Security vulnerability processing method and device, computer device and storage medium

Abstract

The application relates to a security vulnerability processing method and device, computer equipment, a storage medium and a computer program product. Related embodiments can be applied to various scenes such as cloud technology, artificial intelligence and intelligent transportation. The method comprises the following steps: obtaining vulnerability information about a security vulnerability from a real-time monitored security intelligence source; determining a severity score of the security vulnerability based on the vulnerability information; when the severity score of the security vulnerability reaches a preset threshold, constructing a retrieval statement comprising a retrieval data source and a vulnerability feature according to the vulnerability information; issuing the retrieval statement to a big data platform, so that the big data platform obtains a retrieval result by performing big data retrieval on security big data corresponding to the retrieval data source according to the vulnerability feature; determining influence information of the security vulnerability based on the retrieval result, and generating a vulnerability analysis report according to the influence information. The method can improve the processing efficiency of the security vulnerability.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus, computer device, storage medium, and computer program product for handling security vulnerabilities. Background Technology

[0002] With the development of computer technology, the importance of network security is constantly increasing. When security vulnerabilities are exposed in the network, how to handle these vulnerabilities to ensure network security is a crucial issue.

[0003] In traditional technologies, when a security vulnerability is discovered, all business security data is manually analyzed and investigated to determine the severity of the vulnerability, the resulting security problems, and the scope of assets affected. The vulnerability is then addressed based on the investigation results. However, the process of manually analyzing and investigating business security data takes a long time, resulting in low efficiency in handling security vulnerabilities. Summary of the Invention

[0004] Therefore, it is necessary to provide a security vulnerability handling method, apparatus, computer equipment, storage medium, and computer program product that can improve processing efficiency in response to the above-mentioned technical problems.

[0005] A method for handling security vulnerabilities, the method comprising:

[0006] Obtain vulnerability intelligence information about security vulnerabilities from real-time monitored security intelligence sources;

[0007] The severity score of the security vulnerability is determined based on the vulnerability intelligence information.

[0008] When the severity score of the security vulnerability reaches a preset threshold, a search statement including the search data source and vulnerability characteristics is constructed based on the vulnerability intelligence information.

[0009] The search query is sent to the big data platform so that the big data platform can perform a big data search from the security big data corresponding to the search data source, based on the vulnerability characteristics, to obtain search results; the security big data is the security data collected and synchronized to the big data platform during the occurrence of the security vulnerability;

[0010] Based on the search results, the impact information of the security vulnerability is determined, and a vulnerability analysis report is generated based on the impact information.

[0011] A security vulnerability handling device, the device comprising:

[0012] The acquisition module is used to obtain vulnerability intelligence information about security vulnerabilities from real-time monitored security intelligence sources;

[0013] The determination module is used to determine the severity score of the security vulnerability based on the vulnerability intelligence information;

[0014] The module is used to construct a search statement that includes the search data source and vulnerability characteristics based on the vulnerability intelligence information when the severity score of the security vulnerability reaches a preset threshold.

[0015] The distribution module is used to distribute the search statement to the big data platform, so that the big data platform can perform big data retrieval from the security big data corresponding to the search data source according to the vulnerability characteristics to obtain the search results; the security big data is the security data collected and synchronized to the big data platform during the occurrence of the security vulnerability;

[0016] The generation module is used to determine the impact information of the security vulnerability based on the search results, and generate a vulnerability analysis report based on the impact information.

[0017] In one embodiment, the acquisition module is further configured to:

[0018] Obtain real-time security intelligence sources from each monitoring server in the distributed monitoring cluster;

[0019] Obtain vulnerability intelligence information about security vulnerabilities obtained by each of the monitoring servers through real-time monitoring of the security intelligence source.

[0020] In one embodiment, the determining module is further configured to:

[0021] The vulnerability intelligence information is formatted to generate formatted vulnerability intelligence information;

[0022] Locate the severity parameter field in the formatted vulnerability intelligence information;

[0023] Based on the severity characteristics corresponding to the severity parameter field, the severity of the security vulnerability is scored to obtain a severity score.

[0024] In one embodiment, the building module is further configured to:

[0025] Locate the vulnerability field in the formatted vulnerability intelligence information;

[0026] The data source for retrieval is determined based on the vulnerability characteristics corresponding to the vulnerability fields;

[0027] Construct a search statement that includes the search data source and the vulnerability characteristics.

[0028] In one embodiment, the apparatus further includes:

[0029] The acquisition module is also used to acquire the access frequency of each of the aforementioned secure big data;

[0030] The selection module is used to select the security big data that has an access frequency greater than a preset frequency value from the various security big data;

[0031] The storage module is used to store the selected secure big data data in the data cache area of ​​the big data platform;

[0032] The delivery module is also used to deliver the search statement to the big data platform, so that the big data platform can perform big data search in the security big data corresponding to the search data source stored in the data cache area according to the vulnerability characteristics, and obtain the search results.

[0033] In one embodiment, the secure big data is data collected from at least two business servers; the apparatus further includes:

[0034] The storage module is also used to store secure big data collected from the same business server in a storage space with contiguous addresses;

[0035] The distribution module is also used to distribute the search statement to the big data platform, so that the big data platform can perform big data search based on the vulnerability characteristics in the security big data stored in the storage space corresponding to the search data source to obtain search results.

[0036] In one embodiment, the apparatus further includes:

[0037] The determining module is also used to determine the time of occurrence of the events that generate each of the security big data;

[0038] The sorting module is used to sort the security big data based on the occurrence time of the event, so as to obtain the sorted security big data.

[0039] The distribution module is also used to distribute the search statement to the big data platform, so that the big data platform can perform big data retrieval from the sorted security big data corresponding to the search data source and obtain the search results based on the vulnerability characteristics.

[0040] In one embodiment, the secure big data is stored through a distributed file system of the big data platform; the distributed file system includes a data operation terminal, a management node, and data nodes; the device further includes:

[0041] The block processing module is used to process each data file in the secure big data through the data operation terminal to obtain file data blocks;

[0042] The sending module is used to send a data storage request to the management node through the data operation terminal, so that the management node instructs the data node to store the file data block in the big data platform based on the data storage request.

[0043] In one embodiment, the method is applied to a security vulnerability processing system; the operational data of the security vulnerability processing system during operation is stored in a main database; the apparatus further includes:

[0044] The synchronization module is used to synchronize the job data from the primary database to the backup database;

[0045] The acquisition module is also used to acquire the job data from the backup database when the primary database fails.

[0046] The synchronization module is also used to synchronize newly generated job data of the security vulnerability handling system to the main database when the main database is restored.

[0047] In one embodiment, the impact information includes the scope of the affected business, the business department identifier, and the responsible person identifier; the determining module is further configured to:

[0048] Based on the search results, the network address of the host that was attacked when the security vulnerability occurred is determined;

[0049] Retrieve the responsible party identifier that matches the network address from the asset database;

[0050] The corresponding business department identifier and the scope of affected business are determined based on the identified responsible person.

[0051] In one embodiment, the search query is sent to the big data platform in response to a search analysis operation triggered on the search page of the terminal; the device further includes:

[0052] A receiving module is used to receive the search results returned by the big data platform;

[0053] The sending module is further configured to send the search results to the terminal, so that the terminal displays the data fields and corresponding data of the search results in different display modes in the result display area of ​​the search page.

[0054] In one embodiment, the apparatus further includes:

[0055] The acquisition module is also used to acquire system logs generated by the security vulnerability handling system during runtime;

[0056] The generation module is also used to generate a log text file based on the system log;

[0057] The storage module is also used to store the system logs on a log server and to store the log text files in a local storage area.

[0058] A computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program performing the following steps:

[0059] Obtain vulnerability intelligence information about security vulnerabilities from real-time monitored security intelligence sources;

[0060] The severity score of the security vulnerability is determined based on the vulnerability intelligence information.

[0061] When the severity score of the security vulnerability reaches a preset threshold, a search statement including the search data source and vulnerability characteristics is constructed based on the vulnerability intelligence information.

[0062] The search query is sent to the big data platform so that the big data platform can perform a big data search from the security big data corresponding to the search data source, based on the vulnerability characteristics, to obtain search results; the security big data is the security data collected and synchronized to the big data platform during the occurrence of the security vulnerability;

[0063] Based on the search results, the impact information of the security vulnerability is determined, and a vulnerability analysis report is generated based on the impact information.

[0064] A computer-readable storage medium having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0065] Obtain vulnerability intelligence information about security vulnerabilities from real-time monitored security intelligence sources;

[0066] The severity score of the security vulnerability is determined based on the vulnerability intelligence information.

[0067] When the severity score of the security vulnerability reaches a preset threshold, a search statement including the search data source and vulnerability characteristics is constructed based on the vulnerability intelligence information.

[0068] The search query is sent to the big data platform so that the big data platform can perform a big data search from the security big data corresponding to the search data source, based on the vulnerability characteristics, to obtain search results; the security big data is the security data collected and synchronized to the big data platform during the occurrence of the security vulnerability;

[0069] Based on the search results, the impact information of the security vulnerability is determined, and a vulnerability analysis report is generated based on the impact information.

[0070] A computer program product includes a computer program that, when executed by a processor, performs the following steps:

[0071] Obtain vulnerability intelligence information about security vulnerabilities from real-time monitored security intelligence sources;

[0072] The severity score of the security vulnerability is determined based on the vulnerability intelligence information.

[0073] When the severity score of the security vulnerability reaches a preset threshold, a search statement including the search data source and vulnerability characteristics is constructed based on the vulnerability intelligence information.

[0074] The search query is sent to the big data platform so that the big data platform can perform a big data search from the security big data corresponding to the search data source, based on the vulnerability characteristics, to obtain search results; the security big data is the security data collected and synchronized to the big data platform during the occurrence of the security vulnerability;

[0075] Based on the search results, the impact information of the security vulnerability is determined, and a vulnerability analysis report is generated based on the impact information.

