A method for generating vulnerability propagation graph, computer storage medium and terminal

Abstract

This article discloses a method, computer storage medium, and terminal for generating a vulnerability propagation map, including: extracting vulnerability information contained in each vulnerability report from one or more vulnerability data sources, and storing the extracted vulnerability information as a first triplet; extracting and storing a second triplet containing the same entity pair as the first triplet from a software supply chain map; determining the credibility of the first triplet based on a first confidence level of the first triplet and a second confidence level of the second triplet; and performing a judgment process of adding the first triplet to the vulnerability propagation map based on the determined credibility level of the first triplet. The embodiment of the present invention generates a propagation map by extracting vulnerability information from the vulnerability data source and extracting the second triplet from the software supply chain map, providing technical support for users to obtain vulnerability information in a timely manner.

Description

Technical Field

[0001] This article relates to but is not limited to information security technology, and in particular to a method for generating a vulnerability propagation map, a computer storage medium, and a terminal. Background Art

[0002] With the rapid development of the Internet and the rapid transmission of information, people have higher demands and requirements for software in terms of practicality and functionality. The competitive pressure in the software market is constantly increasing, which requires continuous and rapid iteration of software development. In order to reduce the time cost in the software development process, a large number of external components will be referenced during the software development process. Referencing external components will inevitably introduce security risks. Once a security vulnerability exists in an external component, the vulnerability will spread along the downstream software supply chain of the component, and all downstream software or components that directly or indirectly reference the component will be exposed to the security risks brought by the vulnerability.

[0003] To minimize the security risks brought by vulnerabilities, security administrators of government and enterprise organizations need to have access to the latest vulnerability intelligence and related threat intelligence for the software or components they are concerned about. In addition to authoritative vulnerability data sources, some third-party public vulnerability data sources will also disclose important vulnerability intelligence in the first place, and the software supply chain contains more complete software dependency information.

[0004] The above-mentioned method of determining vulnerability information requires technical personnel to master professional and comprehensive software application knowledge, and technical personnel need to conduct complex application analysis and collation to obtain vulnerability correlation information. How to obtain vulnerability intelligence of the software or components that users are concerned about, as well as vulnerability intelligence of the components they depend on, in the first place, and feed back the vulnerability intelligence information to users so that users can take emergency response measures as soon as possible and minimize the losses caused by the vulnerabilities has become a problem to be solved. Summary of the Invention

[0005] The following is a summary of the subject matter described in detail herein. This summary is not intended to limit the scope of the claims.

[0006] The embodiments of the present invention provide a method for generating a vulnerability propagation map, a computer storage medium, and a terminal, which can provide technical support for users to obtain vulnerability information in a timely manner.

[0007] An embodiment of the present invention provides a method for generating a vulnerability propagation graph, comprising:

[0008] Extracting vulnerability information contained in each vulnerability report from one or more vulnerability data sources, and storing the extracted vulnerability information as a first triplet;

[0009] Extract and store the second triplet containing the same entity pairs as the first triplet from the software supply chain graph;

[0010] determining the credibility of the first triplet based on a first confidence level of the first triplet and a second confidence level of the second triplet;

[0011] Based on the determined credibility of the first triplet, a judgment process of adding the first triplet to the vulnerability propagation graph is performed.

[0012] On the other hand, an embodiment of the present invention further provides a computer storage medium, in which a computer program is stored. When the computer program is executed by a processor, the method for generating a vulnerability propagation map is implemented.

[0013] In another aspect, an embodiment of the present invention further provides a terminal, comprising: a memory and a processor, wherein the memory stores a computer program;

[0014] The processor is configured to execute the computer program in the memory;

[0015] When the computer program is executed by the processor, the method for generating a vulnerability propagation map as described above is implemented.

[0016] The technical solution of this application includes: extracting vulnerability information contained in each vulnerability report from one or more vulnerability data sources, and storing the extracted vulnerability information as a first triplet; extracting and storing a second triplet containing the same entity pair as the first triplet from the software supply chain graph; determining the credibility of the first triplet based on the first confidence of the first triplet and the second confidence of the second triplet; and performing a judgment process of adding the first triplet to the vulnerability propagation graph based on the determined credibility of the first triplet. The embodiment of the present invention realizes the generation of a propagation graph by extracting vulnerability information from the vulnerability data source and extracting the second triplet from the software supply chain graph, providing technical support for users to obtain vulnerability information in a timely manner.

[0017] Other features and advantages of the present invention will be described in the following description, and in part will become apparent from the description, or will be understood by practicing the present invention. The purposes and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The accompanying drawings are used to provide a further understanding of the technical solution of the present invention and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the technical solution of the present invention and do not constitute a limitation on the technical solution of the present invention.

[0019] Figure 1 A flowchart of a method for generating a vulnerability propagation map according to an embodiment of the present invention;

[0020] Figure 2This is an architectural diagram of an example vulnerability map used in the present invention. DETAILED DESCRIPTION

[0021] To make the purpose, technical solutions and advantages of the present invention more clearly understood, the embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be noted that, unless there is a conflict, the embodiments and features in the embodiments of the present application can be combined with each other in any manner.

[0022] The steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions. Also, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be performed in an order different from that shown here.

[0023] Figure 1 A flowchart of a method for generating a vulnerability propagation map according to an embodiment of the present invention is shown in FIG. Figure 1 Shown, including:

[0024] Step 101: Extract vulnerability information contained in each vulnerability report from one or more vulnerability data sources, and store the extracted vulnerability information as a first triplet;

[0025] Step 102: extract and store a second triplet containing the same entity pair as the first triplet from the software supply chain graph;

[0026] Step 103: Determine the credibility of the first triplet based on the first confidence of the first triplet and the second confidence of the second triplet. Here, the first confidence and the second confidence can be directly extracted in the process of extracting the first triplet and extracting the second triplet with reference to related technologies.

[0027] Step 104: Based on the determined credibility of the first triplet, a judgment process of adding the first triplet to the vulnerability propagation graph is performed.

[0028] The embodiment of the present invention obtains a first triplet by extracting vulnerability information from a vulnerability data source, determines the credibility of the first triplet based on the confidence of the first triplet and the second triplet extracted from the software supply chain graph, and determines whether to add the first triplet to the vulnerability propagation graph based on the credibility, thereby generating a graph for vulnerability intelligence information processing, and providing data support for users to take timely emergency response measures based on vulnerability information.

[0029] In an exemplary embodiment, the vulnerability information in the embodiment of the present invention includes one or any combination of the following information: vulnerability propagation relationship of affected components, vulnerability propagation relationship of affected software, version of affected software, and version of affected components.

