Method, device and equipment for training vulnerability scanning strategy matching model

Abstract

Embodiments of the present application provide a vulnerability scanning strategy matching model training method, device and equipment, and relate to the technical field of network security. The method comprises: obtaining vulnerability scanning records of network devices uploaded by a vulnerability scanning device, including: attribute information of the network devices, vulnerability scanning strategy parameters adopted by the vulnerability scanning device for scanning the network devices, and corresponding vulnerability scanning results; determining vulnerability scanning strategy target parameters corresponding to the network devices according to the vulnerability scanning strategy parameters and the corresponding vulnerability scanning results; generating device attribute samples according to the attribute information, and generating corresponding labels according to the corresponding vulnerability scanning strategy target parameters; generating a training set according to the samples and the labels; training a preset vulnerability scanning strategy matching model using the training set to obtain a model with strong matching capability, and then quickly matching vulnerability scanning strategy parameters corresponding to a network device to be scanned, i.e. a vulnerability scanning strategy, based on the model.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a training method, apparatus, and device for a vulnerability scanning strategy matching model. Background Technology

[0002] Currently, the cybersecurity industry is committed to preventing and combating network penetration attacks, which are typically carried out by attackers based on vulnerabilities in network devices to compromise the confidentiality and integrity of user and enterprise data resources.

[0003] Therefore, to better prevent network penetration attacks, it is often necessary to quickly scan for and patch vulnerabilities in network devices. However, traditional solutions typically rely on professionals manually matching the appropriate vulnerability scanning strategies for each network device. This is inefficient and highly dependent on the experience of the personnel. Furthermore, it cannot meet the scanning needs when there are many network devices to be scanned. Summary of the Invention

[0004] This invention provides a training method, apparatus, and device for a vulnerability scanning strategy matching model, which can improve the matching efficiency of vulnerability scanning strategies.

[0005] In a first aspect, embodiments of the present invention provide a method for training a vulnerability scanning strategy matching model, the method comprising:

[0006] Obtain the vulnerability scanning records of network devices uploaded by the vulnerability scanning device. The vulnerability scanning records include: the attribute information of the network device, the vulnerability scanning strategy parameters used by the vulnerability scanning device to scan the network device, and the vulnerability scanning results corresponding to the scanning strategy parameters.

[0007] Based on the vulnerability scanning strategy parameters used by the vulnerability scanning device to scan the network device and the corresponding vulnerability scanning results, determine the target parameters of the vulnerability scanning strategy for the network device.

[0008] Based on the attribute information of network devices, generate device attribute samples, and based on the target parameters of the vulnerability scanning strategy corresponding to the network devices, generate labels corresponding to the device attribute samples; based on the generated device attribute samples and their corresponding labels, generate a vulnerability scanning strategy training set.

[0009] The vulnerability scanning strategy matching model is trained using a vulnerability scanning strategy training set.

[0010] In some possible implementations of the first aspect, the target parameters of the vulnerability scanning strategy for the network device are determined based on the vulnerability scanning strategy parameters used by the vulnerability scanning device to scan the network device and the corresponding vulnerability scanning results, including:

[0011] Based on the vulnerability scanning strategy parameters used by the network scanning devices and the vulnerability scanning results corresponding to each set of vulnerability scanning strategy parameters, a fitting function between the vulnerability scanning strategy parameters and the vulnerability scanning results is constructed.

[0012] A genetic algorithm is used to find the optimal solution for the fitted function, thereby obtaining the target parameters of the vulnerability scanning strategy for the network device.

[0013] In some possible implementations of the first aspect, a device attribute sample is generated based on attribute information in the vulnerability scan log, including:

[0014] Calculate the correlation coefficients between the attribute fields in the attribute information and the corresponding target parameters of the vulnerability scanning strategy;

[0015] Delete attribute fields in the attribute information whose correlation coefficient is lower than or equal to a preset threshold;

[0016] Generate a sample of device attributes based on the attribute information after deleting attribute fields.

[0017] In some possible implementations of the first aspect, the default vulnerability scanning strategy matching model is a convolutional neural network;

[0018] The vulnerability scanning strategy matching model is trained using a vulnerability scanning strategy training set, including:

[0019] The input layer of the convolutional neural network receives device attribute samples from the training set of the vulnerability scanning strategy;

[0020] The hidden layers of a convolutional neural network extract sample features from received device attribute samples;

[0021] The output layer of the convolutional neural network classifies the received device attribute samples based on the extracted sample features to obtain the vulnerability scanning strategy parameters corresponding to the received device attribute samples.

