Vulnerability demonstration method and apparatus

Abstract

The application discloses a vulnerability display method and device, and relates to the technical field of system security. A specific embodiment of the method comprises the following steps: obtaining vulnerability information of a plurality of target vulnerabilities from a plurality of vulnerability disclosure platforms; determining a credibility value of the target vulnerabilities according to platform weights of the vulnerability disclosure platforms; performing sorting processing on the plurality of target vulnerabilities according to the credibility values and the vulnerability information of the target vulnerabilities, and displaying the plurality of target vulnerabilities after the sorting processing; determining a plurality of effective vulnerabilities from the plurality of target vulnerabilities after the sorting processing, and determining an authoritative score value of each vulnerability disclosure platform according to the plurality of effective vulnerabilities; and updating the platform weights of the vulnerability disclosure platforms according to the authoritative score values of the vulnerability disclosure platforms. The embodiment can provide effective vulnerability reference information to users based on the vulnerability disclosure platforms.

Description

Technical Field

[0001] This invention relates to the field of system security technology, and in particular to a vulnerability display method and apparatus. Background Technology

[0002] Operating systems, applications, and third-party components may all contain vulnerabilities, impacting the overall security of the system. Vulnerability information is scattered across multiple vulnerability disclosure platforms. These platforms are prone to false positives and false negatives, and their authority, focus, and vulnerability presentation methods often vary significantly. Therefore, providing users with effective vulnerability reference information based on these various disclosure platforms is a pressing issue that needs to be addressed. Summary of the Invention

[0003] In view of this, embodiments of the present invention provide a vulnerability display method and apparatus, which can provide users with effective vulnerability reference information based on various vulnerability disclosure platforms.

[0004] In a first aspect, embodiments of the present invention provide a vulnerability display method, including:

[0005] Obtain vulnerability information for multiple target vulnerabilities from multiple vulnerability disclosure platforms;

[0006] The credibility value of the target vulnerability is determined based on the platform weight of each vulnerability disclosure platform.

[0007] Based on the trust value and vulnerability information of the target vulnerabilities, the multiple target vulnerabilities are sorted and the sorted target vulnerabilities are displayed.

[0008] From the sorted target vulnerabilities, multiple valid vulnerabilities are identified, and based on the multiple valid vulnerabilities, the authority score of each vulnerability disclosure platform is determined.

[0009] The platform weight of the vulnerability disclosure platform is updated based on its authority score.

[0010] Optionally, the step of identifying multiple valid vulnerabilities from the sorted pool of target vulnerabilities includes:

[0011] Receive feedback from users regarding the sorted target vulnerabilities;

[0012] Based on the feedback information, several valid vulnerabilities were identified.

[0013] Optionally, the step of identifying multiple valid vulnerabilities from the sorted pool of target vulnerabilities includes:

[0014] From the sorted target vulnerabilities, a predetermined number of vulnerabilities are identified as the valid vulnerabilities;

[0015] or,

[0016] From the sorted list of target vulnerabilities, vulnerabilities with a confidence value not less than a preset threshold are identified as valid vulnerabilities.

[0017] Optionally, determining the trust value of the target vulnerability based on the platform weight of each vulnerability disclosure platform includes:

[0018] Determine the disclosure information corresponding to each target vulnerability platform, wherein the disclosure information indicates whether the target vulnerability is disclosed on the vulnerability disclosure platform;

[0019] The credibility value of the target vulnerability is determined based on the disclosure information and platform weight of each vulnerability disclosure platform.

[0020] Optionally, determining the authority score of each vulnerability disclosure platform based on the plurality of valid vulnerabilities includes:

[0021] Determine the total number of vulnerabilities obtained from the vulnerability disclosure platform, and calculate the comprehensiveness score based on the total number of vulnerabilities;

[0022] Determine the number of valid vulnerabilities obtained from the vulnerability disclosure platform, and calculate an accuracy score based on the number of valid vulnerabilities;

[0023] The authority score of the vulnerability disclosure platform is determined based on the comprehensiveness score and the accuracy score.

[0024] Optionally, updating the platform weight of the vulnerability disclosure platform based on its authority score includes:

[0025] If the authority score of the vulnerability disclosure platform is greater than the first score, the platform weight of the vulnerability disclosure platform will be increased.

[0026] If the authority score of the vulnerability disclosure platform is less than the second score, the platform weight of the vulnerability disclosure platform will be reduced, where the second score is less than the first score.

[0027] Optionally, the vulnerability information includes: severity level;

[0028] The step of sorting multiple target vulnerabilities based on their trust values ​​and vulnerability information includes:

[0029] Based on the trust value and severity level of each target vulnerability, the multiple target vulnerabilities are sorted.

[0030] Optionally, the step of sorting multiple target vulnerabilities based on their trust values ​​and vulnerability information includes:

[0031] Obtain vulnerability detection parameters;

[0032] Based on the vulnerability detection parameters, the multiple target vulnerabilities are divided into multiple categories;

[0033] For each category: based on the trust value and vulnerability information of the target vulnerability, the vulnerabilities in the category are sorted.

[0034] Optionally, the vulnerability detection parameters include: operating system;

[0035] The step of classifying the multiple target vulnerabilities into multiple categories based on the vulnerability detection parameters includes:

[0036] Obtain vulnerability description information for the target vulnerability, wherein the vulnerability description information includes: system description information;

[0037] Based on the comparison results between the operating system and the system description information, the target vulnerability is classified into target categories, including: operating system matching category or operating system exclusion category.

[0038] Optionally, the vulnerability detection parameters include: version number;

[0039] The step of classifying the multiple target vulnerabilities into multiple categories based on the vulnerability detection parameters includes:

[0040] Obtain the vulnerability description information of the target vulnerability, wherein the vulnerability description information includes: version description information;

[0041] Based on the comparison results between the version number and the version description information, the target vulnerability is classified into target categories, including: version number matching category or version number exclusion category.

[0042] Optionally, the vulnerability detection parameters include: version number;

[0043] The step of classifying the multiple target vulnerabilities into multiple categories based on the vulnerability detection parameters includes:

[0044] Obtain the patch link address corresponding to the target vulnerability provided by the vulnerability disclosure platform. The patch link address includes: official link address and / or unofficial link address.