[0076] The aforementioned security vulnerability handling methods, devices, computer equipment, storage media, and computer program products determine the severity score of security vulnerabilities based on vulnerability intelligence information obtained from real-time monitored security intelligence sources. Because the security intelligence sources are monitored in real-time, the timeliness of the security intelligence is ensured, thereby enabling timely detection of security vulnerabilities and improving the efficiency of vulnerability handling. When the severity score of a security vulnerability reaches a preset threshold, a search statement including the retrieval data source and vulnerability characteristics is constructed based on the vulnerability intelligence information. The search statement is then sent to a big data platform, which retrieves search results from the security big data corresponding to the retrieval data source based on the vulnerability characteristics. Based on the impact information of the security vulnerability determined by the search results, a vulnerability analysis report is generated. Therefore, when a security vulnerability occurs, security big data can be quickly retrieved and search results obtained. Compared to manual analysis and investigation of security data, this shortens the analysis and investigation time and improves the efficiency of security vulnerability handling. Furthermore, the results obtained through the big data platform are more comprehensive, avoiding data omissions, and the resulting vulnerability analysis report is more accurate and comprehensive. Attached Figure Description

[0077] Figure 1 This is a diagram illustrating the application environment of a security vulnerability handling method in one embodiment.

[0078] Figure 2 This is a flowchart illustrating a security vulnerability handling method in one embodiment;

[0079] Figure 3 This is a schematic diagram of a search page in one embodiment;

[0080] Figure 4 This is a schematic diagram of the security intelligence module in another embodiment;

[0081] Figure 5 This is a flowchart illustrating a method for obtaining severity scores in one embodiment;

[0082] Figure 6 This is a schematic diagram of formatted vulnerability intelligence information in one embodiment;

[0083] Figure 7 This is a flowchart illustrating a method for constructing a search statement in one embodiment;

[0084] Figure 8 This is a flowchart illustrating the retrieval method in one embodiment;

[0085] Figure 9 This is a schematic diagram illustrating the interaction process between the terminal and the server in one embodiment;

[0086] Figure 10 This is a flowchart illustrating a method for storing file data blocks in one embodiment;

[0087] Figure 11 This is a schematic diagram of a distributed file system in one embodiment;

[0088] Figure 12 This is a schematic diagram of a security vulnerability handling system in one embodiment;

[0089] Figure 13a This is a schematic diagram illustrating the reading and writing of job data in one embodiment;

[0090] Figure 13b This is a schematic diagram illustrating the read / write operation data when the main database fails in one embodiment;

[0091] Figure 13c This is a schematic diagram illustrating read / write job data after the main database is restored in one embodiment;

[0092] Figure 14 This is a schematic diagram illustrating the storage of log text files and system logs in one embodiment;

[0093] Figure 15 This is a flowchart illustrating a security vulnerability handling method in another embodiment;

[0094] Figure 16 This is a structural block diagram of a security vulnerability handling device in one embodiment;

[0095] Figure 17This is a structural block diagram of a security vulnerability handling device in another embodiment;

[0096] Figure 18 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0097] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0098] The security vulnerability handling method provided in this application can be applied to, for example... Figure 1 The application environment shown includes server 102, big data platform 104, and security intelligence source 106. Server 102 obtains vulnerability intelligence information about security vulnerabilities from the real-time monitored security intelligence source 106 and determines the severity score of the security vulnerabilities based on the vulnerability intelligence information. When the severity score of a security vulnerability reaches a preset threshold, a search statement including the search data source and vulnerability characteristics is constructed based on the vulnerability intelligence information. Server 102 sends the search statement to big data platform 104, so that big data platform 104 can perform big data retrieval from the security big data corresponding to the search data source, based on the vulnerability characteristics, to obtain search results. Security big data refers to security data collected and synchronized to big data platform 104 during the occurrence of a security vulnerability. Server 102 determines the impact information of the security vulnerability based on the search results and generates a vulnerability analysis report based on the impact information.

[0099] Server 102 can be an independent physical server or a server cluster composed of multiple service nodes in the blockchain system. The service nodes form a peer-to-peer (P2P) network. The P2P protocol is an application layer protocol that runs on top of the Transmission Control Protocol (TCP).

[0100] In addition, a server can also be a server cluster consisting of multiple physical servers, and can be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms.

[0101] In one embodiment, such as Figure 2 As shown, a security vulnerability handling method is provided, which is applied to... Figure 1Taking the server in the example, the following steps are included:

[0102] S202: Obtain vulnerability intelligence information about security vulnerabilities from real-time monitored security intelligence sources.

[0103] Security vulnerabilities are flaws in the security design of computer hardware or software. Attackers can exploit these design flaws to gain unauthorized access to a computer system, thereby stealing information or damaging the system. Examples of security vulnerabilities include Office Web Component heap decay vulnerabilities, RTF stack buffer overflow vulnerabilities, and remote memory corruption vulnerabilities. For instance, hackers can exploit browser security vulnerabilities to infiltrate social networking sites accessed through those browsers, obtain the site's security certificates, and then steal users' login names and passwords. Similarly, hackers can exploit computer system security vulnerabilities to implant Trojan viruses, which can then tamper with or delete files within the system.

[0104] Security intelligence refers to announcements and reports related to security vulnerabilities. For example, security intelligence can be research reports on security vulnerabilities published by security researchers or third-party security research institutions, or security announcements issued by device manufacturers regarding the security threats posed by vulnerabilities to their devices. Security intelligence sources are various sources of security information, including websites, public accounts, mini-programs, and application clients. For example, a security intelligence source can be a webpage with the domain name "https: / / www.xxx.com," or a public account named "Security Vulnerability Analysis."

[0105] Among them, vulnerability intelligence information is intelligence information that describes the characteristics of security vulnerabilities, including the CVE (Common Vulnerabilities and Exposures) number of the security vulnerability, the discovery time, the severity score, the vulnerability type, the attack path, etc.

[0106] In one embodiment, the security intelligence source is a webpage that publishes security intelligence. S202 specifically includes: the server using web crawler software to crawl security intelligence about security vulnerabilities from the webpage; performing intelligence analysis on the security intelligence to obtain vulnerability intelligence information about the security vulnerabilities.

[0107] S204 determines the severity score of security vulnerabilities based on vulnerability intelligence information.

[0108] The severity score measures the degree of harm caused by a security vulnerability, and can be an integer, decimal, or percentage. A higher severity score indicates greater potential damage from the vulnerability.

[0109] In one embodiment, the server can determine the severity score of a security vulnerability according to the Common Vulnerability Scoring System (CVSS), and then classify the severity of the vulnerability into levels based on the severity score. For example, the CVSS security vulnerability scoring system classifies the severity of security vulnerabilities into four levels: low, medium, high, and critical. Based on the severity score determined by the CVSS security vulnerability scoring system, which ranges from 1 to 10, a severity score in the range of 0.1–3.9 indicates a "low" severity level; a severity score in the range of 4.0–6.9 indicates a "medium" severity level; a severity score in the range of 7.0–8.9 indicates a "high" severity level; and a severity score in the range of 9.0–10.0 indicates a "critical" severity level.

[0110] S206: When the severity score of a security vulnerability reaches a preset threshold, a search statement is constructed based on vulnerability intelligence information, including the search data source and vulnerability characteristics.

[0111] The retrieval data source indicates the origin of the retrieved data. For example, the retrieval data source could be a WAF (Web Application Firewall) system, a honeypot system, or a DDoS (Distributed Denial of Service) protection device. For instance, when a hacker exploits a security vulnerability to attack the network layer, attack data is generated in the network intrusion prevention system and the network intrusion detection system. Therefore, the attack data retrieved by the server originates from the network intrusion prevention system and the network intrusion detection system; the retrieval data source is thus the network intrusion prevention system and the network intrusion detection system.

[0112] Among these, vulnerability characteristics refer to the features or characteristics of a security vulnerability. For example, when a hacker exploits a security vulnerability to attack a website, if the attack payload of the HTTP request sent to the website carries the string "AAA", then the vulnerability characteristic of that security vulnerability is that the attack payload includes the string "AAA". As another example, when an attack is launched using a certain security vulnerability, if the source IP address of the attack is "123.123.123.123", then the vulnerability characteristic of that security vulnerability is that the attack source IP address is "123.123.123.123".

[0113] The search statement is a statement used to describe the characteristics of the data being retrieved, including the search data source and vulnerability characteristics. The server searches the data from the search data source based on the search statement, retrieving data that matches the vulnerability characteristics; this retrieved data is the search result. For example, the search statement is DATA_INDEX = “WAF” AND “AAA” IN “Attack Payload”. Here, DATA_INDEX = “WAF” indicates that the search is performed on web attack data obtained from a WAF (Web Application Firewall), the WAF system is the search data source, AND is the search condition relation, and “AAA” IN “Attack Payload” means that the characters “AAA” are present in the “Attack Payload” field.

[0114] In one embodiment, after classifying the severity of security vulnerabilities, the server can further determine whether the classified severity meets a preset level. If so, it determines that the security vulnerability needs to be searched, and constructs a search statement including the search data source and vulnerability characteristics based on vulnerability intelligence information. If not, the security vulnerability is ignored.

[0115] In one embodiment, S206 specifically includes: when the severity score of a security vulnerability reaches a preset threshold, obtaining a vulnerability field based on vulnerability intelligence information; determining the retrieval data source based on the vulnerability characteristics corresponding to the vulnerability field; and constructing a retrieval statement that includes the retrieval data source and vulnerability characteristics.

[0116] The vulnerability intelligence information includes intelligence information describing the characteristics of security vulnerabilities. The server can obtain the vulnerability fields of security vulnerability 1 from the vulnerability intelligence information of security vulnerability 1. For example, if the vulnerability intelligence information is "CVE number is CVE-2010-3333, severity score is 5.3, attack payload is cx00432AAA", the vulnerability fields obtained by the server from this vulnerability intelligence information are shown in Table 1.

