the advanced analysis submodule includes: a proof identification unit configured to perform a viewpoint proof identification process on the completed vulnerability intelligence to obtain a proof identification process result;

[0033] The search and identification unit is configured to perform number association search and identification processing on the common vulnerability disclosure number based on the proof identification processing result to obtain the global vulnerability intelligence to be reported.

[0034] In some embodiments of the present disclosure, based on the above technical solution, the intelligence report module includes: an object creation submodule, configured to perform intelligence object creation processing on the global vulnerability intelligence to be reported to obtain a vulnerability intelligence file object;

[0035] The intelligence filling submodule is configured to use the global vulnerability intelligence to be reported to perform vulnerability intelligence filling processing on the vulnerability intelligence file object to generate a vulnerability monitoring report.

[0036] In some embodiments of the present disclosure, based on the above technical solution, the network vulnerability monitoring and management device further includes: an attachment construction module, configured to obtain a report storage path of the vulnerability monitoring report, and use the report storage path to perform vulnerability attachment construction processing on the vulnerability monitoring report to generate a vulnerability intelligence file;

[0037] The file monitoring module is configured to perform vulnerability intelligence sharing processing on the vulnerability intelligence file to monitor and manage the vulnerability intelligence file.

[0038] According to one aspect of an embodiment of the present disclosure, a computer-readable medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the method for monitoring and managing network vulnerabilities in the above technical solution is implemented.

[0039] According to one aspect of an embodiment of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute the network vulnerability monitoring and management method in the above technical solution by executing the executable instructions.

[0040] In the technical solution provided by the embodiments of the present disclosure, on the one hand, distributed collection is used to automatically collect network vulnerability intelligence to be monitored, which improves data collection efficiency, releases the manpower involved in the data collection process, realizes the linkage of data collection and data reporting, and has a higher degree of automation; on the other hand, intelligence extraction and automatic parsing of the target vulnerability intelligence data obtained through standardized analysis are performed to obtain network vulnerability intelligence to be reported in multiple dimensions, and vulnerability monitoring reports are automatically generated in preset or customized output forms for monitoring and management, which can quickly and accurately realize the reporting of vulnerability intelligence, improve security professionalism and influence, and at the same time avoid manual analysis and participation in the reporting and monitoring management process, further release human resources, and improve the efficiency, accuracy and intelligence of vulnerability intelligence reporting.

[0041] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present disclosure, and together with the specification, are used to explain the principles of the present disclosure. Obviously, the drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0043] Figure 1 The schematic diagram schematically shows an exemplary system architecture to which the technical solution of the present disclosure is applied;

[0044] Figure 2 A flowchart schematically shows a method for monitoring and managing network vulnerabilities in some embodiments of the present disclosure;

[0045] Figure 3 A flowchart schematically shows the steps of a method for generating network vulnerability intelligence to be reported in some embodiments of the present disclosure;

[0046] Figure 4 A flowchart schematically shows a method for obtaining network product vulnerability intelligence in some embodiments of the present disclosure;

[0047] Figure 5 A flowchart schematically shows another method for obtaining network product vulnerability intelligence in some embodiments of the present disclosure;

[0048] Figure 6 A flowchart schematically shows the steps of a method for automatic information completion processing and advanced analysis in some embodiments of the present disclosure;

[0049] Figure 7 A flowchart schematically shows the steps of a first advanced analysis method in some embodiments of the present disclosure;

[0050] Figure 8 A flowchart schematically shows the steps of a second advanced analysis method in some embodiments of the present disclosure;

[0051] Fig. 9 A flowchart schematically shows the steps of a third advanced analysis method in some embodiments of the present disclosure;

[0052] Fig.10 A flowchart schematically shows the steps of a fourth advanced analysis method in some embodiments of the present disclosure;

[0053] Fig.11 A flowchart schematically shows the steps of a method for generating a vulnerability monitoring report in some embodiments of the present disclosure;

[0054] Fig.12 A flowchart schematically shows the steps of a method for vulnerability intelligence sharing processing in some embodiments of the present disclosure;

[0055] Fig.13 The overall step flow chart of the network vulnerability monitoring and management method in some embodiments of the present disclosure is schematically shown;

[0056] Fig.14 The module structure diagram of the network vulnerability monitoring and management method in the application scenario of some embodiments of the present disclosure is schematically shown;

[0057] Fig.15 The following is a schematic flowchart showing the steps of a method for monitoring and managing network vulnerabilities in application scenarios according to some embodiments of the present disclosure;

[0058] Fig.16 The flowchart schematically shows the steps of the method for parsing and processing the reporting intelligence format in the application scenario in some embodiments of the present disclosure;

[0059] Fig.17 The structure block diagram of a network vulnerability monitoring and management device in some embodiments of the present disclosure is schematically shown;

[0060] Fig.18 The structure diagram of a computer system suitable for implementing the electronic device of the embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0061] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be more comprehensive and complete and will fully convey the concept of the example embodiments to those skilled in the art.

[0062] In addition, the described features, structures or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced without one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known methods, devices, implementations or operations are not shown or described in detail to avoid blurring the various aspects of the present disclosure.

[0063] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0064] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0065] In the relevant technologies in this field, the current security vulnerability intelligence in the industry is often simply collected from public vulnerability announcements, CVE (Common Vulnerabilities & Exposures) or vulnerability library lists on the Internet, and then manually fill in the vulnerability information disclosed by CNVD (China National Vulnerability Database), and then manually share the filled-in vulnerability information.

[0066] Among them, vulnerability intelligence refers to the knowledge or information related to the latest security vulnerability information on software or hardware, which is delivered to specific users through technical means as soon as possible, providing knowledge reserves for the risk response required in enterprise security operations.

[0067] The CVE number is like a dictionary table, giving a public name to widely recognized information security vulnerabilities or weaknesses that have been exposed.

[0068] CNVD is a national network security vulnerability database established by the National Computer Network Emergency Response Technical Processing Coordination Center in collaboration with important domestic information system units, basic telecommunications operators, network security vendors, software vendors and Internet companies.

[0069] However, this monitoring and management method of vulnerability data has a high degree of manual participation, which cannot free up manpower, and cannot be linked with the previous automated vulnerability collection to achieve automated vulnerability data supervision effects.

[0070] Based on the problems existing in the above solutions, the present disclosure provides a new network vulnerability monitoring and management method, a network vulnerability monitoring and management device, a computer-readable medium and an electronic device.

[0071] Figure 1 A schematic diagram of an exemplary system architecture applying the technical solution of the present disclosure is shown.

[0072] like Figure 1 As shown, the system architecture 100 may include a terminal 110 , a network 120 , and a server 130 . The terminal 110 and the server 130 are connected via the network 120 .

[0073] The terminal 110 may be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, etc., but is not limited thereto. The network 120 may be a communication medium of various connection types that can provide a communication link between the terminal 110 and the server 130, such as a wired communication link, a wireless communication link, or an optical fiber cable, etc., which is not limited in this application. The server 130 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms.

[0074] Specifically, the server end 130 collects network vulnerability intelligence to be monitored from at least two intelligence data sources in a distributed manner, and performs standardized analysis and processing on the collected network vulnerability intelligence to be monitored to obtain target vulnerability intelligence data. Furthermore, the target vulnerability intelligence data is standardized and stored in a warehouse to construct a network vulnerability database. Then, the target vulnerability intelligence data that has been standardized and stored in the warehouse is extracted and automatically parsed according to preset or customized network vulnerability extraction rules to generate network vulnerability intelligence to be reported. Finally, the network vulnerability intelligence to be reported is automatically completed and analyzed, and a vulnerability monitoring report is automatically generated in a preset or customized output form.

[0075] In addition, the network vulnerability monitoring and management method in the embodiment of the present disclosure can be applied to a terminal or a server, and the present disclosure does not make any special limitation on this. The embodiment of the present disclosure mainly uses the application of the network vulnerability monitoring and management method to the server 130 as an example.

[0076] The network vulnerability monitoring and management method, network vulnerability monitoring and management device, computer-readable medium and electronic device provided by the present disclosure are described in detail below in conjunction with specific implementation methods.

