Software recommendation method and device for vulnerability repair, electronic equipment and medium

Abstract

The disclosure provides a software recommendation method, device, equipment, storage medium and program product for vulnerability repair, relates to the technical field of computers, and can be applied to the technical field of finance. The method comprises the following steps: in response to receiving a software recommendation request from a user, input information corresponding to the software recommendation request is obtained; a target second software matching a target vulnerability to be repaired is determined in each second software; a plurality of different versions of the second software matching the second target software are determined; according to the vulnerability information corresponding to each second software, the number of vulnerabilities generated by upgrading the first software to each version of the second software is determined respectively, and / or according to the function description feature words corresponding to each second software, the function modification value generated by upgrading the first software to each version of the second software is determined respectively; and at least one target version of the second software is recommended according to the number of vulnerabilities and / or the function modification value.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and can be applied to the field of financial technology, and more specifically to a software recommendation method, apparatus, device, medium and program product for vulnerability remediation. Background Technology

[0002] Currently, security vulnerability analysis systems cannot effectively identify the impact of upgrading to a new version on the functionality of existing software. Existing upgrade recommendation methods are simplistic, only targeting a given vulnerability to determine the upgrade version. The recommendations often only include the first version that fixes the given vulnerability and the latest version of the entire open-source software, resulting in inaccurate results. Furthermore, this can introduce new vulnerabilities, frequently leading to repeated upgrades or version incompatibility issues, and failing to anticipate the risks of functional modifications. Summary of the Invention

[0003] In view of the above problems, this disclosure provides a software recommendation method, apparatus, device, medium, and program product for vulnerability remediation. Based on the target vulnerability to be remediated in the target system and the first software currently used by the target system, a target second software is first determined, followed by multiple different versions of the second software. Then, the number of vulnerabilities and / or functional modification values ​​resulting from upgrading from the first software to each version of the second software are determined respectively. Based on the number of vulnerabilities and / or functional modification values, at least one target version of the second software is recommended. For example, the second software with the fewest vulnerabilities is recommended to improve security; the second software with the lowest functional modification value is recommended to reduce the cost of upgrading the software; or the second software with low cost and high security is recommended. This facilitates users upgrading open-source software versions and remediating the target vulnerability in one step by recommending at least one target version of the second software, while reducing the workload of functional testing, security testing, and other testing.

[0004] According to a first aspect of this disclosure, a software recommendation method for vulnerability remediation is provided, comprising: in response to receiving a software recommendation request from a user, acquiring input information corresponding to the software recommendation request, the input information including a target vulnerability to be remediated in a target system and a first software currently used by the target system; determining a target second software that matches the target vulnerability to be remediated among the second software based on vulnerability remediation information corresponding to each second software; determining multiple different versions of the second software that match the second target software; determining the number of vulnerabilities generated by upgrading from the first software to each version of the second software based on the vulnerability information corresponding to each second software, and / or determining the functional modification value generated by upgrading from the first software to each version of the second software based on the functional description features corresponding to each second software; and recommending at least one target version of the second software based on the number of vulnerabilities and / or the functional modification value.

[0005] According to an embodiment of this disclosure, determining the target second software that matches the target vulnerability to be repaired among the second software based on the vulnerability repair information corresponding to each second software includes: determining an identifier number corresponding to the target vulnerability to be repaired; and determining the target second software that matches the target vulnerability to be repaired among the second software based on the mapping relationship between the identifier number and the vulnerability repair information.

[0006] According to an embodiment of this disclosure, determining multiple different versions of the second software that match the second target software includes: determining multiple different versions of the second software based on a preset software version timing link that matches the second target software.

[0007] According to an embodiment of this disclosure, the step of determining the functional modification value generated by upgrading the second software from the first software to each version based on the functional description feature words corresponding to each second software includes: obtaining a first functional description feature word corresponding to the first software; obtaining a second functional description feature word corresponding to each second software; and determining the functional modification value generated by upgrading the second software from the first software to each version based on the preset functional modification value corresponding to each second functional description feature word and the first functional description feature word.

[0008] According to an embodiment of this disclosure, recommending at least one target version of the second software based on the number of vulnerabilities includes: recommending second software with a number of vulnerabilities less than a first preset value.

[0009] According to an embodiment of this disclosure, recommending at least one target version of the second software based on the functional modification value includes: recommending second software with a functional modification value less than a second preset value.