[0045] Based on the version number, determine the version number matching information of the target vulnerability;

[0046] Based on the access information of the patch link address and the version number matching information, the target vulnerability is classified into target categories, which include: patch unavailable, patch pending verification, or patch available.

[0047] Secondly, embodiments of the present invention provide a vulnerability display device, comprising:

[0048] The vulnerability acquisition module is used to obtain vulnerability information of multiple target vulnerabilities from multiple vulnerability disclosure platforms;

[0049] The trust value determination module is used to determine the trust value of the target vulnerability based on the platform weight of each vulnerability disclosure platform.

[0050] The sorting module is used to sort the multiple target vulnerabilities according to their trust values ​​and vulnerability information, and to display the sorted target vulnerabilities.

[0051] The score determination module is used to identify multiple valid vulnerabilities from multiple target vulnerabilities after sorting, and to determine the authority score of each vulnerability disclosure platform based on the multiple valid vulnerabilities.

[0052] The weight update module is used to update the platform weight of the vulnerability disclosure platform based on its authority score.

[0053] Thirdly, embodiments of the present invention provide an electronic device, including:

[0054] One or more processors;

[0055] Storage device for storing one or more programs.

[0056] When the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any of the above embodiments.

[0057] Fourthly, embodiments of the present invention provide a computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the methods described in any of the above embodiments.

[0058] Fifthly, embodiments of the present invention provide a computer program product, including a computer program that, when executed by a processor, implements the methods described in any of the above embodiments.

[0059] One embodiment of the above invention has the following advantages or beneficial effects: Platform weights are used to characterize the comprehensiveness and accuracy of vulnerability information provided by vulnerability disclosure platforms. Based on the disclosure information of each target vulnerability and the platform weights of each vulnerability disclosure platform, the credibility value of each target vulnerability is determined. The credibility value is used to characterize the degree of credibility of the vulnerability information of the target vulnerability. Based on the credibility value and vulnerability information of the target vulnerabilities, multiple target vulnerabilities are sorted, and the sorted target vulnerabilities are displayed to the user. Compared to directly displaying vulnerability information collected by each vulnerability disclosure platform, the solution of this embodiment of the invention, which sorts multiple target vulnerabilities based on their credibility value and vulnerability information, can provide users with more effective vulnerability reference information.

[0060] Furthermore, by identifying valid vulnerabilities from multiple target vulnerabilities, the authority score of the vulnerability platform can be determined. Based on the authority score, the platform weight can be adjusted so that the credibility value of the vulnerability can be more accurately determined based on the platform weight, thereby making the vulnerability information displayed to users more valuable for reference.

[0061] The further effects of the aforementioned unconventional alternative methods will be explained below in conjunction with specific implementation methods. Attached Figure Description

[0062] The accompanying drawings are provided to better understand the invention and are not intended to unduly limit the scope of the invention. Wherein:

[0063] Figure 1 This is a flowchart illustrating a vulnerability display method provided in the first embodiment of the present invention;

[0064] Figure 2 This is a flowchart illustrating a vulnerability display method provided in the second embodiment of the present invention;

[0065] Figure 3 This is a flowchart illustrating a form display method provided in the third embodiment of the present invention;

[0066] Figure 4 This is a flowchart illustrating a vulnerability display method provided in the fourth embodiment of the present invention;

[0067] Figure 5 This is a schematic diagram of the structure of a vulnerability display system provided in the fourth embodiment of the present invention;

[0068] Figure 6 This is a schematic diagram of the structure of a vulnerability display device provided in an embodiment of the present invention;

[0069] Figure 7 This is a schematic diagram of the structure of a computer system suitable for implementing terminal devices or servers of the present invention. Detailed Implementation

[0070] The following description, in conjunction with the accompanying drawings, illustrates exemplary embodiments of the present invention, including various details to aid understanding. These details should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the invention. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0071] The acquisition, storage, use, and processing of data in this application all comply with the relevant provisions of national laws and regulations.

[0072] Figure 1 This is a flowchart illustrating a vulnerability display method provided in the first embodiment of the present invention, as shown below. Figure 1 As shown, the method includes:

[0073] Step 101: Obtain vulnerability information for multiple target vulnerabilities from multiple vulnerability disclosure platforms.

[0074] Vulnerability disclosure platforms are platforms that display vulnerability information of operating systems, applications, third-party components, etc., such as the National Information Security Vulnerability Sharing Platform.

[0075] The system retrieves search parameters and vulnerability information for multiple target vulnerabilities matching the search parameters from various vulnerability disclosure platforms. Search parameters may include: third-party component name, third-party component version number, operating system name, or application name, etc. Vulnerability information may include: vulnerability identifier, severity level, vulnerability description, patch information, version number, operating system, etc.

[0076] There are several ways to obtain search parameters. For example, users can directly input search parameters, and the search parameters can be obtained based on the user's input. Alternatively, a mapping can be constructed between the system and third-party component names, third-party component version numbers, operating system names, or application names, and the search parameters can be obtained based on this mapping. Another method is to obtain the target system's system information, service information, and directory information, and determine the search parameters based on this information.

[0077] Step 102: Determine the trust value of the target vulnerability based on the platform weight of each vulnerability disclosure platform.

[0078] Because vulnerability disclosure platforms may experience false positives or omissions, and their authority varies, a platform weight is assigned to each platform. This weight reflects the comprehensiveness and accuracy of the vulnerability information provided by the platform. A higher platform weight indicates greater authority and accuracy of the disclosed vulnerability information.

[0079] The trust value is used to characterize the trustworthiness of a target vulnerability. The higher the trust value, the more accurate the vulnerability information of the target vulnerability platform.

[0080] The same initial platform weight can be set for each vulnerability disclosure platform. Subsequently, the platform weights of each vulnerability disclosure platform are continuously adjusted based on the comprehensiveness and accuracy of the vulnerabilities disclosed by each platform. For ease of statistics, the sum of the platform weights of all vulnerability disclosure platforms can be set to a fixed value.

[0081] Step 103: Based on the trust value and vulnerability information of the target vulnerabilities, sort the multiple target vulnerabilities and display the sorted target vulnerabilities.