[0030] An embodiment of the present invention adds the first triplet to the vulnerability propagation graph based on the determined credibility of the first triplet. Through the data architecture of the vulnerability propagation graph, the vulnerability propagation graph stores information such as the vulnerability propagation chains between affected components and software, between components, and the versions of the affected software and components.

[0031] In an exemplary embodiment, a vulnerability in the embodiment of the present invention generally includes a vulnerability information. Accordingly, a vulnerability information corresponds to a first triplet.

[0032] The system in this embodiment of the present invention fuses multi-source vulnerability intelligence with information from the software supply chain and, based on this fused information, constructs a vulnerability propagation map. This map stores the dependencies between all vulnerable software and components, i.e., the vulnerability propagation chain. If a user enters the software or component of their interest into the system in advance, the system will continuously update the vulnerability propagation map. If a vulnerability is discovered in that software or component, or in an upstream component it depends on, the system will promptly send the user an alert message containing the vulnerability propagation chain affecting that software or component.

[0033] In an exemplary embodiment, the embodiment of the present invention extracts the first confidence level in the following manner:

[0034] When the vulnerability information extracted from the vulnerability data source is unstructured vulnerability information, the first confidence of the first triple storing the vulnerability information is obtained by weighting, according to a preset first weighting coefficient, the prediction confidence in the vulnerability information extraction phase and the mapping confidence of the entity pair mapped from the extracted entity pair to the entity pair of the platform enumeration item (CPE) dictionary;

[0035] When the vulnerability information extracted from the vulnerability data source is structured vulnerability information, the first confidence of the first triple storing the vulnerability information is: a mapping confidence of mapping the extracted entity pair to the entity pair of the CPE dictionary;

[0036] The cumulative sum of the prediction confidence and the first weighted coefficient of the mapping confidence of the entity pair is equal to 1.

[0037] In an exemplary embodiment, the embodiment of the present invention extracts the second confidence level in the following manner:

[0038] Map the two entities in the first triplet to two entities in the software supply chain graph respectively. The entities in the first triplet and the entities in the software supply chain graph are both represented by CPE records in the CPE dictionary. The mapping is successful when the entity in the CPE record in the software supply chain graph is the same as the entity in the CPE record of the first triplet entity.

[0039] For the entity in the first triple, if the entity mapping is successful, the confidence of the entity mapping is 1, or if the original string of the entity in the software supply chain graph is obtained, the confidence of the entity mapping is the confidence of the entity disambiguation of mapping the original string to the current CPE record of the entity; if the entity mapping is unsuccessful, the confidence of the entity mapping is 0;

[0040] The confidence levels of the entity mappings of the two entities in the first triplet are weighted by a preset second weighting coefficient and then summed to obtain a confidence level of the entity pair mapping; when mapping the first triplet to the software supply chain graph, if it is determined that the relationship between the entity pairs of the first triplet is consistent with the relationship between the entity pairs in the mapped software supply chain graph, the confidence level of the obtained entity pair mapping is determined as the second confidence level; if it is determined that the relationship between the entity pairs of the first triplet is inconsistent with the relationship between the entity pairs in the mapped software supply chain graph, the second confidence level is determined to be 0;

[0041] The relationship consistency includes: the relationship type between the entity pairs in the first triplet and the relationship type between the entity pairs in the second triplet satisfy a preset one-to-one mapping correspondence.

[0042] The embodiments of the present invention do not limit the specific architecture of the software supply chain. The following provides examples of two architectures of the software supply chain map, and explains the mapping of the vulnerability propagation map and the relationship types in the software supply chain map under these two architectures.

[0043] Example 1: The software supply chain graph contains two entity types, software and components, and the relationship between software and components is "downstream", as shown in the 5th column of Table 1: Given an entity pair whose type is the 8th or 9th entity pair type in Table 1, when the relationship of the entity pair in the vulnerability propagation graph and the relationship in the software supply chain graph are as shown in the 4th and 5th columns of Table 1 respectively, then the relationship of the entity pair in the vulnerability propagation graph and the relationship in the software supply chain graph are considered to be consistent; taking the 8th pair of entity types in Table 1 as an example, when the relationship of the entity pair <affected component X, affected software Y> in the vulnerability propagation graph is "propagation vulnerability" and the relationship in the software supply chain graph is "downstream", then the relationship between X and Y in the vulnerability propagation graph and the software supply chain graph is considered to be consistent.

[0044] Example 2: When the entity types contained in the software supply chain graph are exactly the same as the entity types in the vulnerability propagation graph, and except for the relationship between the software and the component being "downstream", the relationship types of other entity pairs are also the same as the relationship types of the corresponding entity pairs in the vulnerability propagation graph, as shown in the 6th column of Table 1; given an entity pair, its type is one of the 10 entity pair types in Table 1, when the relationship between the entity pair in the vulnerability propagation graph and the relationship in the software supply chain graph are shown in the 4th and 6th columns of the following table respectively, it is considered that the relationship of the entity pair in the vulnerability propagation graph and the relationship in the software supply chain graph are consistent.

[0045]

[0046] Table 1

[0047] In an exemplary embodiment, the embodiment of the present invention determines the credibility of the first triplet, including:

[0048] The first confidence level and the second confidence level are weighted according to a preset third weighting coefficient and then summed to obtain the credibility level.

[0049] In an exemplary embodiment, before determining the credibility of the first triplet, the method of the embodiment of the present invention further includes:

[0050] When it is determined that the first triplet is extracted from more than one vulnerability report of the vulnerability data source, corresponding weights of different vulnerability reports are determined by generalizing authenticity information of the vulnerability reports;

[0051] The first confidences of the same first triplet are weighted by the weights of the vulnerability reports to obtain a first confidence of the same first triplet.

[0052] Authenticity-related information includes but is not limited to one or any combination of the following vulnerability report characteristics: release time, last update time, number of updates, and number of reference links, etc.

[0053] In an exemplary embodiment, the reliability in the embodiment of the present invention is S total , S total The expression is:

[0054]

[0055] Where m is the number of vulnerability reports extracted from the first triplet. represents the weight of the determined i-th vulnerability report, is the first confidence corresponding to the first triplet extracted from the i-th vulnerability report; represents m identical first triples, the first confidence level determined by the weight of the determined vulnerability report; α and 1-α represent the coefficients for weighting the first confidence level and the second confidence level, respectively; S graph Indicates the second confidence corresponding to the second triplet.

[0056] In an exemplary embodiment, before determining the credibility of the first triplet, the method of the embodiment of the present invention further includes:

[0057] The first confidence level and the second confidence level are dimensionalized.