[0077] Figure 2 The following schematically shows a flow chart of the steps of the network vulnerability monitoring and management method in some embodiments of the present disclosure. Figure 2 As shown, the network vulnerability monitoring and management method can mainly include the following steps:

[0078] Step S210: Distributedly collect network vulnerability intelligence to be monitored from at least two intelligence data sources, and perform standardized analysis and processing on the collected network vulnerability intelligence to be monitored to obtain target vulnerability intelligence data.

[0079] Step S220: Standardize and store the target vulnerability intelligence data in a database to build a network vulnerability database.

[0080] Step S230: Extract intelligence and automatically parse the target vulnerability intelligence data that has been standardized and stored in the database using preset or customized network vulnerability extraction rules to generate network vulnerability intelligence to be reported.

[0081] Step S240: automatically complete and perform advanced analysis on the network vulnerability intelligence to be reported, and automatically generate a vulnerability monitoring report in a preset or customized output format.

[0082] In the exemplary embodiments of the present disclosure, on the one hand, distributed collection is adopted to automatically collect network vulnerability intelligence to be monitored, which improves data collection efficiency, releases the manpower involved in the data collection process, realizes the linkage of data collection and data reporting, and has a higher degree of automation; on the other hand, intelligence extraction and automatic parsing are performed on the target vulnerability intelligence data obtained through standardized analysis to obtain network vulnerability intelligence to be reported in multiple dimensions, and vulnerability monitoring reports are automatically generated in preset or customized output forms for monitoring and management, which can quickly and accurately realize the reporting of vulnerability intelligence, improve security professionalism and influence, and at the same time avoid manual analysis and participation in the reporting and monitoring management process, further release human resources, and improve the efficiency, accuracy and intelligence of vulnerability intelligence reporting.

[0083] The following is a detailed description of each step of the network vulnerability monitoring and management method.

[0084] In step S210, network vulnerability intelligence to be monitored is collected from at least two intelligence data sources in a distributed manner, and the collected network vulnerability intelligence to be monitored is subjected to standardized analysis and processing to obtain target vulnerability intelligence data.

[0085] In an exemplary embodiment of the present disclosure, crawlers are used to collect network vulnerability intelligence to be monitored from various intelligence data sources on the Internet. When collecting network vulnerability intelligence to be monitored, a distributed collection cluster method can be used. Among them, distributed crawlers are a technical means that can support high scalability and high concurrency.

[0086] Specifically, the entire cluster can be divided into multiple subclusters as sub-nodes of the distributed crawler. Each subcluster focuses on crawling one intelligence data source. For example, the intelligence data source can be a data source website. That is, each subcluster performs one type of crawling task. The type of crawling task can be flexibly determined according to the data source and development method. Common task types include static pages, dynamic pages, and REST (Representational State Transfer) interfaces.

[0087] In addition, the distributed collection method can regularly trigger each distributed crawler to crawl the network vulnerability intelligence to be monitored on the Internet. Since some data source websites may set up anti-crawling mechanisms, when the distributed crawler fails, the crawler script of the distributed crawler can be updated to continue data collection for the data source website.

[0088] After the network vulnerability intelligence to be monitored is collected in a distributed manner, the network vulnerability intelligence to be monitored can be subjected to standardized analysis and processing to obtain target vulnerability intelligence data. Standardized analysis and processing can be to extract data of specified fields from the network vulnerability intelligence to be monitored as target vulnerability intelligence data. Therefore, the target vulnerability intelligence data can include the intelligence name field, intelligence source link, vulnerability generation time, vulnerability author, intelligence collection time, intelligence source field and network vulnerability keywords.

[0089] In addition, the target vulnerability intelligence data may also include Common Vulnerabilities & Exposures (CVE) numbers, Common Vulnerability Scoring System (CVSS) vectors, and Proof of Concept (POC) data. Moreover, other vulnerability data may also be included depending on the different network vulnerability intelligence to be monitored that can be provided by the intelligence data source and the need to report vulnerability data, and this exemplary embodiment does not specifically limit this.

[0090] In step S220, the target vulnerability intelligence data is standardized and stored in a database to construct a network vulnerability database.

[0091] In an exemplary embodiment of the present disclosure, the target vulnerability intelligence data obtained through the standardized analysis process may also be stored in a corresponding network vulnerability database.

[0092] In order to extract and report the target vulnerability intelligence data at a regular interval, as well as to extract and parse the target vulnerability intelligence data, the target vulnerability intelligence data can be uploaded to the corresponding network vulnerability database for storage. The network vulnerability database stores the target vulnerability intelligence data in a standardized format. The standardized format indicates that the storage field of the target vulnerability intelligence data is set according to a pre-set standard.

[0093] In step S230, intelligence extraction and automatic parsing processing are performed on the standardized stored target vulnerability intelligence data using preset or customized network vulnerability extraction rules to generate network vulnerability intelligence to be reported.

[0094] In an exemplary embodiment of the present disclosure, after the target vulnerability intelligence data is standardized and stored in a network vulnerability database, intelligence extraction can be performed on the target vulnerability intelligence data at regular intervals according to preset or customized network vulnerability extraction rules, so as to further perform automatic parsing and processing to obtain the network vulnerability intelligence to be reported.

[0095] In an alternative embodiment, Figure 3 A flowchart showing the steps of generating network vulnerability intelligence to be reported is shown in FIG. Figure 3 As shown, the method includes at least the following steps: In step S310, intelligence is extracted from the standardized stored target vulnerability intelligence data using preset or customized network vulnerability extraction rules to obtain vulnerability intelligence to be identified.

[0096] When intelligence extraction is performed on target vulnerability intelligence data that has been standardized and stored in the database, it can be implemented according to preset or customized network vulnerability extraction rules.

[0097] For example, the preset or customized network vulnerability extraction rule may be a rule that specifies the specified fields of the target vulnerability intelligence data to be extracted, or a rule that extracts specified fields from the target vulnerability data and stores the specified fields in a specified format, or other rules set according to actual conditions, and this exemplary embodiment does not make any special limitations on this.

[0098] After extracting intelligence according to the network vulnerability extraction rules, the vulnerability intelligence to be identified can be obtained. The vulnerability intelligence to be identified needs to be further processed to identify the intelligence source to determine whether it can be monitored and managed.

[0099] In step S320, the vulnerability intelligence to be identified is processed for reporting intelligence source identification to obtain reportable vulnerability intelligence, and the reportable vulnerability intelligence is automatically parsed to generate network vulnerability intelligence to be reported.

[0100] After extracting the vulnerability intelligence to be identified, the vulnerability intelligence to be identified can be processed for reporting intelligence source identification to obtain reportable vulnerability intelligence that can be reported and monitored.

[0101] Specifically, the intelligence source field in the vulnerability intelligence to be identified is extracted. Further, a customized reporting intelligence source condition is determined. For example, the reporting intelligence source condition includes that the intelligence source field cannot be in non-English.

[0102] The intelligence source field is matched with the conditions for reporting intelligence source, so that the vulnerability intelligence to be identified whose intelligence source field meets the conditions for reporting intelligence source can be regarded as reportable vulnerability intelligence, so as to further perform automatic parsing and processing to obtain the network vulnerability intelligence to be reported.

[0103] In an optional embodiment, the network vulnerability intelligence to be reported includes network product vulnerability intelligence. Figure 4 A flowchart of a method for obtaining network product vulnerability intelligence is shown. Figure 4 As shown, the method at least includes the following steps: In step S410, a network vulnerability keyword library is used to perform network vulnerability keyword identification processing on the reportable vulnerability intelligence to obtain a network vulnerability keyword.

[0104] The network vulnerability keyword represents product component information, and the product is a product generated by the vulnerability in the target vulnerability intelligence data. For example, the product component information can be product manufacturer information, etc.

[0105] The network vulnerability keyword can be extracted from the reportable vulnerability intelligence. After the network vulnerability keyword is extracted, the corresponding network vulnerability keyword library can be used to determine whether the network vulnerability keyword can be parsed.

[0106] Among them, the network vulnerability keyword library is formed by automatic classification and manual intervention of target intelligence data collected historically.

[0107] In step S420, the network vulnerability keyword is subjected to network vulnerability keyword parsing processing to obtain network product vulnerability intelligence. When the network vulnerability keyword exists in the network vulnerability keyword library, the network vulnerability keyword can be subjected to network vulnerability keyword parsing processing to obtain network product vulnerability intelligence. The network vulnerability keyword parsing processing is performed based on the mapping relationship between the network vulnerability keyword in the network vulnerability keyword library and the network product vulnerability intelligence. Specifically, the network product vulnerability intelligence having a mapping relationship with the network vulnerability keyword can be queried.

