A software vulnerability assessment method, system, and medium based on contrastive learning
By training a feature extraction model through comparative learning, the problem of low efficiency in software vulnerability assessment is solved, and efficient and accurate vulnerability assessment is achieved, which is particularly suitable for vulnerability assessment in power systems.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- STATE GRID HUNAN ELECTRIC POWER COMPANY LIMITED
- Filing Date
- 2023-03-10
- Publication Date
- 2026-05-26
AI Technical Summary
In existing technologies, software vulnerability assessment is inefficient and easily affected by subjective factors, making it difficult to achieve efficient and accurate vulnerability assessment.
A feature extraction model is trained using a contrastive learning approach. By comparing positive and negative samples of vulnerability attributes, the model learns to extract feature vectors of vulnerability attributes. An encoder, decoder, contrastive discriminator, and distribution discriminator are then used for feature extraction and classification.
It improves the accuracy and efficiency of software vulnerability assessment, is applicable to vulnerability assessment in power systems, and can determine the priority of vulnerability handling.
Smart Images
Figure CN116204889B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of software vulnerability assessment technology, specifically to a software vulnerability assessment method, system, and medium based on comparative learning. Background Technology
[0002] With the development of information technology, new business applications are gradually becoming the main carriers of power systems. However, the existence of software vulnerabilities poses serious security risks to these applications, hindering their development. Vulnerability assessment is a crucial component of vulnerability mitigation, determining its priority.
[0003] Vulnerability assessment is the reasonable evaluation and classification of the harm caused by vulnerabilities, and it is an important component of vulnerability management. CVSS (Common Vulnerability Scoring System) is currently the mainstream foundation for vulnerability assessment. CVSS 3.1 assigns severity scores to vulnerabilities through basic assessment, lifecycle assessment, and environmental assessment, and introduces relevant assessment factors and scopes, allowing assessors to prioritize responses and resources based on threats. Currently, the number of vulnerabilities is constantly increasing, and traditional manual vulnerability assessment methods are inefficient and susceptible to subjective influences. Vulnerability assessment is gradually moving towards automation. Therefore, how to achieve efficient and accurate vulnerability assessment has become a key technical problem that urgently needs to be solved in software vulnerability assessment. Summary of the Invention
[0004] The technical problem to be solved by the present invention is to provide a software vulnerability assessment method, system and medium based on contrastive learning, which addresses the above-mentioned problems of the prior art. The present invention aims to improve the accuracy of software vulnerability assessment by using contrastive learning in the feature extraction process to obtain more effective high-dimensional vulnerability feature representations.
[0005] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows:
[0006] A software vulnerability assessment method based on contrastive learning includes:
[0007] S101, the vulnerability attributes of the vulnerability to be evaluated are used to extract feature vectors using a trained feature extraction model. The feature extraction model is trained using a contrastive learning-based training method. The contrastive learning training method includes learning to extract feature vectors of vulnerability attributes by comparing positive and negative samples of vulnerability attributes.
[0008] S102, use a vulnerability classifier to classify the feature vectors to obtain the classification results of the vulnerabilities to be evaluated.
[0009] Optionally, the feature extraction model in step S101 includes an encoder, a decoder, a contrastive discriminator, and a distribution discriminator. The encoder is used to encode the normalized vulnerability attributes of the input to obtain a feature vector. The decoder is used to decode the feature vector output by the encoder to obtain a reconstructed vulnerability attribute. The contrastive discriminator is used to distinguish between positive and negative samples in a binary classification model through contrastive learning. The normalized vulnerability attribute and its corresponding feature vector constitute a positive sample, and the normalized vulnerability attribute and its random high-dimensional representation constitute a negative sample. The distribution discriminator is used to approximate the feature vector to a specified distribution P to be fitted in a binary classification model. The positive sample is the feature vector, and the negative sample is the distribution vector of the specified distribution P to be fitted.
[0010] Optionally, before step S101, a feature extraction model is trained using a contrastive learning-based training method:
[0011] S201, Construct a sample training set for the vulnerability samples, specifying the distribution P to be fitted to the feature vectors;
[0012] S202, using the error between the vulnerability attribute and its reconstructed vulnerability attribute as the loss function, the encoder, decoder, contrast discriminator and distribution discriminator in the feature extraction model are trained using the sample training set until a preset termination condition is reached. The preset termination condition means that the error between the vulnerability attribute and the reconstructed vulnerability attribute is less than a set value or the number of training times is equal to a preset number of times threshold.
[0013] Optionally, the sample training set for constructing the vulnerability samples in step S201 includes:
[0014] S301, Collect vulnerability attributes from vulnerability samples;
[0015] S302, perform data filtering on vulnerability samples, including deleting vulnerability samples with incomplete vulnerability attribute data, replacing incorrect vulnerability attributes in vulnerability samples with the mean or specified value, and re-collecting at least one of the following: vulnerability attributes of vulnerability samples.
[0016] S303, performing data augmentation on vulnerability samples, including at least one of the following: randomly discarding vulnerability samples with more than a set value of vulnerability attribute data, merging vulnerability samples with less than a set value of vulnerability attribute data into new vulnerability samples, and performing data interpolation based on existing vulnerability samples to generate new vulnerability samples.
[0017] S304 normalizes the vulnerability attributes of all vulnerability samples to obtain normalized vulnerability attributes.