[0082] Vulnerability information may include: vulnerability identifier, severity level, vulnerability description, patch information, version number, operating system, etc. Multiple target vulnerabilities can be sorted by severity level and trust value; they can also be sorted by operating system and trust value; or by version number and trust value, etc.

[0083] It can sort and display vulnerability information from multiple target vulnerability disclosure platforms according to trust value and vulnerability information. Alternatively, it can sort and display multiple target vulnerabilities obtained from each target vulnerability platform according to trust value and vulnerability information.

[0084] Step 104: From the sorted target vulnerabilities, identify several valid vulnerabilities, and based on these valid vulnerabilities, determine the authority score of each vulnerability disclosure platform.

[0085] Valid vulnerabilities are those with a high degree of credibility selected from multiple target vulnerabilities. In one embodiment of the present invention, multiple valid vulnerabilities can be determined from multiple target vulnerabilities after sorting by: receiving feedback information from users regarding the multiple target vulnerabilities after sorting; and determining multiple valid vulnerabilities based on the feedback information.

[0086] Users can submit feedback on multiple target vulnerabilities after sorting. Feedback may include: multiple target vulnerabilities, and confirmation that the user-reported vulnerabilities are valid.

[0087] Feedback information may also include: false positive vulnerability IDs, false positive cause classifications, and false negative vulnerability IDs and false negative cause classifications. Based on user feedback, false positive vulnerabilities are removed from the displayed target vulnerabilities to obtain valid vulnerabilities. Through the classification of false positive and false negative causes, the system is further analyzed and optimized to make the vulnerability information displayed by the system more accurate.

[0088] The authority score is used to characterize the comprehensiveness and accuracy of the vulnerability disclosure platform in executing the vulnerability demonstration method. Generally, the more vulnerabilities obtained from the vulnerability disclosure platform, and the more valid vulnerabilities obtained, the higher the authority score of that platform.

[0089] Step 105: Update the platform weight of the vulnerability disclosure platform based on its authority score.

[0090] A higher authority score for a vulnerability disclosure platform indicates greater accuracy of the disclosed vulnerability information and higher platform authority, thus justifying an increase in the platform's weight. Conversely, a lower authority score indicates lower accuracy of the disclosed vulnerability information and lower platform authority, thus justifying a decrease in the platform's weight.

[0091] In this embodiment of the invention, platform weights are used to characterize the comprehensiveness and accuracy of vulnerability disclosure platforms. Based on the disclosure information of each target vulnerability and the platform weights of each vulnerability disclosure platform, a credibility value is determined for each target vulnerability. The credibility value characterizes the accuracy of the vulnerability information. Based on the credibility value and vulnerability information of the target vulnerabilities, multiple target vulnerabilities are sorted, and the sorted target vulnerabilities are displayed to the user. Compared to directly displaying vulnerability information collected by each vulnerability disclosure platform, this embodiment of the invention sorts and displays multiple target vulnerabilities based on their credibility value and vulnerability information, providing users with more effective vulnerability reference information.

[0092] Furthermore, by identifying valid vulnerabilities from multiple target vulnerabilities, the authority score of the vulnerability platform can be determined. Based on the authority score, the platform weight can be adjusted so that the credibility value of the vulnerability can be more accurately determined based on the platform weight. This makes the vulnerability information presented to users more valuable for reference.

[0093] In one embodiment of the present invention, association information between the target system and the upgraded patches can also be constructed. After obtaining vulnerability information for multiple target vulnerabilities, the upgrade status of the target system for each target vulnerability is determined and displayed based on the association relationship, and reminders are sent according to the upgrade status of the target system for each target vulnerability to facilitate subsequent upgrade and maintenance work for the target system. For example: Target vulnerability 1, critical vulnerability, upgraded; Target vulnerability 2, medium vulnerability, upgraded, not yet completed, etc.

[0094] Figure 2 This is a flowchart illustrating a vulnerability display method provided in the second embodiment of the present invention, as shown below. Figure 2 As shown, the method includes:

[0095] Step 201: Obtain vulnerability information for multiple target vulnerabilities from multiple vulnerability disclosure platforms.

[0096] Step 202: Determine the disclosure information corresponding to each target vulnerability platform; based on the disclosure information and platform weight of each vulnerability disclosure platform, determine the credibility value of the target vulnerability.

[0097] Disclosure information indicates whether a target vulnerability has been disclosed on a vulnerability disclosure platform. If the target vulnerability is disclosed on the current vulnerability disclosure platform, the disclosure information for the target vulnerability on the current vulnerability disclosure platform is 1. If the target vulnerability is not disclosed on the current vulnerability disclosure platform, the disclosure information for the target vulnerability on the current vulnerability disclosure platform is 0. The credibility value V of the target vulnerability can be determined according to the platform weight w of the vulnerability disclosure platforms (totaling N). i and disclosure information f i The formula for calculating the trust value V of a vulnerability is as follows:

[0098]

[0099] Disclosure information can also characterize the number of times a target vulnerability appears on multiple vulnerability disclosure platforms. For example, if there are 10 vulnerability disclosure platforms, and information about target vulnerability 1 appears on all 10 platforms, then the disclosure information for target vulnerability 1 is 10. If information about target vulnerability 2 appears on only one of those platforms, then the disclosure information for target vulnerability 2 is 1. Clearly, the credibility value of target vulnerability 1 is higher than that of target vulnerability 2.

[0100] The higher the platform weight of a vulnerability disclosure platform, the greater the credibility of the vulnerabilities disclosed by that platform. There are several ways to determine the credibility of a target vulnerability based on the disclosed information and the platform weights of each vulnerability disclosure platform. For example, the credibility of the target vulnerability can be determined by the ratio of the disclosed information of the target vulnerability to the total number of vulnerability disclosure platforms; or the credibility of the target vulnerability can be determined by the sum of the platform weights of all vulnerability disclosure platforms that disclosed the target vulnerability.

[0101] Step 203: Based on the trust value and vulnerability information of each target vulnerability, sort the multiple target vulnerabilities and display the sorted target vulnerabilities.

[0102] Step 204: Identify several valid vulnerabilities from the sorted target vulnerabilities.

