Vulnerability information screening method and device, equipment and medium

Abstract

The application discloses a vulnerability information screening method and device, equipment and medium, and relates to the technical field of computers. The method comprises the following steps: collecting target products and original to-be-screened version information of the target products; converting the original to-be-screened version information by using a preset conversion algorithm to obtain target to-be-screened version information; judging whether there is vulnerability information matched with the target products and the target to-be-screened version information in a preset heuristic library; and if there is, screening the vulnerability information from the preset heuristic library. In the above method, the original to-be-screened version information is converted to obtain target to-be-screened version information meeting the standard, and the target to-be-screened version information is used to directly screen corresponding vulnerability information in the preset heuristic library, so that the screening in the preset version vulnerability library with a large amount of data can be omitted, and the corresponding vulnerability information can be quickly obtained.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to methods, apparatus, devices and media for filtering vulnerability information. Background Technology

[0002] Vulnerability discovery methods are categorized into two types: principle scanning and version scanning. Principle scanning involves interacting with vulnerable software via the network or other means, directly triggering or preparing to trigger the vulnerability based on its characteristics, and then analyzing the software's response to determine if it contains the vulnerability. Version scanning involves querying the software's version number via the network or other means, and using the version number in conjunction with known information to determine if a specific vulnerability exists. In version scanning scenarios, numerous software products exist, each with different version naming conventions. Vulnerability scanning systems need to perform vulnerability matching on this vast amount of unstructured data. Since the products and their version numbers constitute a large dataset, methods for organizing and processing the data are required to determine the existence of specific vulnerabilities as quickly as possible.

[0003] To address the challenges of retrieving and judging large amounts of data during version scanning and the complexity of operations and maintenance, existing technologies dynamically generate SQL (Structured Query Language) statements based on databases, using vulnerability indexes and filtering logical indexes to query and match vulnerabilities. While these technologies reduce the workload for operations personnel in adding vulnerability databases by using dynamic SQL generation and filtering logical indexes, the unstructured nature of version information necessitates the introduction of custom comparison logic into the SQL, requiring the implementation of stored procedures or similar methods. For example, if software product YY has 100 version numbers 0-99, and the version of the software product YY to be searched is 0 (logical value greater than 0), then 100 stored procedures would be executed, resulting in unacceptable time consumption for a single search.

[0004] In summary, how to quickly obtain corresponding vulnerability information is a problem that needs to be solved in this field. Summary of the Invention

[0005] In view of this, the purpose of this invention is to provide a vulnerability information filtering method, apparatus, device, and medium, capable of quickly obtaining corresponding vulnerability information. The specific solution is as follows:

[0006] Firstly, this application discloses a vulnerability information filtering method, including:

[0007] Collect information on the target product and the original, unscreened versions of the target product;

[0008] The original version information to be screened is transformed using a preset transformation algorithm to obtain the target version information to be screened.

[0009] Determine whether there is vulnerability information in the preset heuristic library that matches the target product and the target version to be screened. If so, filter out the vulnerability information from the preset heuristic library.

[0010] Optionally, the step of converting the original version information to be filtered using a preset conversion algorithm to obtain the target version information to be filtered includes:

[0011] Determine whether the original version information to be filtered meets the first preset condition;

[0012] If the original version information to be screened is determined to meet the first preset condition, then the original version information to be screened is converted using a preset digital conversion algorithm to obtain the target version information to be screened.

[0013] Optionally, after determining whether the original version information to be filtered meets the first preset condition, the method further includes:

[0014] If it is determined that the original version information to be screened does not meet the first preset condition, then the original version information to be screened is converted using a preset text conversion algorithm to obtain the target version information to be screened.

[0015] Optionally, before converting the original version information to be filtered using a preset text conversion algorithm if it is determined that the original version information to be filtered does not meet the first preset condition, the method further includes:

[0016] The historical product and historical version information to be screened are processed according to preset information to obtain training data. The initial prediction model is then trained using the training data based on supervised learning to obtain the target prediction model, so as to obtain the preset text conversion algorithm using the target prediction model.