[0010] According to an embodiment of this disclosure, recommending at least one target version of the second software based on the number of vulnerabilities and the functional modification value includes: obtaining second software with a number of vulnerabilities less than a first preset value and determining a first set; obtaining second software with a functional modification value less than a second preset value and determining a second set; and using the intersection version between the first set and the second set as the target version and recommending the target version of the second software.

[0011] According to an embodiment of this disclosure, the method further includes: collecting data information, the data information including vulnerability information, software vulnerability repair information, version information of each software, and functional feature descriptions of each version of the software; wherein, the vulnerability information includes CVE number, vulnerability content corresponding to the CVE number, vulnerability exploitation conditions corresponding to the CVE number, and software corresponding to the CVE number; the software vulnerability repair information includes the CVE number.

[0012] According to embodiments of this disclosure, the method further includes one or more of the following data processing methods: a first data processing method is to establish a vulnerability information database based on the vulnerability information; a second data processing method is to establish a software information database based on the software's patch vulnerability information, the version information of each software, and the functional feature description of each version of the software; a third data processing method is to establish a software version timeline link based on the iteration timeline corresponding to the version information of each software; and a fourth data processing method is to associate the vulnerability information database and the software information database based on the CVE number.

[0013] A second aspect of this disclosure provides a software recommendation apparatus for vulnerability remediation, comprising: an acquisition module, configured to, in response to receiving a software recommendation request from a user, acquire input information corresponding to the software recommendation request, the input information including a target vulnerability to be remediated in a target system and a first software currently used by the target system; a first determination module, configured to, based on vulnerability remediation information corresponding to each second software, determine a target second software matching the target vulnerability to be remediated among the second software; a second determination module, configured to, based on vulnerability information corresponding to each second software, determine the number of vulnerabilities generated by upgrading from the first software to each version of the second software, and / or, based on functional description features corresponding to each second software, determine the functional modification values ​​generated by upgrading from the first software to each version of the second software; and a recommendation module, configured to, based on the number of vulnerabilities and / or the functional modification values, recommend at least one target version of the second software.

[0014] A third aspect of this disclosure provides an electronic device comprising: one or more processors; and a memory for storing one or more programs, wherein, when the one or more programs are executed by the one or more processors, the one or more processors perform the software recommendation method described above for vulnerability remediation.

[0015] A fourth aspect of this disclosure also provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the software-recommended method described above for vulnerability remediation.

[0016] The fifth aspect of this disclosure also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described software recommendation method for vulnerability remediation.

[0017] The software recommendation method for vulnerability remediation provided in this embodiment can first determine a target second software based on the target vulnerability to be remediated in the target system and the first software currently used by the target system, and then determine multiple different versions of the second software. Then, it determines the number of vulnerabilities and / or functional modification values ​​generated by upgrading from the first software to each version of the second software, and recommends at least one target version of the second software based on the number of vulnerabilities and / or functional modification values. For example, it recommends the second software with the fewest vulnerabilities to improve security, recommends the second software with the lowest functional modification value to reduce the cost of upgrading the software, or recommends the second software with low cost and high security. This is beneficial for users to upgrade the open source software version and fix the target vulnerability to be remediated in one go by recommending at least one target version of the second software, while reducing the workload of functional testing, security testing and other testing. Attached Figure Description

[0018] The foregoing contents, as well as other objects, features, and advantages of this disclosure, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0019] Figure 1 The illustration schematically depicts application scenarios of software recommendation methods, apparatuses, devices, media, and program products for vulnerability remediation according to embodiments of this disclosure;

[0020] Figure 2 A flowchart illustrating a software recommendation method for vulnerability remediation according to an embodiment of this disclosure is shown schematically.

[0021] Figure 3 The illustration schematically shows an execution diagram of a user acquiring second software according to an embodiment of the present disclosure;

[0022] Figure 4A schematic block diagram of a software recommendation apparatus for vulnerability remediation according to an embodiment of the present disclosure is shown; and

[0023] Figure 5 A block diagram schematically illustrates an electronic device suitable for implementing a software recommendation method for vulnerability remediation according to an embodiment of the present disclosure. Detailed Implementation

[0024] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts of the present disclosure.

[0025] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0026] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0027] When using expressions such as "at least one of A, B, and C", they should generally be interpreted in accordance with the meaning that is commonly understood by a person skilled in the art (e.g., "a system having at least one of A, B, and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B, and C, etc.).