[0108] In this exemplary embodiment, the network vulnerability keyword library can be used to implement network vulnerability keyword recognition processing and keyword parsing processing of reportable vulnerability intelligence to obtain network product vulnerability data, enrich the content of the network vulnerability intelligence to be reported, and further realize the monitoring and management of the network vulnerability intelligence to be monitored.

[0109] However, in the process of establishing the mapping relationship between network vulnerability keywords and network product vulnerability intelligence, there may be a situation where network product vulnerability intelligence with a mapping relationship is not established for some network vulnerability keywords, resulting in the situation where network product vulnerability intelligence cannot be obtained by performing network vulnerability keyword parsing on the network vulnerability keywords, and therefore it is necessary to manually complete the network product vulnerability intelligence.

[0110] In an optional embodiment, the network vulnerability intelligence to be reported includes network product vulnerability intelligence. Figure 5 A flowchart showing another method for obtaining network product vulnerability intelligence is shown. Figure 5 As shown, the method at least includes the following steps: In step S510, a network vulnerability keyword library is used to perform network vulnerability keyword identification processing on the reportable vulnerability intelligence to obtain network vulnerability keywords.

[0111] The network vulnerability keyword represents product component information, where the product is a product generated by a vulnerability in the target vulnerability intelligence data. For example, the product component information may be product manufacturer information, etc.

[0112] The network vulnerability keyword can be extracted from the reportable vulnerability intelligence. After the network vulnerability keyword is extracted, the corresponding network vulnerability keyword library can be used to determine whether the network vulnerability keyword can be parsed.

[0113] Among them, the network vulnerability keyword library is formed by automatic classification and manual intervention of target intelligence data collected historically.

[0114] In step S520, when the network vulnerability keyword is subjected to keyword parsing processing and the network product vulnerability intelligence is not obtained, the network vulnerability keyword is subjected to component identification processing and the network product vulnerability intelligence is obtained.

[0115] If the network product vulnerability information is not obtained by performing keyword parsing processing on the network vulnerability keyword, the network product vulnerability information and the network vulnerability keyword library are completed according to the network vulnerability keyword.

[0116] When a network keyword belongs to a network vulnerability keyword library, but the corresponding network product vulnerability intelligence cannot be obtained by keyword parsing, the network product vulnerability intelligence corresponding to the keyword can be determined through the accumulation of manual experience. In addition, in order to further strengthen the keyword parsing process, the network product vulnerability intelligence can be completed in the mapping relationship between the network vulnerability keyword and the network product vulnerability intelligence, so as to avoid the situation where the network product vulnerability intelligence cannot be obtained when the keyword parsing process is performed on the same network vulnerability keyword next time.

[0117] In this exemplary embodiment, when it is impossible to perform keyword parsing to obtain network product vulnerability data, component identification processing can also be performed on the network vulnerability keywords to obtain them, thereby strengthening the keyword parsing processing method and making it more adaptable.

[0118] In addition, when the network vulnerability intelligence to be reported includes other vulnerability intelligence, other forms of automatic parsing and processing can also be performed.

[0119] In an optional embodiment, the network vulnerability intelligence to be reported includes network name vulnerability intelligence, and the reportable vulnerability intelligence is subjected to name regularization matching processing using preset or customized name regular matching rules to obtain the network name vulnerability intelligence.

[0120] Since the network product vulnerability intelligence is known, the network product vulnerability intelligence and the intelligence name field can be processed together for name regularization matching.

[0121] Specifically, the intelligence name field is extracted from the reportable vulnerability intelligence, and a field with a fixed format corresponding to the network product vulnerability intelligence and the intelligence name field is preset, such as "the vulnerability of the component..." Then, the network product vulnerability intelligence and the intelligence name field are filled into the preset field together to obtain "the vulnerability of the network product vulnerability intelligence 1 intelligence name field 1 occurs", and the preset field after filling is the network name vulnerability intelligence.

[0122] In step S240, the network vulnerability intelligence to be reported is automatically completed and analyzed, and a vulnerability monitoring report is automatically generated in a preset or customized output format.

[0123] In an exemplary embodiment of the present disclosure, after the network vulnerability intelligence to be reported is generated, the network vulnerability intelligence to be reported may be further subjected to information automatic completion processing and advanced analysis.

[0124] In an alternative embodiment, Figure 6 A flowchart showing the steps of the method for automatic information completion processing and advanced analysis is shown, such as Figure 6As shown, the method at least includes the following steps: In step S610, the network vulnerability intelligence to be reported is automatically completed to obtain completed vulnerability intelligence.

[0125] Specifically, the intelligence source link, vulnerability generation time, vulnerability author and intelligence collection time can be extracted from the network vulnerability intelligence to be reported. It is worth noting that the intelligence source link, vulnerability generation time, vulnerability author and intelligence collection time are data that exist in the distributed intelligence data source.

[0126] Furthermore, the intelligence source field, network product vulnerability intelligence, intelligence name field, intelligence source link, vulnerability generation time, vulnerability author and intelligence collection time are automatically completed to obtain completed vulnerability intelligence.

[0127] Specifically, determine the fixed format field corresponding to the intelligence source field, network product vulnerability intelligence, intelligence name field, intelligence source link, vulnerability generation time, vulnerability author, and intelligence income time, and fill the extracted intelligence source field, network product vulnerability intelligence, intelligence name field, intelligence source link, vulnerability generation time, vulnerability author, and intelligence income time into the fixed format field to obtain completed vulnerability intelligence.

[0128] In step S620, an advanced analysis is performed on the completed vulnerability information to obtain the global vulnerability information to be reported.

[0129] In an alternative embodiment, Figure 7 A flowchart showing the steps of the first advanced analysis method is shown in FIG. Figure 7 As shown, the method at least includes the following steps: In step S710, a universal vulnerability scoring vector recognition process is performed on the completed vulnerability intelligence to obtain a vector recognition process result.

[0130] Specifically, it may be possible to check whether there is a universal vulnerability scoring vector in the completed vulnerability intelligence to obtain a vector identification processing result, so as to extract the universal vulnerability scoring vector from the completed vulnerability intelligence.

[0131] In step S720, based on the vector recognition processing result, vulnerability vector parsing processing is performed on the completed vulnerability intelligence to obtain global vulnerability intelligence.

[0132] When the vector identification processing result is that a universal vulnerability scoring vector exists in the completed vulnerability intelligence, vulnerability vector parsing processing can be performed on the universal vulnerability scoring vector in the completed vulnerability intelligence to obtain global vulnerability intelligence.

[0133] Among them, the common vulnerability scoring vector consists of Base, Temporal, and Environmental, each of which consists of a set of indicators. Each group generates a numerical score from 0 to 10, as well as a vector, a compressed text representation reflecting the value used to derive the score. Base represents the intrinsic properties of the vulnerability. Temporal reflects the characteristics of the vulnerability changing over time. Environmental represents the vulnerability characteristics unique to any user environment. CVSS enables IT managers, vulnerability announcement providers, security vendors, application vendors, and researchers to benefit by adopting this common IT vulnerability scoring language.

[0134] The Base indicators include AV (Access Vector), AC (Access Complexity), Au (Authentication), C (Confidentiality Impact), I (Integrity Impact), and A (Availability Impact); the Temporal indicators include E (Exploitability), RL (Remediation Level), and RC (Report Confidence); the Environmental indicators include CDP (Collateral Damage Potential), TD (Target Distribution), CR, IR, and AR (Security Requirements).

[0135] Therefore, each metric in the Common Vulnerability Score vector consists of an abbreviated metric name followed by a ": (colon)" and then the metric value. The Common Vulnerability Score vector lists these metrics and metric values ​​in a predetermined order using the " / (slash)" character.

[0136] After obtaining the general vulnerability scoring vector, the vulnerability attribute data can be determined according to the mapping relationship between the indicator name and the flag and the corresponding vulnerability attribute data. For example, the general vulnerability scoring vector is AV:10 / AC:8 / A:6 / C:7... After the vulnerability vector is parsed, the corresponding vulnerability attribute data can be determined to include the attack path is remote, the attack complexity is medium, authentication is required, and confidentiality is partially affected... Further, global vulnerability intelligence containing vulnerability attribute data is generated.

