Method and apparatus for classifying actions of host security vulnerability patching

Abstract

The application provides a method and device for classifying effective actions of a host security vulnerability patch program, wherein the method comprises the following steps: reading installation information of a patch program and pre-generated configuration information list, and writing the same into an initialization list; extracting professional information, action type information and effective action files from the initialization list; extracting field information of patch effective actions from the effective action files by searching keyword information; and matching the field information with the configuration information list, and classifying the patch effective actions according to the action type information. According to the application, the patch effective actions are classified according to the action type, so that the behavior processing efficiency of a large host security vulnerability patch program can be effectively improved, the difficulty of manual operation can be effectively reduced, and the professional skill requirement for operation and maintenance personnel can be effectively reduced.

Description

Technical Field

[0001] This application relates to the financial field, and in particular to a method and apparatus for classifying the effective actions of a host security vulnerability patch. Background Technology

[0002] In recent years, with the increasing importance of network information security, the data security, operational stability, and business continuity assurance of mainframe operating systems (z / OS), subsystems, and tools that support the core business of the traditional financial industry have become extremely important. Mainframes are characterized by complex system architectures and large volumes of sensitive data. To resolve past issues or avoid problems that have occurred in other user environments, it is necessary to regularly install host security vulnerability patches and categorize and implement their effects. Currently, there is a lack of systematic implementation tools and methods for these operations.

[0003] The existing method for classifying host security vulnerability patches mainly involves host maintenance personnel manually analyzing and categorizing each patch item based on the patch package installation status and outputting a file. Since each full installation of a vulnerability patch package involves several thousand patches, and each patch may have multiple active actions, relying solely on manual classification is costly in terms of both manpower and time. Therefore, tools are needed to implement this functionality. Summary of the Invention

[0004] The purpose of this application is to provide a method and apparatus for classifying the effective actions of host security vulnerability patches. By classifying the effective actions of patches according to the action type, the efficiency of behavior processing of large host security vulnerability patches can be effectively improved, the difficulty of manual operation can be effectively reduced, and the professional skill requirements of operation and maintenance personnel can be effectively reduced.

[0005] This application provides a method for classifying the activation actions of a host security vulnerability patch, the method including:

[0006] Read the patch installation information and the pre-generated configuration information list, and write them into the initialization list;

[0007] Extract professional information, action type information, and effective action files from the initialization list;

[0008] By retrieving keyword information, the field information of the patch activation action is extracted from the activation action file; and

[0009] The field information is matched with the configuration information list, and the patch activation actions are classified according to the action type information.

[0010] In a specific embodiment, the configuration information list is generated according to the following steps:

[0011] The extended system modifier is used to obtain a full list of function modification identifiers from the host, the list of function modification identifiers containing multiple function modification identifier columns;

[0012] Extract product / tool-related information from the function modification identifier as tag information for the function modification identifier; and

[0013] The function modification identifier is mapped one-to-one with the label information to generate the configuration information list, which is then stored.

[0014] In a specific embodiment, the keyword information is generated according to the following steps:

[0015] Login to the environment through the mainframe user management subsystem and verify user identity and management permissions;

[0016] Run the patch program, check the installation package of the patch program, and generate a patch installation list for the patch programs that can be installed normally;

[0017] The patch installation list is checked and confirmed, and the keyword information is extracted; and

[0018] The keyword information is categorized according to the professional information and stored in the designated host file system.

[0019] In a specific embodiment, the number of patch actions taken before classification is counted by retrieving the keyword information;

[0020] The number of patch actions that have been classified and activated is counted; and

[0021] Compare the number of patch actions that took effect before and after the classification.

[0022] In a specific embodiment, counting the number of patch actions that have completed the classification includes:

[0023] Based on the summary information of the patch activation actions that have been categorized, their specific implementation steps, actions, behaviors, etc., are sequentially written into the action list of the patch activation actions; and

[0024] The number of patch activation actions in the action list is counted according to the professional information, thereby obtaining the number of patch activation actions that have been classified.

[0025] In a specific embodiment, the field information is matched with the configuration information list, and the patch activation actions are classified according to the action type information, including:

[0026] The field information is compared and matched one by one with the configuration information list. The patch activation actions and their corresponding temporary program modification identifiers are classified according to professional categories and summarized according to the action type information.

[0027] This application provides a device for classifying the activation actions of host security vulnerability patches, the device comprising:

[0028] The storage module is used to read the installation information of the patch program and the pre-generated configuration information list, and write them into the initialization list;

[0029] An extraction module is used to extract professional information, action type information, and effective action files from the initialization list;

[0030] The action management module is used to extract field information of patch activation actions from the activation action file by retrieving keyword information; and

[0031] The classification module is used to match the field information with the configuration information list and classify the patch activation actions according to the action type information.