[0022] The model parameters of the convolutional neural network are iteratively updated based on the vulnerability scanning strategy parameters and labels corresponding to the received device attribute samples until the training stopping condition is met, thus obtaining the trained vulnerability scanning strategy matching model.

[0023] In some possible implementations of the first aspect, the parameters of the convolutional neural network are iteratively updated based on the vulnerability scanning strategy parameters and labels corresponding to the received device attribute samples until the training stopping condition is met, resulting in a trained vulnerability scanning strategy matching model, including:

[0024] The loss value of the vulnerability scanning strategy matching model is calculated based on the vulnerability scanning strategy parameters and labels corresponding to the received device attribute samples.

[0025] If the loss value of the vulnerability scanning strategy matching model is greater than or equal to the preset threshold, the model parameters of the vulnerability scanning strategy matching model are iteratively updated until the loss value of the vulnerability scanning strategy matching model is less than the preset threshold, thus obtaining the trained vulnerability scanning strategy matching model.

[0026] In some possible implementations of the first aspect, the vulnerability scanning strategy parameters include the following options: scanning task item, scanning tool corresponding to the scanning task item, scanning order of the scanning task item, and scanning cycle.

[0027] Secondly, embodiments of the present invention provide a vulnerability scanning strategy matching method, the method comprising:

[0028] Send the trained vulnerability scanning strategy matching model parameters to each vulnerability scanning device so that each vulnerability scanning device can build a vulnerability scanning strategy matching model based on the model parameters. This model is used to match the attribute information of the network device to be scanned and determine the vulnerability scanning strategy parameters corresponding to the network device to be scanned.

[0029] The vulnerability scanning strategy matching model is obtained based on the training method of the vulnerability scanning strategy matching model described above.

[0030] Thirdly, embodiments of the present invention provide a training apparatus for a vulnerability scanning strategy matching model, the apparatus comprising:

[0031] The acquisition module is used to acquire vulnerability scanning records of network devices uploaded by the vulnerability scanning device. The vulnerability scanning records include: attribute information of the network device, vulnerability scanning strategy parameters used by the vulnerability scanning device to scan the network device, and vulnerability scanning results corresponding to the scanning strategy parameters.

[0032] The determination module is used to determine the target parameters of the vulnerability scanning strategy for the network device based on the vulnerability scanning strategy parameters used by the vulnerability scanning device to scan the network device and the corresponding vulnerability scanning results.

[0033] The generation module is used to generate device attribute samples based on the attribute information of network devices, and to generate labels corresponding to the device attribute samples based on the target parameters of the vulnerability scanning strategy corresponding to the network devices; and to generate a vulnerability scanning strategy training set based on the generated device attribute samples and their corresponding labels.

[0034] The training module is used to train a preset vulnerability scanning strategy matching model using a vulnerability scanning strategy training set.

[0035] Fourthly, embodiments of the present invention provide a vulnerability scanning strategy matching device, the device comprising:

[0036] The sending module is used to send the model parameters of the trained vulnerability scanning strategy matching model to each vulnerability scanning device, so that each vulnerability scanning device can construct a vulnerability scanning strategy matching model based on the model parameters, which is used to match the attribute information of the network device to be scanned and determine the vulnerability scanning strategy parameters corresponding to the network device to be scanned.

[0037] The vulnerability scanning strategy matching model is obtained based on the training method of the vulnerability scanning strategy matching model described above.

[0038] Fifthly, embodiments of the present invention provide an electronic device comprising: at least one processor; and a memory communicatively connected to the at least one processor; the memory storing instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the method described above.

[0039] In a sixth aspect, embodiments of the present invention provide a non-transitory computer-readable storage medium storing computer instructions for causing a computer to perform the methods described above.

[0040] In a seventh aspect, embodiments of the present invention provide a computer program product comprising a computer program that, when executed by a processor, implements the methods described above.