[0017] Optionally, the step of training the initial prediction model using the training data to obtain the target prediction model based on supervised learning includes:

[0018] The current prediction model is trained using the training data based on supervised learning to obtain the current prediction result. The comparison result between the current prediction result and the actual result is obtained. Then, it is determined whether the accuracy of the comparison result is not less than a preset threshold. If it is less than the threshold, the current prediction model is adjusted based on the current training result and the actual result to obtain the next prediction model.

[0019] The next prediction model is updated to the current prediction model, and the process jumps back to the step of training the current prediction model using the training data based on supervised learning, until the accuracy of the comparison result is not less than the preset threshold, so as to obtain the target prediction model.

[0020] Optionally, after determining whether there is vulnerability information in the preset heuristic library that matches the target product and the target version information to be screened, the method further includes:

[0021] If not, then filter out the vulnerability information that matches the target product and the target version information to be filtered from the preset version vulnerability database.

[0022] Optionally, the step of filtering out vulnerability information from a preset vulnerability database that matches the target product and the target version to be filtered includes:

[0023] The corresponding version filtering logic is queried from the preset filtering logic table using the product name of the target product, and an SQL query statement is generated based on the group_concat form. Then, the target version information to be filtered is bound using the SQL query statement.

[0024] The SQL query statement is used to query the corresponding vulnerability index from the filtering information table of the preset version vulnerability database, and based on the vulnerability index, the vulnerability information that matches the target product and the target version information to be filtered is filtered out from the vulnerability information table of the preset version vulnerability database. Then the vulnerability information is saved to the preset heuristic database.

[0025] Secondly, this application discloses a vulnerability information screening device, comprising:

[0026] The information collection module is used to collect information about the target product and the original version of the target product to be screened.

[0027] The information conversion module is used to convert the original version information to be screened using a preset conversion algorithm to obtain the target version information to be screened.

[0028] The filtering module is used to determine whether there is vulnerability information in the preset heuristic library that matches the target product and the target version to be filtered. If so, the vulnerability information is filtered out from the preset heuristic library.

[0029] Thirdly, this application discloses an electronic device, including:

[0030] Memory, used to store computer programs;

[0031] A processor is used to execute the computer program to implement the steps of the aforementioned disclosed vulnerability information screening method.

[0032] Fourthly, this application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the steps of the aforementioned disclosed vulnerability information selection method.

[0033] As can be seen, this application collects the target product and its original unfiltered version information; it uses a preset conversion algorithm to convert the original unfiltered version information to obtain target unfiltered version information; it determines whether there is vulnerability information in a preset heuristic library that matches the target product and the target unfiltered version information, and if so, it filters out the vulnerability information from the preset heuristic library. Therefore, since the naming rules of the original unfiltered version information are inconsistent, it is impossible to filter based on the original unfiltered version information. Thus, this application first uses a preset conversion algorithm to convert the original unfiltered version information into target unfiltered version information that can be directly filtered, improving the subsequent filtering speed; it filters out vulnerability information that matches the target product and target unfiltered version information from a preset heuristic library with a relatively small amount of data. Since there is no need to filter from a large preset version vulnerability library, the speed and efficiency of obtaining vulnerability information are improved, reducing time and maintenance costs. Attached Figure Description

[0034] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0035] Figure 1 This is a flowchart of a vulnerability information screening method disclosed in this application;

[0036] Figure 2 This application discloses a flowchart of a specific vulnerability information screening method.

[0037] Figure 3 This application discloses a flowchart of a specific vulnerability information screening method.

[0038] Figure 4 This is a schematic diagram of a specific vulnerability detection model disclosed in this application;

[0039] Figure 5 This is a schematic diagram of the structure of a vulnerability information screening device disclosed in this application;

[0040] Figure 6 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation

[0041] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0042] To address the challenges of retrieving and judging large amounts of data during version scanning and the complexity of operations and maintenance, existing technologies dynamically generate SQL statements based on databases using vulnerability indexes and filtering logical indexes to query and match vulnerabilities. While these technologies reduce the workload for operations personnel in adding vulnerability databases by using dynamic SQL generation and filtering logical indexes, the unstructured nature of version information necessitates the introduction of custom comparison logic into the SQL, requiring the implementation of stored procedures or similar methods. For example, if software product YY has 100 version numbers from 0 to 99, and the version of the software product YY to be searched is 0 (logically greater than 0), then 100 stored procedures would be executed, making a single search unacceptably time-consuming.