[0028] Embodiments of this disclosure provide a software recommendation method and apparatus for vulnerability remediation. In response to receiving a software recommendation request from a user, the method acquires input information corresponding to the software recommendation request, including a target vulnerability to be remediated in the target system and a first software currently used by the target system. Based on vulnerability remediation information corresponding to each second software, the method determines a target second software that matches the target vulnerability to be remediated. It also determines multiple different versions of the second software that match the target second software. Based on the vulnerability information corresponding to each second software, the method determines the number of vulnerabilities resulting from upgrading from the first software to each version of the second software, and / or, based on the functional description features corresponding to each second software, determines the functional modification value resulting from upgrading from the first software to each version of the second software. Finally, the method recommends at least one target version of the second software based on the number of vulnerabilities and / or the functional modification value.

[0029] Figure 1 The illustration schematically depicts application scenarios of software recommendation methods, apparatuses, devices, media, and program products for vulnerability remediation according to embodiments of the present disclosure.

[0030] like Figure 1 As shown, application scenario 100 according to this embodiment may include terminal devices 101, 102, and 103, a network 104, and a server 105. Network 104 serves as a medium for providing a communication link between terminal devices 101, 102, and 103 and server 105. Network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0031] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, and 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0032] Terminal devices 101, 102, and 103 can be various electronic devices with displays and web browsing capabilities, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0033] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using terminal devices 101, 102, and 103 (for example only). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0034] It should be noted that the software recommendation method for vulnerability remediation provided in this disclosure embodiment can generally be executed by server 105. Correspondingly, the software recommendation device for vulnerability remediation provided in this disclosure embodiment can generally be located in server 105. The software recommendation method for vulnerability remediation provided in this disclosure embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with terminal devices 101, 102, 103 and / or server 105. Correspondingly, the software recommendation device for vulnerability remediation provided in this disclosure embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with terminal devices 101, 102, 103 and / or server 105.

[0035] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0036] The following will be based on Figure 1 The described scene, through Figure 2 The software recommendation method for vulnerability remediation according to the disclosed embodiments is described in detail.

[0037] Figure 2 A flowchart illustrating a software recommendation method for vulnerability remediation according to an embodiment of this disclosure is shown schematically.

[0038] like Figure 2 As shown, this embodiment includes operations S210 to S250, and the software recommendation method for vulnerability remediation can be executed by a server.

[0039] In the technical solution disclosed herein, the acquisition, collection, storage, use, processing, transmission, provision, disclosure, and application of data all comply with the provisions of relevant laws and regulations, necessary confidentiality measures have been taken, and they do not violate public order and good morals.

[0040] In operation S210, in response to receiving a software recommendation request from the user, input information corresponding to the software recommendation request is obtained. The input information includes the target vulnerability to be patched in the target system and the first software currently used by the target system.

[0041] In operation S220, based on the vulnerability repair information corresponding to each second software, the target second software that matches the target vulnerability to be repaired is determined among each second software.

[0042] In operation S230, multiple different versions of the second software are identified that match the second target software.

[0043] In operation S240, based on the vulnerability information corresponding to each second software, the number of vulnerabilities generated by upgrading the second software from the first software to each version is determined, and / or, based on the functional description feature words corresponding to each second software, the functional modification value generated by upgrading the second software from the first software to each version is determined.

[0044] When operating S250, based on the number of vulnerabilities and / or the feature modification value, recommend at least one target version of the second software.

[0045] This embodiment addresses the issues of introducing new vulnerabilities and incompatibility problems caused by recommending only the first version of open-source software that fixes a given vulnerability or the latest version of the entire open-source software. When recommending open-source software upgrades, in addition to identifying upgradable versions, it matches the feature descriptions of each version's updates to the software to be rectified with relevant feature information from each open-source software. The upgrade cost to each upgradable version is calculated and used as a feature modification value for software recommendations. This also provides early warnings of potential version incompatibility issues. Furthermore, it calculates the number of vulnerabilities to determine the security risk of upgrades, considering security when recommending software. This also provides early warnings of new vulnerabilities introduced by upgrades, thus resolving the issues of introducing new vulnerabilities and repeated upgrades caused by open-source software upgrades.

[0046] The data collection module in the software recommendation system collects data according to the scope of data collection. This scope may include vulnerability information collection, open-source software version information collection, open-source software version vulnerability patching information collection, open-source software version update function information collection, and collection of open-source software functions used by software requiring rectification. The collected data can be further processed, such as building a vulnerability information database based on vulnerability information, or extracting feature words from the update function descriptions of various open-source software versions to obtain feature words corresponding to the software's functions. Regularly visiting the website of each open-source software to obtain all historical version information, feature information of each version, and vulnerability patching information can serve as the primary source of recommendation analysis data and contribute to building an open-source software information database.

