A multi-screen visualization method and device for a software vulnerability knowledge graph

Abstract

The present invention discloses a multi-screen visualization method and device for a software vulnerability knowledge graph. The method comprises the following steps: 1) constructing or obtaining a software vulnerability knowledge graph of a target software; 2) drawing a basic main view of the software vulnerability knowledge graph and displaying it on a first screen; 3) when the number of nodes at the same level exceeds a set threshold, aggregating the nodes at the corresponding level to generate an aggregate node and displaying it on the first screen; 4) placing the aggregate node or entity node that needs to be further displayed on the first screen on a second screen through a set operation; the placed node is used as a root node on the second screen, and the child nodes of the root node and the aggregate nodes related to the root node are displayed; 5) if there are multiple similar nodes to the entity node a displayed on the second screen, each similar node is placed on a screen respectively, and when the code in the entity node a is flipped or located, data linkage is performed on the corresponding code on each corresponding screen.

Description

Technical Field

[0001] The present invention relates to the field of software vulnerability analysis, and in particular to a method and device for visualizing a software vulnerability knowledge graph. Background Art

[0002] Software vulnerability knowledge graphs are effective tools for facilitating understanding of target software, lowering the barrier to acquiring and disseminating expertise, and enhancing human-computer collaboration in vulnerability mining and analysis scenarios. Visualizing software vulnerability knowledge graphs is the most intuitive way to present software vulnerability knowledge and can serve as an effective auxiliary analysis tool, improving the efficiency of vulnerability analysts.

[0003] With the continuous expansion of software and vulnerability data sources and the advancement of knowledge extraction and fusion technologies, the scale of software vulnerability knowledge graphs continues to expand. Simply presenting large-scale knowledge graphs can create significant visual clutter, making it difficult to focus on the information of interest. Visualizing large-scale knowledge graphs can also reduce graph rendering efficiency and affect the smoothness of human-computer interaction. Using software vulnerability knowledge graphs to assist manual analysis presents challenges in effectively organizing and presenting large-scale graph data.

[0004] Existing knowledge graph visualization methods are typically designed around specific business or application scenarios. In the field of software vulnerability analysis, information is primarily presented through charts, reports, and text. There is no effective method or mature system for visualizing large-scale software vulnerability knowledge graphs. Summary of the Invention

[0005] In response to the problems existing in the prior art, the present invention aims to provide a multi-screen visualization method and device for software vulnerability knowledge graphs. This invention targets a software vulnerability knowledge graph that includes basic entities such as software name, version number, code file name, function name, function body, CFG, vulnerability identifier, and vulnerability patch, as well as basic relationships between entities such as composition, dependency, influence, and similarity. Focusing on the needs of software understanding and vulnerability code association analysis scenarios, the present invention utilizes multiple display screens to organize data relationships such as cascades and comparisons in the graph, and provides analysts with a visual interactive analysis tool through data aggregation, drill-down exploration, and view linkage.

[0006] To achieve the above objectives, the multi-screen visualization solution provided by the present invention is as follows:

[0007] A multi-screen visualization method for a software vulnerability knowledge graph, comprising the following steps:

[0008] 1) Constructing or obtaining a software vulnerability knowledge graph of the target software; wherein the software vulnerability knowledge graph comprises entities and associations between entities; the entities include software name, version number, code file name, function name, function body, and vulnerability identifier; and the associations include composition relationships, impact relationships, and similarity relationships between entities;

[0009] 2) drawing a basic main view of the software vulnerability knowledge graph based on the software vulnerability knowledge graph and displaying it on the first screen; the basic main view of the software vulnerability knowledge graph includes a plurality of most popular software names, vulnerability identifiers, data categories, the amount of data in each category, and the association relationship between the data categories;

[0010] 3) When the number of nodes at the same level exceeds a set threshold, the nodes at the corresponding level are aggregated to generate an aggregate node and displayed on the first screen;

[0011] 4) The aggregate nodes or entity nodes to be further displayed on the first screen are placed on the second screen through a setting operation; on the second screen, the placed node is used as the root node, and the child nodes of the root node and the aggregate nodes related to the root node are obtained from the software vulnerability knowledge graph for display;

[0012] 5) If the entity node a displayed on the second screen has multiple similar code relationships, each similar code is placed on a screen respectively. When the code in the entity node a is flipped or located, the data of the similar codes on each corresponding screen is linked.