[0043] Therefore, this application provides a vulnerability information filtering scheme that can quickly obtain the corresponding vulnerability information.

[0044] See Figure 1 As shown in the figure, this application discloses a vulnerability information filtering method, including:

[0045] Step S11: Collect information on the target product and the original unscreened versions of the target product.

[0046] In this embodiment, it can be understood that there are multiple naming rules for the original version information of the target product to be screened, that is, the original version information to be screened is in a non-standard form. If the original version information to be screened is used for vulnerability information screening in the future, it will be very inconvenient or even impossible to screen.

[0047] Step S12: Use a preset conversion algorithm to convert the original version information to be screened to obtain the target version information to be screened.

[0048] In this embodiment, a preset conversion algorithm is used to convert non-standardized original version information to be screened into standardized target version information to be screened. For example, original version information to be screened with different naming rules is converted into numbers that can be directly compared. This can greatly improve the speed and efficiency of subsequent vulnerability screening using target version information to be screened.

[0049] Step S13: Determine whether there is vulnerability information in the preset heuristic library that matches the target product and the target version information to be screened. If so, filter out the vulnerability information from the preset heuristic library.

[0050] In this embodiment, it is determined whether there is vulnerability information matching the target product and the target version to be screened in a preset heuristic library with a relatively small data volume. If so, the vulnerability information is filtered out from the preset heuristic library. Because the data volume of the preset heuristic library is much smaller than that of the preset version vulnerability library, the speed of vulnerability filtering in the preset heuristic library is much faster than that in the preset version vulnerability library. This improves the speed and efficiency of vulnerability information filtering and reduces operation and maintenance costs. It should be noted that although the data volume of the preset heuristic library is smaller than that of the preset version vulnerability library, in most cases, vulnerability information matching the target product and the target version to be screened can be filtered out from the preset heuristic library.

[0051] As can be seen, this application collects the target product and its original unfiltered version information; it uses a preset conversion algorithm to convert the original unfiltered version information to obtain target unfiltered version information; it determines whether there is vulnerability information in a preset heuristic library that matches the target product and the target unfiltered version information, and if so, it filters out the vulnerability information from the preset heuristic library. Therefore, since the naming rules of the original unfiltered version information are inconsistent, it is impossible to filter based on the original unfiltered version information. Thus, this application first uses a preset conversion algorithm to convert the original unfiltered version information into target unfiltered version information that can be directly filtered, improving the subsequent filtering speed; it filters out vulnerability information that matches the target product and target unfiltered version information from a preset heuristic library with a relatively small amount of data. Since there is no need to filter from a large preset version vulnerability library, the speed and efficiency of obtaining vulnerability information are improved, reducing time and maintenance costs.

[0052] See Figure 2 As shown in the figure, this application discloses a specific vulnerability information filtering method, including:

[0053] Step S21: Collect information on the target product and the original unscreened versions of the target product.

[0054] Step S22: Determine whether the original version information to be screened meets the first preset condition; if it is determined that the original version information to be screened meets the first preset condition, then use a preset digital conversion algorithm to convert the original version information to be screened to obtain the target version information to be screened.

[0055] In this embodiment, it is determined whether the original version information to be filtered meets the first preset condition, that is, whether the naming rule of the original version information to be filtered is a number. For example, the version number of nginx is: "1.17.2", "1.9.5", "1.17.2", "1.9.5", "1.17.2", "0.6.18". They are all three groups of numbers separated by two dots ".". If the numbers are separated by ".", then a preset number conversion algorithm can be used. For example, "1.17.2" will become three groups of numbers "1, 17, 2". The base-100 formula "2*100+17*10000+1*1000000" will be converted into a directly comparable integer.