[0032] This application also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the above-mentioned method for classifying the effective actions of host security vulnerability patches.

[0033] This application also provides a computer-readable storage medium storing a computer program that executes the above-described method for classifying the effective actions of host security vulnerability patch programs.

[0034] This application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the above-mentioned method for classifying the effective actions of host security vulnerability patch programs. Attached Figure Description

[0035] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0036] Figure 1 This is a flowchart of a method for classifying the effective actions of a host security vulnerability patch according to an embodiment of this application;

[0037] Figure 2This is a flowchart illustrating the generation of a configuration information list according to an embodiment of this application;

[0038] Figure 3 This is a flowchart illustrating the generation of keyword information according to an embodiment of this application;

[0039] Figure 4 This is another flowchart of the method for classifying the effective actions of host security vulnerability patch programs according to embodiments of this application;

[0040] Figure 5 This is a flowchart illustrating the number of patch activation actions that have been classified and statistically completed according to an embodiment of this application.

[0041] Figure 6 This is a schematic diagram of a host security vulnerability patch activation action classification device according to an embodiment of this application;

[0042] Figure 7 This is a schematic diagram of the code management module in an embodiment of this application;

[0043] Figure 8 This is a schematic diagram of the inventory management module in an embodiment of this application;

[0044] Figure 9 This is a schematic diagram of the output module according to an embodiment of this application;

[0045] Figure 10 This is a schematic diagram of the first statistical unit in an embodiment of this application;

[0046] Figure 11 This is a schematic diagram of a computer device according to an embodiment of this application. Detailed Implementation

[0047] Referring to the accompanying drawings, the foregoing and other features of this application will become apparent from the following description. Specific embodiments of this application are specifically disclosed in the description and drawings, illustrating partial implementations in which the principles of this application may be employed. It should be understood that this application is not limited to the described embodiments; rather, it includes all modifications, variations, and equivalents falling within the scope of the appended claims.

[0048] In embodiments of this application, the term "and / or" includes any one and all combinations of one or more of the terms listed in association. The terms "comprising," "including," "having," etc., refer to the presence of the stated features, elements, components, or assemblies, but do not exclude the presence or addition of one or more other features, elements, components, or assemblies.

[0049] In the embodiments of this application, the singular forms "a," "the," etc., may include the plural forms and should be broadly interpreted as "a kind" or "a class" rather than limited to the meaning of "an." Furthermore, the term "the" should be understood to include both the singular and plural forms unless the context explicitly indicates otherwise. Additionally, the term "according to" should be understood as "at least partially based on…," and the term "based on" should be understood as "at least partially based on…," unless the context explicitly indicates otherwise.

[0050] This application provides a method for classifying the activation actions of host security vulnerability patches. Figure 1 This is a flowchart illustrating the classification method for the activation actions of host security vulnerability patches in embodiments of this application. For example... Figure 1 As shown, the method includes:

[0051] Step 11: Read the patch installation information and the pre-generated configuration information list, and write them into the initialization list;

[0052] Step 12: Extract professional information, action type information, and effective action file from the initialization list;

[0053] Step 13: Extract the field information of the patch activation action from the activation action file by searching keyword information; and

[0054] Step 14: Match the field information with the configuration information list and classify the patch activation actions according to the action type.

[0055] As can be seen from the above embodiments, this application classifies patch activation actions according to action type, which can effectively improve the behavior processing efficiency of mainframe security vulnerability patch programs, effectively reduce the difficulty of manual operation, and effectively reduce the professional skill requirements for operation and maintenance personnel.

[0056] Furthermore, this application enables unified installation of security vulnerability patches for mainframes, rapid acquisition of activation actions, and centralized batch activation, greatly reducing downtime.

[0057] In addition, this application can provide a method for extracting the activation actions of mainframe security vulnerability patches, which can automate the acquisition of activation actions.

[0058] Furthermore, the method provided in this application is transparent to users, which can reduce the professional requirements of users for host operation and encapsulate a large number of complex programs into the host tool platform, so users do not need to have extensive host operation and maintenance experience.

[0059] In addition, this application can provide visual management, allowing host users to obtain results simply by submitting jobs and executing tool programs, thus "hiding" complex and tedious host commands and operation processes in the backend.

[0060] Step 11 is illustrated below.