[0117] Table 1

[0118] Vulnerable fields CVE number Severity score Attack payload Security Vulnerability 1 2010-3333 5.3 cx00432AAA

[0119] Vulnerability fields correspond to vulnerability features. For example, the vulnerability feature corresponding to the attack payload field is "the attack payload includes the character 'AAA'". After the server determines the vulnerability feature, the big data platform determines the source of the retrieved data based on the vulnerability feature corresponding to the vulnerability field; that is, it determines the data source based on the vulnerability feature corresponding to the vulnerability field. The server can construct search clauses based on the data source and vulnerability features respectively; the constructed search clauses are connected with search condition keywords to obtain the search statement. In one embodiment, the search statement includes multiple search clauses, each describing a search condition. Search clauses are connected by search condition relation words. Search conditions are used to represent the conditions that the search results must meet, and at least one search clause's search condition is constructed based on the vulnerability feature. Search condition relation words represent the logical relationship between search conditions, including AND, OR, NOT, etc. For example, the search statement is "search clause 1 AND (search clause 2 OR search clause 3)", where search clauses 1-3 correspond to search conditions 1-3 respectively. The logical relationship between the search conditions described by this search statement is "search condition 1 AND (search condition 2 OR search condition 3)". The data retrieved by the server based on this search statement must satisfy at least one of search condition 2 or search condition 3, and must also satisfy search condition 1.

[0120] S208 sends the search query to the big data platform so that the big data platform can perform big data retrieval based on vulnerability characteristics from the security big data corresponding to the search data source to obtain the search results; security big data is security data collected and synchronized to the big data platform during the occurrence of security vulnerabilities.

[0121] A big data platform is a server cluster capable of storing and computing massive amounts of data, and can employ a distributed storage system for data storage. A distributed storage system disperses data across multiple independent computer devices, which communicate with each other via a network. Security big data can be data collected from business servers used for business processing and synchronized to the big data platform. For example, security big data can include network asset data, threat intelligence data, honeypot data, network layer attack data, key leakage data, web attack data, DDoS attack data, DNS resolution record data, security vulnerability data, reverse shell data, malicious file data, local privilege escalation event data, brute-force attack event data, login event data, business component data, process information data, open port data, network communication data, etc.

[0122] The search results consist of data retrieved by the server from a big data platform that matches vulnerability characteristics. These results may include the attack source IP address and region, country of origin, attack type, city of origin, IP address of the target host, data node, attack payload, and attack time. For example... Figure 3 As shown, the search interface includes a search query edit box, a search trigger control, a results display area, and a drop-down control for selecting a search time range. The server receives the search query entered in the edit box and, in response to the search command triggered by the search trigger control, sends the query to the big data platform. The big data platform then performs a big data search based on vulnerability characteristics within the security big data corresponding to the search data source to obtain search results. The big data platform feeds the search results back to the server, which displays the results in the results display area of ​​the search page. Users can select a time range using the drop-down control on the search page, and the big data platform searches for data generated within that time range. For example, if a user selects a 15-minute time range, the big data platform searches for security big data generated within the last 15 minutes.

[0123] S210: Determine the impact information of security vulnerabilities based on the search results, and generate a vulnerability analysis report based on the impact information.

[0124] The impact information details the consequences of the security vulnerability, including the scope of business affected, the business department identified, and the responsible party identified. The vulnerability analysis report analyzes the security vulnerability, including its severity, the scope of affected business, the responsible party, and remediation methods.

[0125] In the above embodiments, the severity score of a security vulnerability is determined based on vulnerability intelligence information obtained from real-time monitored security intelligence sources. Real-time monitoring of security intelligence sources ensures the timeliness of security intelligence, thereby improving the efficiency of vulnerability handling. When the severity score of a security vulnerability reaches a preset threshold, a search statement including the data source and vulnerability characteristics is constructed based on the vulnerability intelligence information. The search statement is sent to the big data platform, enabling the platform to perform a big data search on the security big data corresponding to the data source, based on the vulnerability characteristics, to obtain search results. Based on the impact information of the security vulnerability determined by the search results, a vulnerability analysis report is generated. When a security vulnerability occurs, security big data can be quickly searched and search results obtained. Compared to manual analysis and investigation of security data, this shortens the analysis and investigation time and improves the efficiency of security vulnerability handling. Furthermore, the results obtained through the big data platform are more comprehensive, avoiding data omissions, and the resulting vulnerability analysis report is more accurate and comprehensive.

[0126] In one embodiment, S202 specifically includes: obtaining security intelligence sources monitored in real time by each monitoring server in the distributed monitoring cluster; and obtaining vulnerability intelligence information about security vulnerabilities obtained by each monitoring server from real-time monitoring of the security intelligence sources.

[0127] The server uses a security intelligence module to monitor security intelligence sources in real time. For example... Figure 4 As shown, the security intelligence module includes a database, a monitoring backend, and a distributed monitoring cluster. The database stores security intelligence collected from security intelligence sources. The distributed monitoring cluster is a cluster of servers used to monitor these sources, consisting of multiple monitoring servers. The monitoring backend manages the distributed monitoring cluster, assigning a corresponding security intelligence source to each monitoring server in the cluster according to the configured monitoring policy. The monitoring servers then monitor their assigned security intelligence sources. The monitoring backend can also set monitoring cycles for the security intelligence sources, and the monitoring servers periodically monitor these sources according to the cycles set by the monitoring backend.

[0128] The monitoring server obtains the addresses of the assigned security intelligence sources and monitors these sources based on those addresses. For example, in a distributed monitoring cluster, monitoring servers A, B, and C are included. Monitoring server A is assigned websites 1-5 as security intelligence sources. Monitoring server A obtains the network addresses of websites 1-5 and monitors them in real time, collecting security intelligence from these websites.

[0129] In the above embodiments, the server obtains security intelligence sources monitored in real time by each monitoring server in the distributed monitoring cluster, and acquires vulnerability intelligence information about security vulnerabilities obtained by each monitoring server through real-time monitoring of the security intelligence sources. Real-time monitoring of the security intelligence sources by each monitoring server ensures the timeliness of the acquired security intelligence, thereby enabling timely detection of security vulnerabilities and improving the efficiency of handling security vulnerabilities.

[0130] In one embodiment, such as Figure 5 As shown, S204 specifically includes:

[0131] S502 formats the vulnerability intelligence information to generate formatted vulnerability intelligence information.

[0132] The formatting process involves recording vulnerability intelligence information in different data fields to obtain formatted vulnerability intelligence information.

[0133] S504, search for the severity parameter field in the formatted vulnerability intelligence information.

[0134] The data fields include severity parameter fields and vulnerability fields. Severity parameter fields are used to score the severity of security vulnerabilities, while vulnerability fields are all fields other than the severity parameter fields. Severity parameter fields may include attack path, attack difficulty, privilege requirements, user interaction, impact scope, confidentiality impact, integrity impact, and availability impact. Vulnerability fields may include internal score, external score, intelligence name, intelligence summary, CVE number, discovery time, security version, affected versions, vulnerability type, PoC status, vulnerability cause, exploitation difficulty, discovery channel, vulnerability details, detection method, remediation suggestions, and reference links. For example, ... Figure 6 As shown, the formatted vulnerability intelligence information includes fields such as internal rating, external rating, CVE number, discovery time, and exploitation difficulty.

[0135] S506 scores the severity of security vulnerabilities based on the severity characteristics corresponding to the severity parameter field, thus obtaining a severity score.

[0136] The severity characteristic, recorded in the severity parameter field, represents the severity level of a security vulnerability. For example, a severity characteristic could be "impact scope covers the entire business scope"; or "attack difficulty is the highest level."

[0137] In one embodiment, S504 specifically includes: the server scoring the vulnerability based on the severity features corresponding to at least two severity parameter fields, obtaining corresponding field scores; and weighting and summing the field scores to obtain a severity score. For example, the server scores the security vulnerability based on the attack path feature corresponding to the attack path field, obtaining a corresponding field score of 6.5; scores the security vulnerability based on the attack difficulty feature corresponding to the attack difficulty field, obtaining a corresponding field score of 5.4; and scores the security vulnerability based on the integrity impact feature corresponding to the integrity impact field, obtaining a corresponding field score of 7.1; the server uses weights of 0.3, 0.4, and 0.3 to weight and sum the three field scores of 6.5, 5.4, and 7.1 to obtain a severity score of 6.24.

[0138] S508: When the severity score of a security vulnerability reaches a preset threshold, a search statement is constructed based on vulnerability intelligence information, including the search data source and vulnerability characteristics.

[0139] S510 sends the search query to the big data platform so that the big data platform can perform big data retrieval based on vulnerability characteristics from the security big data corresponding to the search data source to obtain the search results; security big data is security data collected and synchronized to the big data platform during the occurrence of security vulnerabilities.

[0140] S512 determines the impact information of security vulnerabilities based on the search results and generates a vulnerability analysis report based on the impact information.

[0141] The specific steps in S508-S512 above can be found by referring to Figure 2 Example.

[0142] In the above embodiments, the vulnerability intelligence information is formatted to generate formatted vulnerability intelligence information. Based on the severity feature corresponding to the severity parameter field obtained from the formatted vulnerability intelligence information, the severity of the security vulnerability is scored to obtain a severity score. This allows the server to process only security vulnerabilities with a severity score reaching a preset threshold, that is, the server only processes security vulnerabilities with higher severity, thus improving the efficiency of security vulnerability processing.

[0143] In one embodiment, such as Figure 7 As shown, S206 specifically includes:

[0144] S702 formats the vulnerability intelligence information to generate formatted vulnerability intelligence information.

[0145] S704: Search for vulnerability fields in formatted vulnerability intelligence information.

[0146] The formatted vulnerability intelligence information includes vulnerability fields and severity parameter fields. The server retrieves the vulnerability fields from the formatted vulnerability intelligence information based on the field names. For example, the server searches for the vulnerability type field and the discovery time field from the formatted vulnerability intelligence information.

[0147] S706 determines the retrieval data source based on the vulnerability characteristics corresponding to the vulnerability field.

[0148] Big data platforms retrieve data matching vulnerability features from security big data. Because these platforms contain massive amounts of data, searching through all of it would be extremely time-consuming. Therefore, the server determines the retrieval data source based on the vulnerability features corresponding to vulnerability fields. This allows the big data platform to search within this defined data source, narrowing the search scope and improving efficiency.