[0056] In this embodiment, after determining whether the original version information to be filtered meets the first preset condition, the method further includes: if it is determined that the original version information to be filtered does not meet the first preset condition, then a preset text conversion algorithm is used to convert the original version information to be filtered to obtain the target version information to be filtered. If the original version information to be filtered does not meet the first preset condition, then the naming rule of the original version information to be filtered is text, and the preset text conversion algorithm can be used to convert the original version information to be filtered, that is, the original version information to be filtered is converted based on text recognition.

[0057] In this embodiment, before converting the original version information to be screened using a preset text conversion algorithm if it is determined that the original version information to be screened does not meet the first preset condition, the method further includes: performing preset information processing on historical products and historical version information to be screened to obtain training data, and using the training data to train an initial prediction model based on supervised learning to obtain a target prediction model, so as to use the target prediction model to obtain the preset text conversion algorithm.

[0058] In this embodiment, the step of training the initial prediction model using the training data based on supervised learning to obtain the target prediction model specifically includes: training the current prediction model using the training data based on supervised learning to obtain the current prediction result, and obtaining a comparison result between the current prediction result and the actual result. Then, it is determined whether the accuracy of the comparison result is not less than a preset threshold. If it is less, the current prediction model is adjusted based on the current training result and the actual result to obtain the next prediction model. The next prediction model is updated to the current prediction model, and the process jumps back to the step of training the current prediction model using the training data based on supervised learning until the accuracy of the comparison result is not less than the preset threshold to obtain the target prediction model. The information on historical products and versions to be screened is preprocessed. For a specific product, such as Java, it is grouped into an array [jdkbeat, jdk1, ...] according to the release time of the version. The order of the above array is shuffled by supervised learning in machine learning, and the model is trained. The current training result is compared with the actual result of the "training data". The prediction model is continuously adjusted based on the comparison result until the accuracy of the current training result of the model reaches a preset threshold. Then, the same method is used to train different types of historical products until a usable version sorting algorithm, i.e., the preset text conversion algorithm, is produced.

[0059] Step S23: Determine whether there is vulnerability information in the preset heuristic library that matches the target product and the target version information to be screened. If so, filter out the vulnerability information from the preset heuristic library.

[0060] Therefore, this application has identified a suitable preset conversion algorithm for the original version information to be screened. That is, a preset number conversion algorithm or a preset text conversion algorithm can be used to convert different original version information to be screened, so that different original version information to be screened can be converted into target version information to be screened, thereby improving the speed of subsequent screening of vulnerability information using target version information to be screened and reducing performance loss.

[0061] See Figure 3 As shown in the figure, this application discloses a specific vulnerability information filtering method, including:

[0062] Step S31: Collect information on the target product and the original unscreened versions of the target product.

[0063] Step S32: Use a preset conversion algorithm to convert the original version information to be screened to obtain the target version information to be screened.

[0064] Step S33: Determine whether there is vulnerability information in the preset heuristic library that matches the target product and the target version to be screened.

[0065] Step S34: If the vulnerability exists, filter out the vulnerability information from the preset heuristic library; if it does not exist, filter out the vulnerability information that matches the target product and the target version information to be filtered from the preset version vulnerability library.

[0066] In this embodiment, the step of filtering out the vulnerability information that matches the target product and the target version information to be filtered from the preset version vulnerability database specifically includes: querying the corresponding version filtering logic from the preset filtering logic table using the product name of the target product, generating an SQL query statement based on the group_concat format, and then binding the target version information to be filtered using the SQL query statement; querying the corresponding vulnerability index from the filtering information table of the preset version vulnerability database using the SQL query statement, and filtering out the vulnerability information that matches the target product and the target version information to be filtered from the vulnerability information table of the preset version vulnerability database based on the vulnerability index, and then saving the vulnerability information to the preset heuristic database. Based on the target product's name, the system queries the pre-defined filtering logic table for the corresponding version filtering logic, and combines this logic into a single SQL query statement that queries the filtering information table for vulnerability information using the `group_concat` method. The pre-defined filtering logic table stores the processing and comparison logic for the target version information to be filtered, stored as a portion of the SQL query statement. The filtering information table stores information related to the version filtering logic and corresponding vulnerability indexes. Based on the SQL query statement, the system binds the target version information to be filtered, queries the filtering information table for all corresponding vulnerability indexes, and then combines these vulnerability indexes with the specific vulnerability information table to query the specific vulnerability information. Finally, the vulnerability information matched between the target product and the target version information to be filtered is saved to a separate pre-defined heuristic library.