[0137] In this exemplary embodiment, for the completed vulnerability intelligence including the universal vulnerability scoring vector, the global vulnerability intelligence including vulnerability attribute data can be obtained by vulnerability vector parsing processing, and the vector attributes of the universal vulnerability scoring vector are applied to ensure the accuracy and comprehensiveness of the obtained global vulnerability intelligence.

[0138] In an alternative embodiment, Figure 8 A flow chart showing the steps of the second advanced analysis method is shown in FIG. Figure 8 As shown, the method includes at least the following steps: In step S810, a universal vulnerability number identification process is performed on the completed vulnerability intelligence data to obtain a number identification process result.

[0139] Specifically, it may be possible to check whether there is a universal vulnerability disclosure number in the vulnerability completion intelligence to obtain a number identification processing result, so as to extract the universal vulnerability disclosure number from the vulnerability completion intelligence.

[0140] In step S820, based on the number recognition processing result, the network name vulnerability intelligence or the completed vulnerability intelligence is subjected to number regularization matching processing using preset or customized number regularization matching rules to obtain the global vulnerability intelligence to be reported including the common vulnerability disclosure number.

[0141] Specifically, since both the network name vulnerability intelligence and the completed vulnerability intelligence are generated by fields in fixed formats, and both fields contain universal vulnerability disclosure numbers, the universal vulnerability disclosure number can be obtained by identifying and processing the fields in fixed positions of the two fixed format fields respectively.

[0142] In this exemplary embodiment, a number regularization matching processing method is provided to obtain the universal vulnerability disclosure number for the vulnerability intelligence that does not have the universal vulnerability disclosure number, and the determination method is simple and accurate.

[0143] In an alternative embodiment, Fig. 9 A flowchart showing the steps of the third advanced analysis method is shown in FIG. Fig. 9 As shown, the method includes at least the following steps: In step S910, a universal vulnerability scoring vector recognition process is performed on the completed vulnerability intelligence data to obtain a vector recognition process result.

[0144] Specifically, it may be possible to check whether there is a universal vulnerability scoring vector in the completed vulnerability intelligence to obtain a vector identification processing result, so as to extract the universal vulnerability scoring vector from the completed vulnerability intelligence.

[0145] In step S920, based on the vector identification processing result, the universal vulnerability disclosure number is subjected to number association search and identification processing to obtain a universal vulnerability scoring vector, and the universal vulnerability scoring vector is subjected to vulnerability vector parsing to obtain the global vulnerability intelligence to be reported.

[0146] When the vector identification processing result is that there is no universal vulnerability scoring vector in the vulnerability intelligence, the universal vulnerability scoring vector can be obtained by performing number association search and identification processing on the universal vulnerability disclosure number to further perform vulnerability vector parsing processing.

[0147] Specifically, the number association search and identification process can be to extract the universal vulnerability score vector corresponding to the universal vulnerability disclosure number from the NVD (National Vulnerability Database). In addition, it can also be secondary extraction from other authoritative websites and other intelligence data sources, which is not specifically limited in this exemplary embodiment.

[0148] After obtaining the universal vulnerability scoring vector through the number association search and identification process, the universal vulnerability scoring vector can be subjected to the same vulnerability vector parsing process as step S720 to obtain vulnerability attribute data, which will not be described in detail here. Further, the generated global vulnerability intelligence includes vulnerability attribute data.

[0149] In this exemplary embodiment, for the completed vulnerability intelligence that does not have a universal vulnerability scoring vector, the corresponding universal number scoring vector can be obtained through number association search and identification processing, which gives full play to the data reliability of the authoritative data intelligence source and improves the vulnerability intelligence to be reported.

[0150] In an alternative embodiment, Fig.10 A flowchart showing the steps of the fourth advanced analysis method is shown in FIG. Fig.10 As shown, the method includes at least the following steps: In step S1010, point of view proof identification processing is performed on the vulnerability completion intelligence to obtain a proof identification processing result.

[0151] Specifically, it may be possible to check whether there is opinion-proving data in the vulnerability-completing intelligence to obtain a proof identification processing result, so as to extract the opinion-proving data from the vulnerability-completing intelligence.

[0152] In step S1020, based on the proof identification processing result, the universal vulnerability disclosure number is subjected to number association search and identification processing to obtain the global vulnerability intelligence to be reported.

[0153] When the proof identification processing result is that there is no opinion proof data in the vulnerability intelligence, the universal vulnerability disclosure number can be directly searched and identified by number association to obtain the global vulnerability intelligence to be reported.

[0154] Specifically, the number association search and identification process can be to extract the proof of concept data corresponding to the common vulnerability disclosure number from the website with the POC link. The proof of concept data is generally used in the vulnerability report, which is a description or an attack sample, so that the reader can confirm that the vulnerability is real.

[0155] In this exemplary embodiment, in order to complete the vulnerability intelligence for which there is no opinion-proving data, a number-associated search and identification process is provided to obtain the corresponding opinion-proving data, which greatly enhances the data reliability of the authoritative intelligence data source and ensures the completeness of the reported vulnerability data.

[0156] After automatically completing and analyzing the reported network vulnerability intelligence, vulnerability monitoring reports can be automatically generated in a preset or customized output format.

[0157] In an alternative embodiment, Fig.11 A flowchart showing the steps of generating a vulnerability monitoring report is shown. Fig.11 As shown, the method includes at least the following steps: In step S1110, the global vulnerability intelligence to be reported is processed by intelligence object creation to obtain a vulnerability intelligence file object.

[0158] Specifically, you can use Python's openpyxl library to create a new vulnerability intelligence file object (workbook). And switch the vulnerability intelligence file object to the default active mode. The vulnerability intelligence file object can subsequently add intelligence source fields, network product vulnerability intelligence, network name vulnerability intelligence, common vulnerability disclosure number, vulnerability attribute data, and opinion proof data.

[0159] In step S1120, the vulnerability intelligence file object is filled with vulnerability intelligence using the global vulnerability intelligence to be reported to generate a vulnerability monitoring report.

[0160] Specifically, the ws.append() method is used to fill the vulnerability intelligence file object with vulnerability intelligence, that is, the intelligence source field, network product vulnerability intelligence, network name vulnerability intelligence, common vulnerability disclosure number, vulnerability attribute data and opinion proof data are added to the table of the vulnerability intelligence file object to obtain a vulnerability monitoring report.

[0161] In addition, you can also set the display effect of vulnerability intelligence in the vulnerability monitoring table through fields such as color and size to facilitate manual viewing.

[0162] In addition, other report generation methods may be used to generate vulnerability monitoring reports corresponding to intelligence source fields, network product vulnerability intelligence, network name vulnerability intelligence, common vulnerability disclosure numbers, vulnerability attribute data, and opinion proof data. This exemplary embodiment does not specifically limit this.

[0163] In this exemplary embodiment, a vulnerability monitoring report corresponding to the global vulnerability intelligence to be reported is generated using a vulnerability intelligence file object. The style is easy to operate and the reading function is also very good.

[0164] In addition, vulnerability monitoring reports can be generated using network name vulnerability intelligence, complete vulnerability intelligence, common vulnerability disclosure numbers, vulnerability attribute data, and proof of opinion data.

[0165] Specifically, create a vulnerability intelligence file object corresponding to the network name vulnerability intelligence, completed vulnerability intelligence, common vulnerability disclosure number, vulnerability attribute data and proof of opinion data, and then perform vulnerability intelligence filling processing on the network name vulnerability intelligence, completed vulnerability intelligence, common vulnerability disclosure number, vulnerability attribute data and proof of opinion data to obtain the corresponding vulnerability monitoring report.

[0166] In addition, Python's openpyxl library can be used to create vulnerability intelligence file objects, and the ws.append() method can be used to fill in vulnerability intelligence.

[0167] Furthermore, the vulnerability monitoring report can also be processed for vulnerability intelligence sharing to achieve monitoring and management of the Lodong intelligence file.

[0168] In an alternative embodiment, Fig.12 A flowchart showing the steps of the vulnerability intelligence sharing process is shown in FIG. Fig.12 As shown, the method includes at least the following steps: in step S1210, the report storage path of the vulnerability monitoring report is obtained, and the report storage path is used to perform vulnerability attachment construction processing on the vulnerability monitoring report to generate a vulnerability intelligence file.