[0058] In an exemplary embodiment, the embodiment of the present invention performs a determination process of adding the first triplet to the vulnerability propagation graph based on the determined credibility of the first triplet, including:

[0059] When the credibility is greater than or equal to a preset credibility threshold, the first triplet is added to the vulnerability propagation graph as an edge of the graph.

[0060] In an exemplary embodiment, the method of the embodiment of the present invention further includes:

[0061] For each entity included in the vulnerability propagation graph, the entity's downstream software supply chain is extracted from the software supply chain graph, and the extracted downstream software supply chain is added to the vulnerability propagation graph. In other words, for each software included in the vulnerability propagation graph, the embodiment of the present invention extracts the downstream software supply chain of the software from the software supply chain graph, and adds the extracted downstream software supply chain to the vulnerability propagation graph; for each component included in the vulnerability propagation graph, the component's downstream software supply chain is extracted from the software supply chain graph, and the extracted downstream software supply chain is added to the vulnerability propagation graph.

[0062] An embodiment of the present invention further provides a computer storage medium, in which a computer program is stored. When the computer program is executed by a processor, the method for generating a vulnerability propagation map is implemented.

[0063] An embodiment of the present invention further provides a terminal, comprising: a memory and a processor, wherein a computer program is stored in the memory;

[0064] The processor is configured to execute the computer program in the memory;

[0065] When the computer program is executed by a processor, the method for generating a vulnerability propagation map as described above is implemented.

[0066] The following briefly describes the embodiments of the present invention through application examples. The application examples are only used to illustrate the embodiments of the present invention and are not used to limit the scope of protection of the present invention.

[0067] Application Examples

[0068] The following is a brief example to illustrate the processing of this application instance. The processing of building a vulnerability propagation map in this application example includes:

[0069] Step 201: Obtain the latest updated vulnerability reports from one or more vulnerability data sources. The vulnerability description in one vulnerability report is "a buffer overflow vulnerability exists in component B of software A...", and extract from the description that the vulnerability propagates from component B to software A. Extract a first triplet from the vulnerability information as <component B, vulnerability propagation, software A>; and extract a first confidence score for the first triplet.

[0070] Step 202: Extract and store a second triplet from the software supply chain graph that contains the same entity pair as the first triplet; that is, extract the relationship between component B and software A, extract that component B's downstream software includes software A, that is, the extracted triplet is <component B, downstream, software A>, and extract a second confidence level for the second triplet;

[0071] Step 203: The first confidence level and the second confidence level of the first triple <component B, vulnerability propagation, software A> are merged to obtain the credibility of the first triple; in this application example, the vulnerability propagation direction is from the component with the vulnerability to its downstream component or software, and the directions of the vulnerability propagation relationship and the downstream relationship are consistent. Therefore, the directions of the relationships between component B and software A extracted from the vulnerability data source and the software supply chain graph are consistent. Therefore, the first confidence level of the first triple <component B, vulnerability propagation, software A> and the second confidence level of the second triple extracted from the software supply chain graph are merged to obtain the credibility of the first triple.

[0072] Step 204: When the credibility of the first triplet obtained is greater than the preset credibility threshold, the edge corresponding to <component B, vulnerability propagation, software A> is Added to the vulnerability propagation map;

[0073] Step 205: Based on the edge added to the vulnerability propagation graph, the downstream software and component nodes related to the edge in the software supply chain graph are introduced into the vulnerability propagation graph; that is, the downstream software supply chains of component B and software A are extracted from the software supply chain graph, and added to the vulnerability propagation graph respectively; return to step 201, and continuously perform update processing of the vulnerability propagation graph according to the updated vulnerability report.

[0074] This application example considers that the dependency chain between software and components is the inverse vulnerability propagation chain. Therefore, the vulnerability propagation graph stores the versions of vulnerability-related software, components, and operating systems, as well as their dependencies. In the vulnerability propagation graph, each software and component either contains a vulnerability itself or has an upstream component that contains a vulnerability. The vulnerability propagation graph is essentially a directed graph, with vertices representing entities and edges representing relationships between entities. The vulnerability propagation chain is the inverse of the dependency chain between vulnerable software and components. The vulnerability propagation relationship is essentially the inverse relationship between the vulnerable software and components. Figure 2 This is an architecture diagram of the vulnerability map of the present invention, such as Figure 2 As shown in Figure 2, the vulnerability propagation graph involves one or any combination of the following entities: vulnerability, affected software, affected components, affected operating systems, and affected versions. The relationship types between entities mainly include: impact, related, lower version, propagation vulnerability, and running on.

[0075] The definitions of all entities and their relationships involved in the vulnerability propagation graph of this application example are shown in Table 2, where each row represents a directed edge in the vulnerability propagation graph. Each represents a triple<E1,R,E2> , the head node E1 represents the head entity, the tail node E2 represents the tail entity, and R represents the relationship between E1 and E2; the following briefly describes all the relationship types between entities; among them,

[0076] Impact: This is the relationship between the vulnerability and the software, components, and operating systems it affects. For pairs of entities with impact relationships, see rows 1 to 3 in Table 2.

[0077] Related: If the affected software and the affected version are related, it means that the given affected software has the given affected version. This relationship also exists between the affected components and the affected versions, and between the affected operating systems and the affected versions. For pairs of entities with related relationships, see rows 4 to 6 in Table 2.

[0078] Lower version: This is the relationship between the affected versions of the same software. If the affected version 2 of a certain software is lower than the affected version 1, then the triple <version 1, lower version, version 2> exists. This relationship is used to obtain the affected version set of the affected software. For entity pairs with lower version relationships, see row 7 of Table 2.

[0079] Vulnerability propagation: If the affected component and the affected software are in a vulnerability propagation relationship, it means that the software depends on, contains, or references the component, or the component affects the software, or the component and the software are upstream and downstream software. This relationship also exists between affected components. Entity pairs with vulnerability propagation relationships are shown in rows 8 and 9 of Table 2.

[0080] Runs on: If a given affected software runs on a given affected operating system, then the software can be considered to affect the operating system. For entity pairs with a Runs on relationship, see the last row in Table 2.

[0081] Given source software or component and target software or component, denoted as E src and E tgt ; Among them, S src Is the source of the vulnerability, that is, E src There is an affected version that is the source of the vulnerability; if src to E tgt If it is reachable, then from E src to E tgt The vulnerability propagation chain is defined as: the head vertex and the tail vertex are E src to E tgt The entities represented by all nodes on this path are affected software or components, and the relationships represented by all edges are vulnerability propagation.