[0103] In one embodiment of the present invention, determining a plurality of valid vulnerabilities from a plurality of target vulnerabilities after sorting includes: determining a preset number of vulnerabilities from a plurality of target vulnerabilities after sorting as valid vulnerabilities; or, determining vulnerabilities from a plurality of target vulnerabilities after sorting with a confidence value not less than a preset threshold as valid vulnerabilities.

[0104] The system can sort the target vulnerabilities according to their trustworthiness values, and select the top preset number of vulnerabilities as valid vulnerabilities from the sorted vulnerabilities. The preset number can be set as needed.

[0105] Vulnerabilities with a trust value not less than a preset threshold can also be directly identified as valid vulnerabilities. The preset threshold can be set according to requirements. Preset thresholds can be 0.5, 0.65, 0.7, etc.

[0106] Step 205: Determine the authority score of each vulnerability disclosure platform based on multiple valid vulnerabilities.

[0107] Determine the total number of vulnerabilities obtained from the vulnerability disclosure platform, and calculate the comprehensiveness score based on the total number of vulnerabilities; determine the number of valid vulnerabilities obtained from the vulnerability disclosure platform, and calculate the accuracy score based on the number of valid vulnerabilities; determine the authority score of the vulnerability disclosure platform based on the comprehensiveness score and the accuracy score.

[0108] In one embodiment of the present invention, the total number of vulnerabilities disclosed by all vulnerability disclosure platforms and the number of vulnerabilities disclosed by the current vulnerability disclosure platform are determined, and the ratio of the number of vulnerabilities disclosed by the current vulnerability disclosure platform to the total number of vulnerabilities is determined as the comprehensiveness score of the current vulnerability disclosure platform.

[0109] In one embodiment of the present invention, the total number of vulnerabilities disclosed by the current vulnerability disclosure platform and the number of valid vulnerabilities are determined, and the ratio of the number of valid vulnerabilities disclosed by the current vulnerability disclosure platform to the total number of vulnerabilities disclosed by the current vulnerability disclosure platform is determined as the accuracy score of the current vulnerability disclosure platform.

[0110] Determine the weights corresponding to the comprehensiveness and accuracy scores, calculate the weighted sum of the comprehensiveness and accuracy scores, and use this weighted sum as the authoritative score of the vulnerability disclosure platform. The weights corresponding to the comprehensiveness and accuracy scores can be set as needed, for example: the weight of the comprehensiveness score is 0.5, and the weight of the accuracy score is 0.5, etc.

[0111] Step 206: Update the platform weight of the vulnerability disclosure platform based on its authority score.

[0112] If the authority score of a vulnerability disclosure platform is greater than the first score, increase the platform weight of the vulnerability disclosure platform; if the authority score of a vulnerability disclosure platform is less than the second score, decrease the platform weight of the vulnerability disclosure platform.

[0113] Both the first and second scores can be set as needed. By increasing the platform weight of vulnerability disclosure platforms with high authority scores and decreasing the platform weight of vulnerability disclosure platforms with low authority scores, the platform weight can more accurately represent the accuracy and comprehensiveness of vulnerability disclosure platforms. Based on the platform weight, the credibility value of each vulnerability is determined, thereby presenting multiple vulnerabilities from various vulnerability disclosure platforms in a more reasonable manner.

[0114] Figure 3 This is a flowchart illustrating a vulnerability display method provided in the third embodiment of the present invention, as shown below. Figure 3 As shown, the method includes:

[0115] Step 301: Obtain vulnerability information for multiple target vulnerabilities from multiple vulnerability disclosure platforms.

[0116] Step 302: Determine the credibility value of the target vulnerability based on the platform weight of each vulnerability disclosure platform.

[0117] Step 303: Obtain vulnerability detection parameters and classify multiple target vulnerabilities into multiple categories based on the vulnerability detection parameters.

[0118] Vulnerability detection parameters include: operating system, version number, patch information, etc. Categories can be set according to specific needs, such as operating system matching category, operating system exclusion category, version number matching category, version number exclusion category, patch available, patch unavailable, patch pending verification, etc.

[0119] In one embodiment of the present invention, the vulnerability detection parameters include: operating system; and classifying multiple target vulnerabilities into multiple categories according to the vulnerability detection parameters, including: obtaining vulnerability description information of the target vulnerabilities, the vulnerability description information including: system description information; and classifying the target vulnerabilities into target categories according to the comparison results between the operating system and the system description information, the target categories including: operating system matching category or operating system exclusion category.

[0120] Vulnerability detection parameters include: operating system, which can include: Linux, Windows, macOS, iOS, Android, etc.

[0121] The system description information in the vulnerability description information of the target vulnerability is obtained. The system description information includes descriptions such as "Linux, Windows, MacOS, iOS, Android" and "Windows, MacOS". Further, the restrictions on the above systems are obtained, such as "appears only on XX platform", "applies to XX platform", "does not apply to XX platform", etc. Natural language processing technology is used to compare the system description information with the vulnerability detection parameters to determine whether the target vulnerability belongs to the operating system matching category or the operating system exclusion category.

[0122] In one embodiment of the present invention, the vulnerability detection parameters include: version number; according to the vulnerability detection parameters, multiple target vulnerabilities are divided into multiple categories, including: obtaining vulnerability description information of the target vulnerabilities, the vulnerability description information including: version description information; according to the comparison result of version number and version description information, the target vulnerabilities are divided into target categories, the target categories including: version number matching category or version number exclusion category.

[0123] Obtain the version description information from the vulnerability description information of the target vulnerability. The version description information includes fields such as "XX version / before XX version / after XX version / between XX-YY versions". Use natural language processing technology or bit-by-bit comparison to determine whether it contains the version number from the vulnerability detection parameters, in order to determine whether the target vulnerability belongs to the version number matching category or the version number exclusion category.

[0124] In one embodiment of the present invention, multiple target vulnerabilities are classified into multiple categories based on vulnerability detection parameters, including: obtaining patch link addresses corresponding to target vulnerabilities provided by a vulnerability disclosure platform, wherein the patch link addresses include: official link addresses and / or unofficial link addresses; and classifying target vulnerabilities into target categories based on access information and version number matching information of the patch link addresses, wherein the target categories include: patch unavailable, patch pending verification, or patch available.