[0013] Furthermore, the entity also includes CFG and vulnerability patches; the association relationship also includes the dependency relationship between entities.

[0014] Furthermore, the basic main view of the software vulnerability knowledge graph also includes an entity and relationship filtering component and an entity search component; wherein, the entity and relationship filtering component filters the data according to the attributes of the data in the software vulnerability knowledge graph, and the entity search component performs fuzzy matching on the name attributes of the entity data according to keywords.

[0015] Furthermore, the aggregation nodes or entity nodes that need to be further displayed on the first screen are placed on the second screen for display by dragging the mouse or right-clicking.

[0016] Furthermore, the entities included in the software vulnerability knowledge graph are layered according to "software name-version number-code file-function-CFG".

[0017] Furthermore, the relevant data of the software vulnerability knowledge graph is preprocessed into json format, and then the front-end visualization component is used to render and generate the basic main view of the software vulnerability knowledge graph.

[0018] A multi-screen visualization device for software vulnerability knowledge graphs, characterized by comprising multiple display screens and a host system; each display screen is connected to the host system respectively, and the host system includes a front-end visualization module and a graph database; wherein,

[0019] The graph database is used to store a software vulnerability knowledge graph of the target software; wherein the software vulnerability knowledge graph includes entities and association relationships between entities; the entities include software names, version numbers, code file names, function names, function bodies, and vulnerability identifiers; the association relationships include composition relationships, impact relationships, and similarity relationships between entities;

[0020] The front-end visualization module is used to draw a basic main view of the software vulnerability knowledge graph based on the software vulnerability knowledge graph and display it on the first screen; the basic main view of the software vulnerability knowledge graph includes a plurality of most popular software names, vulnerability identifiers, data categories, the amount of data in each category, and the association relationship between the data categories;

[0021] The host system is used to aggregate the nodes of the corresponding level to generate an aggregate node and display it on the first screen when the number of nodes at the same level exceeds a set threshold; and when the aggregate node or entity node to be further displayed on the first screen is placed on the second screen through a set operation, the child nodes of the root node and the aggregate nodes related to the root node are obtained from the software vulnerability knowledge graph on the second screen with the placed node as the root node for display; if there are multiple similar nodes to the entity node a displayed on the second screen, each similar node is placed on a screen respectively, and when the code in the entity node a is flipped or located, the corresponding code on each corresponding screen is linked to data.

[0022] Furthermore, it also includes a data preprocessing module for preprocessing the relevant data of the software vulnerability knowledge graph into json format and sending it to the front-end visualization module.

[0023] The advantages of the present invention are as follows:

[0024] 1. With the help of multiple display screens, a feasible solution for visual software vulnerability analysis based on knowledge graph is provided.

[0025] 2. With the help of multiple display screens, a solution is provided for effectively organizing and visualizing large-scale knowledge graph data. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 A schematic diagram of using multiple screens to achieve data aggregation and drill-down exploration.

[0027] Figure 2 To realize similar code comparison diagram using multiple screens.

[0028] Figure 3 This is a flow chart of the multi-screen visualization method of the software vulnerability knowledge graph of the present invention. DETAILED DESCRIPTION

[0029] The present invention will be described in further detail below with reference to the accompanying drawings. The examples given are only used to explain the present invention and are not used to limit the scope of the present invention.

[0030] The present invention provides a solution for realizing large-scale software vulnerability knowledge graph visualization with the help of multiple screens. It utilizes multiple display screens for screen combination, data splitting and data linkage, and realizes effective organization and visual interaction of software vulnerability knowledge graph data in the scenarios of software understanding and vulnerability code association analysis, thereby improving the efficiency of manual analysis.

[0031] Method flow of the present invention Figure 3 As shown, the steps include:

[0032] Step 1: Build or obtain a software vulnerability knowledge graph for the target software. To facilitate software understanding and vulnerability code association analysis, the software vulnerability knowledge graph should at least include basic entities such as software name, version number, code file name, function name, function body, and vulnerability identifier, as well as basic relationships between entities such as composition, impact, and similarity. This can be expanded to include entities such as CFGs and vulnerability patches, as well as relationships between entities such as dependencies. Composition relationships primarily refer to inclusion relationships between software-related entities, including "software name-version number," "version number-code file," "code file-function," and "function-CFG." Impact relationships primarily refer to impact relationships between vulnerability entities and affected software-related entities, including "vulnerability identifier-software," "vulnerability identifier-version number," and "vulnerability identifier-function." Similarity relationships primarily refer to code similarities between software-related entities, including "code file-code file" and "function-function." A software vulnerability knowledge graph is constructed around the software vulnerability knowledge graph and stored in a graph database.