[0061] In some embodiments, such as Figure 2 As shown, the configuration information list is pre-generated according to the following steps:

[0062] Step 21: Use the System Modification Program Extended (SMP / E) to obtain a full list of Function Modification Identifiers (FMIDs) from the host; the FMID list contains multiple FMIDs.

[0063] Step 22: Extract product / tool-related information from the FMID as the tag information for that FMID; and

[0064] Step 23: Match each FMID with its tag information, generate a configuration information list, and store it.

[0065] Step 13 is illustrated below.

[0066] In some embodiments, the field information of the patch activation action includes, but is not limited to, Program Temporary Fix Identifier (PTFID), Function Modification Identifier (FMID), and action type.

[0067] In some embodiments, keyword information includes, but is not limited to, information about successfully installed patches, information about patch actions, and system-level information modified by the patch.

[0068] In some embodiments, such as Figure 3 As shown, the generation of keyword information includes the following steps:

[0069] Step 31: Log in to the environment through the mainframe user management subsystem and verify the user's identity and management permissions, etc.

[0070] Step 32: Run the patch program and check its installation packages. Generate a patch installation list for patches that can be installed normally. For example, you can specify a time range to check the installation packages of each patch within that time range. Alternatively, you can specify a product identification code to check the installation packages of each patch for a specific product.

[0071] Step 33: Check and confirm the generated patch installation list, and extract key information, such as information on successfully installed patches, patch action details, and system-level information modified by the patches; and

[0072] Step 34: Categorize the keyword information according to profession and store it in the specified host file system.

[0073] Step 14 is illustrated below.

[0074] In some embodiments, the field information of the patch activation action is compared and matched one by one with the configuration information list, the patch activation actions and their corresponding Program Temporary FixIdentifier (PTFID) are classified according to profession, and summarized according to the action type.

[0075] Figure 4 This is another flowchart illustrating the classification method for the activation actions of host security vulnerability patches in this application embodiment. For example... Figure 4 As shown, the method also includes:

[0076] Step 15: By retrieving keyword information, count the number of patch actions that took effect before the classification.

[0077] Step 16: Count the number of patch actions that have been categorized and taken effect; and

[0078] Step 17: Compare the number of patch actions that took effect before and after the classification. If they are the same, end the comparison; if they are different, display an error message.

[0079] The following is an exemplary description of step 16. For example... Figure 5 As shown, counting the number of patch actions that have been categorized and taken effect includes the following steps:

[0080] Step 161: Based on the summary information of each patch's activation action after classification, write its specific implementation steps, actions, behaviors, etc., into the action list of each patch's activation action in sequence; and

[0081] Step 162: Count the number of patch actions that have taken effect in the action list of each profession according to their profession, and thus obtain the total number of patch actions that have taken effect after completing the classification.

[0082] The above specific applications are merely examples; other implementation methods will not be described in detail.

[0083] Based on the same inventive concept, this application also provides a device for classifying the effective actions of host security vulnerability patches. Since the principle behind the problem solved by the device for classifying the effective actions of host security vulnerability patches is similar to that of the method for classifying the effective actions of host security vulnerability patches, the implementation of the device for classifying the effective actions of host security vulnerability patches can refer to the implementation of the method for classifying the effective actions of host security vulnerability patches; repeated details will not be elaborated further.

[0084] Figure 6 This is a schematic diagram of a host security vulnerability patch application activation action classification device according to an embodiment of this application. Figure 6 As shown, the host security vulnerability patch program effective action classification device 1 provided in this application embodiment includes a storage module 10, an extraction module 20, an action management module 30, and a classification module 40.

[0085] Storage module 10 is used to read the installation information of the patch and the pre-generated configuration information list, and write them into the initialization list.

[0086] The extraction module 20 is used to extract professional information, action type information, and effective action files from the initialization list.

[0087] The action management module 30 is used to extract field information of patch activation actions from the activation action file by retrieving keyword information.

[0088] The classification module 40 is used to match field information with the configuration information list and classify the patch activation actions according to the action type.

[0089] As can be seen from the above embodiments, this application classifies patch activation actions according to action type, thereby effectively improving the behavior processing efficiency of mainframe security vulnerability patch programs, effectively reducing the difficulty of manual operation, and effectively reducing the professional skill requirements for operation and maintenance personnel.

[0090] Furthermore, this application enables unified installation of security vulnerability patches for mainframes, rapid acquisition of activation actions, and centralized batch activation, greatly reducing downtime.

[0091] In addition, this application can provide a method for extracting the activation actions of mainframe security vulnerability patches, which can automate the acquisition of activation actions.