[0169] Since the vulnerability monitoring report needs to be processed for vulnerability intelligence sharing, the vulnerability monitoring report can be constructed as an attachment in a vulnerability reporting email. Based on this, when generating the vulnerability reporting email, the vulnerability monitoring report needs to be processed for corresponding vulnerability attachment construction. Among them, the vulnerability reporting email is the vulnerability intelligence file.

[0170] Specifically, the report storage path storing the vulnerability monitoring report is obtained, such as C:\\Users\\Desktop\\a.txt. Further, the report storage path is processed by using the python email library to construct a vulnerability attachment to obtain a vulnerability report email. The vulnerability attachment construction processing method can be att1 = MIMEText (open ('C:\\Users\\Desktop\\a.txt', 'rb').read(), 'base64', 'utf-8').

[0171] Specifically, the email library is mainly responsible for constructing emails. The email library refers to some structures displayed on the mailbox page, such as sender, recipient, subject, body and attachments, etc. In step S1220, vulnerability intelligence sharing processing is performed on the vulnerability intelligence file to monitor and manage the vulnerability intelligence file.

[0172] After the vulnerability intelligence file is constructed, the vulnerability intelligence file, that is, the vulnerability reporting email, can be sent to the vulnerability data sharing mailbox to perform vulnerability intelligence sharing processing on the vulnerability intelligence file.

[0173] Specifically, the smtplib library is mainly responsible for sending emails. The smtplib library is an action of sending emails, specifically connecting to the mailbox server, then logging into the mailbox, and finally sending the email, which includes the sender, recipient, and email content.

[0174] Among them, the vulnerability data sharing mailbox can be the CNVD's public reporting mailbox.

[0175] In this exemplary embodiment, after constructing a vulnerability intelligence file corresponding to the vulnerability monitoring report, the vulnerability intelligence file can be sent to a vulnerability data sharing mailbox to complete the vulnerability data reporting process and realize monitoring and management of the vulnerability intelligence file without manual participation, greatly freeing up human resources.

[0176] To further illustrate the relationship between the drawings, Fig.13 The overall step flow chart of the method for reporting vulnerability data is shown as follows: Fig.13As shown, in step S1301, the network vulnerability intelligence to be monitored is collected from at least two intelligence data sources in a distributed manner, and the collected network vulnerability intelligence to be monitored is subjected to standardized analysis and processing to obtain target vulnerability intelligence data; in step S1302, the target vulnerability intelligence data is subjected to standardized storage processing to construct a network vulnerability database; in step S1303, the target vulnerability intelligence data that has been standardized and stored is subjected to intelligence extraction using preset or customized network vulnerability extraction rules to obtain vulnerability intelligence to be identified; in step S1304, the target vulnerability intelligence data is subjected to standardized storage processing to construct a network vulnerability database. Build a network vulnerability database; in step S1305, automatically complete the information of the reported network vulnerability intelligence to obtain the completed vulnerability intelligence; in step S1306, perform universal vulnerability scoring vector recognition processing on the completed vulnerability intelligence to obtain vector recognition processing results; in step S1307, based on the vector recognition processing results, perform vulnerability vector parsing processing on the completed vulnerability intelligence to obtain global vulnerability intelligence; in step S1308, perform universal vulnerability number recognition processing on the completed vulnerability intelligence to obtain number recognition processing results; in step S1309, perform number regularization matching on the network name vulnerability intelligence or the completed vulnerability intelligence Processing is performed to obtain the global vulnerability intelligence to be reported including the common vulnerability disclosure number; in step S1310, the common vulnerability scoring vector recognition processing is performed on the completed vulnerability intelligence to obtain the vector recognition processing result; in step S1311, the common vulnerability disclosure number is subjected to number association search recognition processing to obtain the common vulnerability scoring vector, and the vulnerability vector parsing processing is performed to obtain the global vulnerability intelligence to be reported; in step S1312, the proof of view recognition processing is performed on the completed vulnerability intelligence to obtain the proof recognition processing result; in step S1313, based on the proof recognition processing result, the common vulnerability disclosure number is subjected to number association search Identify and process the global vulnerability intelligence to be reported; in step S1314, perform intelligence object creation processing on the global vulnerability intelligence to be reported to obtain a vulnerability intelligence file object; in step S1315, perform vulnerability intelligence filling processing on the vulnerability intelligence file object using the global vulnerability intelligence to be reported to generate a vulnerability monitoring report; in step S1316, obtain the report storage path of the vulnerability monitoring report, and use the report storage path to perform vulnerability attachment construction processing on the vulnerability monitoring report to generate a vulnerability intelligence file; in step S1317, perform vulnerability intelligence sharing processing on the vulnerability intelligence file to monitor and manage the vulnerability intelligence file.

[0177] The following is a detailed description of the vulnerability data reporting method provided in the embodiment of the present disclosure in conjunction with a specific application scenario.

[0178] Fig.14 The module structure diagram of the network vulnerability monitoring and management method in the application scenario is shown as follows: Fig.14As shown, module 1410 is an intelligence collection module, module 1420 is a data storage module, module 1430 is a reporting intelligence extraction module, module 1440 is a reporting intelligence analysis module, module 1450 is a reporting form generation module and module 1460 is a reporting email sending module.

[0179] Among them, the intelligence collection module 1410 uses a crawler to collect network vulnerability intelligence to be monitored from public intelligence on the Internet, and performs standardized analysis and processing on the network vulnerability intelligence to be monitored to obtain target vulnerability intelligence data; the data storage module 1420 stores the standardized target vulnerability intelligence data into the corresponding network vulnerability database; the reporting intelligence extraction module 1430 judges the intelligence source field of the target vulnerability intelligence data according to the customized reporting intelligence source conditions; the reporting intelligence parsing module 1440 extracts and automatically parses the target vulnerability intelligence data according to the reporting format of the vulnerability data disclosed by CNVD when the intelligence source resources meet the reporting intelligence source conditions to obtain the global vulnerability intelligence to be reported, such as the intelligence source field, network product vulnerability intelligence, network name vulnerability intelligence, general vulnerability disclosure number, vulnerability attribute data and opinion proof data; the reporting form generation module 1450 automatically generates a vulnerability monitoring report corresponding to the global vulnerability intelligence to be reported; the reporting email sending module 1160 regularly generates a vulnerability reporting email corresponding to the vulnerability monitoring report, and sends the latest vulnerability reporting email every week.

[0180] Fig.15 The following is a flowchart showing the steps of the monitoring and management method of network vulnerabilities in the application scenario. Fig.15 As shown, in step S1510, intelligence is collected.

[0181] Use crawlers to collect network vulnerability intelligence to be monitored from various intelligence data sources on the Internet. When collecting network vulnerability intelligence to be monitored, you can use a distributed collection cluster. Among them, distributed crawlers are a technical means that can support high scalability and high concurrency.

[0182] Specifically, the entire cluster can be divided into multiple sub-clusters as sub-nodes of the distributed crawler. Each sub-cluster focuses on crawling one intelligence data source. For example, the intelligence data source can be a data source website. That is, each sub-cluster performs one type of crawling task.

[0183] In step S1520, the information is formatted.

[0184] Standardized analysis and processing of the network vulnerability intelligence to be monitored from different intelligence data sources is performed to obtain target vulnerability intelligence data, which is convenient for subsequent vulnerability intelligence storage and analysis and processing.

[0185] Standardized analysis processing can be to extract data of specified fields from the network vulnerability intelligence to be monitored as target vulnerability intelligence data. Therefore, the target vulnerability intelligence data can include intelligence name field, intelligence source link, vulnerability generation time, vulnerability author, intelligence collection time, intelligence source field and network vulnerability keywords.

[0186] In addition, the target vulnerability intelligence data may also include a common vulnerability disclosure number, a common vulnerability scoring vector, and proof of opinion data. Moreover, other vulnerability data may also be included according to the different network vulnerability intelligence to be monitored that can be provided by the intelligence data source and the need to report vulnerability data, which is not specifically limited in this exemplary embodiment.

[0187] In step S1530, the information is stored in the database.