[0082] The length of the vulnerability propagation chain is the number of edges in the vulnerability propagation chain; if the vulnerability propagation chain length is 1, that is, the vulnerability propagation chain does not contain an intermediate node, it means that E src The vulnerability is directly propagated to E tgt ; If the vulnerability propagation chain length is greater than 1, the vulnerability propagation chain contains an intermediate node, indicating that E src The vulnerability is indirectly spread to E tgt ; The following formula gives a vulnerability propagation chain with a length of n+1, E src The vulnerability in n software or components spreads to E tgt :

[0083]

[0084]

[0085] Table 2

[0086] In this application example, each entity node in the vulnerability propagation graph has a unique ID and related attributes. Vulnerabilities include attributes such as Common Vulnerabilities and Exposures (CVE) IDs, CNVD (China National Vulnerability Sharing Platform) IDs, Common Weakness Enumeration (CWE) IDs, and Common Vulnerability Scoring System (CVSS) scores. Common Platform Enumeration Items (CPE) provide standardized representations of products and versions. The attributes of affected software, components, operating systems, and versions primarily include their corresponding CPE product records. The attributes of affected software, components, and operating systems are their corresponding CPE product records. The attributes of affected versions are their corresponding CPE product version records, as well as whether the corresponding software or component version is the source of the vulnerability. If the corresponding software or component version itself contains the vulnerability, the vulnerability source attribute for that version is true. Otherwise, if it simply depends on an upstream component containing the vulnerability, the vulnerability source attribute for that version is false. In this application example, each edge of the graph also has corresponding attributes, namely the credibility of the information corresponding to this edge, the list of vulnerability report uniform resource locators (URLs) from which the information corresponding to this edge is extracted, and the release time and last update time of each vulnerability report.

[0087] To clarify this application example, the following briefly describes the software supply chain map. The software supply chain map includes all software and components, the dependencies between components, the operating system on which the software runs, and version information for the software, components, and operating system. Software component analysis techniques, such as static analysis, dynamic analysis, and software configuration file analysis, can be used to iteratively obtain the components and dependencies between components within the software, and thus construct a software supply chain map. This application example does not elaborate on the process of constructing the software supply chain map.

[0088] The following differences exist between the vulnerability propagation graph of this application example and the software supply chain graph: First, the software, components, and operating systems included in the vulnerability propagation graph either have vulnerabilities themselves or are directly or indirectly dependent on vulnerable components. When they have vulnerabilities themselves, the vulnerability source attribute of the affected version with the vulnerability is True; while the software and components included in the software supply chain graph may not have vulnerabilities and do not depend on vulnerable components; secondly, the vulnerability propagation graph contains vulnerability entities and information such as software, components, operating systems, etc. related to them, while the software supply chain graph does not contain vulnerability entities and information related to vulnerabilities, such as whether software, components, operating systems, etc. have vulnerabilities, or whether they depend on vulnerable components; finally, in the software supply chain graph, there are downstream relationships between components and software, and between components. The meanings of downstream relationships and vulnerability propagation relationships are different. If component A and component B meet the downstream relationship, that is, This means that the downstream of A includes B. If component A is also affected by the vulnerability, then component A and component B are in a vulnerability propagation relationship, i.e. A propagates the vulnerability to B; that is, the downstream relationship and the vulnerability propagation relationship have the same direction, except that the vulnerability propagation relationship has an additional constraint, namely, the head entity in the entity pair that satisfies the vulnerability propagation relationship either has a vulnerability itself or depends on a component with a vulnerability.

[0089] As mentioned above, the relationship types between software and components, and between components are vulnerability propagation relationships in the vulnerability propagation map of this application example, but are downstream relationships in the software supply chain map. In addition, the entities and other relationship types between entities in the vulnerability propagation map of this application example are the same as those in the software supply chain map. In addition, the attributes of software, components, and operating systems in the software supply chain map include their corresponding CPE product records, and the version attributes also include their corresponding CPE product version records.

[0090] The vulnerability data sources in this application example include websites that publish vulnerability information. This application example uses website domain names to distinguish these vulnerability data sources. Each vulnerability data source contains a large number of vulnerability reports, and each vulnerability report often describes only a specific vulnerability. These vulnerability reports are distinguished by URLs. Vulnerability data sources known to those skilled in the art include domestic sources such as CNVD and the National Information Security Vulnerability Database (CNNVD), as well as international sources such as the U.S. National Vulnerability Database (NVD). In addition to vulnerability data sources such as CNVD, CNNVD, and NVD, the vulnerability data sources in this application example may also include some relatively important third-party vulnerability data sources, such as Synk and ExploitDB. In an exemplary embodiment, this application example selects vulnerability data sources for extracting vulnerability information by referring to the following process: obtaining reference links for all vulnerabilities from one or more vulnerability data sources and extracting the domain names therein; for each domain name in the reference link, counting the frequency of citations of the domain name in all reference links; and sorting the domain names from high to low based on the counted citation frequencies. A preset number of vulnerability data sources to be monitored is X, and the top X domain names are obtained, with the websites corresponding to these domain names being designated as vulnerability data sources that require continuous monitoring.

[0091] In an exemplary embodiment, this application example can monitor public vulnerability data sources and obtain newly emerged vulnerability reports from these vulnerability data sources at fixed intervals (for example, 6 hours, 12 hours, or 24 hours); it should be noted that some vulnerability data sources provide a vulnerability data download interface, such as CNVD and NVD, which can download updated (new and / or changed) vulnerability data in the format of Extensible Markup Language (xml) and / or JavaScript Object Notation (json), and extract unstructured vulnerability information such as vulnerability descriptions or structured vulnerability information such as CPE records from these vulnerability data. For vulnerability data sources that do not provide a vulnerability data download interface, this application example can obtain vulnerability information through the following processing: first, obtain its vulnerability report index page from the vulnerability data source; obtain its newly added vulnerability report link from the vulnerability report index page, and extract vulnerability information from the newly added vulnerability report link; in an exemplary embodiment, some vulnerability information contains relevant code, and this application example refers to relevant technologies to extract vulnerability information including affected software, components and their versions from the comments of the relevant code.

[0092] In one exemplary embodiment, the vulnerability information in this application example includes: vulnerability propagation relationships of affected components, vulnerability propagation relationships of affected software, versions of affected software, and versions of affected components. In one exemplary embodiment, the vulnerability information in this application example, including entities and relationship types between entities, can be extracted using existing information extraction methods in the relevant art.