[0092] Furthermore, the method provided in this application is transparent to users, which can reduce the professional requirements of users for host operation and encapsulate a large number of complex programs into the host tool platform, so users do not need to have extensive host operation and maintenance experience.

[0093] In addition, this application can provide visual management, allowing host users to obtain results simply by submitting jobs and executing tool programs, "hiding" complex and tedious host commands and operation processes in the backend.

[0094] In some embodiments, the host security vulnerability patch activation action classification device 1 further includes a code management module 50. The code management module 50 is used to generate a configuration information list. For example... Figure 7 As shown, the code management module 50 includes an acquisition unit 501, a tag unit 502, and a generation unit 503.

[0095] The acquisition unit 501 is used to acquire a full list of Function Modification Identifiers (FMIDs) from the host using the System Modification Program Extended (SMP / E).

[0096] Tag unit 502 is used to extract product / tool ​​related information from each FMID as the tag information for that FMID; and

[0097] The generation unit 503 is used to map each FMID to its tag information, generate a configuration information list, and store it.

[0098] In some embodiments, the field information of the patch activation action includes, but is not limited to, Program Temporary Fix Identifier (PTFID), Function Modification Identifier (FMID), and action type.

[0099] In some embodiments, keyword information includes, but is not limited to, information about successfully installed patches, information about patch actions, and system-level information modified by the patch.

[0100] In some embodiments, the host security vulnerability patch activation action classification device 1 further includes a manifest management module 60. The manifest management module 60 is used to generate keyword information.

[0101] like Figure 8 As shown, the list management module 60 includes a login unit 601, an inspection unit 602, an extraction unit 603, and a classification unit 604.

[0102] The login unit 601 is used to log in to the environment through the mainframe user management subsystem and to determine the user's identity and management permissions.

[0103] The inspection unit 602 is used to run patch programs, inspect the installation packages of the patch programs, and generate a patch installation list for patches that can be installed normally. For example, a time range can be specified to inspect the installation packages of each patch program within that time range. For example, a product identification code can be specified to inspect the installation packages of each patch program for a specified product.

[0104] The extraction unit 603 is used to check and confirm the patch installation list generated by the collection module 40, and extract keyword information, such as information on successfully installed patches, information on patch activation actions, and system underlying information modified by the patches.

[0105] Classification unit 604 is used to classify keyword information according to profession and store it in the specified host file system.

[0106] The classification module 40 is illustrated below.

[0107] In some embodiments, the classification module 40 compares and matches the field information of the patch activation action with the configuration information list one by one, classifies the patch activation action and its corresponding Program Temporary FixIdentifier (PTFID) according to profession, and summarizes them according to the action type.

[0108] In some embodiments, the host security vulnerability patch activation action classification device 1 further includes an output module 70. The output module 70 is used to compare the number of patch activation actions before and after classification. Figure 9 As shown, the output module 70 includes a first statistical unit 701, a second statistical unit 702, and a comparison unit 703.

[0109] The first statistical unit 701 is used to count the number of patch actions that took effect before classification by retrieving keyword information.

[0110] The second statistics unit 702 is used to count the number of patch actions that have been completed and are now active.

[0111] The comparison unit 703 is used to compare the number of patch actions that took effect before and after the classification. If the two are the same, the comparison ends; if they are not the same, an error message is displayed.

[0112] like Figure 10 As shown, the first statistical unit 701 includes a writing unit 7011 and a third statistical unit 7012.

[0113] The writing unit 7011 is used to write the specific implementation steps, actions, behaviors, and other information of each patch's effective action into the action list of each patch's effective action in sequence, based on the summary information of each patch's effective action after the classification is completed.

[0114] The third statistical unit 7012 is used to count the number of patch activation actions in the action list of each profession according to profession, thereby obtaining the total number of patch activation actions that have been classified.

[0115] This application also provides a computer device. Figure 11 This is a schematic diagram of a computer device according to an embodiment of this application. The computer device 2 includes a memory 21, a processor 22, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the above-described method for classifying the effective actions of host security vulnerability patches.

[0116] This application also provides a computer-readable storage medium storing a computer program that executes the above-described method for classifying the effective actions of host security vulnerability patching programs.

[0117] This application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the above-mentioned method for classifying the effective actions of host security vulnerability patch programs.

[0118] It should be noted that the acquisition, storage, use, and processing of data in the technical solution of this application all comply with the relevant provisions of national laws and regulations.

[0119] The user information in this application embodiment is obtained through legal and compliant means, and the acquisition, storage, use, and processing of user information are authorized and agreed upon by the user.