[0188] In order to extract the target vulnerability intelligence data for reporting at a regular interval, and to extract intelligence and automatically parse the target vulnerability intelligence data, the target vulnerability intelligence data can be uploaded to the corresponding network vulnerability database for storage. The network vulnerability database stores the target vulnerability intelligence data in a standardized format. The standardized format indicates that the storage field of the target vulnerability intelligence data is set in a standard.

[0189] In step S1540, report the information extraction.

[0190] The latest stored target vulnerability intelligence data, that is, the vulnerability intelligence to be identified, is extracted from the network vulnerability database on a regular basis. The timing period can be one week or one day, and this exemplary embodiment does not make any special limitation on this.

[0191] In step S1550, the intelligence source identification is reported.

[0192] After extracting the vulnerability intelligence to be identified, the intelligence source field in the vulnerability intelligence to be identified can be extracted. Further, a customized reporting intelligence source condition, that is, a customized reporting intelligence source rule, is determined. For example, the reporting intelligence source condition includes that the intelligence source field is not in full English.

[0193] In step S1560, intelligence identification is reported.

[0194] When the intelligence source field meets the corresponding reporting intelligence source conditions, the reporting intelligence can be further identified. Generally, after the reporting intelligence source identification is passed, it can also be determined that the reportable vulnerability intelligence that has passed the reporting intelligence identification, that is, the reporting intelligence source identification has passed meets the reporting requirements, so as to eliminate meaningless vulnerability intelligence that cannot be reported. For example, the POC analysis content of the vulnerability intelligence to be identified that has been published does not need to be reported.

[0195] In step S1570, the information format is parsed.

[0196] For the reportable and missed intelligence identified through the intelligence reporting, further analysis and processing of the reporting format can be performed. The analysis and processing of the reporting intelligence is based on the prescribed reporting format of vulnerability data disclosed by CNVD, and vulnerability data such as the intelligence source field, network product vulnerability intelligence, network name vulnerability intelligence, common vulnerability disclosure number, vulnerability attribute data and opinion proof data need to be reported.

[0197] Specifically, Fig.16 The following is a flowchart showing the steps of the method for parsing and processing the reporting information format in the application scenario. Fig.16 As shown, in step S1601, component keywords are identified.

[0198] The intelligence source field is matched with the intelligence source conditions to extract the network vulnerability keywords in the vulnerability intelligence that can be reported when the intelligence source field meets the intelligence source conditions. The network vulnerability keywords represent product component information, and the product is the product that generates the vulnerability in the vulnerability intelligence that can be reported. For example, the product component information can be product manufacturer information, etc.

[0199] In step S1602, product analysis is performed.

[0200] After the network vulnerability keyword is extracted, the corresponding network vulnerability keyword library may be used to determine whether the network vulnerability keyword can be processed by keyword parsing.

[0201] Among them, the network vulnerability keyword library is formed by automatic classification and manual intervention of target intelligence data collected historically, and can be a network vulnerability keyword library.

[0202] When a network vulnerability keyword exists in the network vulnerability keyword library, the network vulnerability keyword can be subjected to network vulnerability keyword parsing to obtain network product vulnerability intelligence. The network vulnerability keyword parsing is performed based on the mapping relationship between the network vulnerability keyword in the network vulnerability keyword library and the network product vulnerability intelligence. Specifically, the network product vulnerability intelligence having a mapping relationship with the network vulnerability keyword can be queried.

[0203] In the process of establishing the mapping relationship between network vulnerability keywords and network product vulnerability intelligence, there may be a situation where network product vulnerability intelligence with a mapping relationship is not established for some network vulnerability keywords, resulting in the inability to obtain network product vulnerability intelligence by performing network vulnerability keyword parsing processing on the network vulnerability keywords. Therefore, it is necessary to manually or automatically complete the network product vulnerability intelligence.

[0204] When a network vulnerability keyword belongs to a network vulnerability keyword library, but the corresponding network product vulnerability intelligence cannot be obtained by performing network vulnerability keyword parsing, the network product vulnerability intelligence corresponding to the keyword can be obtained by accumulating manual experience or automatically calculating and completing. In addition, in order to further strengthen the network vulnerability keyword parsing, the network product vulnerability intelligence can be completed in the mapping relationship between the network vulnerability keyword and the network product vulnerability intelligence, so as to avoid the situation where the network product vulnerability intelligence cannot be obtained when the network vulnerability keyword parsing is performed on the same network vulnerability keyword next time.

[0205] In step S1603, the vulnerability name is resolved.

[0206] In order to determine the network name vulnerability intelligence of the vulnerability data to be reported, the intelligence name field in the target intelligence data can be subjected to name regularization matching. In addition, since the network product vulnerability intelligence is known, the network product vulnerability intelligence and the intelligence name field can be subjected to name regularization matching together.

[0207] Specifically, the intelligence name field is extracted from the reportable vulnerability intelligence, and a field with a fixed format corresponding to the network product vulnerability intelligence and the intelligence name field is preset, such as "the vulnerability of the component..." Then, the network product vulnerability intelligence and the intelligence name field are filled into the preset field together to obtain "the vulnerability of the network product vulnerability intelligence 1 intelligence name field 1 occurs", and the preset field after filling is the network name vulnerability intelligence.

[0208] In step S1604, the information is automatically completed.

[0209] Specifically, the intelligence source link, vulnerability generation time, vulnerability author and intelligence collection time can be extracted from the network vulnerability intelligence to be reported. It is worth noting that the intelligence source link, vulnerability generation time, vulnerability author and intelligence collection time are data that exist in the distributed intelligence data source.

[0210] Furthermore, the intelligence source field, network product vulnerability intelligence, intelligence name field, intelligence source link, vulnerability generation time, vulnerability author and intelligence collection time are automatically completed to obtain completed vulnerability intelligence.

[0211] Specifically, determine the fixed format field corresponding to the intelligence source field, network product vulnerability intelligence, intelligence name field, intelligence source link, vulnerability generation time, vulnerability author, and intelligence collection time, and fill the extracted intelligence source field, network product vulnerability intelligence, intelligence name field, intelligence source link, vulnerability generation time, vulnerability author, and intelligence collection time into the fixed format field to obtain the completed vulnerability intelligence, so as to realize the completion of vulnerability data.

[0212] According to the requirement of generating missing and completed vulnerability intelligence, that is, the preliminary data collection, it is also possible to generate completed vulnerability intelligence including vulnerability data such as vulnerability impact object type and security recommendations to meet the completion requirements under different scenario needs.

[0213] In step S1605, it is determined whether a common vulnerability exposure number exists.

[0214] Check whether there is a field for the common vulnerability exposure number in the vulnerability intelligence to determine whether there is a common vulnerability exposure number.

[0215] In step S1606, the common vulnerability disclosure number is obtained by parsing.

[0216] When the common vulnerability disclosure number does not exist in the vulnerability intelligence, the common vulnerability disclosure number can be obtained by regularizing and matching the vulnerability number.

[0217] Specifically, since both the network name vulnerability intelligence and the completed vulnerability intelligence are generated by fields in fixed formats, and both fields contain universal vulnerability disclosure numbers, the universal vulnerability disclosure number can be obtained by identifying and processing the fields in fixed positions of the two fixed format fields respectively.

[0218] In step S1607, it is determined whether there is a common vulnerability scoring vector.

[0219] Check whether there is a common vulnerability scoring vector field in the vulnerability intelligence to determine whether there is a common vulnerability scoring vector.

[0220] In step S1608, a common vulnerability scoring vector is obtained through association search.

[0221] When there is no universal vulnerability scoring vector in the completed vulnerability intelligence, the universal vulnerability scoring vector can be obtained by performing number association search and identification processing on the universal vulnerability disclosure number for further vulnerability vector parsing processing.

[0222] Specifically, the number association search and identification process can be to extract the universal vulnerability score vector corresponding to the universal vulnerability disclosure number from the NVD (National Vulnerability Database). In addition, it can also be secondary extraction from other authoritative websites and other intelligence data sources, which is not specifically limited in this exemplary embodiment.

[0223] In step S1609, vector parsing is performed on the universal vulnerability score vector.

[0224] Regardless of whether the universal vulnerability scoring vector is obtained by performing number association search processing, or the universal vulnerability scoring vector is obtained from target intelligence data, the universal vulnerability scoring vector can be subjected to vector parsing processing to obtain vulnerability attribute data.

