A vulnerability impact range reasoning method and system based on deep learning

Abstract

The present invention relates to a vulnerability impact range reasoning method and system based on deep learning. The steps of the method include: collecting vulnerability information, obtaining the correlation between software products and vulnerabilities based on the vulnerability information, and constructing a vulnerability knowledge graph; constructing a data set of a vulnerability impact range reasoning algorithm model based on the vulnerability knowledge graph; using the constructed data set to construct a vulnerability impact range reasoning algorithm model and train it; using the trained vulnerability impact range reasoning algorithm model to perform vulnerability impact range reasoning. Further, the method also includes the step of evaluating the training results of the vulnerability impact range reasoning algorithm model. In order to solve the problem of low accuracy in vulnerability impact range reasoning, the present invention proposes a vulnerability impact range reasoning method based on deep learning, which can effectively improve the accuracy of vulnerability impact range reasoning and improve the ability to mine security vulnerabilities.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security and relates to a vulnerability impact range reasoning method and system based on deep learning. Background Art

[0002] Open source has far-reaching significance for the development of software. It helps developers share results and allows developers to focus on their own innovations, which promotes the rapid development of technology. According to incomplete statistics, 78% of enterprises are using open source software, and more and more companies are beginning to pay attention to the security of third-party reliance. Open source software has the characteristics of openness, joint participation, and free dissemination. Therefore, the security threats of open source software are prone to software vulnerabilities due to the lack of security awareness and technical level of developers themselves. On the other hand, it is impossible to avoid the introduction of security risks by attackers, such as injecting Trojan programs into open source software to attack the software supply chain. In the life cycle of open source software, various vulnerabilities emerge frequently and are easily exploited by hackers, resulting in property losses. The purpose of vulnerability impact range reasoning is to explore open source software products that have not yet been discovered and are affected by vulnerabilities, so as to discover potential risks in advance.

[0003] At present, the scope of vulnerability impact is usually obtained through NVD (National Vulnerability Database). NVD will give a list of CPE (Common Platform Enumeration) of software affected by the vulnerability in the details page of each vulnerability. However, the CPE list is not complete. For example, the description of CVE-2018-0852 clearly states that the vulnerability affects the software product Microsoft Outlook 2007SP3, but until April 2022, the CPE list published by NVD on the vulnerability details page did not record the software product Microsoft Outlook2007SP3. The existing method of inferring the scope of vulnerability impact infers the software products affected by the file where the vulnerability is located. This method can improve the scope of vulnerability impact to a certain extent, but it requires a lot of manpower to find vulnerability-related files, and only the information of the file where the vulnerability is located is used, and the rest of the vulnerability information is ignored, resulting in low reasoning efficiency and low accuracy. Summary of the invention

[0004] In order to solve the problem of low accuracy in reasoning about the impact range of vulnerabilities, the present invention proposes a method and system for reasoning about the impact range of vulnerabilities based on deep learning. The present invention can effectively improve the accuracy of reasoning about the impact range of vulnerabilities and improve the ability to mine security vulnerabilities.

[0005] The purpose of the present invention is to provide a vulnerability impact range reasoning method based on deep learning. The method constructs a heterogeneous network of vulnerabilities, adopts a deep learning method, and infers the impact range of the vulnerability by link reasoning, so as to effectively help security analysts discover vulnerabilities in software and resolve security risks as soon as possible.

[0006] To achieve the above object, the present invention adopts the following technical solution:

[0007] A vulnerability impact range reasoning method based on deep learning, the steps of which include:

[0008] Collect vulnerability information, obtain the relationship between software products and vulnerabilities based on the vulnerability information, and build a vulnerability knowledge graph;

[0009] Based on the vulnerability knowledge graph, a dataset for the vulnerability impact range reasoning algorithm model is constructed;

[0010] Using the constructed data set, build and train the vulnerability impact range inference algorithm model;

[0011] Use the trained vulnerability impact range inference algorithm model to infer the vulnerability impact range.

[0012] Furthermore, the obtaining of the association between software products and vulnerabilities based on vulnerability information and the construction of a vulnerability knowledge graph includes: based on the existing vulnerability knowledge graph, extracting software version information contained in the vulnerability patch, completing the vulnerability knowledge, improving the association between software products and vulnerabilities, and constructing a new vulnerability knowledge graph.

[0013] Furthermore, the acquisition of the association between software products and vulnerabilities according to vulnerability patches and the construction of a vulnerability knowledge graph includes the following steps:

[0014] a) Collect patches corresponding to the vulnerabilities from the vulnerability information publishing platform.

[0015] b) Obtain the software products affected by the vulnerability and their corresponding versions based on the vulnerability patches, and refine the granularity of software products.

[0016] c) Extract the knowledge graph triple <head entity, tail entity, relationship>, add it to the original vulnerability knowledge graph, and construct a new vulnerability knowledge graph.