[0120] While this application provides the method operation steps as described in the embodiments or flowcharts, more or fewer operation steps may be included based on conventional or non-inventive labor. The order of steps listed in the embodiments is merely one possible execution order among many and does not represent the only execution order. In actual device or client product execution, the methods shown in the embodiments or drawings can be executed sequentially or in parallel (e.g., in a parallel processor or multi-threaded processing environment).

[0121] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, apparatus (systems), or computer program products. Therefore, the embodiments of this specification can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0122] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0123] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0124] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0125] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on its differences from other embodiments. In particular, the system embodiments are relatively simple in description because they are fundamentally similar to the method embodiments; relevant parts can be referred to the descriptions in the method embodiments. In this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. The terms "upper," "lower," etc., indicating orientation or positional relationships based on the orientation or positional relationships shown in the accompanying drawings, are only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of this application.

[0126] Unless otherwise expressly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to fixed connections, detachable connections, or integral connections; mechanical connections or electrical connections; direct connections or indirect connections through an intermediate medium; and internal connections between two components. Those skilled in the art can understand the specific meaning of the above terms in this application according to the specific circumstances. It should be noted that, without conflict, the embodiments and features in the embodiments of this application can be combined with each other. This application is not limited to any single aspect, nor to any single embodiment, nor to any combination and / or substitution of these aspects and / or embodiments. Moreover, each aspect and / or embodiment of this application can be used alone or in combination with one or more other aspects and / or embodiments.

[0127] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application, and they should all be covered within the scope of the claims and specification of this application.

Claims

1. A method for classifying the activation actions of host security vulnerability patches, characterized in that, The method includes: Read the patch installation information and the pre-generated configuration information list, and write them into the initialization list; Extract professional information, action type information, and effective action files from the initialization list; By retrieving keyword information, the field information of the patch activation action is extracted from the activation action file; and The field information is compared and matched one by one with the configuration information list. The patch activation actions and their corresponding function modification identifiers are classified according to professional categories and summarized according to the action type information. The field information includes the function modification identifier. The configuration information list is generated according to the following steps: The extended system modifier is used to obtain a full list of function modification identifiers from the host, the list of function modification identifiers containing multiple function modification identifiers; Extract product / tool-related information from the function modification identifier as tag information for the function modification identifier; and The function modification identifier is mapped one-to-one with the label information to generate the configuration information list, which is then stored.

2. The method as described in claim 1, characterized in that, The keyword information is generated according to the following steps: Log in to the environment through the mainframe user management subsystem and verify user identity and management permissions; Run the patch program, check the installation package of the patch program, and generate a patch installation list for the patch programs that can be installed normally; The patch installation list is checked and confirmed, and the keyword information is extracted; as well as The keyword information is categorized according to the professional information and stored in the designated host file system.

3. The method as described in claim 1, characterized in that, The method further includes: By retrieving the keyword information, the number of patch actions taken before classification is counted. The number of patch actions that have been classified and activated is counted; and Compare the number of patch actions that took effect before and after the classification.

4. The method as described in claim 3, characterized in that, The number of patch actions that have been categorized and taken effect is counted, including: Based on the summary information of the patch activation actions that have been categorized, their specific implementation steps, actions, and behavior information are sequentially written into the action list of the patch activation actions; and The number of patch activation actions in the action list is counted according to the professional information, thereby obtaining the number of patch activation actions that have been classified.

5. A device for classifying the activation actions of host security vulnerability patches, characterized in that, The device includes: The storage module is used to read the installation information of the patch program and the pre-generated configuration information list, and write them into the initialization list; An extraction module is used to extract professional information, action type information, and effective action files from the initialization list; The action management module is used to extract field information of patch activation actions from the activation action file by retrieving keyword information; and The classification module is used to compare and match the field information one by one with the configuration information list, classify the patch activation actions and their corresponding function modification identifiers according to profession, and summarize them according to the action type information, wherein the field information includes the function modification identifier; The device further includes a code management module, which is used to generate the configuration information list. The code management module includes: The acquisition unit is used to acquire a full list of function modification identifiers from the host using an extended system modification program, the list of function modification identifiers containing multiple function modification identifiers; A tagging unit is used to extract product / tool-related information from the function modification identifier, as tag information for the function modification identifier; and The generation unit is used to map the function modification identifier to the tag information one by one, generate the configuration information list, and store it.

6. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the host security vulnerability patching action classification method according to any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that performs the classification method for the effective actions of a host security vulnerability patch as described in any one of claims 1 to 4.

8. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the host security vulnerability patching action classification method according to any one of claims 1 to 4.

Images