[0018] Optionally, in step S202, when training the encoder, decoder, contrastive discriminator, and distribution discriminator in the feature extraction model using the sample training set, the loss function used to train the encoder and decoder is:
[0019] ,
[0020] In the above formula, Let G represent the loss function used to train the encoder G and decoder Y. The normalized vulnerability attributes, To reconstruct the vulnerability attributes.
[0021] Optionally, in step S202, when training the encoder, decoder, contrastive discriminator, and distribution discriminator in the feature extraction model using the sample training set, the loss function used to train the contrastive discriminator is:
[0022] ,
[0023] In the above formula, The loss function used to train the contrast discriminator. This is a Softplus function operation. To compare the discriminator's judgment results for positive samples, To compare the discriminator's judgment results for negative samples, To compare the discriminator's performance on negative samples The judgment result, For positive sample feature attributes, These are negative sample feature attributes.
[0024] Optionally, in step S202, when training the encoder, decoder, contrastive discriminator, and distribution discriminator in the feature extraction model using the sample training set, the loss function used to train the distribution discriminator is:
[0025] ,
[0026] In the above formula, The loss function used to train the distribution discriminator. For a vector that is to be fitted to a high-dimensional feature distribution, To generate a high-dimensional feature distribution to be fitted, Indicates from Obtaining the expectation from the distribution , It is a logarithmic function. For the distribution discriminator pair The confidence score is obtained by judging the vector. Normalized vulnerability attributes The distribution is represented as follows: Indicates from Obtaining expectations , For the distribution discriminator to the feature vector The confidence score, For the encoder to normalize the vulnerability attributes The feature vector obtained through encoding.
[0027] Optionally, in step S202, when training the encoder, decoder, contrast discriminator, and distribution discriminator in the feature extraction model using the sample training set, it also includes training the vulnerability classifier simultaneously, and the loss function used to train the vulnerability classifier is:
[0028] ,
[0029] In the above formula, The loss function used to train the vulnerability classifier. For cross-entropy, For feature vectors, For the vulnerability classifier, the feature vector The classification results The tags are for vulnerability samples.
[0030] Furthermore, this invention also provides a software vulnerability assessment system based on contrastive learning, comprising:
[0031] The feature extraction program unit is used to extract feature vectors from the vulnerability attributes of the vulnerability to be evaluated using a trained feature extraction model. The feature extraction model is trained using a contrastive learning-based training method, which includes learning to extract feature vectors of vulnerability attributes by comparing positive and negative samples of vulnerability attributes.
[0032] The vulnerability classification program unit is used to classify feature vectors using a vulnerability classifier to obtain the classification results of the vulnerabilities to be evaluated.
[0033] Optionally, the feature extraction model of the feature extraction program unit includes an encoder, a decoder, a contrastive discriminator, and a distribution discriminator. The encoder is used to encode the normalized vulnerability attributes of the input to obtain a feature vector. The decoder is used to decode the feature vector output by the encoder to obtain a reconstructed vulnerability attribute. The contrastive discriminator is used to distinguish between positive and negative samples in a binary classification model through contrastive learning. The normalized vulnerability attribute and its corresponding feature vector constitute a positive sample, and the normalized vulnerability attribute and its random high-dimensional representation constitute a negative sample. The distribution discriminator is used to approximate the feature vector to a specified distribution P to be fitted in a binary classification model. The positive sample is the feature vector, and the negative sample is the distribution vector of the specified distribution P to be fitted.
[0034] Optionally, it also includes a training unit for training the feature extraction model using a contrastive learning-based training method:
[0035] The sample construction unit is used to construct a sample training set for vulnerability samples, specifying the distribution P to be fitted to the feature vectors;
[0036] The training iteration program unit is used to train the encoder, decoder, contrast discriminator, and distribution discriminator in the feature extraction model using the error between the vulnerability attribute and the reconstructed vulnerability attribute as the loss function, and until a preset termination condition is reached. The preset termination condition means that the error between the vulnerability attribute and the reconstructed vulnerability attribute is less than a set value or the number of training times is equal to a preset number threshold.
[0037] Optionally, the sample construction program unit constructs a sample training set for vulnerability samples by: collecting vulnerability attributes of vulnerability samples; filtering data for vulnerability samples, including deleting vulnerability samples with incomplete vulnerability attribute data, replacing erroneous vulnerability attributes in vulnerability samples with the mean or a specified value, and re-collecting at least one of the vulnerability attributes of vulnerability samples; performing data augmentation on vulnerability samples, including randomly discarding vulnerability samples with more than a set value of vulnerability attribute data, merging vulnerability samples with less than a set value of vulnerability attribute data into new vulnerability samples, and performing data interpolation based on existing vulnerability samples to generate new vulnerability samples; and normalizing the vulnerability attributes of all vulnerability samples to obtain normalized vulnerability attributes.
[0038] Optionally, when the training iteration program unit uses a sample training set to train the encoder, decoder, contrastive discriminator, and distribution discriminator in the feature extraction model, the loss function used to train the encoder and decoder is:
[0039] ,
[0040] In the above formula, Let G represent the loss function used to train the encoder G and decoder Y. The normalized vulnerability attributes, To reconstruct the vulnerability attributes.
[0041] Optionally, when the training iteration unit uses a sample training set to train the encoder, decoder, contrastive discriminator, and distribution discriminator in the feature extraction model, the loss function used to train the contrastive discriminator is:
[0042] ,
[0043] In the above formula, The loss function used to train the contrast discriminator. This is a Softplus function operation. To compare the discriminator's judgment results for positive samples, To compare the discriminator's judgment results for negative samples, To compare the discriminator's performance on negative samples The judgment result, For positive sample feature attributes, These are negative sample feature attributes.