[0093] This application example can refer to relevant technologies to extract more than one type of information from vulnerability information, including: entities that can be directly extracted and relationships between entities; relationships between entities that can be directly extracted include: vulnerabilities in entities and impacts in relationships; the title or description of a vulnerability report often contains some attributes of the vulnerability, such as CVE ID and CNVD ID, etc., and vulnerability attribute information such as CVE ID and CNVD ID can be obtained through regular expression matching, that is, the vulnerability entity can be directly extracted. In addition, all other information such as the affected software extracted from the vulnerability report is considered to be related to the vulnerability. In other words, the vulnerability entity and the relationship between the vulnerability entity and other entities can be directly extracted. The construction of a vulnerability propagation map requires a total of 5 relationships, of which the first relationship is the relationship between the vulnerability and the affected software, component, and operating system, that is, this relationship can be directly extracted. The lower versions in the relationship and the versions in the vulnerability propagation graph are represented using standardized CPE records. The software version format in the CPE record is: cpe:2.3:part:vendor:product:version:update:edition:language:sw_edition:target_sw:target_hw:other. Given two CPE record versions of a given software, the size of the two versions is compared by sequentially comparing the version number (version), update package (update), and version (edition) of the two CPE records. Therefore, the lower versions between the affected versions can also be directly extracted.

[0094] In an exemplary embodiment, this application example can refer to methods including entity recognition technology to extract one or more entities from vulnerability information, including: affected software, affected components, affected operating systems, and affected versions; the relationships to be extracted in this application example are the relationships between these entities; entity recognition technology is needed to extract these entities because the vulnerability description may contain both affected and unaffected software, components, operating systems, or both affected and unaffected versions; to distinguish between affected entities and unaffected entities, their contextual context needs to be analyzed and modeled.

[0095] In an exemplary embodiment, this application example can refer to methods including entity recognition technology to extract one or more relationship types between entities in vulnerability information: related, propagation vulnerability, and running on; wherein, related exists in 3 groups of entity pairs, and it is necessary to pair the affected software, affected components, affected operating systems, and their related affected versions. Propagation vulnerability exists in 2 groups of entity pairs, and it is necessary to extract the dependency relationships between the affected components and software, and between the affected components. Running on only exists in 1 group of entity pairs, and it is necessary to identify whether the given affected software runs on a given affected operating system. For entities such as affected software, affected components, affected operating systems, affected versions, and relationships to be extracted; and / or, the relationship types between entities such as related, propagation vulnerability, and running on, this application example can extract them through a pipeline solution or a joint extraction solution in the relevant technology; wherein, the pipeline solution: first use the entity recognition model to extract entities, and then use the relationship extraction model to identify the relationships in the entities based on the extracted entities; the joint extraction solution: use the entity-relationship joint extraction model to simultaneously extract entities and the relationships between entities.

[0096] In an exemplary embodiment, this application example can refer to the relevant technology to extract the first confidence of the first triplet; the vulnerability information extracted from the vulnerability data source in this application example includes unstructured vulnerability information and structured vulnerability information; wherein,

[0097] For unstructured vulnerability information, given a first triplet, the first triplet contains entity pairs and relationship types between entity pairs. The first confidence of the first triplet corresponding to the unstructured vulnerability information is divided into two parts: 1. The prediction confidence in the information extraction stage; 2. The mapping confidence of mapping the extracted entity pairs to the entity pairs in the CPE dictionary; In an exemplary embodiment, the first confidence in this application example is equal to the prediction confidence and the mapping confidence, which are weighted according to a preset first weighting coefficient and then summed; In an exemplary embodiment, the cumulative sum of the prediction confidence and the first weighting coefficient of the mapping confidence is equal to 1. The following is a brief description of the prediction confidence and the mapping confidence; wherein,

[0098] If the pipeline extraction scheme is used, the prediction confidence is the weighted sum of the prediction confidences of the named entity recognition model and the relationship extraction model; if the joint extraction scheme is used, the prediction confidence is the prediction confidence of the entity relationship recognition model in the related technology; mapping confidence: the two entities of the first triple are mapped to the CPE dictionary respectively, that is, entity disambiguation is performed on them respectively, then the mapping confidence of the entity pair of the first triple is the weighted sum of the confidences of the entity disambiguation of the two entities. The extracted source entities are mapped to different target entity sets for standardization. For example, the product names of the affected software, affected components, affected operating systems, etc. are mapped to the product names in the CPE dictionary, and the affected versions are mapped to the product versions in the CPE dictionary.

[0099] For the first confidence level of structured vulnerability information, the entities and relationship types extracted from the structured vulnerability information in this application example are the same as those for unstructured vulnerability information. However, structured vulnerability information can be directly extracted without the need for entity and relationship recognition algorithms. Therefore, the first confidence level of the first triple corresponding to the structured vulnerability information is the mapping confidence level of the entity pair, which is the same as the mapping confidence level of the first triple corresponding to the unstructured vulnerability information. All entities extracted from the vulnerability data source are represented by the corresponding mapped target CPE records, the affected software, components, operating systems, etc. are represented by CPE product records, and the affected versions are represented by CPE product version records.

[0100] Based on information such as vulnerability propagation and affected version triples extracted from the vulnerability data source, this application example extracts a second triplet containing the same entity pairs as the first triplet from the software supply chain graph, obtains a second confidence level of the second triplet in the software supply chain graph, and is used to fuse the information extracted from the vulnerability data source and the information extracted from the software supply chain graph to add the information determined after the fusion processing to the vulnerability propagation graph.

[0101] In an exemplary embodiment, the present application example is given a first triple extracted from a vulnerability data source.<E1,R,E2> , extract the second triplet from the software supply chain graph, that is,<E1,R,E2> Mapped to the software supply chain graph<E′1,R′,E′2> , which is a triple mapping problem; triple mapping is divided into: entity pair mapping, entity pair relationship extraction and calculation of the second confidence.

[0102] In an exemplary embodiment, the entity pair mapping of this application example refers to mapping the two entities E1 and E2 in the first triple to the software supply chain graph, that is, finding the entities in the software supply chain graph that represent the same meaning as these two entities. In this application example, the software, components, operating systems, versions and other entities in the software supply chain graph are also represented by corresponding CPE records.<E1,E2> Recorded as source entity pair, entity pair mapping only needs to obtain two entities from the software supply chain graph<E′1,E′2> , satisfying that the CPE record corresponding to E1 is the same as the CPE record corresponding to E′1, and the CPE record corresponding to E2 is the same as the CPE record corresponding to E′2.

[0103] For the two entities in the second triplet, this application example calculates the confidence of each entity mapping using two schemes: First, if the entity mapping is successful, the confidence of the entity mapping is the confidence of the entity disambiguation of mapping E''s original string to E''s current CPE record in the software supply chain graph. If the entity mapping is unsuccessful, the confidence of the entity mapping is 0. E''s original string refers to the software name, component name, etc. extracted from the software configuration file or software code comment using automated information extraction methods. The software or component corresponding to these names may be inconsistent with the corresponding software or component name in the CPE record. This inconsistency is measured using the confidence of entity disambiguation in related technologies. Second, if the entity mapping is successful, the confidence of the entity mapping is 1; otherwise, if the entity mapping is unsuccessful, the confidence of the entity mapping is 0. This scheme is applicable to the case where the product or version referred to by the original string of all entities E' in the software supply chain graph is indeed the product or version referred to by E''s current CPE record.