[0149] In one embodiment, S704 specifically includes: searching for a target field corresponding to the vulnerability characteristics in the data fields of the security big data; and determining the retrieval data source based on the target field.

[0150] Security big data in the big data platform is stored in the form of data fields. For example, network asset data in security big data includes fields such as hostname, IP address, asset ID, operating system type, creation time, expiration time, business module, and physical location. The server searches for target fields corresponding to vulnerability characteristics within the data fields of the security big data. For example, if a security vulnerability's characteristic is that the attack payload contains the characters "AAA", then the target field corresponding to this vulnerability characteristic is the attack payload field. Since the attack payload field corresponds to the data field of network layer attack data generated in the WAF system, the data source determined by the server for retrieval is the WAF system.

[0151] S708, construct a search statement that includes the search data source and vulnerability characteristics.

[0152] The server constructs search statements based on the data source and vulnerability characteristics, and then searches for security big data that matches the vulnerability characteristics from the data source based on the constructed search statements.

[0153] In one embodiment, the search statement includes at least two search clauses. S706 specifically includes: constructing search clauses based on the search data source and vulnerability characteristics respectively, and then connecting the constructed search clauses with search condition relation words to obtain the search statement. For example, the search clause constructed by the server based on the search data source is DATA_INDEX = “WAF”, indicating that the search is performed on WEB attack data from WAF, and “WEB attack data from WAF” is the search condition that the search result must satisfy; the search clause constructed based on the vulnerability characteristics is “AAA” IN “Attack Payload”, indicating that the attack payload field includes the character “AAA”, and “the attack payload field includes the character “AAA”” is the search condition that the search result must satisfy. Then, the server connects the two constructed search clauses with the search condition relation word “AND” to obtain the search statement “DATA_INDEX = 'WAF'AND 'AAA' IN 'Attack Payload'”.

[0154] S710 sends the search query to the big data platform, enabling the big data platform to perform big data retrieval based on vulnerability characteristics from the security big data corresponding to the search data source to obtain search results; security big data is security data collected and synchronized to the big data platform during the occurrence of security vulnerabilities.

[0155] S712 determines the impact information of security vulnerabilities based on the search results and generates a vulnerability analysis report based on the impact information.

[0156] The specific steps in S702, S710-S712 above can be found by referring to Figure 5 and Figure 2 Example.

[0157] In the above embodiments, vulnerability fields are searched within formatted vulnerability intelligence information. Based on the vulnerability characteristics corresponding to these fields, the retrieval data source is determined, and a retrieval statement including the retrieval data source and vulnerability characteristics is constructed. This allows the big data platform to perform big data retrieval based on the retrieval statement and obtain retrieval results. Compared to manual analysis and investigation of security data, this shortens the analysis and investigation time and improves the efficiency of security vulnerability processing. Furthermore, the results obtained through retrieval statements are more comprehensive, avoiding data omissions and making the resulting vulnerability analysis report more accurate and complete.

[0158] In one embodiment, such as Figure 8 As shown, S208 includes S802-S806 before it, and S208 specifically includes S808.

[0159] S802, obtain the access frequency of various security big data.

[0160] The access frequency refers to the frequency at which secure big data is read. For example, the access frequency could be 30 times per minute, 200 times per hour, etc.

[0161] In one embodiment, S802 specifically includes: the big data platform setting a counter for each secure big data; incrementing the corresponding counter by one after each access to the secure big data; and the server obtaining the access frequency of each secure big data based on the value recorded by the counter corresponding to each secure big data.

[0162] In one embodiment, security big data can be network asset data, threat intelligence data, honeypot data, network layer attack data, key leakage data, web attack data, DDoS attack data, DNS resolution record data, security vulnerability data, reverse shell data, malicious file data, local privilege escalation event data, brute-force attack event data, login event data, business component data, process information data, port open data, network communication data, etc.

[0163] Network asset data comprises several key data categories, including: network asset data (data related to computer assets, including hostname, IP address, asset ID, operating system type, creation time, expiration time, business module, physical location, machine owner, and remarks), threat intelligence data (data on the IP address and related domains of attack sources in attack events), honeypot data (data from attack events captured by honeypot systems), target IP address, target port, source IP address, source port, honeypot node, username, password, protocol type, and additional event information), and network layer attack data (data generated from network intrusion prevention systems or network intrusion detection systems based on network layer attack behavior). Key vulnerability data includes attack time, source IP address, source port, target IP address, destination port, risk stage, number of attacks, transmitted data, protocol type, attack type, and attack payload. Key leakage data records key leakage events occurring on the internet; key fields include leakage time, affiliated department, responsible person, leakage address, leaked key, key validity, leakage duration, and number of accesses. Web attack data originates from WAF devices and reflects events attacking web systems; key fields include attack time, source IP address, source port, target IP address, destination port, attack domain, protocol type, HTTP method, attack address, attack message, attack type, and attack payload. DDoS attack data originates from anti-DDoS devices and describes denial-of-service attacks from external attackers; key fields include attack start time, attack end time, attack type, list of attack source IPs, attack packet capture, and maximum peak attack traffic. DNS resolution record data contains data related to DNS (Domain Name System) request events. Key fields include request time, target IP address, target port, request domain name, request URL, source IP address, process name, process ID, process path, process MD5 hash, and number of requests. Security vulnerability data contains system vulnerability information for business systems. Key fields include vulnerability occurrence time, server IP address, vulnerability name, vulnerability ID, vulnerability status, vulnerability category, vulnerability path, severity level, vulnerability details, and vulnerability remediation recommendations.Reverse shell data records information about reverse shell actions that occurred after a server was attacked. Key fields include attack time, target IP address, target port, domain name, URL, source IP address, process name, process ID, process path, process MD5 hash, number of processes, and number of reverse shell attempts. Malicious file data records information about malicious files appearing on the business server. Key fields include malicious file creation time, file path, file MD5 hash, file size, file content, malicious characteristics, black / white status, file creator, and file visitor. Local privilege escalation event data records malicious privilege escalation events that occurred on the business server. Key fields include extraction event time, event IP address, process name, process ID, process path, process MD5 hash, process command, and username. Brute-force attack event data records brute-force password attacks on the business server. Key fields include password attack time, target IP address, target port, source IP address, source port, protocol type, username, password, and number of attempts. Login event data records events of logging into the business server. Key fields include login time, target IP address, target port, source IP address, source port, protocol type, username, password, and login command. Business component data contains information about service components used during the business system's development. When a new vulnerability is discovered, this information can be used to quickly determine if the business is affected, allowing for timely remediation. Key fields include component server IP address, component name, component path, process name, process ID, process path, process MD5, process command, component version, component website homepage, component start time, usage status, and component owner. Process information data records information about currently running processes on the business server. Key fields include server IP address, process start time, process end time, process name, process ID, process path, process MD5, process command, and number of processes. Port open data records information about ports open to the outside world from the business server. Key fields include server IP address, process name, process ID, process path, process MD5, process command, open port, and open service type. Network communication data records network layer interaction information of business systems. The main fields include interaction time, data interaction direction, source IP address, source port, destination IP address, destination port, protocol type, data packet size, and original binary content of the message.

[0164] S804: Select the security big data that is accessed more frequently than a preset frequency value from among the various security big data.

[0165] The higher the access frequency of each security big data point, the more times it is read per unit of time. The server selects security big data points whose access frequency exceeds a preset frequency value, meaning it selects security big data points whose read count per unit of time exceeds the preset frequency value. The preset frequency value measures the access frequency of the security big data. The server can configure the preset frequency value according to actual needs. For example, the preset frequency value can be configured to 30 times / second.

[0166] S806 stores the selected secure big data in the data cache area of ​​the big data platform.

[0167] The data cache is a storage space in memory used for temporary data storage. Big data platforms can create a data cache in memory to store secure big data accessed more frequently than a preset frequency.

[0168] In one embodiment, S806 specifically includes: the server determining a data cache area in the storage space of the big data platform; and storing the secure big data corresponding to access frequencies greater than a preset frequency value in the data cache area. For example, the server selects a storage space with addresses XXXX-XXXX as the data cache area in the storage space of the big data platform, and then stores the secure big data corresponding to access frequencies greater than the preset frequency value in the data cache area.

[0169] S808 sends the search query to the big data platform, enabling the big data platform to perform a big data search in the secure big data stored in the data cache corresponding to the search data source based on the vulnerability characteristics, and obtain the search results.

[0170] After the server sends the search query to the big data platform, the platform, based on the vulnerability characteristics, first performs a big data search in the secure big data stored in the data cache corresponding to the search data source. If the server does not find a search result matching the query in the data cache, it continues searching in the remaining storage space of the big data platform.

[0171] In one embodiment, S808 specifically includes: in response to a search analysis operation triggered on the search page, the terminal sends a search statement to the server; the server distributes the search statement obtained from the terminal to the big data platform, so that the big data platform performs a big data search in the secure big data corresponding to the search data source stored in the data cache area based on vulnerability characteristics, and obtains the search results. The terminal can be a smartphone, tablet, laptop, desktop computer, smartwatch, smart home appliance, in-vehicle terminal (such as a smart transportation terminal), etc., but is not limited to these. Specifically, such as... Figure 9As shown, the interface of terminal 902 displays a search page, which includes a search statement editing box, a search time selection drop-down menu, a search analysis operation trigger control, and a results display area. In response to a search analysis operation triggered on the search page, the terminal sends the search statement entered in the search statement editing box to the server. The server then distributes the search statement obtained from the terminal to the big data platform, enabling the big data platform to perform a big data search based on vulnerability characteristics within the secure big data stored in the data cache corresponding to the search data source, and obtain the search results.

[0172] In the above embodiments, frequently accessed secure big data is stored in a specific data cache area within the big data platform. When the big data platform receives a search query, it prioritizes searching the data cache area, improving search efficiency and enabling faster retrieval of search results.

[0173] In one embodiment, the security big data is data collected from at least two business servers; before S208, it also includes: storing the security big data collected from the same business server in a storage space with contiguous addresses; S208 further includes: sending the search statement to the big data platform so that the big data platform can perform big data search based on vulnerability characteristics in the security big data stored in the storage space corresponding to the search data source to obtain search results.