[0044] Optionally, when the training iteration unit uses a sample training set to train the encoder, decoder, contrastive discriminator, and distribution discriminator in the feature extraction model, the loss function used to train the distribution discriminator is:
[0045] ,
[0046] In the above formula, The loss function used to train the distribution discriminator. For a vector that is to be fitted to a high-dimensional feature distribution, To generate a high-dimensional feature distribution to be fitted, Indicates from Obtaining the expectation from the distribution , It is a logarithmic function. For the distribution discriminator pair The confidence score is obtained by judging the vector. Normalized vulnerability attributes The distribution is represented as follows: Indicates from Obtaining expectations , For the distribution discriminator to the feature vector The confidence score, For the encoder to normalize the vulnerability attributes The feature vector obtained through encoding.
[0047] Optionally, when the training iteration unit trains the encoder, decoder, contrast discriminator, and distribution discriminator in the feature extraction model using a sample training set, it also includes training a vulnerability classifier, and the loss function used to train the vulnerability classifier is:
[0048] ,
[0049] In the above formula, The loss function used to train the vulnerability classifier. For cross-entropy, For feature vectors, For the vulnerability classifier, the feature vector The classification results The tags are for vulnerability samples.
[0050] Furthermore, the present invention also provides a software vulnerability assessment system based on contrastive learning, including a microprocessor and a memory interconnected thereto, wherein the microprocessor is programmed or configured to execute the software vulnerability assessment method based on contrastive learning.
[0051] Furthermore, the present invention also provides a computer-readable storage medium storing a computer program that is programmed or configured by a microprocessor to execute the contrastive learning-based software vulnerability assessment method.
[0052] Compared with the prior art, the present invention has the following main advantages:
[0053] 1. This invention includes training a feature extraction model using a contrastive learning-based training method. The contrastive learning training method involves learning to extract feature vectors of vulnerability attributes by comparing positive and negative samples of vulnerability attributes, allowing the model to learn an effective high-dimensional representation of the samples, thereby improving the performance of downstream tasks (classification of vulnerabilities to be evaluated) and effectively enhancing the accuracy of software vulnerability assessment.
[0054] 2. Considering that new business applications are gradually becoming the main carriers of the power system, and the power system has stringent requirements for the security of software vulnerabilities, the method of this invention is particularly suitable for vulnerability assessment of the power system.
[0055] 3. The vulnerability assessment method of the present invention is applicable to various vulnerability handling methods and can be used as a pre-processing part of vulnerability handling to determine the priority of vulnerability handling. Attached Figure Description
[0056] Figure 1 This is a schematic diagram of the basic process of the method in an embodiment of the present invention.
[0057] Figure 2 This is a schematic diagram of the network structure of the feature extraction model in an embodiment of the present invention.
[0058] Figure 3 This is a schematic diagram of the combined network structure of the feature extraction model and the vulnerability classifier in an embodiment of the present invention.
[0059] Figure 4 This is a schematic diagram of the combined training process of the feature extraction model and the vulnerability classifier in an embodiment of the present invention.
[0060] Figure 5 This is a flowchart illustrating the process of selecting a classification method based on the number of sample labels in an embodiment of the present invention.
[0061] Figure 6This is a schematic diagram of the comparative experimental results in an embodiment of the present invention. Detailed Implementation
[0062] like Figure 1 As shown, the software vulnerability assessment method based on contrastive learning in this embodiment includes:
[0063] S101, the vulnerability attributes of the vulnerability to be evaluated are used to extract feature vectors using a trained feature extraction model. The feature extraction model is trained using a contrastive learning-based training method. The contrastive learning training method includes learning to extract feature vectors of vulnerability attributes by comparing positive and negative samples of vulnerability attributes.
[0064] S102, use a vulnerability classifier to classify the feature vectors to obtain the classification results of the vulnerabilities to be evaluated.
[0065] like Figure 2 As shown, the feature extraction model in step S101 of this embodiment includes an encoder (denoted as G), a decoder (denoted as Y), and a contrast discriminator (denoted as G). ) and distributed discriminator (represented as ).
[0066] The encoder is used to encode the normalized vulnerability attributes of the input to obtain a feature vector, which can be expressed in functional form as follows: ,in, For feature vectors, G represents the normalized vulnerability attributes, and G is the encoder.
[0067] The decoder is used to decode the feature vector output by the encoder to obtain the reconstructed vulnerability attributes.
[0068] A contrastive discriminator is a binary classification model used to distinguish between positive and negative samples through contrastive learning. Normalized vulnerability attributes and their corresponding feature vectors constitute positive samples, which can be represented as:
[0069] ,
[0070] The normalized vulnerability attributes and random high-dimensional representations constitute negative samples, which can be represented as:
[0071] ,
[0072] in, It is a random high-dimensional representation, that is, a randomly generated feature vector;
[0073] The process by which the contrast discriminator distinguishes between positive and negative samples is represented as follows: and ,in As a positive sample, Negative samples;
[0074] A distribution discriminator is a binary classification model that approximates feature vectors to a specified distribution P to be fitted. The binary classification model identifies positive samples. and negative samples The distinction is made by bringing the feature vectors closer to the specified distribution P to be fitted, with positive samples... The characteristics of high-dimensional vulnerabilities are negative samples The vector of a random standard normal distribution Positive samples are feature vectors, and negative samples are distribution vectors of the specified distribution P to be fitted. In this embodiment, the label value of positive samples is specifically defined as 0, and the label value of negative samples is 1. Alternatively, other label values that can distinguish between positive and negative samples can be used as needed.