[0067] In this embodiment, it can be understood that the present application uses a secondary query statement combined with an SQL query statement and standard vector conversion to filter out corresponding vulnerability information. Among them, the standard vector conversion can be, for example, converting the original version information to be filtered into target version information to be filtered in the same format as the target product. The secondary query statement uses "or" to combine filtering statements related to different products. For example, the filtering conditions related to product "A" are "ver < a" and "a < ver and ver < b", and their indexes in the [filtering logic] table (Identity document, i.e., identity number) are 1 and 2 respectively. Then the generated secondary query statement is select distinct [index] from (select [index],?1 as ver from [filtering information table] where [software] = 'A' and ((ver < M) or (ver > min and ver < max))), where?1 represents the directly comparable number after conversion for binding the software version used in the query; and the key part of the primary query statement for generating the part ((ver < M) or (ver > min and ver < max)) is select '(' || group_concat('(' || [filtering logic] || ')', 'or') || ')'.

[0068] In this embodiment, for a given product and target version information to be filtered in a preset version vulnerability library, it can be determined whether there is vulnerability information. The empty result or the matched vulnerability information retrieved is saved in the preset heuristic library for matching acceleration. Before the product is released, vulnerability matching training can be carried out to cover as many results of the vulnerability library as possible and accelerate the matching speed during actual matching. For example Figure 4 As shown in a specific schematic diagram of a vulnerability detection model, if the customer allows uploading to the preset heuristic library, during the life cycle of the product serving the customer, the information of different preset heuristic libraries at all nodes, namely user heuristic library a, user heuristic library b, and user heuristic library c, is aggregated and collected on the server, that is, the cloud data collection center, and the heuristic library data is analyzed offline using big data analysis methods. By analyzing the heuristic library data of customers in different industry types, a standardized vulnerability detection model is established. For example, in the financial industry vulnerability model, there is a financial industry model training heuristic library, an education industry vulnerability model, and an education industry training heuristic library.

[0069] Thus, it can be seen that the present application adds heuristic library logic, which can place the process of calculating the preset version vulnerability matching before the product is released, and thus can be calculated in advance. In the actual usage scenario, it can speed up the screening speed of vulnerability information, and also increases the heuristic library cloud synchronization ability to accumulate industry vulnerability data, conduct big data collection, analysis and modeling, and build a better preset heuristic library according to the update of the user model.

[0070] See Figure 5 As shown in the figure, this application discloses a vulnerability information screening device, including:

[0071] Information collection module 11 is used to collect information on the target product and the original version of the target product to be screened;

[0072] The information conversion module 12 is used to convert the original version information to be screened using a preset conversion algorithm to obtain the target version information to be screened.

[0073] The filtering module 13 is used to determine whether there is vulnerability information in the preset heuristic library that matches the target product and the target version information to be filtered. If so, the vulnerability information is filtered out from the preset heuristic library.

[0074] As can be seen, this application collects the target product and its original unfiltered version information; it uses a preset conversion algorithm to convert the original unfiltered version information to obtain target unfiltered version information; it determines whether there is vulnerability information in a preset heuristic library that matches the target product and the target unfiltered version information, and if so, it filters out the vulnerability information from the preset heuristic library. Therefore, since the naming rules of the original unfiltered version information are inconsistent, it is impossible to filter based on the original unfiltered version information. Thus, this application first uses a preset conversion algorithm to convert the original unfiltered version information into target unfiltered version information that can be directly filtered, improving the subsequent filtering speed; it filters out vulnerability information that matches the target product and target unfiltered version information from a preset heuristic library with a relatively small amount of data. Since there is no need to filter from a large preset version vulnerability library, the speed and efficiency of obtaining vulnerability information are improved, reducing time and maintenance costs.

[0075] In some specific embodiments, the information conversion module 12 includes:

[0076] The first conversion unit is used to determine whether the original version information to be screened meets the first preset condition; if it is determined that the original version information to be screened meets the first preset condition, the original version information to be screened is converted using a preset digital conversion algorithm to obtain the target version information to be screened.