[0174] A business server is a computer device used to provide business services. Multiple business servers can be deployed on the same local area network (LAN) and connected to each other via a network. For example, 20 business servers are connected to the LAN of company A, and the big data platform collects security big data from these 20 business servers.

[0175] The server stores the secure big data collected from the same business server in a contiguous storage space within the big data platform. For example, the server stores the secure big data collected from business server A in a contiguous storage space with addresses 0X00000000-0X10000000; and stores the secure big data collected from business server B in a contiguous storage space with addresses 0X10000000-0XF0000000.

[0176] The server sends the search query to the big data platform. The big data platform first searches for the secure big data from business service A in a contiguous storage space, then searches for the secure big data from business server B in another contiguous storage space, and so on, until the search operation is completed and the search results are obtained.

[0177] In the above embodiments, since the security big data collected from the same business server is stored in the contiguous storage space of the big data platform, when the server searches for security big data collected from the same business server, it can search in the contiguous storage space, which reduces the disk addressing time and improves the search speed.

[0178] In one embodiment, before S208, the method further includes: determining the event occurrence time corresponding to the event that generated each security big data; sorting each security big data based on the event occurrence time to obtain sorted security big data; S208 specifically includes: sending the search statement to the big data platform so that the big data platform can perform big data search based on vulnerability characteristics from the sorted security big data corresponding to the search data source to obtain search results.

[0179] When an event occurs, the server retrieves and records the event time, then sorts the security big data according to the order of event occurrence, resulting in sorted security big data, which is then synchronized to the big data platform. Alternatively, the server can synchronize security big data and its corresponding event time to the big data platform, where the platform sorts the security big data based on the event occurrence time.

[0180] Servers can sort large amounts of secure data using either comparison-based or non-comparison-based sorting algorithms. Examples of comparison-based sorting algorithms include exchange sort, insertion sort, selection sort, and merge sort. Examples of non-comparison-based sorting algorithms include counting sort, bucket sort, and radix sort.

[0181] The server sends the search query to the big data platform, which then performs a big data search based on vulnerability characteristics from the sorted security big data corresponding to the search data source to obtain the search results.

[0182] In the above embodiments, the server sorts the security big data based on the time of event occurrence, enabling the big data platform to retrieve the security big data in the order of event occurrence, thereby shortening the retrieval time and improving the retrieval speed.

[0183] In one embodiment, secure big data is stored through a distributed file system of a big data platform; the distributed file system includes a data operation terminal, a management node, and data nodes; such as Figure 10 As shown, S208 also includes the following:

[0184] S1002, through the data operation terminal, divides each data file in the secure big data into blocks to obtain file data blocks.

[0185] A Distributed File System (DFS) is a file system that distributes large amounts of data across data nodes connected by a computer network. Examples of DFS include NFS (Network File System), OSS (Object Storage Service), and HDFS (Hadoop Distributed File System). HDFS runs on general-purpose hardware and uses a multi-replica mechanism to divide data files into blocks, distributing these blocks across numerous local file systems on various servers. HDFS automatically saves data as multiple replicas; if one replica fails, other replicas can be used for automatic data recovery, improving fault tolerance. Furthermore, HDFS can handle data at the GB, TB, and even PB levels, and supports millions of files, employing streaming data access to ensure data consistency.

[0186] The data operation client (Client) is the management client of the distributed file system, used to perform block processing on data files within the distributed file system. The data operation client can also manage the entire HDFS through commands, such as starting or stopping the entire distributed file system. The management node and data nodes are software running on the distributed file system. The management node handles data operation requests from the data operation client and manages file block location information (metadata). The data nodes execute read and write commands issued by the management node, performing read and write operations on data according to these commands.

[0187] S1004, send a data storage request to the management node through the data operation terminal, so that the management node instructs the data node to store file data blocks in the big data platform based on the data storage request.

[0188] like Figure 11As shown, the data operation terminal interacts with the management node, sending data storage requests. Upon receiving the data storage request, the management node issues commands to the data nodes, instructing them to store file data blocks. After storing the file data blocks according to the management node's commands, the data nodes send the file data block location information back to the management node, allowing the management node to relay this location information back to the data operation terminal. The distributed file system can also back up file data blocks, distributing the backup copies across different data nodes. If data is lost due to a failure on one data node, the data in the failed data node can be recovered using data stored on other data nodes.

[0189] S1006 sends the search statement to the big data platform so that the big data platform can perform big data search from the file data block corresponding to the search data source and obtain the search results based on the vulnerability characteristics.

[0190] S1008: Based on the search results, determine the impact information of the security vulnerability and generate a vulnerability analysis report based on the impact information.

[0191] The specific steps in S1006-1008 above can be found by referring to Figure 2 Example.

[0192] In the above embodiments, the server performs block processing on the data file through the data operation terminal, thereby distributing the obtained file data blocks and backup copies of the file data blocks to different data nodes, which improves the reliability of the file system.

[0193] In one embodiment, the impact information includes the scope of the affected business, the business department identifier, and the responsible person identifier; S210 specifically includes: determining the network address of the host attacked when the security vulnerability occurred based on the search results; retrieving the responsible person identifier that matches the network address from the asset database; and determining the corresponding business department identifier and the scope of the affected business based on the responsible person identifier.

[0194] The scope of business affected by a security vulnerability includes: **Business Scope:** This refers to the business operations impacted by the occurrence of a security vulnerability. When a vulnerability occurs, hackers exploit it to attack the computer system, affecting the business services provided by that system. For example, the affected business scope could include goods exchange, instant messaging, and information dissemination services. **Business Department Identifier:** This identifies the business department affected by the vulnerability and can consist of characters, numbers, and letters. For example, it could be Department A, or it could be 12345. **Responsible Person Identifier:** This identifies the person responsible for the affected business department and can also consist of characters, numbers, and letters. For example, it could be the number A-123, or it could be the name of the person in charge, such as Li XX. **Asset Database:** This database stores information about various assets. Asset information includes the asset's serial number, the identifier of the responsible person, and the purchase date.

[0195] Specifically, such as Figure 3 As shown, the search results include the network address of the target host, "10.10.10.10". Based on this network address, the server can query the asset database for the responsible person's identifier of the target host. Then, based on the business department to which the responsible person belongs, the server can determine the business department identifier and the scope of the affected business based on the business department to which the responsible person belongs.

[0196] In the above embodiments, the server determines the responsible person identifier, business department identifier, and affected business scope based on the search results, and generates a vulnerability analysis report based on the determined responsible person identifier, business department identifier, and affected business scope. This allows for targeted handling of security vulnerabilities based on the vulnerability analysis report, thereby improving the efficiency of security vulnerability handling.

[0197] In one embodiment, the search statement is sent to the big data platform in response to a search analysis operation triggered on the search page of the terminal; before S210, the method further includes: receiving the search results returned by the big data platform; sending the search results to the terminal so that the terminal displays the data fields and corresponding data in the search results in different display modes in the result display area of ​​the search page.

[0198] The retrieval and analysis operation is used to trigger the big data platform to perform retrieval actions on secure big data. This can be triggered by clicking a control, swiping the screen, or using voice commands. For example... Figure 9As shown, when a user triggers a search and analysis operation on the search page of terminal 902, terminal 902 uploads the search statement to server 904, and server 904 sends the search statement to big data platform 906. When big data platform 906 obtains the search results, it sends the results back to server 904. Server 904 then sends the search results to terminal 902, and terminal 902 displays the data fields and corresponding data from the search results in different display modes in the results display area of ​​the search page.

[0199] Different display methods can include displaying data fields and their corresponding data in different colors, such as displaying data fields in red and displaying the data corresponding to data fields in blue; or displaying data fields and their corresponding data in different fonts, such as displaying data fields in SimSun font and displaying the data corresponding to data fields in Heiti font.

[0200] In the above embodiments, the server responds to the search analysis operation triggered on the search page of the terminal by sending the search statement to the big data platform, then receives the search results returned by the big data platform, and sends the search results to the terminal, so that the terminal can display the search results in an intuitive and concise manner.

[0201] In one embodiment, the security vulnerability handling method is applied to a security vulnerability handling system; the job data of the security vulnerability handling system during operation is stored in a main database; before S210, the method further includes: synchronizing job data from the main database to a backup database; when the main database fails, retrieving job data from the backup database; and when the main database recovers, synchronizing newly generated job data of the security vulnerability handling system during operation to the main database.

[0202] The security vulnerability handling system is a system that includes a security intelligence module, an operation module, a feature retrieval module, a security big data module, a storage module, and a log module. Specifically, the security vulnerability handling system can be as follows: Figure 12 The system shown.

[0203] The security intelligence module monitors security intelligence sources to obtain security intelligence. It mainly includes a database, a monitoring backend, and a distributed monitoring cluster. The database stores the security intelligence collected from the sources. The distributed monitoring cluster is a cluster of servers used to monitor the security intelligence sources, consisting of multiple monitoring servers. The monitoring backend manages the distributed monitoring cluster, assigning a corresponding security intelligence source to each monitoring server in the cluster according to the configured monitoring policy. The monitoring servers then monitor the assigned security intelligence sources.

[0204] The operation module is used to perform big data retrieval operations. It analyzes security intelligence to obtain vulnerability information, then extracts vulnerability features based on this information, and constructs a search statement that includes the search data source and vulnerability features. The operation module then sends the search statement to the feature retrieval module, which searches the security big data of the big data platform according to the search statement.

[0205] The feature-based retrieval module stores frequently accessed data in a dedicated data cache. When a retrieval request containing a search query is received, it prioritizes searching the data cache. If no results are found in the cache, it searches other data storage areas within the big data platform, thus enabling rapid result retrieval. The big data platform can store security big data related to the same business server in contiguous storage spaces, reducing disk access time and improving retrieval speed. The feature-based retrieval module sorts security big data generated on the same business server according to the time of the events that generated it, allowing for retrieval of the sorted security big data and further improving retrieval speed.