[0075] In this embodiment, the encoder and decoder in the feature extraction model constitute an encoder-decoder model for extracting feature vectors. The encoder is the core component for feature vector extraction; the decoder, contrastive discriminator, and distribution discriminator are used to assist in the training of the encoder. After training, only the encoder is needed to extract feature vectors. The encoder extracts the vulnerability attributes into a higher-dimensional representation, i.e., a feature vector, by combining various sample attributes. In this embodiment, a 1*128 dimensional feature vector represents a high-dimensional vulnerability feature. During training, the high-dimensional vulnerability feature is subjected to a distribution P to be fitted, and the normalized vulnerability attributes are... The distribution is represented as The decoder then attempts to restore the feature vectors to normalized vulnerability attributes. The actual result obtained from the restoration is the reconstruction of the vulnerability attributes, denoted as... In this embodiment, the training method for contrastive learning includes learning to extract feature vectors of vulnerability attributes by comparing positive and negative samples of vulnerability attributes. The core idea is to reduce the reconstruction of vulnerability attributes. Normalized vulnerability attributes The gap between the two is used to improve the accuracy of high-dimensional feature representation.
[0076] Normalization ensures that different vulnerability attributes have the same value range. In this embodiment, the calculation function expression for the normalized vulnerability attributes is:
[0077] ,
[0078] In the above formula, The normalized vulnerability attributes, The vulnerability attributes before normalization. This represents the average value of the vulnerability's attributes. This represents the variance of the vulnerability attribute.
[0079] like Figure 3 As shown, when using the feature extraction model in this embodiment, only the encoder needs to be used. By combining the encoder with the vulnerability classifier, the feature vector can be classified to obtain the classification result of the vulnerability to be evaluated.
[0080] like Figure 4 As shown, before step S101, a feature extraction model is trained using a contrastive learning-based training method:
[0081] S201, Construct a sample training set for the vulnerability samples, and specify the distribution P to be fitted for the feature vectors (such as normal distribution, uniform distribution, etc., specifically the standard normal distribution in this embodiment).
[0082] S202, using the error between the vulnerability attribute and its reconstructed vulnerability attribute as the loss function, the encoder, decoder, contrast discriminator and distribution discriminator in the feature extraction model are trained using the sample training set until a preset termination condition is reached. The preset termination condition means that the error between the vulnerability attribute and the reconstructed vulnerability attribute is less than a set value or the number of training times is equal to a preset number of times threshold.
[0083] In step S201 of this embodiment, the sample training set for constructing the vulnerability samples includes:
[0084] S301, Collect vulnerability attributes from vulnerability samples;
[0085] S302, perform data filtering on vulnerability samples, including deleting vulnerability samples with incomplete vulnerability attribute data, replacing incorrect vulnerability attributes in vulnerability samples with the mean or specified value, and re-collecting at least one of the following: vulnerability attributes of vulnerability samples.
[0086] S303, performing data augmentation on vulnerability samples, including at least one of the following: randomly discarding vulnerability samples with more than a set value of vulnerability attribute data, merging vulnerability samples with less than a set value of vulnerability attribute data into new vulnerability samples, and performing data interpolation based on existing vulnerability samples to generate new vulnerability samples.
[0087] S304 normalizes the vulnerability attributes of all vulnerability samples to obtain normalized vulnerability attributes.
[0088] Step S302 involves data filtering. Complete vulnerability sample data is a prerequisite for obtaining good feature extraction. However, in practice, incomplete data often exists, such as missing data or data exceeding limits. For these incomplete data situations, deletion, imputation, and re-collection are employed. Deletion: Samples with incomplete data are deleted and not included in subsequent training. Imputation: Unreasonable attribute values are replaced with the mean or specified values. Re-collection: Re-collect the relevant attributes of the vulnerability sample manually. The trainer should use appropriate data filtering methods to ensure the correctness and usability of the vulnerability samples.
[0089] Step S303 involves data augmentation (balancing). The labels on the vulnerability sample data may be highly imbalanced. For example, the number of high-risk vulnerabilities may be far less than the number of ordinary vulnerabilities. This can lead to underfitting of the model in subsequent training for vulnerabilities with limited data, resulting in inaccurate vulnerability assessments. To enhance the generalization ability of the vulnerability assessment model, undersampling and oversampling methods are employed. Undersampling involves randomly discarding vulnerability samples with an excessive number of samples. Oversampling utilizes the SMOTE algorithm to synthesize data from the fewer vulnerability samples. New vulnerability samples are then synthesized through manual interpolation based on the minority class of vulnerability samples, creating a relatively balanced vulnerability dataset.
[0090] In step S202 of this embodiment, when training the encoder, decoder, contrastive discriminator, and distribution discriminator in the feature extraction model using the sample training set, the loss function used to train the encoder and decoder is:
[0091] ,
[0092] In the above formula, Let G represent the loss function used to train the encoder G and decoder Y. The normalized vulnerability attributes, To reconstruct vulnerability attributes, this embodiment represents the encoder-decoder model process as follows: Then we have: Using the loss function This allows for backpropagation optimization of the network parameters of the encoder and decoder, such as... Figure 2 As shown, solid lines represent forward propagation and dashed lines represent backward propagation.