[0047] Understandably, since feature update information for open-source software versions is often descriptive text, in order to more quickly locate the affected features, feature word processing of the open-source software version's features can be performed through scheduled tasks or other means to build a feature word library for each version's updated features, providing computational data for subsequent feature modification values.

[0048] By using scheduled tasks or other methods, the unique identifiers of vulnerability information in the vulnerability database can be matched with the patched vulnerability information in open-source software versions, establishing a relationship between the two and linking the vulnerability database and the software database, thereby improving the efficiency of software recommendation. For example, using the CVE number as a unique identifier, the security vulnerabilities patched in each version of open-source software can be clearly identified, allowing users to query the open-source software version that patched the vulnerability.

[0049] For example, based on the target vulnerability to be patched in the target system and the first software currently used by the target system, a target second software is first determined, and then multiple different versions of the second software are determined. Then, the number of vulnerabilities and / or functional modification values ​​generated by upgrading from the first software to each version of the second software are determined respectively. Based on the number of vulnerabilities and / or functional modification values, at least one target version of the second software is recommended. For example, the second software with the fewest vulnerabilities is recommended to improve security, the second software with the lowest functional modification value is recommended to reduce the cost of upgrading the software, or the second software with low cost and high security is recommended. This is beneficial for users to upgrade the open source software version and patch the target vulnerability to be patched in one go by recommending at least one target version of the second software, while reducing the workload of functional testing, security testing and other testing.

[0050] Furthermore, among multiple target versions of the second software, the system can recommend the optimal upgrade version based on user needs. For example, it could recommend the second software with lower cost and higher security; the most secure upgrade version with the fewest vulnerabilities; or the lowest-cost upgrade version with the lowest functional modification value. Simultaneously, it can display a list of selectable repair versions, including all second software versions from multiple different versions. When a user views the details of each second software, a list of required functional modifications for upgrading to that version can be displayed. This list can include descriptive keywords for the corresponding functions of each second software. It can also display a list of security vulnerabilities introduced by upgrading to that version, including vulnerability information, thus providing early warning before upgrading.

[0051] Based on the vulnerability repair information corresponding to each second software, the target second software that matches the target vulnerability to be repaired is determined in each second software, including: determining the identification number corresponding to the target vulnerability to be repaired; and determining the target second software that matches the target vulnerability to be repaired in each second software according to the mapping relationship between the identification number and the vulnerability repair information.

[0052] The identifier corresponding to the target vulnerability to be patched can be a CVE number, which is a unique identifier assigned to publicly known cybersecurity vulnerabilities. This identifier is used to identify the vulnerability and to link to other repositories.

[0053] For example, the vulnerability information database and the software information database are associated based on the CVE number. The vulnerability information database is used to match the identifier number corresponding to the target vulnerability to be patched. The software information database contains information on each software application, including vulnerability patching information. Based on the mapping relationship between the identifier number and the vulnerability patching information, the target secondary software can be determined, such as open-source software that can modify the lowest version of the target vulnerability.

[0054] The software recommendation method for vulnerability remediation provided in this embodiment can determine the target second software that matches the target vulnerability to be remediated among each second software according to the mapping relationship between the identifier number and the vulnerability remediation information, which is conducive to quickly locating the target open source software.

[0055] Determining multiple different versions of the second software that match the second target software includes: determining multiple different versions of the second software based on a preset software version timing link that matches the second target software.

[0056] To clarify the iterative relationships of open-source software versions, open-source software version recommendations can be implemented by arranging version information according to the iteration sequence corresponding to the version information of each software, such as establishing a corresponding software version sequence link.

[0057] For example, based on the release sequence of open-source software versions, the version information in the open-source software information repository is arranged in a progressive order from first to last according to the open-source software dimension. The next version of the current version is recorded in the information repository to form a link structure. Subsequent second software will search for versions sequentially according to this link, thereby identifying multiple different versions of the second software.

[0058] The software recommendation method for vulnerability remediation provided in this embodiment facilitates the rapid identification of multiple different versions of the second software based on a preset software version timing chain that matches the second target software, thereby obtaining multiple upgradable and secure versions of open source software.

[0059] Based on the functional description feature words corresponding to each second software, determine the functional modification value generated by upgrading the second software from the first software to each version, including: obtaining the first functional description feature words corresponding to the first software; obtaining the second functional description feature words corresponding to each second software; and determining the functional modification value generated by upgrading the second software from the first software to each version based on the preset functional modification value corresponding to each second functional description feature word and the first functional description feature word.