[0041] In this invention, vulnerability scanning records of network devices uploaded by vulnerability scanning devices can be obtained. Based on the vulnerability scanning strategy parameters and corresponding vulnerability scanning results in the vulnerability scanning records, the target parameters of the vulnerability scanning strategy corresponding to the network device are determined. Based on the attribute information in the vulnerability scanning records, device attribute samples are generated, and based on the corresponding target parameters of the vulnerability scanning strategy, labels corresponding to the device attribute samples are generated. Based on the generated samples and their corresponding labels, a training set is generated. The training set is used to train a preset vulnerability scanning strategy matching model to obtain a model with strong matching ability. Then, based on the model, the vulnerability scanning strategy parameters corresponding to the network device to be scanned are quickly and accurately matched, i.e., the vulnerability scanning strategy.

[0042] It should be understood that the description in the Summary of the Invention is not intended to limit the key or essential features of the embodiments of the present invention, nor is it intended to restrict the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0043] The above and other features, advantages, and aspects of the various embodiments of the present invention will become more apparent from the accompanying drawings and the following detailed description. The drawings are provided for a better understanding of the invention and are not intended to limit the invention. In the drawings, the same or similar reference numerals denote the same or similar elements, wherein:

[0044] Figure 1 A schematic diagram of an exemplary operating environment in which embodiments of the present invention can be implemented is shown;

[0045] Figure 2 A flowchart illustrating a training method for a vulnerability scanning strategy matching model provided in an embodiment of the present invention is shown.

[0046] Figure 3 A flowchart of a vulnerability scanning strategy matching method provided by an embodiment of the present invention is shown;

[0047] Figure 4 The diagram shows a structural diagram of a training device for a vulnerability scanning strategy matching model provided in an embodiment of the present invention;

[0048] Figure 5 The diagram shows a structural diagram of a vulnerability scanning strategy matching device provided in an embodiment of the present invention;

[0049] Figure 6 A structural diagram of an exemplary electronic device capable of implementing an embodiment of the present invention is shown. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0051] Furthermore, the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0052] To address the problems in the background technology, embodiments of the present invention provide a training method, apparatus, and device for a vulnerability scanning strategy matching model. Specifically, vulnerability scanning records of network devices uploaded by a vulnerability scanning device can be obtained. Based on the vulnerability scanning strategy parameters and corresponding vulnerability scanning results in the vulnerability scanning records, the target parameters of the vulnerability scanning strategy corresponding to the network device are determined. Device attribute samples are generated based on the attribute information in the vulnerability scanning records, and labels corresponding to the device attribute samples are generated based on the corresponding target parameters of the vulnerability scanning strategy. A training set is generated based on the generated samples and their corresponding labels. The training set is used to train a preset vulnerability scanning strategy matching model to obtain a model with strong matching capabilities. Then, based on this model, the vulnerability scanning strategy parameters corresponding to the network device to be scanned, i.e., the vulnerability scanning strategy, can be quickly and accurately matched.

[0053] The training method, apparatus, and device for the vulnerability scanning strategy matching model provided in this invention will be described in detail below with reference to the accompanying drawings and specific embodiments.

[0054] Figure 1 A schematic diagram of an exemplary operating environment in which embodiments of the present invention can be implemented is shown, such as... Figure 1 As shown, the operating environment 100 may include multiple vulnerability scanning devices 110 and servers 120.

[0055] Among them, the vulnerability scanning device 110 can be a portable mobile electronic device, such as a USB flash drive, handheld device, etc., and supports USB, Wi-Fi, Bluetooth connection to network devices in various scenarios. The server 120 can be a single server, a server cluster, or a cloud server, etc., with high hardware configuration and strong computing power.

[0056] As an example, vulnerability scanning device 110 connects to the network device to obtain the network device's attribute information, namely the device's operating status indicators and its own hardware and software environment. At the same time, it uses multiple sets of vulnerability scanning strategy parameters (each set of vulnerability scanning strategy parameters can constitute a vulnerability scanning strategy) to perform vulnerability scanning on the network device, obtains the vulnerability scanning results corresponding to each set of vulnerability scanning strategy parameters, and then uploads the vulnerability scanning record of the network device to server 120. The vulnerability scanning record includes: the network device's attribute information, the vulnerability scanning strategy parameters used by the vulnerability scanning device to scan the network device, and the vulnerability scanning results corresponding to the scanning strategy parameters.