[0017] Furthermore, the data set for constructing the vulnerability impact range inference algorithm model includes the following steps:

[0018] a) Formalize the vulnerability knowledge graph as in represents the vertex set (i.e., node set) of the graph, that is, the entity set in the vulnerability knowledge graph, and ε represents the edge set of the graph, that is, the relationship set between entities in the vulnerability knowledge graph. is the attribute set of the nodes in the graph. Each node has a specific node type, and each edge has a specific edge type. The mapping function of the node type is: The mapping function of edge type is: in and represents the set of node types and the set of edge types, and In addition, the attribute mapping function is in is a collection of attribute keys, is a set of attribute values. i Represents node v i The attribute key of s i Represents node v i The attribute value of .

[0019] b) For each node and its attributes in the vulnerability knowledge graph, use initialization models such as PACE (Position-Aware Character Embedding) and BERT to obtain the initial vector representation of each node in the vulnerability knowledge graph.

[0020] c) Extract and divide the data in the vulnerability knowledge graph in proportion to generate training set, validation set and test set.

[0021] Furthermore, the vulnerability impact range inference algorithm model constructed includes GATNE-I or GATNE-T, and the training process of the model includes the following steps:

[0022] a) Input training set Node embedding dimension d, edge embedding dimension s, learning rate η.

[0023] b) Initialize all model parameters.

[0024] c) Perform random walk sampling on the training set according to the batch size to generate a random walk sequence.

[0025] d) Generate training samples from random walk sequences {(v i ,v j ,r)}. Where r represents the node v i and node v j The relationship type.

[0026] e) Perform gradient update according to the loss function to update the model parameters. The loss function is as follows:

[0027]

[0028] Among them, the probability distribution of nodes of type t is P t(v), c j is the node v in the random walk sequence j The context node embedding vector, v i,r For node v i Embedding vector under relation type r, σ(x) is the sigmoid activation function, L is the number of negative samples, v l,k For slave node v j The lth negative sample randomly sampled from the probability distribution of represents the expected calculation, c l,k Represents node v l,k The context embedding vector of .

[0029] Furthermore, in the above step c), meta-paths between various entities are set to guide the random walk algorithm to generate a random walk sequence, so that the random walk sequence contains rich vulnerability knowledge, thereby improving the quality of training samples.

[0030] Furthermore, the above method also includes the step of evaluating the training results of the vulnerability impact range inference algorithm model, specifically including:

[0031] a) Set evaluation indicators, including hit rate (hit@10), average ranking (MR), and average reciprocal ranking (MRR). The calculation formula is as follows:

[0032]

[0033]

[0034]

[0035] in, It is an indicator function. When the input is True, the output is 1, and when the input is False, the output is 0. is the test set, r ij is a triple (v i ,v j ,r)’s ranking.

[0036] b) For each correct triple in the test set, replace the tail node with each software product entity to generate a polluted triple.

[0037] c) Send all polluted triplets and correct triplets to the trained model to obtain the prediction score.

[0038] d) Calculate the hit@10, MR, and MRR of the correct triple in all triples (including correct triples and contaminated triples) according to the calculation formula.

[0039] A vulnerability impact range reasoning system based on deep learning, comprising:

[0040] The vulnerability knowledge graph construction module is used to collect vulnerability information, obtain the relationship between software products and vulnerabilities based on the vulnerability information, and construct a vulnerability knowledge graph;

[0041] The data set construction module is used to construct a data set for the vulnerability impact range reasoning algorithm model based on the vulnerability knowledge graph;

[0042] A model building module is used to build and train a vulnerability impact range inference algorithm model using the constructed data set;

[0043] The vulnerability impact scope reasoning module is used to perform vulnerability impact scope reasoning using the trained vulnerability impact scope reasoning algorithm model.

[0044] The technical solution of the present invention achieves the following beneficial effects:

[0045] The present invention integrates multi-dimensional information of vulnerabilities and uses deep learning technology to improve the semantic understanding of vulnerabilities. It can efficiently and accurately complete the reasoning of the impact scope of vulnerabilities and can effectively mine open source software products that are affected by vulnerabilities that have not yet been discovered, thereby discovering potential vulnerability risks early. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 It is a flow chart of the method of the present invention.

[0047] Figure 2 It is a flow chart for constructing the vulnerability impact range reasoning algorithm model in the present invention. DETAILED DESCRIPTION

[0048] The present invention will be further described below in conjunction with the accompanying drawings. The following examples are only used to more clearly illustrate the technical solution of the present invention, and cannot be used to limit the scope of protection of the present invention. It should be pointed out that the following detailed description is exemplary and is intended to provide further description of the present application.

[0049] This embodiment provides a vulnerability impact range reasoning method based on deep learning, and its overall process is as follows: Figure 1 As shown, it mainly includes the following steps:

[0050] 1) Collect vulnerability data from vulnerability publishing platforms, perform normalization processing, and build a vulnerability knowledge graph. The specific instructions are as follows:

[0051] 1a) Collect patches corresponding to the vulnerability from the vulnerability information release platform. For example, the security vulnerability numbered CVE-2021-32773 originates from the fact that code evaluated using the Racket sandbox may cause system modules to mistakenly use modules created by attackers instead of their expected dependencies. Attackers can use this vulnerability to control system functions, thereby allowing access to facilities that are intended to be restricted. Get the patch link for the vulnerability from the vulnerability details page of NVD. Then go to 1b).