[0033] Step 2: Draw the basic main view of the software vulnerability knowledge graph. Focusing on the software understanding and vulnerability code association analysis scenarios, the data in the graph database is preprocessed into json format, and the front-end visualization component is used to render the basic main view, which includes entity nodes such as the software names of the Top K in terms of attention, vulnerability identifiers, the number of data in each category, and the association between each data category, as well as entity and relationship screening components and entity search components. Since the graph database organizes data in a way that is easy to store and retrieve graph data, it is less efficient to directly process graph data. Therefore, the present invention first preprocesses it into json format, reorganizes and encapsulates the data according to the requirements of the front-end visualization view, and each view corresponds to one or more json data. The relationship screening component filters data according to the attributes of the data in the graph; the search component performs fuzzy matching on the name attributes of the entity data based on keywords.

[0034] The method of rendering the basic main view using the front-end visualization component is:

[0035] 1) The front end obtains data in json format;

[0036] 2) Organize JSON data according to the data format specified by the rendering interface opened by the visualization component;

[0037] 3) Call the rendering interface of the visualization component, pass the organized data, draw it, and obtain the basic main view of the software vulnerability knowledge graph.

[0038] Step 3: Utilize multiple screens for data aggregation and drill-down exploration, supporting interactive visualization of cascading and comparison relationships within the software vulnerability knowledge graph. For example, for the hierarchical relationship of software components, such as "software name - version number - code file - function - CFG," large graph data volumes make it difficult to display all entity nodes within a limited area. A data aggregation algorithm is used to aggregate hierarchical entities whose node count exceeds a specified threshold and display them as aggregate nodes. Aggregate and entity nodes can be dragged or right-clicked to display them in a new display screen browser, presenting the drill-down exploration results. When multiple display screens are available, multiple drill-down exploration interactions enable visualization of cascading and comparison relationships within the software vulnerability knowledge graph. Drag-and-drop uses the dragged node as the root node, and the new screen displays the dragged node's child nodes and related aggregate nodes. Aggregate nodes are loaded onto the main view alongside the entity nodes, distinguished by color, transparency, or a dashed box.

[0039] Step 4: Use multiple screens to achieve visual presentation and interaction of similar code relationships in the software vulnerability knowledge graph. When there are multiple similar nodes for a specified entity node in the software vulnerability knowledge graph, such as multiple similar function nodes for a specified function entity node, the overall delivery is achieved with the help of multiple display screens. The delivery location depends on the pre-configured strategy of the visualization system or is dynamically specified by the analyst. The code of each similar function node is delivered to a screen separately; the similar code data on each screen provides a row-level comparison relationship presentation, and when the analyst flips or locates the code line, the data linkage in the multi-screen view is supported. The code of each similar code relationship can be loaded on one screen or on multiple screens separately. Among them, data linkage is mainly achieved by recording the anchor position of similar codes and tracking the code line number displayed in the current view. For example, there is a similar relationship between function entity node F1 and function entity node F2. The anchor position of F1 is the starting line number L1 of the similar code in function F1, and the anchor position of F2 is the starting line number L2 of the similar code in function F2. When multi-screen linkage is displayed, the two initial views are respectively positioned at the anchor positions of the two functions. When the analyst flips the code line of one view, the number of code lines flipped in other views and the speed are kept synchronized.

[0040] The device of the present invention includes multiple display screens and a host system, and the host system includes a front-end visualization module, a data preprocessing module, and a graph database.

[0041] While specific embodiments of the present invention have been disclosed for illustrative purposes, intended to facilitate understanding and implementation of the present invention, those skilled in the art will appreciate that various substitutions, variations, and modifications are possible without departing from the spirit and scope of the present invention and the appended claims. Therefore, the present invention should not be limited to the disclosure of the preferred embodiments, and the scope of protection claimed in the present invention shall be determined by the scope of the claims.