[0104] This application example calculates the confidence of the entity mapping of E1 and the confidence of the entity mapping of E2 respectively based on the above processing; the mapping confidence of the entity pair is the weighted sum of the confidence of the entity mapping of E1 and the confidence of the entity mapping of E2.

[0105] In an exemplary embodiment, the extraction of the relationship between entity pairs in this application example includes: if the mapping confidence of the entity pair is greater than or equal to a preset confidence threshold, extracting the target entity pair in the software supply chain graph<E′1,E′2> The relationship between is denoted as R′; if<E1,E2> The relationship R between them is vulnerability propagation, so we can judge the software supply chain graph.<E′1,E′2> To determine whether the relationship R′ between E′1 and E′2 is downstream, we simply need to determine whether there is at least one path between E′1 and E′2 in the software supply chain graph, that the head node and tail node of the path correspond to entities E′1 and E′2, respectively, and that all the relationships along the path are downstream. A path that meets these conditions can be called a downstream supply chain. If there is at least one downstream supply chain between E′1 and E′2 in the software supply chain graph, then the relationship R′ from E′1 to E′2 in the software supply chain graph is downstream. Since the direction of vulnerability propagation and downstream relationships are consistent, the entity-to-relationship mapping is successful.

[0106] This application example mainly extracts downstream relationships between components and software, and between components from the software supply chain graph. Similar methods can also be used to extract running and related relationships between entity pairs, but it is necessary to limit the length of the path between entity pairs in the software supply chain, that is, to limit the number of edges contained in the path.

[0107] In this application example, the first triple<E1,R,E2> Mapping to the second triple in the software supply chain graph<E′1,R′,E′2> If the relationship R between the entity pairs of the first triple is consistent with the relationship R′ between the entity pairs in the software supply chain graph, the output second confidence is the confidence of the entity pair mapping, otherwise the output second confidence is 0.

[0108] This application example provides a method for extracting a first triplet from a vulnerability data source and a second triplet from a software supply chain graph, and each method also determines a corresponding first confidence level and a second confidence level.

[0109] In an exemplary embodiment, this application example selects the first triples extracted from multiple vulnerability data sources through fusion processing, and uses them to construct a vulnerability propagation map. The following briefly describes the fusion process through an example, including:

[0110] The input of the fusion process is: the first triplet and the second triplet are obtained by processing; if the first triplet is extracted from h unstructured vulnerability reports and k structured vulnerability reports; the second triplet is extracted from the software supply chain graph, then the first confidence level includes: the first confidence level of the first triplet extracted from the h unstructured vulnerability data sources The first confidence of the first triple extracted from k structured vulnerability data sources The second confidence level includes the second confidence level S of the second triplet extracted from the software supply chain graph. G .

[0111] The output of the fusion process is: the credibility S of the first triplet total Credibility S total The higher the credibility, the more accurate the first triplet is; this application example adds the first triplet whose credibility is greater than a preset credibility threshold to the vulnerability propagation map.

[0112] In an exemplary embodiment, the dimensions of the first confidence and the second confidence obtained from different extraction schemes may not be uniform. This application example calibrates the first confidence and the second confidence to unify these dimensions. The first confidence calibration model of the unstructured vulnerability data source, the first confidence calibration model of the structured vulnerability data source, and the second confidence calibration model of the software supply chain map prepared in advance are respectively denoted as M U 、M S and M G ; Use M respectively U To S U Each first confidence in is calibrated using M S To S S Each first confidence in is calibrated using M G To S G The calibration is performed with every second confidence in .

[0113] For all the vulnerability reports of the first triple extracted, this application example calculates the weight of each vulnerability report based on preset features such as release time. The first confidence level after calibration of all vulnerability reports The second confidence level S in the software supply chain graph after calibration graph Perform weighted sum and finally get the credibility S of the first triple total .

[0114] The application examples are unstructured vulnerability information extractor E U , Structured Vulnerability Information Extractor E S , Software Supply Chain Graph Information Extractor E G, only when the first confidence and second confidence of these three extractors are in the same dimension, the information credibility obtained after fusing these three types of extraction confidence can best reflect the quality of the information. This application example maps these three types of confidence to the same dimension, that is, makes the three types of confidence consistent with their true probabilities. The calibrated first confidence and second confidence are called calibration confidence. When the confidence of an extractor (first confidence / second confidence) is calibrated to a standard, given a triplet extracted by the extractor (first triplet / second triplet), if the calibration confidence of the triplet is 0.8, it means that among the 100 triplets with a calibration confidence of 0.8 given by the extractor, 80 triplets are correct information.

[0115] In an exemplary embodiment, this application example uses a pre-built logistic regression model to analyze E U 、E S and E G The confidence of these three extractors is calibrated.

[0116] Given an extractor Q and its training set X, obtaining a calibrated model for Q consists of two steps:

[0117] Use the extractor Q to extract triples (first triples / second triples) from the training set X, and record the extraction confidence of the extracted triples as X ‘ ; The label of the extracted triple is recorded as y. If the triple is true information, y is 1, and if the triple is false information, y is 0. Use the extraction confidence X ‘ As a new input sample, use the sample label y to train a logistic regression model, denoted as M. For a given sample, the given extractor Q extracts the confidence of the sample, and inputs the confidence into the logistic regression model M. The probability value output by M is the calibrated confidence of the sample. Use the above method to obtain the extractor E respectively U 、E S and E G The calibration extractor is denoted as M U 、M S and M G .

[0118] In this application example, the training sets X of the three extractors are different. When Q is the unstructured vulnerability information extractor E U When Q is the input of the entity relationship extraction model, such as unstructured vulnerability text data; when Q is the structured vulnerability information extractor E S , the training set is the input of the entity mapping model, which is used to map the extracted structured data to the CPE dictionary; when Q is the software supply chain graph information extractor E GWhen constructing the software supply chain graph, if the entity mapping model is used to map the original strings of automatically extracted software entities to their corresponding CPE dictionaries, and the first method of calculating the confidence of entity mapping is used, then the training set is the input of the entity mapping model; otherwise, no calibration is required, because the entity mapping degree calculated by the second method of calculating the confidence of entity mapping is 1 or 0, which already represents the true probability distribution; the following calibration steps are all for E G The case of the first method, that is, the case where the probability needs to be calibrated;

[0119] In addition, the training set input sample X and the extracted triples X ‘ It is not necessarily a one-to-one correspondence. Taking entity relationship extraction as an example, a sentence in X may contain multiple entities and relationships, or may contain no entities and relationships. The purpose of probability calibration is to map the extraction confidence of a given triple output by the extractor to the true probability distribution, that is, the calibration confidence. The extraction confidence of the triple and the calibration confidence are in a one-to-one correspondence. If the structured vulnerability information extractor E S and software supply chain graph information extractor E G The entity mapping schemes used in are all unsupervised algorithms. For example, if string similarity is directly used for entity mapping, then the training set X in the first method above is empty. It is necessary to label the triples extracted from structured data and graph data separately to obtain the triple label y. The second method remains unchanged.