[0057] Server 120 determines the target parameters of the vulnerability scanning strategy for the network device based on the vulnerability scanning strategy parameters and their corresponding vulnerability scanning results in the vulnerability scanning record. These are the optimal vulnerability scanning strategy parameters based on the vulnerability scanning results. Based on the attribute information in the vulnerability scanning record, server 120 generates device attribute samples and generates labels corresponding to the device attribute samples based on the corresponding vulnerability scanning strategy target parameters. Based on the generated samples and their corresponding labels, server 120 generates a vulnerability scanning strategy training set. This training set is then used to train a preset vulnerability scanning strategy matching model to obtain a trained vulnerability scanning strategy matching model.

[0058] Server 120 sends the model parameters of the trained vulnerability scanning strategy matching model to each vulnerability scanning device, so that each vulnerability scanning device can construct a vulnerability scanning strategy matching model based on the received model parameters. This model is used to match the attribute information of the network device to be scanned, and quickly and accurately determine the vulnerability scanning strategy parameters, i.e., the vulnerability scanning strategy, corresponding to the network device to be scanned.

[0059] The training method of the vulnerability scanning strategy matching model provided in the embodiments of the present invention will be described in detail below. The execution entity of this training method may be... Figure 1 The server shown is 120.

[0060] Figure 2 The flowchart illustrates a training method for a vulnerability scanning strategy matching model provided by an embodiment of the present invention, as shown below. Figure 2 As shown, training method 200 may include the following steps:

[0061] S210: Obtain vulnerability scanning records of network devices uploaded by the vulnerability scanning device.

[0062] The vulnerability scanning records include: the attribute information of the network device, the vulnerability scanning strategy parameters used by the vulnerability scanning device to scan the network device, and the vulnerability scanning results corresponding to the scanning strategy parameters.

[0063] For example, the attribute information of a network device may include: device type, operating system information, software installation information, hardware configuration information, network information, firewall information, default browser type, number of antivirus software, etc.

[0064] The vulnerability scanning strategy parameters used by vulnerability scanning devices to scan network devices may include: scanning tasks, the scanning tools corresponding to the scanning tasks, the scanning order of the scanning tasks, and the scanning cycle.

[0065] The vulnerability scan results corresponding to the scanning strategy parameters can include: the number of vulnerabilities detected, the time spent scanning, etc.

[0066] S220, Based on the vulnerability scanning strategy parameters used by the vulnerability scanning device to scan the network device and the corresponding vulnerability scanning results, determine the target parameters of the vulnerability scanning strategy for the network device.

[0067] In some embodiments, a fitting function, i.e. a correlation, between vulnerability scanning strategy parameters and vulnerability scanning results can be constructed based on each set of vulnerability scanning strategy parameters used by the network device and the vulnerability scanning results corresponding to each set of vulnerability scanning strategy parameters. Then, a genetic algorithm is used to find the optimal solution for the fitting function, and the optimal solution is used as the target parameters of the vulnerability scanning strategy corresponding to the network device. This allows for the rapid and accurate acquisition of a set of vulnerability scanning strategy parameters that optimizes the scanning results of the network device.

[0068] For example, a logistic regression model or a linear regression model can be used to fit each set of vulnerability scanning strategy parameters used by the network scanning device and the vulnerability scanning results corresponding to each set of vulnerability scanning strategy parameters, so as to quickly construct a fitting function between the vulnerability scanning strategy parameters and the vulnerability scanning results.

[0069] S230: Generate device attribute samples based on the attribute information of network devices, and generate labels corresponding to the device attribute samples based on the target parameters of the vulnerability scanning strategy corresponding to the network devices. Generate a vulnerability scanning strategy training set based on the generated device attribute samples and their corresponding labels.

[0070] In some embodiments, the correlation coefficient between the attribute fields in the attribute information and the corresponding target parameters of the vulnerability scanning strategy can be calculated. For example, the correlation coefficient between the attribute fields in the attribute information and the corresponding target parameters of the vulnerability scanning strategy can be calculated by chi-square test. Then, attribute fields in the attribute information whose correlation coefficient is lower than or equal to a preset threshold, i.e. irrelevant fields, are deleted. Based on the attribute information after deleting the attribute fields, a device attribute sample is generated.