[0093] To improve the effective representation of high-dimensional features, it is necessary to prevent confusion between positive and negative samples, i.e., to improve the discriminative power of positive samples. Therefore, in step S202 of this embodiment, when training the encoder, decoder, contrastive discriminator, and distribution discriminator in the feature extraction model using the sample training set, the loss function used to train the contrastive discriminator is:
[0094] ,
[0095] In the above formula, The loss function used to train the contrast discriminator. This is a Softplus function operation. To compare the discriminator's judgment results for positive samples, To compare the discriminator's judgment results for negative samples, To compare the discriminator's performance on negative samples The judgment result, For positive sample feature attributes, These are negative sample feature attributes. Using loss function This allows for backpropagation optimization of the network parameters of the comparison discriminator, such as... Figure 2 As shown.
[0096] In step S202 of this embodiment, when training the encoder, decoder, contrastive discriminator, and distribution discriminator in the feature extraction model using the sample training set, the loss function used to train the distribution discriminator is:
[0097] ,
[0098] In the above formula, The loss function used to train the distribution discriminator. For a vector that is to be fitted to a high-dimensional feature distribution, To generate a high-dimensional feature distribution to be fitted, Indicates from Obtaining the expectation from the distribution , It is a logarithmic function. For the distribution discriminator pair The confidence score is obtained by judging the vector. Normalized vulnerability attributes The distribution is represented as follows: Indicates from Obtaining expectations , For the distribution discriminator to the feature vector The confidence score, For the encoder to normalize the vulnerability attributes The encoded feature vector. Using the loss function. This allows for backpropagation optimization of the network parameters of the distributed discriminator, such as... Figure 2 As shown.
[0099] Vulnerability assessment can be viewed as a multi-classification task based on vulnerability characteristics. A deep learning model is used to fit the vulnerability distribution to achieve vulnerability classification. The high-dimensional vulnerability vectors obtained through the feature extraction model are beneficial for training the vulnerability assessment model, improving the accuracy of vulnerability assessment. Simultaneously, using a deep learning model for vulnerability assessment reduces the subjective influence of human assessment. Therefore, the vulnerability classifier in this embodiment specifically employs a deep learning model.
[0100] In addition, such as Figure 5 As shown, if the number of sample labels is insufficient when constructing the sample training set for vulnerability samples, clustering methods (such as the t-SNE clustering algorithm) can be directly used to classify vulnerabilities in cases with few samples.
[0101] It should be noted that the vulnerability classifier can be trained together with the feature extraction model or independently. As an optional implementation, in step S202 of this embodiment, when training the encoder, decoder, contrast discriminator, and distribution discriminator in the feature extraction model using a sample training set, the vulnerability classifier is also trained simultaneously. In this embodiment, the vulnerability classifier is a ten-class deep learning model. The loss function of the vulnerability assessment model is the cross-entropy loss function, and the vulnerability assessment process is represented as... And the loss function used to train the vulnerability classifier is:
[0102] ,
[0103] In the above formula, The loss function used to train the vulnerability classifier. For cross-entropy, For feature vectors, For the vulnerability classifier, the feature vector The classification results The labels for the vulnerability samples are (in this embodiment, the evaluation scores from the general vulnerability scoring system CVSS are rounded down). A loss function is then used. This allows for backpropagation optimization of the network parameters of the vulnerability classifier, such as... Figure 3 As shown, solid lines represent forward propagation and dashed lines represent backward propagation.
[0104] After training the feature extraction model and vulnerability classifier, the vulnerability attributes of the vulnerabilities to be evaluated are normalized to obtain the normalized vulnerability attributes. Inputting it into the encoder allows the trained feature extraction model to extract feature vectors. , can be represented as:
[0105] ,
[0106] eigenvectors By inputting the vulnerability classifier, the classification results of the vulnerabilities to be evaluated can be obtained, which can be represented as:
[0107] ,
[0108] In the above formula, The classification result for the vulnerability to be evaluated ranges from 1 to 10 (ten categories). A higher vulnerability rating indicates a higher priority for vulnerability handling. When vulnerability evaluation labels are lacking, an effective vulnerability evaluation model cannot be obtained. In this case, a clustering algorithm is used to cluster the vulnerability sample data and the vulnerability to be evaluated for vulnerability evaluation. The t-SNE algorithm is used to obtain a vulnerability feature distribution map. Vulnerability samples with similar characteristics to the vulnerability to be evaluated are obtained. The label that appears most frequently among these similar vulnerability samples is used as the evaluation result for the vulnerability to be evaluated.
[0109] To validate the software vulnerability assessment method based on contrastive learning in this embodiment, 16 common vulnerability attributes were extracted from the NVD database to form training and test sets. CVSS basic scores were used as labels. The training set contained 50,000 samples, and the test set contained 10,000 samples. To handle non-numeric attributes, the word2vec method was used for word embedding. The test environment consisted of a 3090 graphics card and a PyTorch runtime environment. Figure 6 This diagram illustrates the comparative experimental results in this embodiment. "OURS" represents the accuracy curve of the method in this embodiment at different rounds, and "LSTM+CNN" represents the accuracy curve of the existing LSTM+CNN method (Shi Fan, Kai Shaofeng, Zheng Jinghua. NAVRS: A Vulnerability Severity Assessment Method Based on Network Assets [C] / / . Proceedings of the 10th China Command and Control Conference (Volume 2)., 2022:328-337.DOI:10.26914 / c.cnkihy.2022.018885.) at different rounds. Both the method in this embodiment and the "LSTM+CNN" scheme employ neural network algorithms. However, the baseline model in "LSTM+CNN" is too simple and cannot handle non-numerical attribute features, thus failing to achieve satisfactory experimental results. The experiments show that the method in this embodiment achieves better scoring accuracy and higher training efficiency under the same training rounds.