[0120] Calibrating the confidence level involves: using M U To S U Each extraction confidence in is calibrated to obtain Using M S To S S Each extraction confidence in is calibrated to obtain M U (S U ) and M S (S S ) U (S U )∪M S (S S ) is denoted as S text , Where m = h + k; use M G To S G Calibrate and get S graph =M G (S G ).

[0121] In one exemplary embodiment, the method of this application example further includes: determining that first triples extracted from two or more vulnerability reports from a vulnerability data source are identical, determining corresponding weights for the different vulnerability reports by generalizing the authenticity-related information of the vulnerability reports; weighting the different first confidences of the extracted identical first triples by the weights determined for each vulnerability report, and summing the weights to obtain a first confidence for the identical first triple. The authenticity-related information includes one or any combination of the following vulnerability report characteristics: release time, last update time, number of updates, and number of reference links. The authenticity-related information is used to measure the freshness, accuracy, and comprehensiveness of vulnerability report information and may include other types of relevant information. In one exemplary embodiment, this application example may also supplement the graph data source with features different from those of the vulnerability reports; combining these features to calculate the credibility of information extracted from the vulnerability reports and the graph data source. In one exemplary embodiment, a later release time and last update time of a vulnerability report in this application example indicates a higher freshness of the information; a greater number of updates indicates that the information is still under maintenance and is likely more accurate; and a greater number of reference links indicates more comprehensive information.

[0122] Table 3 shows the characteristics of vulnerability reports in this application example and their generalization method g(f). In this application example, given a first triple and all m vulnerability reports extracted from the first triple, the method for calculating the weights of these vulnerability reports is to perform the following processing on the i-th (1≤i≤m) vulnerability report in turn:

[0123] Step 1: For each feature of the vulnerability report, use Generalize the features; is the zth feature of the i-th vulnerability report;

[0124] Step 2: Sum all the features after generalization and record it as The set of features summed up for all vulnerability reports is:

[0125] Step 3: Perform normalization to obtain the weight of each vulnerability report

[0126] Information quality is determined by two factors: whether the information extraction process introduces errors, and whether the information in the original data source matches the facts. This application example measures information extraction errors using calibrated first and second confidence levels. The authenticity of vulnerability information in the original vulnerability data source is measured using information such as the release or update time of the vulnerability and the number of data sources containing the triple. These two factors are combined to evaluate the quality of all extracted vulnerability information. Specifically, for each extracted first triple, the first confidence levels of the triple from different data sources and the authenticity of the vulnerability data source are combined to determine the credibility of each first triple.

[0127] feature Generalization Method Release Time Today or yesterday: 10, within a week: 8, within a month: 6, within a year: 4, other: 1 Last updated Today or yesterday: 10, within a week: 8, within a month: 6, within a year: 4, other: 1 Update times Greater than 6:10, between 6 and 2:5, other: 1 Number of reference links 30 and above: 10, 30-20 (between 30 and 20): 8, 20-10: 6, 10-5: 4, other: 1

[0128] Table 3

[0129] Final credibility S total It includes two parts: the first part is the sum of the products of the calibrated confidence of the first triplet extracted from all vulnerability reports in the vulnerability data source (the confidence after the first confidence is calibrated) and the weight of the corresponding vulnerability report; the second part is the product of the calibrated confidence of the second triplet extracted from the software supply chain graph (the confidence after the second confidence is calibrated) and its weight; in an exemplary instance, this application example uses the parameter α to adjust the contribution ratio of these two parts to the final credibility.

[0130]

[0131] Where m is the number of vulnerability reports extracted from the first triple, including both unstructured and structured vulnerability reports; is the weight of the i-th vulnerability report, is the first confidence level corresponding to the vulnerability information in the i-th vulnerability report (which can be the result after calibration); S graph It is also the second confidence level of the information in the graph data source (which can be the result after calibration). If 0<α<1, then the first triplet confidence level S total Between 0 and 1; the first triplet with a score greater than the preset credibility threshold is added to the vulnerability propagation map; for example, given a first triplet and its credibility, if the credibility score is less than 0.3, it means that it is likely to be wrong vulnerability information and is directly discarded; if the credibility is between 0.4 and 0.6, the authenticity of its vulnerability information is further analyzed; if its credibility is greater than 0.7, it means that the first triplet is likely to be true information and is inserted into the vulnerability propagation map.

[0132] The following example illustrates the calculation of credibility: given the first triple, the second triple is extracted from two vulnerability reports and a graph data source; Table 4 gives the credibility S of the first tripletotal The calculation steps are as follows:

[0133] For the two vulnerability reports, perform the following processing:

[0134] For each feature of the vulnerability report, g(f) is used to generalize the feature in turn to obtain the generalized feature of each vulnerability report (see rows 2 to 5 of Table 4 for the generalized features); all the features after generalization are summed up; the set of the sum of the features of the two vulnerability reports is obtained, that is, Its value is {19,14} (see row 6 of Table 4); Perform normalization to obtain the weight of each vulnerability report Its value is {0.58, 0.42} (see row 7 of Table 4); obtain the calibration confidence of the first triple extracted from the two vulnerability reports, whose value is {0.89, 0.78} (see row 8 of Table 4); calculate the weighted sum of the two calibration confidences to obtain the credibility of the triple in the vulnerability data source:

[0135]

[0136] Given the parameter α and the calibration confidence S of the second triplet in the graph data source (i.e., the software supply chain graph), graph , the credibility of the first triple is S total =α*0.84+(1-α)*S graph .