Claims

1. A multi-screen visualization method for a software vulnerability knowledge graph, comprising the following steps: 1) Constructing or obtaining a software vulnerability knowledge graph of the target software; wherein the software vulnerability knowledge graph comprises entities and associations between entities; the entities include software name, version number, code file name, function name, function body, and vulnerability identifier; and the associations include composition relationships, impact relationships, and similarity relationships between entities; 2) drawing a basic main view of the software vulnerability knowledge graph based on the software vulnerability knowledge graph and displaying it on the first screen; the basic main view of the software vulnerability knowledge graph includes a plurality of most popular software names, vulnerability identifiers, data categories, the amount of data in each category, and the association relationship between the data categories; 3) When the number of nodes at the same level exceeds a set threshold, the nodes at the corresponding level are aggregated to generate an aggregate node and displayed on the first screen; 4) The aggregate nodes or entity nodes to be further displayed on the first screen are placed on the second screen through a setting operation; on the second screen, the placed node is used as the root node, and the child nodes of the root node and the aggregate nodes related to the root node are obtained from the software vulnerability knowledge graph for display; 5) If there are multiple similar nodes to the entity node a displayed on the second screen, each similar node is placed on a screen respectively. When the code in the entity node a is flipped or located, data linkage is performed on the corresponding codes on each corresponding screen.

2. The method according to claim 1, characterized in that The entity also includes CFG and vulnerability patches; the association relationship also includes the dependency relationship between entities.

3. The method according to claim 1, characterized in that The basic main view of the software vulnerability knowledge graph also includes an entity and relationship screening component and an entity search component; wherein the entity and relationship screening component filters the data according to the attributes of the data in the software vulnerability knowledge graph, and the entity search component performs fuzzy matching on the name attributes of the entity data according to keywords.

4. The method according to claim 1, 2 or 3, characterized in that: The aggregation nodes or entity nodes that need to be further displayed on the first screen are placed on the second screen for display by dragging the mouse or right-clicking.

5. The method according to claim 2, characterized in that The entities contained in the software vulnerability knowledge graph are layered according to "software name-version number-code file-function-CFG".

6. The method according to claim 1, 2 or 3, characterized in that: The relevant data of the software vulnerability knowledge graph is preprocessed into json format, and then the basic main view of the software vulnerability knowledge graph is generated by rendering using the front-end visualization component.

7. A multi-screen visualization device for software vulnerability knowledge graph, characterized in that: The system comprises a plurality of display screens and a host system; each display screen is respectively connected to the host system, and the host system comprises a front-end visualization module and a graph database; wherein the graph database is used to store a software vulnerability knowledge graph of the target software; wherein the software vulnerability knowledge graph comprises entities and associations between entities; the entities comprise software names, version numbers, code file names, function names, function bodies, and vulnerability identifiers; and the associations comprise composition relationships, influence relationships, and similarity relationships between entities; The front-end visualization module is used to draw a basic main view of the software vulnerability knowledge graph based on the software vulnerability knowledge graph and display it on the first screen; the basic main view of the software vulnerability knowledge graph includes multiple most popular software names, vulnerability identifiers, data categories, the amount of data in each category, and the correlation between the data categories; the host system is used to aggregate the nodes of the corresponding level to generate an aggregate node and display it on the first screen when the nodes at the same level exceed the set threshold; and when the aggregate node or entity node to be further displayed on the first screen is placed on the second screen through a setting operation, the placed node is used as the root node on the second screen, and the child nodes of the root node and the aggregate nodes related to the root node are obtained from the software vulnerability knowledge graph for display; if there are multiple similar nodes for the entity node a displayed on the second screen, each similar node is placed on a screen respectively, and when the code in the entity node a is flipped or located, the corresponding code on each corresponding screen is linked to data.

8. The device according to claim 7, characterized in that It also includes a data preprocessing module for preprocessing the relevant data of the software vulnerability knowledge graph into json format and sending it to the front-end visualization module.

9. The device according to claim 7, characterized in that The entity also includes CFG and vulnerability patches; the association relationship also includes the dependency relationship between entities.

10. The device according to claim 9, characterized in that The host system stratifies the entities contained in the software vulnerability knowledge graph by "software name-version number-code file-function-CFG".

Images