[0110] In summary, the software vulnerability assessment method based on contrastive learning in this embodiment includes training a feature extraction model using a contrastive learning-based training method. This method involves learning to extract feature vectors for vulnerability attributes by comparing positive and negative samples of vulnerability attributes. This allows the model to learn an effective high-dimensional representation of the samples, improving the performance of downstream tasks (classification of vulnerabilities to be assessed) and effectively enhancing the accuracy of software vulnerability assessment. Considering that new business applications are increasingly becoming the main carriers of power systems, and that power systems have stringent security requirements for software vulnerabilities, the method in this embodiment is particularly suitable for vulnerability assessment in power systems. This software vulnerability assessment method based on contrastive learning can be applied to various vulnerability mitigation methods and can serve as a pre-processing step in determining vulnerability mitigation priorities.
[0111] Furthermore, this embodiment also provides a software vulnerability assessment system based on contrastive learning, including:
[0112] The feature extraction program unit is used to extract feature vectors from the vulnerability attributes of the vulnerability to be evaluated using a trained feature extraction model. The feature extraction model is trained using a contrastive learning-based training method, which includes learning to extract feature vectors of vulnerability attributes by comparing positive and negative samples of vulnerability attributes.
[0113] The vulnerability classification program unit is used to classify feature vectors using a vulnerability classifier to obtain the classification results of the vulnerabilities to be evaluated.
[0114] In this embodiment, the feature extraction model of the feature extraction program unit includes an encoder, a decoder, a contrast discriminator, and a distribution discriminator. The encoder is used to encode the normalized vulnerability attributes of the input to obtain a feature vector. The decoder is used to decode the feature vector output by the encoder to obtain a reconstructed vulnerability attribute. The contrast discriminator is used to distinguish between positive and negative samples in a binary classification model through contrastive learning. The normalized vulnerability attribute and its corresponding feature vector constitute a positive sample, and the normalized vulnerability attribute and its random high-dimensional representation constitute a negative sample. The distribution discriminator is used to approximate the feature vector to a specified distribution P to be fitted in a binary classification model. The positive sample is the feature vector, and the negative sample is the distribution vector of the specified distribution P to be fitted.
[0115] This embodiment also includes a training unit for training the feature extraction model using a contrastive learning-based training method:
[0116] The sample construction unit is used to construct a sample training set for vulnerability samples, specifying the distribution P to be fitted to the feature vectors;
[0117] The training iteration program unit is used to train the encoder, decoder, contrast discriminator, and distribution discriminator in the feature extraction model using the error between the vulnerability attribute and the reconstructed vulnerability attribute as the loss function, and until a preset termination condition is reached. The preset termination condition means that the error between the vulnerability attribute and the reconstructed vulnerability attribute is less than a set value or the number of training times is equal to a preset number threshold.
[0118] In this embodiment, the sample construction program unit constructs a sample training set for vulnerability samples by: collecting vulnerability attributes of vulnerability samples; filtering data for vulnerability samples, including deleting vulnerability samples with incomplete vulnerability attribute data, replacing erroneous vulnerability attributes in vulnerability samples with the mean or a specified value, and re-collecting at least one of the vulnerability attributes of vulnerability samples; performing data augmentation on vulnerability samples, including randomly discarding vulnerability samples with more than a set value of vulnerability attribute data, merging vulnerability samples with less than a set value of vulnerability attribute data into new vulnerability samples, and performing data interpolation based on existing vulnerability samples to generate new vulnerability samples; and normalizing the vulnerability attributes of all vulnerability samples to obtain normalized vulnerability attributes.
[0119] In this embodiment, when the training iteration program unit uses the sample training set to train the encoder, decoder, contrast discriminator, and distribution discriminator in the feature extraction model, the loss function used to train the encoder and decoder is:
[0120] ,
[0121] In the above formula, Let G represent the loss function used to train the encoder G and decoder Y. The normalized vulnerability attributes, To reconstruct the vulnerability attributes.
[0122] In this embodiment, when the training iteration program unit uses the sample training set to train the encoder, decoder, contrastive discriminator, and distribution discriminator in the feature extraction model, the loss function used to train the contrastive discriminator is:
[0123] ,
[0124] In the above formula, The loss function used to train the contrast discriminator. This is a Softplus function operation. To compare the discriminator's judgment results for positive samples, To compare the discriminator's judgment results for negative samples, To compare the discriminator's performance on negative samples The judgment result, For positive sample feature attributes, These are negative sample feature attributes.
[0125] In this embodiment, when the training iteration program unit uses the sample training set to train the encoder, decoder, contrast discriminator, and distribution discriminator in the feature extraction model, the loss function used to train the distribution discriminator is:
[0126] ,
[0127] In the above formula, The loss function used to train the distribution discriminator. For a vector that is to be fitted to a high-dimensional feature distribution, To generate a high-dimensional feature distribution to be fitted, Indicates from Obtaining the expectation from the distribution , It is a logarithmic function. For the distribution discriminator pair The confidence score is obtained by judging the vector. Normalized vulnerability attributes The distribution is represented as follows: Indicates from Obtaining expectations , For the distribution discriminator to the feature vector The confidence score, For the encoder to normalize the vulnerability attributes The feature vector obtained through encoding.