[0225] After obtaining the general vulnerability scoring vector, the vulnerability attribute data can be determined according to the mapping relationship between the indicator name and the flag and the corresponding vulnerability attribute data. For example, the general vulnerability scoring vector is AV:10 / AC:8 / A:6 / C:7... After the vulnerability vector is parsed, the corresponding vulnerability attribute data can be determined to include the attack path is remote, the attack complexity is medium, authentication is required, and confidentiality is partially affected... Further, global vulnerability intelligence containing vulnerability attribute data is generated.

[0226] That is, the vulnerability attribute data may include data such as attack complexity, confidentiality, integrity, availability, attack path, and authentication prerequisites, and may also include data of other indicators, which are not listed one by one in this exemplary embodiment.

[0227] In step S1610, it is verified whether the viewpoint certification data exists.

[0228] Check whether there is a field containing proof-of-view data in the vulnerability completion intelligence to determine whether there is proof-of-view data.

[0229] In step S1611, the opinion-proving data is obtained through association identification.

[0230] When there is no proof-of-view data in the vulnerability completion intelligence, the proof-of-view data can be obtained through number association identification processing.

[0231] Specifically, the number-related search and identification processing can be to extract the proof-of-concept data corresponding to the common vulnerability disclosure number from the website with the POC link to improve the vulnerability data to be reported.

[0232] In step S1580, a reporting form is generated.

[0233] Specifically, create a vulnerability intelligence file object corresponding to the network name vulnerability intelligence, completed vulnerability intelligence, common vulnerability disclosure number, vulnerability attribute data and proof of opinion data, and then perform vulnerability intelligence filling processing on the network name vulnerability intelligence, completed vulnerability intelligence, common vulnerability disclosure number, vulnerability attribute data and proof of opinion data to obtain the corresponding vulnerability monitoring report.

[0234] In addition, Python's openpyxl library can be used to create a vulnerability intelligence file object, and the ws.append() method can be used to fill in the vulnerability intelligence.

[0235] In step S1590, a report email is sent.

[0236] By using the email library and smtplib library of Python, vulnerability intelligence files corresponding to the missed monitoring reports, i.e. vulnerability reporting emails, can be generated, and vulnerability reporting emails with vulnerability monitoring reports attached can be sent to the public reporting mailbox of CNVD. In addition, by setting up scheduled tasks through the scheduled script, the latest vulnerability monitoring reports can be sent to the vulnerability data sharing mailbox on a weekly basis, completing the reporting process of public vulnerability data, and further realizing the monitoring and management of vulnerability intelligence files.

[0237] Based on the above application scenarios, it can be seen that the network vulnerability monitoring and management method provided by the embodiment of the present disclosure, on the one hand, adopts distributed collection to automatically collect the network vulnerability intelligence to be monitored, thereby improving the data collection efficiency, releasing the manpower involved in the data collection process, and realizing the linkage of data collection and data reporting, with a higher degree of automation; on the other hand, the target vulnerability intelligence data obtained by standardized analysis is subjected to intelligence extraction and automatic parsing processing to obtain network vulnerability intelligence to be reported in multiple dimensions, and vulnerability monitoring reports are automatically generated in preset or customized output forms for monitoring and management, which can quickly and accurately realize the reporting of vulnerability intelligence, improve security professionalism and influence, and at the same time avoid manual analysis and participation in the reporting and monitoring management process, further releasing human resources, and improving the efficiency, accuracy and intelligence of vulnerability intelligence reporting.

[0238] It should be noted that although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0239] The following describes an apparatus embodiment of the present disclosure, which can be used to execute the network vulnerability monitoring and management method in the above-mentioned embodiment of the present disclosure. For details not disclosed in the apparatus embodiment of the present disclosure, please refer to the embodiment of the network vulnerability monitoring and management method in the above-mentioned embodiment of the present disclosure.

[0240] Fig.17 The structure block diagram of a network vulnerability monitoring and management device in some embodiments of the present disclosure is schematically shown. Fig.17 As shown, the network vulnerability monitoring and management device 1700 can mainly include: an intelligence collection module 1710, an intelligence storage module 1720, an intelligence analysis module 1730 and an intelligence reporting module 1740.

[0241] The intelligence collection module 1710 is configured to collect network vulnerability intelligence to be monitored from at least two intelligence data sources in a distributed manner, and perform standardized analysis and processing on the collected network vulnerability intelligence to be monitored to obtain target vulnerability intelligence data; the intelligence storage module 1720 is configured to perform standardized storage and processing on the target vulnerability intelligence data to build a network vulnerability database; the intelligence analysis module 1730 is configured to perform intelligence extraction and automatic analysis processing on the target vulnerability intelligence data that has been standardized and stored in the database according to preset or customized network vulnerability extraction rules, and generate network vulnerability intelligence to be reported; the intelligence report module 1740 is configured to perform automatic information completion processing and advanced analysis on the network vulnerability intelligence to be reported, and automatically generate a vulnerability monitoring report in a preset or customized output format.

[0242] In some embodiments of the present disclosure, the intelligence parsing module includes: an intelligence extraction submodule configured to extract intelligence from the target vulnerability intelligence data that has been standardized and stored in the library according to a preset or customized network vulnerability extraction rule to obtain vulnerability intelligence to be identified;

[0243] The intelligence identification submodule is configured to perform reporting intelligence source identification processing on the vulnerability intelligence to be identified to obtain reportable vulnerability intelligence, and automatically parse the reportable vulnerability intelligence to generate network vulnerability intelligence to be reported.

[0244] In some embodiments of the present disclosure, the intelligence identification submodule includes: an identification processing unit configured to perform network vulnerability keyword identification processing on the reportable vulnerability intelligence using a network vulnerability keyword library to obtain a network vulnerability keyword;

[0245] The parsing processing unit is configured to perform keyword parsing processing on the network vulnerability keywords to obtain network product vulnerability intelligence.

[0246] In some embodiments of the present disclosure, the intelligence identification submodule includes: an identification processing unit configured to perform network vulnerability keyword identification processing on the reportable vulnerability intelligence using a network vulnerability keyword library to obtain a network vulnerability keyword;

[0247] The component identification unit is configured to perform component identification processing on the network vulnerability keyword to obtain network product vulnerability intelligence when the network product vulnerability intelligence is not obtained by performing keyword parsing processing on the network vulnerability keyword.

[0248] In some embodiments of the present disclosure, the intelligence identification submodule includes: a regular matching unit configured to use preset or customized name regular matching rules to perform name regularization matching processing on the reportable vulnerability intelligence to obtain network name vulnerability intelligence.

[0249] In some embodiments of the present disclosure, the intelligence reporting module includes: a completion processing submodule configured to automatically complete the information of the reported network vulnerability intelligence to obtain completed vulnerability intelligence;

[0250] The advanced analysis submodule is configured to perform advanced analysis on the completed vulnerability intelligence to obtain the global vulnerability intelligence to be reported.

[0251] In some embodiments of the present disclosure, the advanced analysis submodule includes: a vector identification unit configured to perform a general vulnerability scoring vector identification process on the completed vulnerability intelligence to obtain a vector identification process result;

[0252] The vector parsing unit is configured to perform vulnerability vector parsing processing on the completed vulnerability intelligence based on the vector recognition processing result to obtain global vulnerability intelligence.

[0253] In some embodiments of the present disclosure, the advanced analysis submodule includes: a number identification unit configured to perform a general vulnerability number identification process on the completed vulnerability intelligence to obtain a number identification process result;

[0254] The matching processing unit is configured to perform number regularization matching processing on the network name vulnerability intelligence or the completed vulnerability intelligence based on the number recognition processing result using a preset or customized number regular matching rule to obtain the global vulnerability intelligence to be reported including the common vulnerability disclosure number.

[0255] In some embodiments of the present disclosure, the advanced analysis submodule includes: a vector identification unit configured to perform a general vulnerability scoring vector identification process on the completed vulnerability intelligence to obtain a vector identification process result;

[0256] The number association unit is configured to perform number association search and identification processing on the common vulnerability disclosure number based on the vector identification processing result to obtain a common vulnerability scoring vector, and perform vulnerability vector parsing processing on the common vulnerability scoring vector to obtain global vulnerability intelligence to be reported.