[0077] In some specific embodiments, the vulnerability information filtering device further includes:

[0078] The second conversion unit is used to convert the original version information to be filtered using a preset text conversion algorithm if it is determined that the original version information to be filtered does not meet the first preset condition, so as to obtain the target version information to be filtered.

[0079] In some specific embodiments, the vulnerability information filtering device further includes:

[0080] The conversion algorithm acquisition unit is used to perform preset information processing on historical product and historical version information to obtain training data, and to train an initial prediction model using the training data based on supervised learning to obtain a target prediction model, so as to obtain the preset text conversion algorithm using the target prediction model.

[0081] In some specific embodiments, the conversion algorithm acquisition unit includes:

[0082] The target prediction model acquisition unit is used to train the current prediction model using the training data based on supervised learning to obtain the current prediction result, and to obtain a comparison result between the current prediction result and the actual result. Then, it determines whether the accuracy of the comparison result is not less than a preset threshold. If it is less, it adjusts the current prediction model based on the current training result and the actual result to obtain the next prediction model. The next prediction model is updated to the current prediction model, and the process jumps back to the step of training the current prediction model using the training data based on supervised learning until the accuracy of the comparison result is not less than the preset threshold to obtain the target prediction model.

[0083] In some specific embodiments, the vulnerability information filtering device further includes:

[0084] The version vulnerability database filtering unit is used to filter out vulnerability information that matches the target product and the target version information to be filtered from a preset version vulnerability database if the vulnerability does not exist.

[0085] In some specific embodiments, the version vulnerability database filtering unit includes:

[0086] The binding unit is used to query the corresponding version filtering logic from the preset filtering logic table using the product name of the target product, generate an SQL query statement based on the group_concat form, and then use the SQL query statement to bind the target version information to be filtered.

[0087] The vulnerability information storage unit is used to query the corresponding vulnerability index from the filtering information table of the preset version vulnerability database using the SQL query statement, and filter out the vulnerability information that matches the target product and the target version information to be filtered from the vulnerability information table of the preset version vulnerability database based on the vulnerability index, and then save the vulnerability information to the preset heuristic database.

[0088] Figure 6This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Specifically, it may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the vulnerability information screening method executed by the electronic device disclosed in any of the foregoing embodiments.

[0089] In this embodiment, the power supply 23 is used to provide operating voltage for various hardware devices on the electronic device; the communication interface 24 can create a data transmission channel between the electronic device and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0090] The processor 21 may include one or more processing cores, such as a quad-core processor or an octa-core processor. The processor 21 may be implemented using at least one hardware form selected from DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 21 may also include a main processor and a coprocessor. The main processor, also known as a CPU (Central Processing Unit), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, the processor 21 may integrate a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, the processor 21 may also include an AI (Artificial Intelligence) processor, which is used to handle computational operations related to machine learning.

[0091] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored on it include operating system 221, computer program 222 and data 223, etc., and the storage method can be temporary storage or permanent storage.

[0092] The operating system 221 manages and controls the various hardware devices and computer programs 222 on the electronic device to enable the processor 21 to perform calculations and processing on the massive amounts of data 223 in the memory 22. The operating system can be Windows, Unix, Linux, etc. The computer program 222, in addition to including a computer program capable of performing the vulnerability information screening method executed by the electronic device as disclosed in any of the foregoing embodiments, may further include computer programs capable of performing other specific tasks. The data 223 may include data received by the electronic device from external devices, as well as data collected by its own input / output interface 25.

[0093] Furthermore, embodiments of this application also disclose a computer-readable storage medium storing a computer program. When the computer program is loaded and executed by a processor, it implements the method steps performed during the vulnerability information screening process disclosed in any of the foregoing embodiments.