[0060] For example, we can collect information on the open-source software used by the software system to be analyzed, including the open-source software versions and the main functional features used, and establish an information database of the system to be analyzed. The software system to be analyzed can be the target system. Alternatively, we can use scheduled tasks or other methods to process the features of the open-source software versions first, and build a feature database of each version's updated features to provide calculation data for subsequent functional modifications.

[0061] It is understandable that the modification costs incurred in upgrading and modifying various software versions can be recorded in advance, and these modification costs can be used as the functional modification value between the two software programs.

[0062] Since each software has corresponding functional description features, a mapping relationship can be established between two functional description features and functional modification values.

[0063] The software recommendation method for vulnerability repair provided in this embodiment can determine the functional modification value generated by upgrading from the first software to each version of the second software based on the preset functional modification value corresponding to each second functional description feature word and the first functional description feature word. The functional modification value can be used to characterize the cost generated by the functional modification and upgrade.

[0064] Recommending at least one target version of the second software based on the number of vulnerabilities, including: recommending the second software with fewer than a first preset value of vulnerabilities.

[0065] Figure 3 This illustration schematically depicts the execution of a user acquiring second software according to an embodiment of the present disclosure, see also Figure 3 First, if a user sends a software recommendation request through client 310, the parameters of this request include input information, such as the target vulnerability to be patched in the target system and the first software currently used by the target system. Upon receiving the request, server 320 forwards the request and input information to software recommendation device 330 for vulnerability patching. Software recommendation device 330, upon receiving the software recommendation request from the user, obtains the input information corresponding to the software recommendation request, including the target vulnerability to be patched in the target system and the first software currently used by the target system; based on the vulnerability patching information corresponding to each second software, it determines a target second software that matches the target vulnerability to be patched; it determines multiple different versions of the second software that match the target second software; based on the vulnerability information corresponding to each second software, it determines the number of vulnerabilities generated by upgrading from the first software to each version of the second software; it obtains a first preset value corresponding to the number of recommended vulnerabilities, and recommends second software with a number of vulnerabilities less than the first preset value, i.e., the target version of the second software, thereby sending the target version of the second software to client 310.

[0066] The software recommendation method for vulnerability repair provided in this embodiment recommends second software with a functional modification value less than a second preset value, which helps users obtain a more secure upgraded version of the second software.

[0067] Recommending at least one target version of the second software based on the functional modification value, including: recommending the second software with a functional modification value less than a second preset value.

[0068] For example, a second preset value corresponding to the functional modification value is obtained, and a second software with a functional modification value less than the second preset value is recommended.

[0069] The software recommendation method for vulnerability repair provided in this embodiment recommends second software with a functional modification value less than a second preset value, which helps users obtain a second software upgrade version with lower cost.

[0070] Recommending at least one target version of second software based on the number of vulnerabilities and the value of functional modifications includes: obtaining second software with fewer than a first preset value of vulnerabilities and determining a first set; obtaining second software with fewer than a second preset value of functional modifications and determining a second set; and using the versions at the intersection of the first set and the second set as target versions and recommending the target version of the second software.

[0071] For example, S1: The user submits a list of characteristic words S of the vulnerability L0 to be fixed and the open-source software functions used by the software system through the user interaction module, as input parameters for the algorithm module.

[0072] S2: The algorithm program searches for the first patched version V0 of the vulnerability in the open-source software version and vulnerability relationship database.

[0073] S3: Based on the first patch version V0, locate the open-source software version relationship link library of the data processing module and query subsequent versions.

[0074] S4: Calculate all upgradable versions V0…Vn of the vulnerability L0 to be patched.

[0075] S5: Denote the upgradable versions V0…Vn as secure versions. For each version Vi (0≤i≤n) of all secure versions V0…Vn, query the open-source software version and vulnerability database to see if the version has other vulnerabilities Li1…Lim. Repeat steps S2 to S5 to calculate the vulnerability information for each secure version.

[0076] S6: The most secure upgrade version is the one with the fewest vulnerabilities.

[0077] S7: Based on the upgradeable versions V0…Vn obtained in step S4, and combining the open-source software version feature word library and the feature word list S of the open-source software functions used by the software system input by the user, calculate the functional information that needs to be modified for each version Vi (0≤i≤n) upgrade, and calculate the modification cost Ci.