[0128] In this embodiment, when the training iteration program unit trains the encoder, decoder, contrast discriminator, and distribution discriminator in the feature extraction model using a sample training set, it also includes training a vulnerability classifier, and the loss function used to train the vulnerability classifier is:
[0129] ,
[0130] In the above formula, The loss function used to train the vulnerability classifier. For cross-entropy, For feature vectors, For the vulnerability classifier, the feature vector The classification results The tags are for vulnerability samples.
[0131] Furthermore, this embodiment also provides a software vulnerability assessment system based on contrastive learning, including a microprocessor and a memory interconnected, wherein the microprocessor is programmed or configured to execute the software vulnerability assessment method based on contrastive learning.
[0132] Furthermore, this embodiment also provides a computer-readable storage medium storing a computer program that is programmed or configured by a microprocessor to execute the contrastive learning-based software vulnerability assessment method.
[0133] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-readable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The functions specified in one or more boxes. These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable apparatus for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0134] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should also be considered within the scope of protection of the present invention.
Claims
1. A software vulnerability assessment method based on contrastive learning, characterized in that, include: S101, the vulnerability attributes of the vulnerability to be evaluated are used to extract feature vectors using a trained feature extraction model. The feature extraction model is trained using a contrastive learning-based training method, which involves learning to extract feature vectors of vulnerability attributes by comparing positive and negative samples of vulnerability attributes. The feature extraction model includes an encoder, a decoder, a contrastive discriminator, and a distribution discriminator. The encoder encodes the normalized vulnerability attributes into feature vectors. The decoder decodes the feature vectors output by the encoder to reconstruct the vulnerability attributes. The contrastive discriminator is a binary classification model that distinguishes between positive and negative samples through contrastive learning. The normalized vulnerability attributes and their corresponding feature vectors constitute positive samples, and the normalized vulnerability attributes and their random high-dimensional representations constitute negative samples. The distribution discriminator is a binary classification model that aligns feature vectors with a specified distribution P to be fitted. Positive samples are feature vectors, and negative samples are distribution vectors of the specified distribution P to be fitted. S102, use a vulnerability classifier to classify the feature vectors to obtain the classification results of the vulnerabilities to be evaluated; Prior to step S101, a feature extraction model is trained using a contrastive learning-based training method: S201, Construct a sample training set for the vulnerability samples, specifying the distribution P to be fitted to the feature vectors; S202, using the error between the vulnerability attribute and its reconstructed vulnerability attribute as the loss function, the encoder, decoder, contrast discriminator, and distribution discriminator in the feature extraction model are trained using a sample training set until a preset termination condition is reached. The preset termination condition means that the error between the vulnerability attribute and the reconstructed vulnerability attribute is less than a set value or the number of training iterations equals a preset threshold. When training the encoder, decoder, contrast discriminator, and distribution discriminator in the feature extraction model using a sample training set, the loss function used for training the distribution discriminator is: ， In the above formula, The loss function used to train the distribution discriminator. For a vector that is to be fitted to a high-dimensional feature distribution, To generate a high-dimensional feature distribution to be fitted, Indicates from Obtaining the expectation from the distribution , It is a logarithmic function. For the distribution discriminator pair The confidence score is obtained by judging the vector. Normalized vulnerability attributes The distribution is represented as follows: Indicates from Obtaining expectations , For the distribution discriminator to the feature vector The confidence score, For the encoder to normalize the vulnerability attributes The feature vector obtained by encoding.
2. The software vulnerability assessment method based on contrastive learning according to claim 1, characterized in that, The sample training set for constructing the vulnerability samples in step S201 includes: S301, Collect vulnerability attributes from vulnerability samples; S302, perform data filtering on vulnerability samples, including deleting vulnerability samples with incomplete vulnerability attribute data, replacing incorrect vulnerability attributes in vulnerability samples with the mean or specified value, and re-collecting at least one of the following: vulnerability attributes of vulnerability samples. S303, performing data augmentation on vulnerability samples, including at least one of the following: randomly discarding vulnerability samples with more than a set value of vulnerability attribute data, merging vulnerability samples with less than a set value of vulnerability attribute data into new vulnerability samples, and performing data interpolation based on existing vulnerability samples to generate new vulnerability samples. S304 normalizes the vulnerability attributes of all vulnerability samples to obtain normalized vulnerability attributes.
3. The software vulnerability assessment method based on contrastive learning according to claim 1, characterized in that, In step S202, when training the encoder, decoder, contrastive discriminator, and distribution discriminator in the feature extraction model using the sample training set, the loss function used to train the encoder and decoder is: ， In the above formula, Let G represent the loss function used to train the encoder G and decoder Y. The normalized vulnerability attributes, To reconstruct the vulnerability attributes.
4. The software vulnerability assessment method based on contrastive learning according to claim 1, characterized in that, In step S202, when training the encoder, decoder, contrastive discriminator, and distribution discriminator in the feature extraction model using the sample training set, the loss function used to train the contrastive discriminator is: ， In the above formula, The loss function used to train the contrast discriminator. This is a Softplus function operation. To compare the discriminator's judgment results for positive samples, To compare the discriminator's judgment results for negative samples, For positive sample feature attributes, These are negative sample feature attributes.