[0125] Version number matching information indicates whether the patch's initial version is compatible with the component version. Access information indicates whether the patch link address can be accessed normally. The component version can be determined by searching system information or obtaining user input. On the vulnerability disclosure platform, locate the page corresponding to the target vulnerability and obtain the patch link address from that page. Then, based on the access information and version number matching information of the patch link address, classify the target vulnerability into the target category.

[0126] Specifically, it can be divided into the following three situations:

[0127] Scenario 1: The vulnerability disclosure platform does not provide official or unofficial links; if the vulnerability disclosure platform provides an official link but the official link is inaccessible, then the target vulnerability will be classified as an unpatched vulnerability.

[0128] Scenario 2: If the vulnerability disclosure platform does not provide an official link address, but provides a non-official link address, and the non-official link address can be accessed normally; or if the vulnerability disclosure platform provides an official link address, but the version number matching information indicates that the starting version of the patch is incompatible with the current component version, then the target vulnerability is classified into the category of patches pending verification.

[0129] Scenario 3: If the vulnerability disclosure platform provides an official link address, and the official link address is accessible, and the version number matching information indicates that the initial version of the patch is compatible with the current component version, then the target vulnerability is classified into the category where the patch is available.

[0130] Step 304: For each category: Sort the vulnerabilities in the category according to the trust value and vulnerability information of the target vulnerability.

[0131] Step 305: Display multiple target vulnerabilities in each category after sorting.

[0132] Table 1 Example of vulnerability display information

[0133]

[0134] Table 1 is an example of vulnerability display information provided by an embodiment of the present invention. As shown in Table 1, multiple vulnerabilities obtained from vulnerability disclosure platform 1, vulnerability disclosure platform 2... vulnerability disclosure platform N are displayed, and the vulnerabilities are divided into multiple categories. For each category, the vulnerabilities are displayed in order of severity level from high to low and trust value from high to low.

[0135] Categories can include: discovered vulnerabilities, exclusion categories based on input parameters, exclusion categories based on version number, exclusion categories based on operating system, categories based on patches pending verification, and categories based on patches that are unavailable. Discovered vulnerabilities refer to all vulnerabilities obtained from the current vulnerability disclosure platform. Input parameters are the parameters entered by the user for the current vulnerability display method. Input parameters can include: minimum severity level, initial weight of the vulnerability disclosure platform, operating system and patch information, etc. Vulnerabilities corresponding to the exclusion categories based on input parameters are those that do not meet the input parameter criteria.

[0136] Step 306: From the sorted target vulnerabilities, identify multiple valid vulnerabilities, and based on these valid vulnerabilities, determine the authority score for each vulnerability disclosure platform.

[0137] Step 307: Update the platform weight of the vulnerability disclosure platform based on its authority score.

[0138] In this embodiment of the invention, vulnerability detection parameters are obtained, and multiple target vulnerabilities are classified into multiple categories based on these parameters. By setting multiple categories, users can clearly view the distribution of target vulnerabilities under each category, enabling them to better utilize the target vulnerabilities displayed by the system for subsequent upgrades, maintenance, and other tasks.

[0139] To facilitate understanding of the method in this embodiment, the specific implementation process of a vulnerability display method for third-party components is described below. After obtaining the required and optional parameters input by the user, the vulnerability query module crawls component vulnerability information from multiple vulnerability disclosure platforms using the third-party component name and records it in a database. Subsequently, vulnerabilities are filtered according to their severity level and calculated and sorted based on the disclosure information and platform weight values. Then, the vulnerability filtering module uses component version number, operating system, patches, and other information to filter each vulnerability, excluding irrelevant vulnerabilities. Subsequently, vulnerabilities are categorized and displayed according to their severity level and the reasons for exclusion. Finally, valid vulnerability information is obtained through manual verification or recommendation algorithms, and the scores of each disclosure platform in this third-party component vulnerability detection are calculated and platform weights are adjusted to improve the accuracy of subsequent recommendations.

[0140] Figure 4 This is a flowchart illustrating a vulnerability display method provided in the fourth embodiment of the present invention, as shown below. Figure 4 As shown, the method includes:

[0141] Step 1: Obtain the required and optional parameters input by the user.

[0142] Required parameters include: component name and version number. The component name is the name of the third-party component to be detected. The version number is the version of the vulnerability being demonstrated.

[0143] Optional parameters include: minimum severity level, initial weight of vulnerability disclosure platform, operating system and patch information.

[0144] Minimum Severity Level: The lowest level of vulnerability to be detected and monitored. Vulnerabilities below this level are ignored. The default value for the minimum severity level is all levels.

[0145] Initial weights of vulnerability disclosure platforms: The sum of the weights of all vulnerability disclosure platforms is 1. By default, the initial weight of each vulnerability disclosure platform is 1 / N, where N is the number of vulnerability disclosure platforms to be monitored. The initial weights of each vulnerability disclosure platform must be set the first time the method is run. During subsequent runs, the system will automatically adjust the platform weights.

[0146] Operating System: Focus on the operating system where the vulnerability exists. The operating system can include: Linux / Windows / MacOS / iOS / Android, etc. The default value is all operating systems.

[0147] Patch information: The vulnerability may have issues such as no patch released, no official patch, patch is inaccessible, or patch is not applicable to the current version. The default value is all categories.

[0148] Step 2: Crawl vulnerability information from various vulnerability disclosure platforms based on the names of third-party components. Vulnerability information may include: vulnerability CVE number, severity level, vulnerability description, patch information, etc., and the crawled information is written to the database.

[0149] Step 3: First, exclude vulnerabilities with a severity level lower than the input parameters and those with an initial weight of 0. These excluded vulnerabilities are categorized as "input parameter excluded vulnerabilities." The remaining vulnerabilities are then deduplicated and sorted according to their severity and trust value.

[0150] Step 4: The vulnerability assessment module uses platform and component version numbers to filter vulnerabilities and classifies them into operating system mismatch and version number mismatch, according to the following rules;

[0151] Based on the operating system field in the vulnerability description information, such as Linux, Windows, MacOS, iOS, Android, etc., obtain fields such as "appears only on XX platform" to eliminate irrelevant vulnerabilities.

[0152] Based on the version number field in the vulnerability description information, obtain fields such as "XX version / before XX version / after XX version / between XX-YY versions", and determine whether the input parameter version number is included by the size of the bits.