[0206] The secure big data module uses a distributed file system to store secure big data, which can be an HDFS system. HDFS manages the secure big data management directory and files according to a tree data structure and provides data operations such as creation, reading, and writing.

[0207] The storage module stores all job data generated during the operation of the security vulnerability processing system. This job data includes the system's configuration information, such as database IP address, port, and database type. Figure 13a As shown, the storage module includes a primary database and a backup database. The primary database is used for reading and writing job data, and it synchronizes the stored job data to the backup database to back up the job data. Figure 13b As shown, when the primary database fails, the primary database interrupts the synchronization of job data to the backup database, and enables the backup database to perform read and write operations on the job data so that the server can retrieve the job data from the backup database. Figure 13c As shown, when the primary database recovers, the backup database continues to read and write job data, and synchronizes newly generated job data during the operation of the security vulnerability handling system to the primary database.

[0208] The logging module is used to record system logs for the security vulnerability handling system. When the security vulnerability handling system malfunctions, the server can use the operational information recorded in the system logs to troubleshoot the problem or optimize and improve the security vulnerability handling system.

[0209] In the above embodiments, the server first stores the job data of the security vulnerability handling system during operation in the primary database, and then synchronizes the job data from the primary database to a backup database for backup. This ensures that job data can be retrieved from the backup database in the event of a failure in the primary database, guaranteeing that the stored job data will not be lost due to a primary database failure and improving the security of the job data.

[0210] In one embodiment, the security vulnerability handling method is applied to a security vulnerability handling system; prior to S210, the method further includes: the server acquiring system logs generated by the security vulnerability handling system during runtime; generating a log text file based on the system logs; storing the system logs on a log server; and storing the log text file in a local storage area.

[0211] System logs record the type, content, and timing of interactions between the system and users. Based on their content, system logs can be categorized into configuration logs, monitoring logs, alarm logs, and runtime logs. Configuration logs record user actions such as adding, deleting, and modifying system configurations. Monitoring logs record the operational behavior of various modules within the system. Alarm logs record alarm actions triggered by alarm modules within the system. Runtime logs record various behaviors of the system in the background during operation. System logs are categorized into four levels: ERROR, WARN, INFO, and DEBUG. ERROR-level system logs record serious faults that cause the system to malfunction. System administrators need to pay close attention to ERROR-level system logs to promptly resolve system faults and ensure normal system operation. WARN-level system logs record abnormal behaviors that occur during system operation. When abnormal behaviors recorded in WARN-level system logs occur, it indicates a certain risk during system operation and a potential operational failure. INFO-level system logs record critical information generated during system operation. DEBUG-level system logs record various information required for system debugging, including runtime parameters and runtime return information.

[0212] like Figure 14 As shown, the server generates a log text file based on the system log, then stores the system log on the log server and the log text file in the local storage area.

[0213] In the above embodiments, the server records and stores the system logs generated during system operation, so that when a system failure occurs, the cause of the failure can be investigated based on the system logs to ensure the safe and stable operation of the system.

[0214] In one embodiment, such as Figure 15As shown, when a security vulnerability is exposed, the security vulnerability handling method includes the following steps:

[0215] S1502 obtains vulnerability intelligence information about security vulnerabilities from real-time monitored security intelligence sources.

[0216] Security intelligence sources can be various websites, public accounts, mini-programs, application clients, etc. Servers can configure monitoring policies through the monitoring backend. These policies are used to set the security intelligence sources monitored by the monitoring servers in the monitoring cluster. For example, the monitoring policy might be that monitoring server A monitors websites 1-3 and mini-program x-1, while monitoring server B monitors websites 4-6 and application client app-2. The servers store the vulnerability intelligence information obtained from the monitoring in a database and then analyze the stored vulnerability intelligence information. The servers monitor security intelligence sources to obtain security intelligence, which includes various announcements and reports released through these sources. Security intelligence includes vulnerability intelligence information, which describes the characteristics of security vulnerabilities, including the CVE number, discovery time, severity score, vulnerability type, and attack path. For example, security intelligence might be a research report on a security vulnerability published by a security researcher on a website, which includes vulnerability intelligence information about the vulnerability.

[0217] S1504 formats the vulnerability intelligence information to generate formatted vulnerability intelligence information.

[0218] Formatting involves recording vulnerability intelligence information across different data fields to obtain formatted vulnerability intelligence. Data fields include severity parameter fields and vulnerability fields. Severity parameter fields are used to score the severity of security vulnerabilities, while vulnerability fields are all fields other than the severity parameter fields. Severity parameter fields may include attack path, attack difficulty, privilege requirements, user interaction, impact scope, confidentiality impact, integrity impact, and availability impact. Vulnerability fields may include internal score, external score, intelligence name, intelligence summary, CVE number, discovery time, security version, affected versions, vulnerability type, PoC status, vulnerability cause, exploitation difficulty, discovery channel, vulnerability details, detection method, remediation suggestions, and reference links.

[0219] S1506, the severity score is obtained based on the severity feature corresponding to the severity parameter field in the formatted vulnerability intelligence information.

[0220] The server scores the severity of a security vulnerability based on the severity features corresponding to the severity parameter fields, resulting in a severity score. Alternatively, the server can score the vulnerability based on the severity features corresponding to at least two severity parameter fields separately, obtaining corresponding field scores, and then weightedly sum these field scores to obtain the final severity score.

[0221] The server can determine the severity level corresponding to the severity score obtained according to the CVSS scoring system. The CVSS security vulnerability scoring system classifies the severity of security vulnerabilities into four levels: low, medium, high, and critical. Based on the severity score determined by the CVSS security vulnerability scoring system, which ranges from 1 to 10, a severity score in the range of 0.1–3.9 indicates a "low" severity level; a severity score in the range of 4.0–6.9 indicates a "medium" severity level; a severity score in the range of 7.0–8.9 indicates a "high" severity level; and a severity score in the range of 9.0–10.0 indicates a "critical" severity level.

[0222] S1508 determines whether a security vulnerability is a critical vulnerability based on its severity score. If the vulnerability is critical, S1510 is executed; otherwise, the vulnerability is ignored.

[0223] In one embodiment, when the severity score reaches a preset threshold, the server determines that the security vulnerability is a critical vulnerability; when the severity score does not reach the preset threshold, the server determines that the security vulnerability is not a critical vulnerability.

[0224] In one embodiment, the server determines the severity level corresponding to the severity score according to the CVSS scoring system. When the severity level reaches a preset level, the server determines the security vulnerability as a critical vulnerability; when the severity score does not reach a preset threshold, the server determines the security vulnerability is not a critical vulnerability.

[0225] S1510: Determine whether a security vulnerability can be searched based on the formatted vulnerability intelligence information. If the security vulnerability can be searched, execute S1512; otherwise, ignore the security vulnerability.

[0226] The server determines whether a security vulnerability can be retrieved based on the formatted data fields. Specifically, if the formatted data fields contain fields that correspond to data fields stored in the big data platform, the security vulnerability is determined to be searchable; otherwise, if the formatted data fields do not contain fields that correspond to data fields stored in the big data platform, the security vulnerability is determined to be unsearchable. For example, if the formatted data fields include an attack payload field, and the data fields stored in the big data platform also include an attack payload field, then the security vulnerability is determined to be searchable.

[0227] S1512, construct a search statement that includes the search data source and vulnerability characteristics based on the vulnerability intelligence information.

[0228] The data source is used to indicate the origin of the retrieved data. The vulnerability characteristic refers to the features or characteristics of a security vulnerability. For example, when a hacker exploits a security vulnerability to attack a website, if the attack payload of the HTTP request sent to the website carries the string "AAA", then the vulnerability characteristic of that security vulnerability is that the attack payload includes the string "AAA". As another example, when an attack is launched using a certain security vulnerability, if the source IP address of the attack is "123.123.123.123", then the vulnerability characteristic of that security vulnerability is that the attack source IP address is "123.123.123.123". The search statement is a statement used to describe the characteristics of the retrieved data, including the data source and vulnerability characteristics.

[0229] A search statement can include multiple search clauses, each defining a search condition. Search clauses are connected by search condition relational terms. Search conditions represent the criteria that the search results must meet. For example, if a vulnerability feature is that the attack payload contains the characters "AAA", the search clause constructed based on this vulnerability feature would be "'AAA'IN 'Attack Payload'", and the search condition determined by this clause is that the attack payload contains the characters "AAA".

[0230] In one embodiment, the server obtains the vulnerability field from the vulnerability intelligence information; determines the retrieval data source based on the vulnerability characteristics corresponding to the vulnerability field; constructs retrieval clauses based on the retrieval data source and the vulnerability characteristics respectively; and connects the constructed retrieval clauses with retrieval condition keywords to obtain the retrieval statement.

[0231] In one embodiment, the terminal displays a search page, then retrieves the search query entered in the search query edit box, which includes the search data source and vulnerability characteristics, and then sends the search query to the server. The server retrieves the search query from the terminal.

[0232] S1514, in response to a search analysis operation triggered on the search page of the terminal, sends the search statement to the big data platform.

[0233] Search and analysis operations can be triggered by search and analysis trigger controls on the search page, such as buttons, screen swipes, or voice commands. When a user triggers a search and analysis operation on the terminal's search page, the terminal generates a search instruction instructing the big data platform to begin the search and sends the instruction to the server. The server responds to the search instruction by sending the search query to the big data platform.

[0234] S1516, the big data platform searches for security big data based on the search query and sends the search results back to the server.

[0235] The big data platform searches its stored data from various data sources based on search queries, retrieving data that matches vulnerability characteristics. This retrieved data is the search result. The platform can store frequently accessed data in a dedicated data cache. When a search request containing a query is received, the platform prioritizes searching the cache. If no results are found there, it searches other data storage areas within the platform, enabling rapid result retrieval. The platform can store security big data related to the same business server in contiguous storage, reducing disk access time and improving search speed. Furthermore, the platform can sort security big data generated on the same business server according to the time of the events that generated it, allowing for searching of the sorted data and further enhancing search speed.