[0257] In some embodiments of the present disclosure, the advanced analysis submodule includes: a proof identification unit configured to perform a viewpoint proof identification process on the completed vulnerability intelligence to obtain a proof identification process result;

[0258] The search and identification unit is configured to perform number-association search and identification processing on the common vulnerability disclosure number based on the proof identification processing result to obtain the global vulnerability intelligence to be reported.

[0259] In some embodiments of the present disclosure, the intelligence reporting module includes: an object creation submodule configured to perform intelligence object creation processing on the global vulnerability intelligence to be reported to obtain a vulnerability intelligence file object;

[0260] The intelligence filling submodule is configured to use the global vulnerability intelligence to be reported to perform vulnerability intelligence filling processing on the vulnerability intelligence file object to generate a vulnerability monitoring report.

[0261] In some embodiments of the present disclosure, the network vulnerability monitoring and management device further includes: an attachment construction module configured to obtain a report storage path of a vulnerability monitoring report, and perform vulnerability attachment construction processing on the vulnerability monitoring report using the report storage path to generate a vulnerability intelligence file;

[0262] The file monitoring module is configured to perform vulnerability intelligence sharing processing on the vulnerability intelligence file so as to monitor and manage the vulnerability intelligence file.

[0263] The specific details of the network vulnerability monitoring and management device provided in each embodiment of the present disclosure have been described in detail in the corresponding method embodiments, and will not be repeated here.

[0264] Fig.18 A schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present disclosure is shown.

[0265] It should be noted that Fig.18 The computer system 1800 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0266] like Fig.18 As shown, the computer system 1800 includes a central processing unit (CPU) 1801, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 1802 or the program loaded from the storage part 1808 to the random access memory (RAM) 1803. In the RAM 1803, various programs and data required for system operation are also stored. The CPU 1801, the ROM 1802, and the RAM 1803 are connected to each other through a bus 1804. The input / output (I / O) interface 1805 is also connected to the bus 1804.

[0267] The following components are connected to the I / O interface 1805: an input section 1806 including a keyboard, a mouse, etc.; an output section 1807 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1808 including a hard disk, etc.; and a communication section 1809 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 1809 performs communication processing via a network such as the Internet. A drive 1810 is also connected to the I / O interface 1805 as needed. A removable medium 1811, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1810 as needed so that a computer program read therefrom is installed into the storage section 1808 as needed.

[0268] In particular, according to an embodiment of the present disclosure, the process described in each method flow chart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains a program code for executing the method shown in the flow chart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication part 1809, and / or installed from a removable medium 1811. When the computer program is executed by a central processing unit (CPU) 1801, various functions defined in the system of the present application are executed.

[0269] It should be noted that the computer-readable medium shown in the embodiment of the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by an instruction execution system, device or device or used in combination with it. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a computer-readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate, or transmit programs for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0270] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0271] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0272] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0273] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any modifications, uses or adaptations of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary technical means in the art that are not disclosed in the present disclosure.

[0274] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A method for monitoring and managing network vulnerabilities, characterized in that: The method comprises: Collecting network vulnerability intelligence to be monitored from at least two intelligence data sources in a distributed manner, and performing standardized analysis and processing on the collected network vulnerability intelligence to be monitored to obtain target vulnerability intelligence data; The target vulnerability intelligence data is standardized and stored in a database to build a network vulnerability database; Extracting intelligence from the target vulnerability intelligence data that has been standardized and stored in the database using preset or customized network vulnerability extraction rules to obtain vulnerability intelligence to be identified; the vulnerability intelligence to be identified includes an intelligence source field; Match the intelligence source field with the intelligence source reporting condition, so as to take the vulnerability intelligence to be identified whose intelligence source field meets the intelligence source reporting condition as the vulnerability intelligence that can be reported; Using a preset or custom name regularization matching rule to perform name regularization matching processing on the reportable vulnerability intelligence to obtain network name vulnerability intelligence; Through the distributed collected intelligence data source, the network name vulnerability intelligence is automatically completed to obtain completed vulnerability intelligence, and the completed content is all included in the intelligence data source; Performing universal vulnerability scoring vector recognition processing on the completed vulnerability intelligence to obtain a vector recognition processing result; based on the vector recognition processing result, performing number association search recognition processing on the universal vulnerability disclosure number to obtain a universal vulnerability scoring vector, and performing vulnerability vector parsing processing on the universal vulnerability scoring vector to obtain global vulnerability intelligence to be reported; or performing point of view proof recognition processing on the completed vulnerability intelligence to obtain a proof recognition processing result; based on the proof recognition processing result, performing number association search recognition processing on the universal vulnerability disclosure number to obtain global vulnerability intelligence to be reported; Automatically generate vulnerability monitoring reports in preset or custom output formats.

2. The network vulnerability monitoring and management method according to claim 1 is characterized in that: The method further comprises: Using a network vulnerability keyword library to perform network vulnerability keyword identification processing on the reportable vulnerability intelligence to obtain network vulnerability keywords; The network vulnerability keywords are subjected to keyword parsing processing to obtain network product vulnerability intelligence.

3. The network vulnerability monitoring and management method according to claim 1 is characterized in that: The method further comprises: Using a network vulnerability keyword library to perform network vulnerability keyword identification processing on the reportable vulnerability intelligence to obtain network vulnerability keywords; When the network product vulnerability information is not obtained by performing keyword parsing processing on the network vulnerability keyword, a component identification processing is performed on the network vulnerability keyword to obtain the network product vulnerability information.

4. The network vulnerability monitoring and management method according to claim 1 is characterized in that: The automatic generation of vulnerability monitoring reports in a preset or custom output format includes: Performing intelligence object creation processing on the global vulnerability intelligence to be reported to obtain a vulnerability intelligence file object; The vulnerability intelligence file object is processed by using the global vulnerability intelligence to be reported to fill in the vulnerability intelligence and generate a vulnerability monitoring report.

5. The network vulnerability monitoring and management method according to claim 4 is characterized in that: The method further comprises: Acquire the report storage path of the vulnerability monitoring report, and use the report storage path to perform vulnerability attachment construction processing on the vulnerability monitoring report to generate a vulnerability intelligence file; The vulnerability intelligence file is subjected to vulnerability intelligence sharing processing so as to monitor and manage the vulnerability intelligence file.

6. A network vulnerability monitoring and management device, characterized in that: The device comprises: An intelligence collection module is configured to collect network vulnerability intelligence to be monitored from at least two intelligence data sources in a distributed manner, and perform standardized analysis and processing on the collected network vulnerability intelligence to be monitored to obtain target vulnerability intelligence data; The intelligence storage module is configured to perform standardized storage processing on the target vulnerability intelligence data to build a network vulnerability database; The intelligence parsing module is configured to extract intelligence from the target vulnerability intelligence data that has been standardized and stored in the database according to preset or customized network vulnerability extraction rules to obtain vulnerability intelligence to be identified; the vulnerability intelligence to be identified includes an intelligence source field; Match the intelligence source field with the intelligence source reporting condition, so as to take the vulnerability intelligence to be identified whose intelligence source field meets the intelligence source reporting condition as the vulnerability intelligence that can be reported; Using a preset or custom name regularization matching rule to perform name regularization matching processing on the reportable vulnerability intelligence to obtain network name vulnerability intelligence; Through the distributed collected intelligence data source, the network name vulnerability intelligence is automatically completed to obtain completed vulnerability intelligence, and the completed content is all included in the intelligence data source; Performing universal vulnerability scoring vector recognition processing on the completed vulnerability intelligence to obtain a vector recognition processing result; based on the vector recognition processing result, performing number association search recognition processing on the universal vulnerability disclosure number to obtain a universal vulnerability scoring vector, and performing vulnerability vector parsing processing on the universal vulnerability scoring vector to obtain global vulnerability intelligence to be reported; or performing point of view proof recognition processing on the completed vulnerability intelligence to obtain a proof recognition processing result; based on the proof recognition processing result, performing number association search recognition processing on the universal vulnerability disclosure number to obtain global vulnerability intelligence to be reported; The Intelligence Reporting module is configured to automatically generate vulnerability monitoring reports in preset or custom output formats.

7. A computer readable medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the network vulnerability monitoring and management method described in any one of claims 1 to 5 is implemented.

8. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to execute the network vulnerability monitoring and management method according to any one of claims 1 to 5 by executing the executable instructions.

Images