[0071] In addition, the target parameters of the vulnerability scanning strategy corresponding to the network device can be used as the label corresponding to the device attribute sample to identify the optimal vulnerability scanning strategy parameters required by the network device corresponding to the device attribute sample.

[0072] In this way, representative attribute fields can be selected, and device attribute samples can be generated based on the attribute information of the key attribute fields, which facilitates subsequent model training and improves the speed of model training and the matching effect of the model.

[0073] It is important to note that the vulnerability scanning strategy training set includes device attribute samples and their corresponding labels.

[0074] S240 uses a vulnerability scanning strategy training set to train a preset vulnerability scanning strategy matching model.

[0075] In some embodiments, the preset vulnerability scanning strategy matching model can be a convolutional neural network, a random forest model, etc.

[0076] If the default vulnerability scanning strategy matching model is a convolutional neural network, the input layer of the convolutional neural network can receive device attribute samples from the vulnerability scanning strategy training set. The hidden layers of the convolutional neural network (including convolutional layers, pooling layers, etc.) extract the sample features of the received device attribute samples. The output layer of the convolutional neural network classifies the received device attribute samples based on the extracted sample features to obtain the vulnerability scanning strategy parameters corresponding to the received device attribute samples.

[0077] The model parameters of the convolutional neural network are iteratively updated based on the vulnerability scanning strategy parameters and labels corresponding to the received device attribute samples until the training stopping condition is met, thus quickly obtaining the trained vulnerability scanning strategy matching model.

[0078] For example, the loss value of the vulnerability scanning strategy matching model can be calculated based on the vulnerability scanning strategy parameters and labels corresponding to the received device attribute samples. If the loss value of the vulnerability scanning strategy matching model is greater than or equal to a preset threshold, the model parameters of the vulnerability scanning strategy matching model are iteratively updated until the calculated loss value is less than the preset threshold, thus obtaining the trained vulnerability scanning strategy matching model.

[0079] According to an embodiment of the present invention, a vulnerability scanning strategy training set can be generated based on vulnerability scanning records, and the preset vulnerability scanning strategy matching model can be quickly trained using the vulnerability scanning strategy training set to obtain a vulnerability scanning strategy matching model with strong matching ability.

[0080] Based on the training method 200 for the vulnerability scanning strategy matching model provided in this embodiment of the invention, this embodiment of the invention also provides a vulnerability scanning strategy matching method.

[0081] like Figure 3 As shown, this vulnerability scanning strategy matching method 300 can be applied to Figure 1 The server 120 shown includes the following steps:

[0082] S310, send the model parameters of the trained vulnerability scanning strategy matching model to each vulnerability scanning device, so that each vulnerability scanning device can construct a vulnerability scanning strategy matching model based on the model parameters, which is used to match the attribute information of the network device to be scanned and determine the vulnerability scanning strategy parameters corresponding to the network device to be scanned. The vulnerability scanning strategy matching model is obtained based on the training method described above.

[0083] Specifically, the attribute information of the network device to be scanned can be input into the vulnerability scanning strategy matching model constructed by the vulnerability scanning device. The vulnerability scanning strategy matching model analyzes and calculates the attribute information to determine the vulnerability scanning strategy parameters corresponding to the network device to be scanned, that is, the vulnerability scanning strategy.

[0084] According to embodiments of the present invention, the vulnerability scanning strategy parameters corresponding to the network device to be scanned can be determined quickly and accurately, effectively improving the matching effect of vulnerability scanning strategies and facilitating the subsequent adoption of appropriate vulnerability scanning strategies to perform vulnerability scanning on the network device to be scanned.

[0085] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily essential to the present invention.

[0086] The above is an introduction to the method embodiments. The following describes the solution of the present invention further through device embodiments.

[0087] Figure 4 The diagram shows a structural diagram of a training apparatus for a vulnerability scanning strategy matching model according to an embodiment of the present invention. Figure 4 As shown, the training device 400 may include:

[0088] The acquisition module 410 is used to acquire the vulnerability scanning records of the network device uploaded by the vulnerability scanning device. The vulnerability scanning records include: the attribute information of the network device, the vulnerability scanning strategy parameters adopted by the vulnerability scanning device to scan the network device, and the vulnerability scanning results corresponding to the scanning strategy parameters.