[0137] Extraction source Vulnerability Report 1 Bug Report 2 ①Release time 4 6 ②Last update time 6 6 ③ Update times 5 1 ④Number of reference links 4 1 The sum of the characteristics of the vulnerability report 19 14 Weight 0.58 0.42 Extraction confidence after calibration 0.89 0.78

[0138] Table 4

[0139] This application example will fuse the information extracted from the vulnerability data source and the software supply chain graph, and then add it as a new edge to the vulnerability propagation graph. The introduction of new edges may introduce new nodes, such as new affected software or components, which will propagate the vulnerability to its downstream software or components. Therefore, in order to make the information of the affected software or components covered by the vulnerability propagation graph more comprehensive, the downstream software or components of these new affected software or components also need to be added to the vulnerability propagation graph. In an exemplary instance, this application example can obtain its downstream software or components from the software supply chain graph. Given the software or component corresponding to a node in the vulnerability propagation graph, the software or component is denoted as E. The downstream software supply chain of E in the software supply chain graph can be obtained by analyzing the software supply chain graph, which is mainly divided into two steps:

[0140] To map a given entity E to the software supply chain graph, we simply need to retrieve entity E′ from the software supply chain graph. E′ must satisfy the following conditions: the CPE record corresponding to E is identical to the CPE record corresponding to E′. The entity mapping scheme is the same as the entity pair mapping scheme used in software supply chain information extraction. The entity mapping confidence is calculated using the same method as previously described. If the entity mapping confidence exceeds a preset threshold, the entity's subtree in the software supply chain graph is retrieved and integrated into the vulnerability propagation graph.

[0141] This application example refers to the subtree of relevant technical entities in the software supply chain graph. The example involves: If a given software or component E is successfully mapped to E′ in the software supply chain graph, then E′'s downstream software supply chain is extracted from the software supply chain graph. E′'s downstream software supply chain is a subgraph of the software supply chain graph, essentially a tree with E′ as the root node. All downstream relationships in E′'s downstream supply chain are converted to vulnerability propagation relationships. The obtained downstream supply chain of E′ is then added to the vulnerability propagation graph, replacing the node corresponding to E in the vulnerability propagation graph with E's downstream supply chain.

[0142] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In hardware implementations, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all components may be implemented as software executed by a processor, such as a digital signal processor or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or temporary medium). As is well known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable, and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those skilled in the art that communication media generally embodies computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

Claims

1. A method for generating a vulnerability propagation graph, comprising: Extracting vulnerability information contained in each vulnerability report from one or more vulnerability data sources, and storing the extracted vulnerability information as a first triplet; Extract and store the second triplet containing the same entity pairs as the first triplet from the software supply chain graph; determining the credibility of the first triplet based on a first confidence level of the first triplet and a second confidence level of the second triplet; Performing a determination process of adding the first triplet to the vulnerability propagation graph based on the determined credibility of the first triplet; Among them, the first confidence is extracted in the following manner: when the vulnerability information extracted from the vulnerability data source is unstructured vulnerability information, the first confidence of the first triplet storing the vulnerability information is: according to a preset first weighting coefficient, the prediction confidence of the vulnerability information extraction stage and the mapping confidence of the extracted entity pair mapped to the entity pair of the platform enumeration item CPE dictionary are weighted and summed; when the vulnerability information extracted from the vulnerability data source is structured vulnerability information, the first confidence of the first triplet storing the vulnerability information is: the mapping confidence of the extracted entity pair mapped to the entity pair of the CPE dictionary; the cumulative sum of the prediction confidence and the first weighting coefficient of the mapping confidence of the entity pair is equal to 1.

2. The method according to claim 1, characterized in that The second confidence level is extracted by: Mapping two entities in the first triplet to two entities in the software supply chain graph, respectively. The entities in the first triplet and the entities in the software supply chain graph are both represented by CPE records in the CPE dictionary. The mapping is successful when the entity of the CPE record found in the software supply chain graph is the same as the entity of the CPE record of the first triplet entity. For the entity in the first triple, if the entity mapping is successful, the confidence of the entity mapping is 1, or the original string of the entity in the software supply chain graph to which the entity is mapped is obtained, and the confidence of the entity mapping is the confidence of the entity disambiguation of mapping the original string to the current CPE record of the entity in the first triple; If the entity mapping is unsuccessful, the confidence of the entity mapping is 0; The confidence levels of the entity mappings of the two entities in the first triplet are weighted by a preset second weighting coefficient and then summed to obtain the confidence level of the entity pair mapping; When mapping the first triple to the software supply chain graph, determining that the relationship between the entity pairs of the first triple is consistent with the relationship between the entity pairs in the mapped software supply chain graph, and determining the obtained confidence of the entity pair mapping as the second confidence; determining that the relationship between the entity pairs of the first triple is inconsistent with the relationship between the entity pairs in the mapped software supply chain graph, and determining the second confidence to be 0; The relationship consistency includes: the relationship type between the entity pairs in the first triplet and the relationship type between the entity pairs in the second triplet satisfy a preset one-to-one mapping correspondence.

3. The method according to any one of claims 1-2, characterized in that Determining the credibility of the first triplet includes: The first confidence level and the second confidence level are weighted according to a preset third weighting coefficient and then summed to obtain the credibility level.

4. The method according to claim 3, characterized in that Before determining the credibility of the first triplet, the method further includes: When it is determined that the first triplet is extracted from more than one vulnerability report of the vulnerability data source, determining corresponding weights of different vulnerability reports by generalizing authenticity-related information of the vulnerability reports; The first confidences of the same first triplet are weighted by the weights of the vulnerability reports to obtain a first confidence of the same first triplet. The authenticity-related information includes one or any combination of the following vulnerability report features: release time, last update time, number of updates, and number of reference links.

5. The method according to claim 4, characterized in that The reliability is S total , S total The expression is: Where m is the number of vulnerability reports extracted from the first triplet. represents the weight of the determined i-th vulnerability report, is the first confidence corresponding to the first triplet extracted from the i-th vulnerability report; represents m identical first triples, the first confidence level determined by the weight of the determined vulnerability report; α and 1-α represent the coefficients for weighting the first confidence level and the second confidence level, respectively; S graph Indicates the second confidence corresponding to the second triplet.

6. The method according to claim 3, characterized in that Before determining the credibility of the first triplet, the method further includes: Perform dimensional unification processing on the first confidence level and the second confidence level.

7. The method according to any one of claims 1-2, characterized in that The step of performing the judgment process of adding the first triplet to the vulnerability propagation graph according to the determined credibility of the first triplet includes: When the credibility is greater than or equal to a preset credibility threshold, the first triple is added as an edge of the graph to the vulnerability propagation graph.

8. The method according to any one of claims 1-2, characterized in that The method further comprises: For each entity included in the vulnerability propagation graph, the downstream software supply chain of the entity is extracted from the software supply chain graph, and the extracted downstream software supply chain is added to the vulnerability propagation graph.

9. A computer storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the method for generating a vulnerability propagation map according to any one of claims 1 to 8.

10. A terminal comprising: A memory and a processor, wherein the memory stores a computer program; wherein, The processor is configured to execute the computer program in the memory; When the computer program is executed by the processor, the method for generating a vulnerability propagation graph according to any one of claims 1 to 8 is implemented.

Images