[0153] Step 5: After obtaining the component-related vulnerabilities, categorize them again based on the patch information. Patch information can be categorized as: patch available, patch unavailable, patch pending verification, etc.

[0154] Step 6: Display the categorized vulnerability information to the user.

[0155] Step 7: Receive false positives and false negatives from users to obtain the number of valid vulnerabilities.

[0156] Table 2 Vulnerability Feedback Information

[0157]

[0158] As shown in Table 2, users can verify the detection results and provide feedback on false alarms, missed alarms, vulnerability numbers, and cause classifications to facilitate subsequent system optimization.

[0159] If the user does not provide detection results, the vulnerability information obtained in step 6 will be selected as valid vulnerabilities using recommended rules. Recommended rules may include: a vulnerability's credibility score exceeding 0.5; and calculating the average number of vulnerabilities reported on each platform in step 6 based on their severity level. The first result is taken from each level. One as a valid vulnerability, etc.

[0160] Step 8: Calculate the authority score of each vulnerability disclosure platform in this third-party component query. Platform i score S i The following parameters are considered in terms of both comprehensiveness and accuracy:

[0161] Total number of vulnerabilities collected: Number of vulnerabilities collected by vulnerability disclosure platform i (r) i ;

[0162] Average number of vulnerabilities: The sum of the number of vulnerabilities across N platforms and the average value.

[0163]

[0164] Number of valid vulnerabilities collected: The number of valid vulnerabilities collected by platform i (c) i ;

[0165] Number of valid vulnerabilities reported: Total number of valid vulnerabilities obtained in step 7. i ;

[0166] Given that the comprehensiveness score has a weight of 0.2 and the accuracy score has a weight of 0.8, the formula for calculating the authority group of vulnerability disclosure platform i in this query is as follows:

[0167]

[0168] Step 9: Update the platform weights of vulnerability disclosure platforms based on their authority scores to provide more accurate reference information for subsequent detection. The weight adjustment algorithm is as follows: Sort the authority scores of each platform in Step 8 from largest to smallest; adjust the platform weights of each vulnerability disclosure platform according to the number of vulnerability disclosure platforms N. The adjustment rules for the number of platforms N include:

[0169] N=1: A vulnerability disclosure platform does not involve weight adjustments.

[0170] N=2: Compare S x and S y The size of the two, if S x＞ S y Then the current weight value w of platform y y *Reduce the initial value w y 1%, the current weight value w of platform x.x *Increase w y 1%.

[0171] N >= 3: Sort each vulnerability disclosure according to the authority group size from largest to smallest, and divide the sorted vulnerability disclosure platforms into three groups: 1 ~ N / 3, N / 3+1 ~ 2N / 3+N%3, and 2N / 3+N%3+1 ~ N. The weight of the platforms in the second group remains unchanged.

[0172] Select one vulnerability disclosure platform from both the first and third groups as an adjustment pair for weight adjustment. The selection rules for adjustment pairs are as follows: the first platform x in the first group and the last platform y in the third group are used as one adjustment pair (i.e., the vulnerability disclosure platforms corresponding to the highest authority group and the lowest authority score are used as one group for weight adjustment), the vulnerability disclosure platforms corresponding to the second highest and second lowest authority scores are used as one group for weight adjustment, and so on.

[0173] The current weight w of platform y in the third group. y *Reduce initial weights w y 1%, will be the current weight w of the first group of platforms x. x *Value plus w y 1%. The formula for adjusting the weight value is as follows:

[0174]

[0175] Figure 5 This is a schematic diagram of the structure of a vulnerability display system provided in the fourth embodiment of the present invention, as shown below. Figure 5 As shown, the system comprises several modules, including input parameter parsing, vulnerability finding and filtering, and trust value calculation. The main functions of each module are described below.

[0176] Input parameter parsing: Parses the required and optional parameters input by the user, and initializes the method.

[0177] Vulnerability Finding & Filtering: Filter vulnerabilities that meet the criteria based on information such as third-party component name, version number, severity level, and monitored platforms on multiple vulnerability disclosure platforms.

[0178] Trust value calculation: Calculate the trust value of each vulnerability based on the platform's weight and disclosed information.

[0179] Vulnerability Finding & Filtering: Detecting whether vulnerability patches exist and are available.

[0180] Results Display: The filtered vulnerabilities are categorized and displayed.

[0181] User feedback / recommendation system feedback: manual judgment of vulnerability correctness or self-feedback judgment of correctness.

[0182] Score Calculation: The authority score of this query on the vulnerability disclosure platform is calculated based on the results of manual / self-feedback.

[0183] Weighting Adjustment: The weights of each vulnerability disclosure platform have been adjusted to ensure more accurate queries in the future.

[0184] In this embodiment of the invention, the introduction of weight values ​​differentiates vulnerability disclosure platforms, making them more consistent with real-world scenarios; the use of human / recommendation system feedback to continuously correct platform weight values ​​reduces false positives and makes the results more valuable; vulnerability screening is improved by adding patch screening to enhance detection accuracy; and results are displayed in categories, making it easy for users to clearly obtain vulnerability-related information.

[0185] Figure 6 This is a schematic diagram of the structure of a vulnerability display device provided in one embodiment of the present invention, as shown below. Figure 6 As shown, the device includes:

[0186] The vulnerability acquisition module 601 is used to acquire vulnerability information of multiple target vulnerabilities from multiple vulnerability disclosure platforms;

[0187] The credibility value determination module 602 is used to determine the credibility value of the target vulnerability based on the platform weight of each vulnerability disclosure platform.

[0188] The sorting module 603 is used to sort the multiple target vulnerabilities according to their trust values ​​and vulnerability information, and to display the sorted multiple target vulnerabilities.

[0189] The score determination module 604 is used to determine multiple valid vulnerabilities from multiple target vulnerabilities after sorting, and to determine the authority score of each vulnerability disclosure platform based on the multiple valid vulnerabilities.

[0190] The weight update module 605 is used to update the platform weight of the vulnerability disclosure platform based on the authority score of the vulnerability disclosure platform.

[0191] Optionally, the score determination module 604 is specifically used for:

[0192] Receive feedback from users regarding the sorted target vulnerabilities;

[0193] Based on the feedback information, several valid vulnerabilities were identified.