[0078] S8: The version that requires the fewest functional modifications to be upgraded is the lowest cost upgrade version.

[0079] S9: The optimal upgrade version is the intersection of the safest upgrade version and the lowest cost upgrade version.

[0080] S10: Display the calculation results of the recommendation algorithm, upgradeable versions and their modification costs, and newly introduced vulnerability information in the user interaction module to help users make decisions.

[0081] The software recommendation method for vulnerability repair provided in this embodiment recommends a second software version of the target version by using the intersection version between the first set and the second set as the target version. This helps users obtain a second software version with lower cost and higher security.

[0082] Recommended software methods for vulnerability remediation also include: collecting data information, which includes vulnerability information, software vulnerability remediation information, version information of each software, and functional feature descriptions of each version of the software; wherein, vulnerability information includes CVE number, vulnerability content corresponding to CVE number, vulnerability exploitation conditions corresponding to CVE number, and software corresponding to CVE number; software vulnerability remediation information includes CVE number.

[0083] It should be noted that, given the diverse sources of vulnerability information, vulnerability information can be collected through various means. For example, it can be collected regularly through automated methods such as subscriptions to collect open-source software vulnerability information released by authoritative security organizations. Alternatively, users can manually import vulnerability information in the form of files. Vulnerability information includes data such as CVE number, vulnerability content, vulnerability exploitation conditions, and open-source software patch version.

[0084] The software recommendation method for vulnerability remediation provided in this embodiment provides data support for software recommendations during vulnerability remediation through collected data information.

[0085] Recommended software methods for vulnerability remediation also include one or more of the following data processing methods: the first data processing method is to establish a vulnerability information database based on vulnerability information; the second data processing method is to establish a software information database based on the software's vulnerability remediation information, the version information of each software, and the functional feature descriptions of each version of the software; the third data processing method is to establish a software version timeline based on the iteration timeline corresponding to the version information of each software; and the fourth data processing method is to associate the vulnerability information database and the software information database based on the CVE number.

[0086] The software recommendation method for vulnerability remediation provided in this embodiment, by associating the vulnerability information database and the software information database with the CVE number, facilitates the rapid acquisition of the target second software that matches the target vulnerability to be remediated; by using the software version time sequence link as the preset software version time sequence link to match the second target software, it facilitates the rapid identification of multiple different versions of the second software.

[0087] Based on the above-described software recommendation method for vulnerability remediation, this disclosure also provides a software recommendation apparatus for vulnerability remediation. The following will be combined with... Figure 4 The device is described in detail.

[0088] Figure 4 A schematic block diagram of a software recommendation apparatus for vulnerability remediation according to an embodiment of the present disclosure is shown.

[0089] like Figure 4 As shown, the software recommendation device 400 for vulnerability repair in this embodiment includes an acquisition module 410, a first determination module 420, a second determination module 430, a third determination module 440, and a recommendation module 450.

[0090] The acquisition module 410 is configured to, in response to receiving a software recommendation request from a user, acquire input information corresponding to the software recommendation request, the input information including a target vulnerability to be patched in the target system and a first software currently used by the target system; the first determination module 420 is configured to, based on the vulnerability patching information corresponding to each second software, determine a target second software that matches the target vulnerability to be patched in the second software; the second determination module 430 is configured to, determine multiple different versions of second software that match the second target software; the third determination module 440 is configured to, based on the vulnerability information corresponding to each second software, determine the number of vulnerabilities generated by upgrading from the first software to each version of the second software, and / or, based on the functional description features corresponding to each second software, determine the functional modification value generated by upgrading from the first software to each version of the second software; and the recommendation module 450 is configured to, based on the number of vulnerabilities and / or the functional modification value, recommend at least one target version of the second software.

[0091] In some embodiments, the first determining module includes: a first determining submodule, configured to determine an identifier number corresponding to the target vulnerability to be repaired; and a second determining submodule, configured to determine, based on the mapping relationship between the identifier number and the vulnerability repair information, a target second software matching the target vulnerability to be repaired among the various second software.

[0092] In some embodiments, the second determining module is configured to determine multiple different versions of the second software based on a preset software version timing link that matches the second target software.

[0093] In some embodiments, the third determining module is further configured to: obtain a first functional description feature word corresponding to the first software; obtain a second functional description feature word corresponding to each second software; and determine the functional modification value generated by upgrading the second software from the first software to each version based on the preset functional modification value corresponding to each second functional description feature word and the first functional description feature word.