5. The software vulnerability assessment method based on contrastive learning according to claim 1, characterized in that, In step S202, when training the encoder, decoder, contrastive discriminator, and distribution discriminator in the feature extraction model using the sample training set, a vulnerability classifier is also trained simultaneously, and the loss function used to train the vulnerability classifier is: ， In the above formula, The loss function used to train the vulnerability classifier. For cross-entropy, For feature vectors, For the vulnerability classifier, the feature vector The classification results The tags are for vulnerability samples.
6. A software vulnerability assessment system based on contrastive learning, characterized in that, include: A feature extraction unit is used to extract feature vectors from the vulnerability attributes of the vulnerability to be evaluated using a trained feature extraction model. The feature extraction model is trained using a contrastive learning-based training method, which involves learning to extract feature vectors of vulnerability attributes by comparing positive and negative samples of the vulnerability attributes. The feature extraction model of the feature extraction unit includes an encoder, a decoder, a contrastive discriminator, and a distribution discriminator. The encoder encodes the normalized vulnerability attributes into feature vectors. The decoder decodes the feature vectors output by the encoder to reconstruct the vulnerability attributes. The contrastive discriminator is a binary classification model that distinguishes between positive and negative samples through contrastive learning. The normalized vulnerability attributes and their corresponding feature vectors constitute positive samples, and the normalized vulnerability attributes and their random high-dimensional representations constitute negative samples. The distribution discriminator is a binary classification model that approximates the feature vectors to a specified distribution P to be fitted. Positive samples are the feature vectors, and negative samples are the distribution vectors of the specified distribution P to be fitted. The vulnerability classification program unit is used to classify feature vectors using a vulnerability classifier to obtain the classification results of the vulnerabilities to be evaluated. It also includes a training unit for training the feature extraction model using a contrastive learning-based training method: The sample construction unit is used to construct a sample training set for vulnerability samples, specifying the distribution P to be fitted to the feature vectors; The training iteration unit is used to train the encoder, decoder, contrast discriminator, and distribution discriminator in the feature extraction model using a sample training set, with the error between the vulnerability attribute and the reconstructed vulnerability attribute as the loss function, until a preset termination condition is reached. The preset termination condition is that the error between the vulnerability attribute and the reconstructed vulnerability attribute is less than a set value, or the number of training iterations equals a preset threshold. When the training iteration unit trains the encoder, decoder, contrast discriminator, and distribution discriminator in the feature extraction model using a sample training set, the loss function used for training the distribution discriminator is: ， In the above formula, The loss function used to train the distribution discriminator. For a vector that is to be fitted to a high-dimensional feature distribution, To generate a high-dimensional feature distribution to be fitted, Indicates from Obtaining the expectation from the distribution , It is a logarithmic function. For the distribution discriminator pair The confidence score is obtained by judging the vector. Normalized vulnerability attributes The distribution is represented as follows: Indicates from Obtaining expectations , For the distribution discriminator to the feature vector The confidence score, For the encoder to normalize the vulnerability attributes The feature vector obtained by encoding.
7. The software vulnerability assessment system based on contrastive learning according to claim 6, characterized in that, The sample construction program unit constructs a sample training set for vulnerability samples by: collecting vulnerability attributes of vulnerability samples; filtering data for vulnerability samples, including deleting vulnerability samples with incomplete vulnerability attribute data, replacing erroneous vulnerability attributes in vulnerability samples with the mean or a specified value, and re-collecting at least one of the vulnerability attributes of vulnerability samples; performing data augmentation on vulnerability samples, including randomly discarding vulnerability samples with more than a set value of vulnerability attribute data, merging vulnerability samples with less than a set value of vulnerability attribute data into new vulnerability samples, and performing data interpolation based on existing vulnerability samples to generate new vulnerability samples; and normalizing the vulnerability attributes of all vulnerability samples to obtain normalized vulnerability attributes.
8. The software vulnerability assessment system based on contrastive learning according to claim 6, characterized in that, When the training iteration program unit uses the sample training set to train the encoder, decoder, contrastive discriminator, and distribution discriminator in the feature extraction model, the loss function used to train the encoder and decoder is: ， In the above formula, Let G represent the loss function used to train the encoder G and decoder Y. The normalized vulnerability attributes, To reconstruct the vulnerability attributes.
9. The software vulnerability assessment system based on contrastive learning according to claim 6, characterized in that, When the training iteration program unit uses the sample training set to train the encoder, decoder, contrastive discriminator, and distribution discriminator in the feature extraction model, the loss function used to train the contrastive discriminator is: ， In the above formula, The loss function used to train the contrast discriminator. This is a Softplus function operation. To compare the discriminator's judgment results for positive samples, To compare the discriminator's judgment results for negative samples, For positive sample feature attributes, These are negative sample feature attributes.
10. The software vulnerability assessment system based on contrastive learning according to claim 6, characterized in that, When the training iteration program unit trains the encoder, decoder, contrast discriminator, and distribution discriminator in the feature extraction model using a sample training set, it also includes training a vulnerability classifier, and the loss function used to train the vulnerability classifier is: ， In the above formula, The loss function used to train the vulnerability classifier. For cross-entropy, For feature vectors, For the vulnerability classifier, the feature vector The classification results The tags are for vulnerability samples.
11. A software vulnerability assessment system based on contrastive learning, comprising interconnected microprocessors and memory, characterized in that, The microprocessor is programmed or configured to execute the software vulnerability assessment method based on contrastive learning as described in any one of claims 1 to 5.
12. A computer-readable storage medium storing a computer program, characterized in that, The computer program is used to be programmed or configured by a microprocessor to execute the software vulnerability assessment method based on contrastive learning as described in any one of claims 1 to 5.