[0194] Optionally, the score determination module 604 is specifically used for:

[0195] From the sorted target vulnerabilities, a predetermined number of vulnerabilities are identified as the valid vulnerabilities;

[0196] or,

[0197] From the sorted list of target vulnerabilities, vulnerabilities with a confidence value not less than a preset threshold are identified as valid vulnerabilities.

[0198] Optionally, the confidence value determination module 602 is specifically used for:

[0199] Determine the disclosure information corresponding to each target vulnerability platform, wherein the disclosure information indicates whether the target vulnerability is disclosed on the vulnerability disclosure platform;

[0200] The credibility value of the target vulnerability is determined based on the disclosure information and platform weight of each vulnerability disclosure platform.

[0201] Optionally, the confidence value determination module 602 is specifically used for:

[0202] Determine the total number of vulnerabilities obtained from the vulnerability disclosure platform, and calculate the comprehensiveness score based on the total number of vulnerabilities;

[0203] Determine the number of valid vulnerabilities obtained from the vulnerability disclosure platform, and calculate an accuracy score based on the number of valid vulnerabilities;

[0204] The authority score of the vulnerability disclosure platform is determined based on the comprehensiveness score and the accuracy score.

[0205] Optionally, the weight update module 605 is specifically used for:

[0206] If the authority score of the vulnerability disclosure platform is greater than the first score, the platform weight of the vulnerability disclosure platform will be increased.

[0207] If the authority score of the vulnerability disclosure platform is less than the second score, the platform weight of the vulnerability disclosure platform will be reduced, where the second score is less than the first score.

[0208] Optionally, the vulnerability information includes: severity level;

[0209] The sorting module 603 is specifically used for:

[0210] Based on the trust value and severity level of each target vulnerability, the multiple target vulnerabilities are sorted.

[0211] Optionally, the sorting module 603 is specifically used for:

[0212] Obtain vulnerability detection parameters;

[0213] Based on the vulnerability detection parameters, the multiple target vulnerabilities are divided into multiple categories;

[0214] For each category: based on the trust value and vulnerability information of the target vulnerability, the vulnerabilities in the category are sorted.

[0215] Optionally, the vulnerability detection parameters include: operating system;

[0216] The sorting module 603 is specifically used for:

[0217] Obtain vulnerability description information for the target vulnerability, wherein the vulnerability description information includes: system description information;

[0218] Based on the comparison results between the operating system and the system description information, the target vulnerability is classified into target categories, including: operating system matching category or operating system exclusion category.

[0219] Optionally, the vulnerability detection parameters include: version number;

[0220] The sorting module 603 is specifically used for:

[0221] Obtain the vulnerability description information of the target vulnerability, wherein the vulnerability description information includes: version description information;

[0222] Based on the comparison results between the version number and the version description information, the target vulnerability is classified into target categories, including: version number matching category or version number exclusion category.

[0223] Optionally, the sorting module 603 is specifically used for:

[0224] Obtain the patch link address corresponding to the target vulnerability provided by the vulnerability disclosure platform. The patch link address includes: official link address and / or unofficial link address.

[0225] Based on the access information and version number matching information of the patch link address, the target vulnerability is classified into target categories, which include: patch unavailable, patch pending verification, or patch available.

[0226] This invention provides an electronic device, comprising:

[0227] One or more processors;

[0228] Storage device for storing one or more programs.

[0229] When one or more programs are executed by one or more processors, the one or more processors implement the methods of any of the above embodiments.

[0230] This invention provides a computer program product, including a computer program that, when executed by a processor, implements the enterprise risk assessment method of this invention.

[0231] The following is for reference. Figure 7 It shows a schematic diagram of the structure of a computer system 700 suitable for implementing a terminal device of the present invention. Figure 7 The terminal device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0232] like Figure 7 As shown, the computer system 700 includes a central processing unit (CPU) 701, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 702 or programs loaded from storage section 708 into random access memory (RAM) 703. The RAM 703 also stores various programs and data required for the operation of the system 700. The CPU 701, ROM 702, and RAM 703 are interconnected via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0233] The following components are connected to the I / O interface 705: an input section 706 including a keyboard, mouse, etc.; an output section 707 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card, modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 710 as needed so that computer programs read from it can be installed into the storage section 708 as needed.

[0234] In particular, according to the embodiments disclosed in this invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 709, and / or installed from removable medium 711. When the computer program is executed by central processing unit (CPU) 701, it performs the functions defined above in the system of this invention.

[0235] It should be noted that the computer-readable medium shown in this invention can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this invention, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0236] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0237] The modules described in the embodiments of this invention can be implemented in software or hardware. These modules can also be housed in a processor, and for example, can be described as: a vulnerability acquisition module, a trust value determination module, a sorting module, a score determination module, and a weight update module. The names of these modules do not necessarily limit the module itself; for example, the vulnerability acquisition module can also be described as "a module that acquires vulnerability information of multiple target vulnerabilities from multiple vulnerability disclosure platforms."

[0238] In another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiments; or it may exist independently and not assembled into the device. The computer-readable medium carries one or more programs, which, when executed by the device, cause the device to include:

[0239] Obtain vulnerability information for multiple target vulnerabilities from multiple vulnerability disclosure platforms;

[0240] The credibility value of the target vulnerability is determined based on the platform weight of each vulnerability disclosure platform.

[0241] Based on the trust value and vulnerability information of the target vulnerabilities, the multiple target vulnerabilities are sorted and the sorted target vulnerabilities are displayed.

[0242] From the sorted target vulnerabilities, multiple valid vulnerabilities are identified, and based on the multiple valid vulnerabilities, the authority score of each vulnerability disclosure platform is determined.

[0243] The platform weight of the vulnerability disclosure platform is updated based on its authority score.

[0244] According to the technical solution of this invention, platform weights are used to characterize the comprehensiveness and accuracy of vulnerability disclosure platforms. Based on the disclosure information of each target vulnerability and the platform weights of each vulnerability disclosure platform, a credibility value is determined for each target vulnerability. The credibility value characterizes the accuracy of the vulnerability information of the target vulnerability. Based on the credibility value and vulnerability information of the target vulnerabilities, multiple target vulnerabilities are sorted, and the sorted target vulnerabilities are displayed to the user. Compared to directly displaying vulnerability information collected by each vulnerability disclosure platform, this invention, by sorting multiple target vulnerabilities according to their credibility value and vulnerability information, can provide users with more effective vulnerability reference information.