[0089] The determination module 420 is used to determine the target parameters of the vulnerability scanning strategy for the network device based on the vulnerability scanning strategy parameters adopted by the vulnerability scanning device to scan the network device and the corresponding vulnerability scanning results.

[0090] The generation module 430 is used to generate device attribute samples based on the attribute information of network devices, generate labels corresponding to the device attribute samples based on the target parameters of the vulnerability scanning strategy corresponding to the network devices, and generate a vulnerability scanning strategy training set based on the generated device attribute samples and their corresponding labels.

[0091] Training module 440 is used to train a preset vulnerability scanning strategy matching model using a vulnerability scanning strategy training set.

[0092] In some embodiments, the determining module 420 is specifically used for:

[0093] Based on the vulnerability scanning strategy parameters used by the network scanning devices and the corresponding vulnerability scanning results, a fitting function between the vulnerability scanning strategy parameters and the vulnerability scanning results is constructed.

[0094] A genetic algorithm is used to find the optimal solution for the fitted function, thereby obtaining the target parameters of the vulnerability scanning strategy for the network device.

[0095] In some embodiments, the generation module 430 is specifically used for:

[0096] Calculate the correlation coefficient between the attribute fields in the attribute information and the corresponding vulnerability scanning strategy target parameters.

[0097] Delete attribute fields in the attribute information whose correlation coefficient is lower than or equal to a preset threshold.

[0098] Generate a sample of device attributes based on the attribute information after deleting attribute fields.

[0099] In some embodiments, the default vulnerability scanning strategy matching model is a convolutional neural network.

[0100] Training module 440 is specifically used for:

[0101] The input layer of the convolutional neural network receives device attribute samples from the training set of the vulnerability scanning strategy.

[0102] The hidden layers of a convolutional neural network extract sample features from received device attribute samples.

[0103] The output layer of the convolutional neural network classifies the received device attribute samples based on the extracted sample features, and obtains the vulnerability scanning strategy parameters corresponding to the received device attribute samples.

[0104] The model parameters of the convolutional neural network are iteratively updated based on the vulnerability scanning strategy parameters and labels corresponding to the received device attribute samples until the training stopping condition is met, thus obtaining the trained vulnerability scanning strategy matching model.

[0105] In some embodiments, the training module 440 is specifically used for:

[0106] The loss value of the vulnerability scanning strategy matching model is calculated based on the vulnerability scanning strategy parameters and labels corresponding to the received device attribute samples.

[0107] If the loss value of the vulnerability scanning strategy matching model is greater than or equal to the preset threshold, the model parameters of the vulnerability scanning strategy matching model are iteratively updated until the loss value of the vulnerability scanning strategy matching model is less than the preset threshold, thus obtaining the trained vulnerability scanning strategy matching model.

[0108] In some embodiments, vulnerability scanning strategy parameters include the following options: scanning task item, scanning tool corresponding to the scanning task item, scanning order of the scanning task item, and scanning cycle.

[0109] Understandable Figure 4 Each module / unit in the training device 400 shown has the function of implementing each step in the training method 200 provided in the embodiments of the present invention, and can achieve its corresponding technical effect. For the sake of brevity, it will not be described in detail here.

[0110] Figure 5 A structural diagram of a vulnerability scanning strategy matching device according to an embodiment of the present invention is shown, as follows: Figure 5 As shown, the vulnerability scanning strategy matching device 500 may include:

[0111] The sending module is used to send the model parameters of the trained vulnerability scanning strategy matching model to each vulnerability scanning device, so that each vulnerability scanning device can construct a vulnerability scanning strategy matching model based on the model parameters, which is used to match the attribute information of the network device to be scanned and determine the vulnerability scanning strategy parameters corresponding to the network device to be scanned.

[0112] The vulnerability scanning strategy matching model is obtained based on the training method described above.

[0113] Understandable Figure 5 Each module / unit in the vulnerability scanning strategy matching device 500 shown has the function of implementing each step in the vulnerability scanning strategy matching method 300 provided in the embodiments of the present invention, and can achieve its corresponding technical effect. For the sake of brevity, it will not be described in detail here.