[0236] Big data platforms can utilize distributed file systems (DFS) to store secure big data. HDFS manages the directories and files of secure big data using a tree-like data structure and provides data operations such as creation, reading, and writing. A DFS can include a data operation client, management nodes, and data nodes. The data operation client is the management client of the DFS, used to process data files in blocks and manage the entire DFS via commands, such as starting or stopping it. Management nodes and data nodes are software running on the DFS. Management nodes handle data operation requests from the data operation client and manage file block location information (metadata). Data nodes execute read and write commands issued by the management nodes, performing read and write operations on data according to these commands.

[0237] In one embodiment, the server stores data collected from business servers within a local area network (LAN) on a big data platform. This results in the big data platform storing massive amounts of secure big data collected from the business servers. The LAN could be, for example, an enterprise's intranet, and the business servers could be the enterprise's servers used for business processing. The business servers store various data generated during business processing, as well as data generated from accessing the business servers. The business servers periodically synchronize the stored data to the big data platform, and this synchronized data becomes the secure big data within the big data platform.

[0238] S1518, the server returns the search results to the terminal so that the terminal can display the search results on the search page.

[0239] After retrieving search results, the big data platform sends them back to the server. The server receives the search results from the big data platform and sends them to the terminal, allowing the terminal to display the data fields and corresponding data from the search results in different ways in the results display area of ​​the search page. These different display methods could include using different colors or different fonts to display the data fields and corresponding data.

[0240] S1520: Based on the search results, determine the impact information of the security vulnerability and generate a vulnerability analysis report based on the impact information.

[0241] The impact information includes the scope of affected business operations, the business department identifier, and the responsible person identifier. Search results may include the target host IP address, the region of the attack source, the attack type, the attack category, the attack payload, the attack stage, HTTP logs, the attack time, the risk level, and the protocol type. Based on the search results, the server determines the network address of the host attacked when the security vulnerability occurred; it retrieves the responsible person identifier matching the network address from the asset database; and based on the responsible person identifier, it determines the corresponding business department identifier and the scope of affected business operations. After obtaining the impact information, including the scope of affected business operations, the business department identifier, and the responsible person identifier, the server generates a vulnerability analysis report, which also includes the scope of affected business operations, the business department identifier, and the responsible person identifier.

[0242] It should be understood that, although Figure 2 , 5 The steps in flowcharts 7-8, 10, and 15 are shown sequentially as indicated by the arrows; however, these steps are not necessarily executed in the exact order indicated by the arrows. Unless explicitly stated herein, there is no strict order requirement for the execution of these steps, and they can be performed in other orders. Furthermore, Figure 2 , 5At least some of the steps in 7-8, 10, and 15 may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but may be executed at different times. The execution order of these steps or stages is not necessarily sequential, but may be executed in turn or alternately with other steps or at least some of the steps or stages in other steps.

[0243] In one embodiment, such as Figure 16 As shown, a security vulnerability handling device is provided. This device can be a software module, a hardware module, or a combination of both integrated into a computer device. Specifically, the device includes: an acquisition module 1602, a determination module 1604, a construction module 1606, a distribution module 1608, and a generation module 1610, wherein:

[0244] The acquisition module 1602 is used to acquire vulnerability intelligence information about security vulnerabilities from real-time monitored security intelligence sources;

[0245] Module 1604 is used to determine the severity score of security vulnerabilities based on vulnerability intelligence information;

[0246] Module 1506 is used to construct a search statement that includes the search data source and vulnerability characteristics based on vulnerability intelligence information when the severity score of a security vulnerability reaches a preset threshold.

[0247] The distribution module 1608 is used to distribute the search query to the big data platform, so that the big data platform can perform big data retrieval from the security big data corresponding to the search data source based on the vulnerability characteristics to obtain the search results; the security big data is the security data collected and synchronized to the big data platform during the occurrence of security vulnerabilities;

[0248] The generation module 1610 is used to determine the impact information of security vulnerabilities based on the search results, and generate a vulnerability analysis report based on the impact information.

[0249] In the above embodiments, the severity score of a security vulnerability is determined based on vulnerability intelligence information obtained from real-time monitored security intelligence sources. Real-time monitoring of security intelligence sources ensures the timeliness of security intelligence, enabling timely detection of security vulnerabilities and improving the efficiency of vulnerability handling. When the severity score of a security vulnerability reaches a preset threshold, a search statement including the retrieval data source and vulnerability characteristics is constructed based on the vulnerability intelligence information. The search statement is sent to the big data platform, allowing the platform to perform a big data search on the security big data corresponding to the retrieval data source, based on the vulnerability characteristics, to obtain search results. Based on the impact information of the security vulnerability determined by the search results, a vulnerability analysis report is generated. When a security vulnerability occurs, security big data can be quickly searched and search results obtained. Compared to manual analysis and investigation of security data, this shortens the analysis and investigation time and improves the efficiency of security vulnerability handling. Furthermore, the results obtained through the big data platform are more comprehensive, avoiding data omissions, and the resulting vulnerability analysis report is more accurate and comprehensive.

[0250] In one embodiment, the acquisition module 1602 is further configured to:

[0251] Obtain real-time security intelligence sources from each monitoring server in the distributed monitoring cluster;

[0252] Obtain vulnerability intelligence information about security vulnerabilities obtained from real-time monitoring of security intelligence sources by various monitoring servers.

[0253] In one embodiment, the determining module 1604 is further configured to:

[0254] The vulnerability intelligence information is formatted to generate formatted vulnerability intelligence information;

[0255] Locate the severity parameter field in the formatted vulnerability intelligence information;

[0256] Based on the severity characteristics corresponding to the severity parameter field, the severity of security vulnerabilities is scored to obtain a severity score.

[0257] In one embodiment, the building module 1606 is further configured to:

[0258] Look for vulnerability fields in the formatted vulnerability intelligence information;

[0259] Determine the retrieval data source based on the vulnerability characteristics corresponding to the vulnerability fields;

[0260] Construct search statements that include the search data source and vulnerability characteristics.

[0261] In one embodiment, such as Figure 17 As shown, the device also includes:

[0262] The acquisition module 1602 is also used to acquire the access frequency of various security big data.

[0263] The selection module 1612 is used to select the security big data that has an access frequency greater than a preset frequency value from various security big data.

[0264] Storage module 1614 is used to store the selected secure big data in the data cache area of ​​the big data platform;

[0265] The distribution module 1608 is also used to distribute the search statement to the big data platform, so that the big data platform can perform big data search in the secure big data corresponding to the search data source stored in the data cache area according to the vulnerability characteristics, and obtain the search results.

[0266] In one embodiment, secure big data is data collected from at least two business servers; the apparatus further includes:

[0267] Storage module 1614 is also used to store secure big data collected from the same business server in a storage space with contiguous addresses;

[0268] The distribution module 1608 is also used to distribute the search query to the big data platform, so that the big data platform can perform big data search based on vulnerability characteristics in the security big data stored in the storage space corresponding to the search data source to obtain the search results.

[0269] In one embodiment, the apparatus further includes:

[0270] The determination module 1604 is also used to determine the time of occurrence of the events that generate each security big data.

[0271] The sorting module 1616 is used to sort the security big data based on the event occurrence time to obtain the sorted security big data.

[0272] The distribution module 1608 is also used to distribute the search query to the big data platform, so that the big data platform can perform big data retrieval based on vulnerability characteristics from the sorted security big data corresponding to the search data source to obtain the search results.

[0273] In one embodiment, secure big data is stored through a distributed file system of a big data platform; the distributed file system includes a data operation terminal, a management node, and data nodes; the device further includes:

[0274] The block processing module 1618 is used to process each data file in the secure big data through the data operation terminal to obtain file data blocks;

[0275] The sending module 1620 is used to send a data storage request to the management node through the data operation terminal, so that the management node instructs the data node to store file data blocks in the big data platform based on the data storage request.

[0276] In one embodiment, the method is applied to a security vulnerability handling system; the job data of the security vulnerability handling system during operation is stored in a main database; the apparatus further includes:

[0277] Synchronization module 1622 is used to synchronize job data from the primary database to the backup database;

[0278] The acquisition module 1602 is also used to acquire job data from the backup database when the primary database fails.

[0279] The synchronization module 1622 is also used to synchronize newly generated job data of the security vulnerability handling system to the main database when the main database is restored.

[0280] In one embodiment, the impact information includes the scope of the affected business, the business department identifier, and the responsible person identifier; the determining module 1604 is further configured to:

[0281] The search results determine the network address of the host that was attacked when the security vulnerability occurred;

[0282] Retrieve the responsible party's identifier from the asset database that matches the network address;

[0283] The corresponding business department identifier and the scope of affected business are determined based on the identifier of the person in charge.

[0284] In one embodiment, the search query is sent to the big data platform in response to a search analysis operation triggered on the search page of the terminal; the apparatus further includes:

[0285] The receiving module 1624 is used to receive the search results returned by the big data platform;

[0286] The sending module 1620 is also used to send the search results to the terminal so that the terminal can display the data fields and corresponding data in the search results in different display modes in the result display area of ​​the search page.

[0287] In one embodiment, the apparatus further includes:

[0288] The acquisition module 1602 is also used to acquire system logs generated by the security vulnerability handling system during runtime;

[0289] The generation module 1610 is also used to generate log text files based on system logs;

[0290] Storage module 1614 is also used to store system logs on a log server and to store log text files in local storage.

[0291] Specific limitations regarding the security vulnerability handling device can be found in the limitations of the security vulnerability handling method described above, and will not be repeated here. Each module in the aforementioned security vulnerability handling device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0292] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 18 As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores security vulnerability handling data. The network interface communicates with external terminals via a network connection. When the computer program is executed by the processor, it implements a security vulnerability handling method.

[0293] Those skilled in the art will understand that Figure 18 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0294] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0295] In one embodiment, a computer-readable storage medium is provided storing a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0296] In one embodiment, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and executes the computer instructions, causing the computer device to perform the steps in the above method embodiments.