[0245] Furthermore, by identifying valid vulnerabilities from multiple target vulnerabilities, the authority score of the vulnerability platform can be determined. Based on the authority score, the platform weight can be adjusted so that the credibility value of the vulnerability can be more accurately determined based on the platform weight. This makes the vulnerability information presented to users more valuable for reference.

[0246] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can occur depending on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A vulnerability demonstration method characterized by comprising: The method comprises the following steps: obtaining vulnerability information of a plurality of target vulnerabilities from a plurality of vulnerability disclosure platforms; determining a credibility value of the target vulnerability according to the platform weight of each vulnerability disclosure platform; sorting the plurality of target vulnerabilities according to the credibility value and the vulnerability information of the target vulnerability, and displaying the plurality of target vulnerabilities after the sorting processing; determining a plurality of effective vulnerabilities from the plurality of target vulnerabilities after the sorting processing, and determining an authority score of each vulnerability disclosure platform according to the plurality of effective vulnerabilities, comprising: determining the total number of vulnerabilities obtained from the vulnerability disclosure platform, and calculating a comprehensiveness score according to the total number of vulnerabilities; determining the number of effective vulnerabilities obtained from the vulnerability disclosure platform, and calculating an accuracy score according to the number of effective vulnerabilities; determining the authority score of the vulnerability disclosure platform according to the comprehensiveness score and the accuracy score; updating the platform weight of the vulnerability disclosure platform according to the authority score of the vulnerability disclosure platform.

2. The method of claim 1, wherein, The method comprises the following steps: receiving feedback information issued by a user for the plurality of target vulnerabilities after the sorting processing; determining a plurality of effective vulnerabilities according to the feedback information.

3. The method of claim 1, wherein, The method comprises the following steps: determining a preset number of vulnerabilities from the plurality of target vulnerabilities after the sorting processing as the effective vulnerabilities; or, determining the vulnerabilities with a credibility value not less than a preset threshold from the plurality of target vulnerabilities after the sorting processing as the effective vulnerabilities.

4. The method of claim 1, wherein, The method comprises the following steps: determining the disclosure information corresponding to each target vulnerability platform, wherein the disclosure information represents whether the target vulnerability is disclosed in the vulnerability disclosure platform; determining the credibility value of the target vulnerability according to the disclosure information and the platform weight corresponding to each vulnerability disclosure platform.

5. The method of claim 1, wherein, The method comprises the following steps: in the case that the authority score of the vulnerability disclosure platform is greater than a first score, increasing the platform weight of the vulnerability disclosure platform; in the case that the authority score of the vulnerability disclosure platform is less than a second score, decreasing the platform weight of the vulnerability disclosure platform, wherein the second score is not greater than the first score.

6. The method of claim 1, wherein, The vulnerability information comprises a hazard level. The method comprises the following steps: sorting the plurality of target vulnerabilities according to the credibility value and the hazard level of each target vulnerability.

7. The method of claim 1, wherein, The method comprises the following steps: obtaining a vulnerability detection parameter; dividing the plurality of target vulnerabilities into a plurality of categories according to the vulnerability detection parameter; for each category: sorting the vulnerabilities in the category according to the credibility value and the vulnerability information of the target vulnerability.

8. The method of claim 7, wherein, The vulnerability detection parameter comprises an operating system. The dividing the plurality of target vulnerabilities into a plurality of categories according to the vulnerability detection parameters comprises: obtaining vulnerability description information of the target vulnerability, wherein the vulnerability description information comprises system description information; dividing the target vulnerability into a target category according to a comparison result of the operating system and the system description information, wherein the target category comprises an operating system matching category or an operating system excluding category.

9. The method of claim 7, wherein, The vulnerability detection parameters comprise a version number. The dividing the plurality of target vulnerabilities into a plurality of categories according to the vulnerability detection parameters comprises: obtaining vulnerability description information of the target vulnerability, wherein the vulnerability description information comprises version description information; dividing the target vulnerability into a target category according to a comparison result of the version number and the version description information, wherein the target category comprises a version number matching category or a version number excluding category.

10. The method of claim 7, wherein, The vulnerability detection parameters comprise a version number. The dividing the plurality of target vulnerabilities into a plurality of categories according to the vulnerability detection parameters comprises: obtaining a patch link address corresponding to the target vulnerability provided by the vulnerability disclosure platform, wherein the patch link address comprises an official link address and / or a non-official link address; determining version number matching information of the target vulnerability according to the version number; dividing the target vulnerability into a target category according to access information of the patch link address and the version number matching information, wherein the target category comprises patch unavailability, patch to be checked, or patch availability.

11. A vulnerability demonstration apparatus characterized by comprising: The method comprises: a vulnerability obtaining module configured to obtain vulnerability information of a plurality of target vulnerabilities from a plurality of vulnerability disclosure platforms; a trusted value determining module configured to determine a trusted value of the target vulnerability according to a platform weight of each of the vulnerability disclosure platforms; a sorting module configured to sort the plurality of target vulnerabilities according to the trusted value and the vulnerability information of each of the target vulnerabilities, and display the plurality of target vulnerabilities after the sorting processing; a score determining module configured to determine a plurality of effective vulnerabilities from the plurality of target vulnerabilities after the sorting processing, determine a weight score of each of the vulnerability disclosure platforms according to the plurality of effective vulnerabilities, wherein the weight score comprises a comprehensiveness score calculated according to a total number of vulnerabilities obtained from the vulnerability disclosure platform, and an accuracy score calculated according to a number of effective vulnerabilities obtained from the vulnerability disclosure platform; and a weight updating module configured to update the platform weight of the vulnerability disclosure platform according to the weight score of the vulnerability disclosure platform.

12. An electronic device, comprising: The method comprises: one or more processors; a storage device configured to store one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the method of any one of claims 1-10.

13. A computer readable medium having stored thereon a computer program, characterized in that The program is executed by the processor to implement the method of any one of claims 1-10.

14. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the method of any one of claims 1-10.

Images