[0114] Figure 6 A structural diagram of an electronic device that can be used to implement embodiments of the present invention is shown. Electronic device 600 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. Electronic device 600 may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0115] like Figure 6As shown, the electronic device 600 may include a computing unit 601, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 602 or a computer program loaded from a storage unit 608 into a random access memory (RAM) 603. The RAM 603 may also store various programs and data required for the operation of the electronic device 600. The computing unit 601, ROM 602, and RAM 603 are interconnected via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0116] Multiple components in electronic device 600 are connected to I / O interface 605, including: input unit 606, such as keyboard, mouse, etc.; output unit 607, such as various types of displays, speakers, etc.; storage unit 608, such as disk, optical disk, etc.; and communication unit 609, such as network card, modem, wireless transceiver, etc. Communication unit 609 allows electronic device 600 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0117] The computing unit 601 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 601 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 601 performs the various methods and processes described above, such as method 200 or method 300. For example, in some embodiments, method 200 or method 300 may be implemented as a computer program product, including a computer program tangibly contained in a computer-readable medium, such as storage unit 608. In some embodiments, part or all of the computer program may be loaded and / or installed on device 600 via ROM 602 and / or communication unit 609. When the computer program is loaded into RAM 603 and executed by the computing unit 601, one or more steps of method 200 or method 300 described above may be performed. Alternatively, in other embodiments, the computing unit 601 may be configured to perform method 200 or method 300 by any other suitable means (e.g., by means of firmware).

[0118] The various embodiments described above can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), payload programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0119] The program code used to implement the methods of the present invention can be written in any combination of one or more programming languages. This program code can be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing device, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code can be executed entirely on the machine, partially on the machine, as a standalone software package partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0120] In the context of this invention, a computer-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. A computer-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of computer-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0121] It should be noted that the present invention also provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause a computer to execute method 200 or method 300 and achieve the corresponding technical effects achieved by executing the methods in the embodiments of the present invention. For the sake of brevity, they will not be described in detail here.

[0122] In addition, the present invention also provides a computer program product, which includes a computer program that implements method 200 or method 300 when executed by a processor.

[0123] To provide interaction with a user, the embodiments described above can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0124] The embodiments described above can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with the implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication (e.g., a communication network) of any form or medium. Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0125] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. Servers can be cloud servers, servers in distributed systems, or servers incorporating blockchain technology.

[0126] It should be understood that the various forms of processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this invention can be achieved, and this is not limited herein.

[0127] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A training method for a vulnerability scanning strategy matching model, characterized in that, The method includes: Obtain vulnerability scanning records of network devices uploaded by vulnerability scanning devices, wherein the vulnerability scanning records include: attribute information of the network devices, vulnerability scanning strategy parameters adopted by the vulnerability scanning devices to scan the network devices, and vulnerability scanning results corresponding to the scanning strategy parameters; Based on the vulnerability scanning strategy parameters used by the vulnerability scanning device to scan the network device and the corresponding vulnerability scanning results, the target parameters of the vulnerability scanning strategy for the network device are determined. Based on the attribute information of the network device, generate device attribute samples, and based on the target parameters of the vulnerability scanning strategy corresponding to the network device, generate labels corresponding to the device attribute samples; based on the generated device attribute samples and their corresponding labels, generate a vulnerability scanning strategy training set; The vulnerability scanning strategy training set is used to train the preset vulnerability scanning strategy matching model; The step of determining the target parameters of the vulnerability scanning strategy for the network device based on the vulnerability scanning strategy parameters used by the vulnerability scanning device to scan the network device and the corresponding vulnerability scanning results includes: Based on the vulnerability scanning strategy parameters used for each set of network devices and the vulnerability scanning results corresponding to each set of vulnerability scanning strategy parameters, a fitting function between the vulnerability scanning strategy parameters and the vulnerability scanning results is constructed. A genetic algorithm is used to find the optimal solution for the fitting function, thereby obtaining the target parameters of the vulnerability scanning strategy corresponding to the network device.

2. The method according to claim 1, characterized in that, The step of generating device attribute samples based on the attribute information in the vulnerability scan record includes: Calculate the correlation coefficient between the attribute fields in the attribute information and the corresponding vulnerability scanning strategy target parameters; Delete attribute fields in the attribute information whose correlation coefficient is lower than or equal to a preset threshold; Generate a sample of device attributes based on the attribute information after deleting attribute fields.