[0094] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0095] The present invention has provided a detailed description of a vulnerability information screening method, apparatus, device, and medium. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A vulnerability information filtering method, characterized in that, include: Collect information on the target product and the original, unscreened versions of the target product; The original version information to be screened is transformed using a preset transformation algorithm to obtain the target version information to be screened. Determine whether there is vulnerability information in the preset heuristic library that matches the target product and the target version to be screened. If so, filter out the vulnerability information from the preset heuristic library. The step of converting the original version information to be screened using a preset conversion algorithm to obtain the target version information to be screened includes: Determine whether the original version information to be screened meets the first preset condition; if it is determined that the original version information to be screened meets the first preset condition, then use a preset digital conversion algorithm to convert the original version information to be screened to obtain the target version information to be screened. After determining whether the original version information to be filtered meets the first preset condition, the method further includes: If it is determined that the original version information to be screened does not meet the first preset condition, then the original version information to be screened is converted using a preset text conversion algorithm to obtain the target version information to be screened. If it is determined that the original version information to be screened does not meet the first preset condition, before converting the original version information to be screened using a preset text conversion algorithm, the method further includes: The historical products and historical versions to be screened are arranged into an array according to the release time. The order of the array is shuffled by supervised learning in machine learning to obtain training data. The initial prediction model is trained on the training data based on supervised learning to obtain the target prediction model, so as to obtain the preset text conversion algorithm using the target prediction model.

2. The vulnerability information filtering method according to claim 1, characterized in that, The method of training the initial prediction model using the training data to obtain the target prediction model based on supervised learning includes: The current prediction model is trained using the training data based on supervised learning to obtain the current prediction result. The comparison result between the current prediction result and the actual result is obtained. Then, it is determined whether the accuracy of the comparison result is not less than a preset threshold. If it is less than the threshold, the current prediction model is adjusted based on the current training result and the actual result to obtain the next prediction model. The next prediction model is updated to the current prediction model, and the process jumps back to the step of training the current prediction model using the training data based on supervised learning, until the accuracy of the comparison result is not less than the preset threshold, so as to obtain the target prediction model.

3. The vulnerability information filtering method according to claim 1 or 2, characterized in that, After determining whether there is vulnerability information in the preset heuristic library that matches the target product and the target version to be screened, the method further includes: If not, then filter out the vulnerability information that matches the target product and the target version information to be filtered from the preset version vulnerability database.

4. The vulnerability information filtering method according to claim 3, characterized in that, The step of filtering out vulnerability information from a preset vulnerability database that matches the target product and the target version to be filtered includes: The corresponding version filtering logic is queried from the preset filtering logic table using the product name of the target product, and an SQL query statement is generated based on the group_concat form. Then, the target version information to be filtered is bound using the SQL query statement. The SQL query statement is used to query the corresponding vulnerability index from the filtering information table of the preset version vulnerability database, and based on the vulnerability index, the vulnerability information that matches the target product and the target version information to be filtered is filtered out from the vulnerability information table of the preset version vulnerability database. Then the vulnerability information is saved to the preset heuristic database.

5. A vulnerability information screening device, characterized in that, include: The information collection module is used to collect information about the target product and the original version of the target product to be screened. The information conversion module is used to convert the original version information to be screened using a preset conversion algorithm to obtain the target version information to be screened. The filtering module is used to determine whether there is vulnerability information in the preset heuristic library that matches the target product and the target version to be filtered. If so, the vulnerability information is filtered out from the preset heuristic library. Specifically, the information conversion module is used for: Determine whether the original version information to be screened meets the first preset condition; if it is determined that the original version information to be screened meets the first preset condition, then use a preset digital conversion algorithm to convert the original version information to be screened to obtain the target version information to be screened. The vulnerability information filtering device is specifically used for: If it is determined that the original version information to be screened does not meet the first preset condition, then the original version information to be screened is converted using a preset text conversion algorithm to obtain the target version information to be screened. The vulnerability information filtering device is specifically used for: The historical products and historical versions to be screened are arranged into an array according to the release time. The order of the array is shuffled by supervised learning in machine learning to obtain training data. The initial prediction model is trained on the training data based on supervised learning to obtain the target prediction model, so as to obtain the preset text conversion algorithm using the target prediction model.

6. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the vulnerability information screening method as described in any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that, Used to store computer programs; wherein, when the computer programs are executed by a processor, they implement the steps of the vulnerability information filtering method as described in any one of claims 1 to 4.

Images