[0094] In some embodiments, the recommendation module is further configured to: recommend a second software with a number of vulnerabilities less than a first preset value.

[0095] In some embodiments, the recommendation module is further configured to: recommend a second software whose function modification value is less than a second preset value.

[0096] In some embodiments, the recommendation module is further configured to: obtain a second software with a number of vulnerabilities less than a first preset value, and determine a first set; obtain a second software with a functional modification value less than a second preset value, and determine a second set; and use the intersection version between the first set and the second set as the target version, and recommend the second software of the target version.

[0097] In some embodiments, the apparatus further includes: a data acquisition module, configured to acquire data information, the data information including vulnerability information, software vulnerability repair information, version information of each software, and functional feature descriptions of each version of the software; wherein, the vulnerability information includes a CVE number, vulnerability content corresponding to the CVE number, vulnerability exploitation conditions corresponding to the CVE number, and software corresponding to the CVE number; the software vulnerability repair information includes the CVE number.

[0098] In some embodiments, the apparatus further includes: a processing module, configured to perform one or more of the following data processing: a first data processing step of establishing a vulnerability information database based on the vulnerability information; a second data processing step of establishing a software information database based on the software's patch vulnerability information, the version information of each software, and the functional feature description of each version of the software; a third data processing step of establishing a software version timeline based on the iteration timeline corresponding to the version information of each software; and a fourth data processing step of associating the vulnerability information database and the software information database based on the CVE number.

[0099] According to embodiments of this disclosure, any plurality of modules among the acquisition module 410, the first determination module 420, the second determination module 430, the third determination module 440, and the recommendation module 450 may be combined into one module, or any one of these modules may be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules may be combined with at least part of the functionality of other modules and implemented in one module. According to embodiments of this disclosure, at least one of the acquisition module 410, the first determination module 420, the second determination module 430, the third determination module 440, and the recommendation module 450 may be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented in hardware or firmware by any other reasonable means of integrating or packaging circuitry, or implemented in any one of software, hardware, and firmware methods, or in a suitable combination of any of these methods. Alternatively, at least one of the acquisition module 410, the first determination module 420, the second determination module 430, the third determination module 440, and the recommendation module 450 may be implemented at least partially as a computer program module, which can perform corresponding functions when the computer program module is run.

[0100] Figure 5 A block diagram schematically illustrates an electronic device suitable for implementing a software recommendation method for vulnerability remediation according to an embodiment of the present disclosure.

[0101] like Figure 5 As shown, an electronic device 500 according to an embodiment of the present disclosure includes a processor 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage portion 508 into a random access memory (RAM) 503. The processor 501 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 501 may also include onboard memory for caching purposes. The processor 501 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0102] RAM 503 stores various programs and data required for the operation of electronic device 500. Processor 501, ROM 502, and RAM 503 are interconnected via bus 504. Processor 501 performs various operations of the method flow according to embodiments of the present disclosure by executing programs in ROM 502 and / or RAM 503. It should be noted that the programs may also be stored in one or more memories other than ROM 502 and RAM 503. Processor 501 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in said one or more memories.

[0103] According to embodiments of this disclosure, the electronic device 500 may further include an input / output (I / O) interface 505, which is also connected to a bus 504. The electronic device 500 may also include one or more of the following components connected to the I / O interface 505: an input section 506 including a keyboard, mouse, etc.; an output section 507 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a LAN card, modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the I / O interface 505 as needed. A removable medium 511, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 510 as needed so that computer programs read from it can be installed into the storage section 508 as needed.

[0104] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of this disclosure.

[0105] According to embodiments of this disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, the computer-readable storage medium may include ROM 502 and / or RAM 503 and / or one or more memories other than ROM 502 and RAM 503 described above.

[0106] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to cause the computer system to implement the software recommendation method for vulnerability remediation provided in embodiments of this disclosure.

[0107] When the computer program is executed by the processor 501, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0108] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 509, and / or installed from a removable medium 511. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0109] In such an embodiment, the computer program can be downloaded and installed from a network via communication section 509, and / or installed from removable medium 511. When the computer program is executed by processor 501, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0110] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0111] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0112] Those skilled in the art will understand that the features described in the various embodiments and / or claims of this disclosure can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure can be combined and / or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0113] The embodiments of this disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. The scope of this disclosure is defined by the appended claims and their equivalents. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. A software recommendation method for vulnerability remediation, comprising: In response to receiving a software recommendation request from a user, the system obtains input information corresponding to the software recommendation request, the input information including the target vulnerability to be patched in the target system and the first software currently used by the target system. Based on the vulnerability repair information corresponding to each second software, a target second software that matches the target vulnerability to be repaired is determined among the second software. Identify multiple different versions of the second software that match the target second software; Based on the vulnerability information corresponding to each second software, the number of vulnerabilities generated by upgrading from the first software to each version of the second software is determined, and / or, based on the functional description feature words corresponding to each second software, the functional modification value generated by upgrading from the first software to each version of the second software is determined, wherein the functional modification value is the upgrade cost of upgrading from the first software to each version of the second software; as well as Based on the number of vulnerabilities, and / or, the functional modification value recommends at least one target version of the second software.