[0297] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical storage, etc. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0298] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0299] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A method for handling security vulnerabilities, characterized in that, The method includes: Obtain vulnerability intelligence information about security vulnerabilities from real-time monitored security intelligence sources; The severity score of the security vulnerability is determined based on the vulnerability intelligence information. When the severity score of the security vulnerability reaches a preset threshold, search clauses are constructed based on the search data source and vulnerability characteristics determined by the vulnerability intelligence information; the search clauses are connected with search condition keywords to obtain a search statement; wherein, each search clause is used to describe a search condition; The search query is sent to the big data platform so that the big data platform can perform a big data search from the security big data corresponding to the search data source, based on the vulnerability characteristics, to obtain search results; the security big data is the security data collected and synchronized to the big data platform during the occurrence of the security vulnerability; Based on the search results, the network address of the host that was attacked when the security vulnerability occurred is determined; Retrieve the responsible party identifier that matches the network address from the asset database; The corresponding business department identifier and the scope of affected business are determined based on the responsible person identifier, and a vulnerability analysis report is generated based on the scope of affected business, the business department identifier, and the responsible person identifier.

2. The method according to claim 1, characterized in that, The determination of the severity score of the security vulnerability based on the vulnerability intelligence information includes: The vulnerability intelligence information is formatted to generate formatted vulnerability intelligence information; Locate the severity parameter field in the formatted vulnerability intelligence information; Based on the severity characteristics corresponding to the severity parameter field, the severity of the security vulnerability is scored to obtain a severity score.

3. The method according to claim 2, characterized in that, The step of constructing search clauses based on the vulnerability intelligence information includes retrieving data sources and vulnerability features, and includes: Locate the vulnerability field in the formatted vulnerability intelligence information; The data source for retrieval is determined based on the vulnerability characteristics corresponding to the vulnerability fields; Construct a search clause that includes the search data source and the vulnerability features.

4. The method according to claim 1, characterized in that, The method further includes: Obtain the access frequency of each of the aforementioned secure big data; Among the various security big data, select the security big data corresponding to the access frequency being greater than a preset frequency value; The selected secure big data is stored in the data cache area of ​​the big data platform; The step of sending the search query to the big data platform, so that the big data platform can perform a big data search from the security big data corresponding to the search data source based on the vulnerability characteristics to obtain search results, includes: The search query is sent to the big data platform so that the big data platform can perform a big data search in the security big data corresponding to the search data source stored in the data cache area based on the vulnerability characteristics, and obtain the search results.

5. The method according to claim 1, characterized in that, The security big data is data collected from at least two business servers; the method further includes: The security big data collected from the same business server is stored in a storage space with contiguous addresses; The step of sending the search query to the big data platform, so that the big data platform can perform a big data search from the security big data corresponding to the search data source based on the vulnerability characteristics to obtain search results, includes: The search query is sent to the big data platform so that the big data platform can perform a big data search based on the vulnerability characteristics in the security big data stored in the storage space corresponding to the search data source to obtain search results.

6. The method according to claim 1, characterized in that, The method further includes: Determine the time of occurrence of the events that generate each of the aforementioned security big data; The security big data are sorted based on the time of occurrence of the event to obtain the sorted security big data. The step of sending the search query to the big data platform, so that the big data platform can perform a big data search from the security big data corresponding to the search data source based on the vulnerability characteristics to obtain search results, includes: The search query is sent to the big data platform so that the big data platform can perform a big data search on the sorted security big data corresponding to the search data source to obtain the search results based on the vulnerability characteristics.

7. The method according to any one of claims 1 to 6, characterized in that, The secure big data is stored through the distributed file system of the big data platform; the distributed file system includes a data operation terminal, a management node, and data nodes; the method further includes: The data operation terminal is used to divide each data file in the secure big data into blocks to obtain file data blocks. The data operation terminal sends a data storage request to the management node, so that the management node, based on the data storage request, instructs the data node to store the file data block in the big data platform.

8. The method according to claim 1, characterized in that, The vulnerability intelligence information obtained from real-time monitored security intelligence sources includes: Obtain real-time security intelligence sources from each monitoring server in the distributed monitoring cluster; Obtain vulnerability intelligence information about security vulnerabilities obtained by each of the monitoring servers through real-time monitoring of the security intelligence source.

9. The method according to any one of claims 1 to 6, characterized in that, The method is applied to a security vulnerability handling system; the operational data of the security vulnerability handling system during operation is stored in a main database; the method further includes: Synchronize the operation data from the primary database to the backup database; When the primary database fails, the job data is retrieved from the backup database; When the main database is restored, the newly generated job data during the operation of the security vulnerability handling system will be synchronized to the main database.

10. The method according to any one of claims 1 to 6, characterized in that, The search query is sent to the big data platform in response to a search analysis operation triggered on the search page of the terminal; Before determining the impact information of the security vulnerability based on the search results, the method further includes: Receive the search results returned by the big data platform; The search results are sent to the terminal so that the terminal displays the data fields and corresponding data from the search results in different display modes in the result display area of ​​the search page.

11. The method according to any one of claims 1 to 6, characterized in that, The method is applied to a security vulnerability handling system; the method further includes: Obtain the system logs generated by the security vulnerability handling system during runtime; Generate a log text file based on the system log; The system logs are stored on a log server, and the log text files are stored in local storage.

12. A security vulnerability handling device, characterized in that, The device includes: The acquisition module is used to obtain vulnerability intelligence information about security vulnerabilities from real-time monitored security intelligence sources; The determination module is used to determine the severity score of the security vulnerability based on the vulnerability intelligence information; The module is used to construct search clauses based on the search data source and vulnerability characteristics determined by the vulnerability intelligence information when the severity score of the security vulnerability reaches a preset threshold; and to connect the search clauses with search condition keywords to obtain a search statement; wherein each search clause is used to describe a search condition. The distribution module is used to distribute the search statement to the big data platform, so that the big data platform can perform big data retrieval from the security big data corresponding to the search data source according to the vulnerability characteristics to obtain the search results; the security big data is the security data collected and synchronized to the big data platform during the occurrence of the security vulnerability; The generation module is used to determine the network address of the host attacked when the security vulnerability occurred based on the search results; retrieve the responsible person identifier matching the network address from the asset database; determine the corresponding business department identifier and the scope of affected business based on the responsible person identifier; and generate a vulnerability analysis report based on the scope of affected business, the business department identifier, and the responsible person identifier.

13. The apparatus according to claim 12, characterized in that, The determining module is also used for: The vulnerability intelligence information is formatted to generate formatted vulnerability intelligence information; Locate the severity parameter field in the formatted vulnerability intelligence information; Based on the severity characteristics corresponding to the severity parameter field, the severity of the security vulnerability is scored to obtain a severity score.

14. The apparatus according to claim 13, characterized in that, The building module is also used for: Locate the vulnerability field in the formatted vulnerability intelligence information; The data source for retrieval is determined based on the vulnerability characteristics corresponding to the vulnerability fields; Construct a search clause that includes the search data source and the vulnerability features.

15. The apparatus according to claim 12, characterized in that, The acquisition module is also used for: Obtain the access frequency of each of the aforementioned secure big data; The device further includes: The selection module is used to select the security big data that has an access frequency greater than a preset frequency value from the various security big data; The storage module is used to store the selected secure big data data in the data cache area of ​​the big data platform; The distribution module is also used for: The search query is sent to the big data platform so that the big data platform can perform a big data search in the security big data corresponding to the search data source stored in the data cache area based on the vulnerability characteristics, and obtain the search results.

16. The apparatus according to claim 12, characterized in that, The security big data is data collected from at least two business servers; the device also includes: A storage module is used to store secure big data collected from the same business server in a storage space with contiguous addresses; The distribution module is also used for: The search query is sent to the big data platform so that the big data platform can perform a big data search based on the vulnerability characteristics in the security big data stored in the storage space corresponding to the search data source to obtain search results.

17. The apparatus according to claim 12, characterized in that, The determining module is also used for: Determine the time of occurrence of the events that generate each of the aforementioned security big data; The device further includes: a sorting module, used to sort each of the security big data based on the occurrence time of the event, to obtain the sorted security big data; The distribution module is also used for: The search query is sent to the big data platform so that the big data platform can perform a big data search on the sorted security big data corresponding to the search data source to obtain the search results based on the vulnerability characteristics.

18. The apparatus according to any one of claims 12 to 17, characterized in that, The secure big data is stored through the distributed file system of the big data platform; the distributed file system includes a data operation terminal, a management node, and data nodes; the device also includes: The block processing module is used to process each data file in the secure big data through the data operation terminal to obtain file data blocks; The device further includes a sending module, configured to send a data storage request to the management node through the data operation terminal, so that the management node, based on the data storage request, instructs the data node to store the file data block in the big data platform.

19. The apparatus according to claim 12, characterized in that, The acquisition module is also used for: Obtain real-time security intelligence sources from each monitoring server in the distributed monitoring cluster; Obtain vulnerability intelligence information about security vulnerabilities obtained by each of the monitoring servers through real-time monitoring of the security intelligence source.

20. The apparatus according to any one of claims 12 to 17, characterized in that, The device is applied to a security vulnerability processing system; the operational data of the security vulnerability processing system during operation is stored in a main database; the device further includes: The synchronization module is used to synchronize the job data from the primary database to the backup database; The acquisition module is also used to: acquire the job data from the backup database when the primary database fails; The synchronization module is also used to: synchronize newly generated job data of the security vulnerability handling system during operation to the main database when the main database is restored.

21. The apparatus according to any one of claims 12 to 17, characterized in that, The search query is sent to the big data platform in response to a search analysis operation triggered on the search page of the terminal; Before determining the impact information of the security vulnerability based on the search results, the device further includes: A receiving module is used to receive the search results returned by the big data platform; The device further includes a sending module, used to send the search results to the terminal, so that the terminal displays the data fields and corresponding data of the search results in different display modes in the result display area of ​​the search page.

22. The apparatus according to any one of claims 12 to 14, characterized in that, The device is used in a security vulnerability handling system; The acquisition module is also used to: acquire system logs generated by the security vulnerability handling system during runtime; The generation module is also used to: generate a log text file based on the system log; The device further includes: The storage module is used to store the system logs on a log server and the log text files in a local storage area.

23. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 11.

24. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 11.

25. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 11.

Images