3. The method according to claim 1, characterized in that, The preset vulnerability scanning strategy matching model is a convolutional neural network; The step of training a preset vulnerability scanning strategy matching model using the vulnerability scanning strategy training set includes: The input layer of the convolutional neural network receives device attribute samples from the training set of the vulnerability scanning strategy; The hidden layers of the convolutional neural network extract sample features from the received device attribute samples; The output layer of the convolutional neural network classifies the received device attribute samples based on the extracted sample features to obtain the vulnerability scanning strategy parameters corresponding to the received device attribute samples. The model parameters of the convolutional neural network are iteratively updated based on the vulnerability scanning strategy parameters and labels corresponding to the received device attribute samples until the training stopping condition is met, thus obtaining the trained vulnerability scanning strategy matching model.

4. The method according to claim 3, characterized in that, The step of iteratively updating the parameters of the convolutional neural network based on the vulnerability scanning strategy parameters and labels corresponding to the received device attribute samples until the training stopping condition is met, thereby obtaining a trained vulnerability scanning strategy matching model, includes: The loss value of the vulnerability scanning strategy matching model is calculated based on the vulnerability scanning strategy parameters and labels corresponding to the received device attribute samples. If the loss value of the vulnerability scanning strategy matching model is greater than or equal to a preset threshold, the model parameters of the vulnerability scanning strategy matching model are iteratively updated until the loss value of the vulnerability scanning strategy matching model is less than the preset threshold, thus obtaining a trained vulnerability scanning strategy matching model.

5. The method according to any one of claims 1-4, characterized in that, The vulnerability scanning strategy parameters include the following options: scanning task item, scanning tool corresponding to the scanning task item, scanning order of the scanning task item, and scanning cycle.

6. A vulnerability scanning strategy matching method, characterized in that, The method includes: The trained vulnerability scanning strategy matching model is sent to each vulnerability scanning device so that each vulnerability scanning device can construct a vulnerability scanning strategy matching model based on the model parameters. This model is used to match the attribute information of the network device to be scanned and determine the vulnerability scanning strategy parameters corresponding to the network device to be scanned. The vulnerability scanning strategy matching model is obtained based on the training method of the vulnerability scanning strategy matching model according to any one of claims 1-5.

7. A training device for a vulnerability scanning strategy matching model, characterized in that, The device includes: The acquisition module is used to acquire vulnerability scanning records of network devices uploaded by the vulnerability scanning device. The vulnerability scanning records include: attribute information of the network device, vulnerability scanning strategy parameters adopted by the vulnerability scanning device to scan the network device, and vulnerability scanning results corresponding to the scanning strategy parameters. The determination module is used to determine the target parameters of the vulnerability scanning strategy for the network device based on the vulnerability scanning strategy parameters used by the vulnerability scanning device to scan the network device and the corresponding vulnerability scanning results. The generation module is used to generate device attribute samples based on the attribute information of the network device, and generate labels corresponding to the device attribute samples based on the target parameters of the vulnerability scanning strategy corresponding to the network device; and generate a vulnerability scanning strategy training set based on the generated device attribute samples and their corresponding labels. The training module is used to train a preset vulnerability scanning strategy matching model using the vulnerability scanning strategy training set. The determining module is specifically used to: construct a fitting function between the vulnerability scanning strategy parameters and the vulnerability scanning results based on the vulnerability scanning strategy parameters used for scanning the network device and the vulnerability scanning results corresponding to each set of vulnerability scanning strategy parameters; and use a genetic algorithm to find the optimal solution for the fitting function to obtain the target parameters of the vulnerability scanning strategy corresponding to the network device.

8. A vulnerability scanning strategy matching device, characterized in that, The device includes: The sending module is used to send the model parameters of the trained vulnerability scanning strategy matching model to each vulnerability scanning device, so that each vulnerability scanning device can construct a vulnerability scanning strategy matching model based on the model parameters, which is used to match the attribute information of the network device to be scanned and determine the vulnerability scanning strategy parameters corresponding to the network device to be scanned. The vulnerability scanning strategy matching model is obtained based on the training method of the vulnerability scanning strategy matching model according to any one of claims 1-5.

9. An electronic device, characterized in that, The device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to cause the at least one processor to perform the method of any one of claims 1-6.

Images