2. The method according to claim 1, wherein, The step of determining the target second software that matches the target vulnerability to be repaired among the various second software based on the vulnerability repair information corresponding to each second software includes: Determine the identifier number corresponding to the target vulnerability to be repaired; and Based on the mapping relationship between the identifier number and the vulnerability repair information, a target second software that matches the target vulnerability to be repaired is determined among the various second software programs.

3. The method according to claim 1, wherein, The determination of multiple different versions of the second software that match the target second software includes: Based on the preset software version timing link that matches the target second software, multiple different versions of the second software are determined.

4. The method according to claim 1, wherein, The step of determining the functional modification values ​​generated by upgrading the second software from the first software to each version based on the functional description feature words corresponding to each second software includes: Obtain the first functional description feature words corresponding to the first software; Obtain the second functional description feature words corresponding to each second software; and Based on the preset functional modification values ​​corresponding to each second functional description feature word and the first functional description feature word, the functional modification values ​​generated by upgrading the second software from the first software to each version are determined respectively.

5. The method according to claim 1, wherein, Based on the number of vulnerabilities, at least one target version of the second software is recommended, including: The recommended software has fewer vulnerabilities than the first preset value.

6. The method according to claim 1, wherein, Based on the aforementioned functional modification values, at least one target version of the second software is recommended, including: The recommended software is the second software whose feature modification value is less than the second preset value.

7. The method according to claim 1, wherein, Based on the number of vulnerabilities and the functional modification values, at least one target version of the second software is recommended, including: Obtain a second software with fewer vulnerabilities than a first preset value, and determine the first set; Acquire a second software with a functional modification value less than a second preset value, and determine a second set; and The intersection version between the first set and the second set is taken as the target version, and a second software version of the target version is recommended.

8. The method according to claim 1, further comprising: Collect data information, including vulnerability information, software vulnerability patching information, version information of each software, and functional feature descriptions of each version of the software; The vulnerability information includes a CVE number, the vulnerability content corresponding to the CVE number, the vulnerability exploitation conditions corresponding to the CVE number, and the software corresponding to the CVE number; the software's vulnerability remediation information includes the CVE number.

9. The method of claim 8, further comprising one or more of the following data processing methods: The first data processing step is to establish a vulnerability information database based on the vulnerability information. The second data processing involves establishing a software information database based on the software's vulnerability repair information, the version information of each software, and the functional feature descriptions of each version of the software. The third data processing involves: establishing a software version timeline based on the iteration sequence corresponding to the version information of each software; and The fourth data processing step is to associate the vulnerability information database and the software information database based on the CVE number.

10. A software recommendation device for vulnerability remediation, comprising: The acquisition module is used to respond to receiving a software recommendation request from a user and acquire input information corresponding to the software recommendation request. The input information includes the target vulnerability to be patched in the target system and the first software currently used by the target system. The first determining module is used to determine, based on the vulnerability repair information corresponding to each second software, a target second software that matches the target vulnerability to be repaired among the second software; The second determining module is used to determine multiple different versions of the second software that match the target second software; The third determining module is used to determine the number of vulnerabilities generated by upgrading the second software from the first software to each version based on the vulnerability information corresponding to each second software, and / or to determine the functional modification value generated by upgrading the second software from the first software to each version based on the functional description feature words corresponding to each second software, wherein the functional modification value is the upgrade cost of upgrading the second software from the first software to each version of the second software; as well as A recommendation module is used to recommend at least one target version of the second software based on the number of vulnerabilities and / or the feature modification value.

11. An electronic device, comprising: One or more processors; Storage device for storing one or more programs. Wherein, when the one or more programs are executed by the one or more processors, the one or more processors perform the method according to any one of claims 1 to 9.

12. A computer-readable storage medium having stored thereon executable instructions that, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 9.

13. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1 to 9.

Images