[0052] 1b) Obtain the software products affected by the vulnerability and the corresponding versions according to the vulnerability patch, refine the software product granularity, obtain a data file containing the vulnerability, software product and version number, and go to 1c).

[0053] 1c) According to the type of structured data in the data file, the corresponding parsing class is constructed based on the existing type parsing template, and the data file is traversed to parse the entities and relationships that constitute the knowledge graph. The final generated knowledge graph data file format is composed of data pairs such as <head entity, tail entity, relationship>. It is supplemented to the original vulnerability knowledge graph to build a new vulnerability knowledge graph.

[0054] 2) Based on the vulnerability knowledge graph, construct a dataset for the vulnerability impact range reasoning model, including a training set, a validation set, and a test set.

[0055] 2a) Formalize the vulnerability knowledge graph as in represents the vertex set of the graph, that is, the entity set in the vulnerability knowledge graph, and ε represents the edge set of the graph, that is, the relationship set between entities in the vulnerability knowledge graph. is the attribute set of the nodes in the graph. Each node has a specific node type, and each edge has a specific edge type. The mapping function of the node type is: The mapping function of edge type is: in and represents the set of node types and the set of edge types, and The attribute mapping function is in is a collection of attribute keys, For a set of attribute values, go to 2b).

[0056] 2b) For each node and its attributes in the vulnerability knowledge graph, PACE is used to perform initial vectorization on short text attributes (such as the name of a software product). PACE encodes text as a linear combination of character encoding and position as weight. It can effectively express the semantics of similar texts with repeated characters. For long text attributes (such as the description of the vulnerability), BERT is used for encoding. BERT is a model based on the Transformer encoder implementation and trained on a large-scale corpus. It has been proven to effectively encode text semantics in various natural language processing tasks. Finally, the initial vector representation of each node in the vulnerability knowledge graph is obtained.

[0057] 2c) Based on the existing knowledge graph triple data files, they are extracted and divided into three data sets according to a certain ratio, including training set, validation set and test set.

[0058] 3) Construct a vulnerability impact range inference algorithm model for training.

[0059] The vulnerability impact range inference algorithm model constructed includes GATNE-I. GATNE is a general attributed multiplex heterogeneous network embedding learning framework (General Attributed Multiplex Heterogeneous Network Embedding). GATNE-I is an inductive model of GATNE, which can convert node features into node initial embedding vectors through multi-layer perceptrons. Similarly, GATNE-I combines node features with edge types to obtain edge embedding vectors, and finally combines the two to obtain node embedding vectors under different edge types. Due to the above characteristics, GATNE-I is more suitable for situations where new nodes continue to appear.

[0060] Among them, the vulnerability impact range inference algorithm model training process is as follows Figure 2 The specific instructions are as follows:

[0061] 3a) Input training set Embedding dimension d, learning rate η, weight matrix M r , go to 3b).

[0062] 3b) Initialize all model parameters using the Xavier method and go to 3c).

[0063] 3c) Set the meta-path between entities, use the random walk based on the meta-path, perform random walk sampling on the training set according to the batch size, and generate a random walk sequence. The meta-path is a sequence of alternating entity types and relationships. It can well guide heterogeneous networks similar to knowledge graphs to generate random walk sequences, and go to 3d).

[0064] 3d) Generate training samples from random walk sequences {(v i ,v j ,r)}, go to 3e).

[0065] 3e) Perform gradient update according to the loss function to update the model parameters. The loss function is as follows:

[0066]

[0067] Among them, the probability distribution of nodes of type t is P t (v), c j is the node v in the random walk sequence j The context node embedding vector, v i,r For node v i Embedding vector under relation type r, σ(x) is the sigmoid activation function, L is the number of negative samples, v l,k For slave node v j The lth negative sample randomly sampled from the probability distribution of represents the expected calculation, c l,k Represents node v l,k The context embedding vector of .

[0068] 4) Evaluation of algorithm model training results.

[0069] 4a) After obtaining the trained model, set evaluation indicators to evaluate the model effect, including hit rate (hit@10), mean ranking (MR), and mean reciprocal ranking (MRR). The calculation formula is as follows:

[0070]

[0071]

[0072]

[0073] in, It is an indicator function. When the input is True, the output is 1, and when the input is False, the output is 0. is the test set, r ij is a triple (v i ,e,v j ). Go to 4b).

[0074] 4b) For each correct triple in the test set, replace the tail node with each product entity to generate a polluted triple, and go to 4c).

[0075] 4c) Send all polluted triplets and correct triplets to the trained model to obtain prediction scores, and go to 4d).

[0076] 4d) Calculate the hit@10, MR, and MRR of the correct triplet among all triples according to the calculation formula.

[0077] 5) Use the trained vulnerability impact range inference algorithm model to infer the vulnerability impact range

[0078] In actual application scenarios, the trained vulnerability impact range inference algorithm model is used to input vulnerabilities, software products and related attributes, and the algorithm model is used to calculate and process them to output the vulnerability impact range inference results.

[0079] Based on the same inventive concept, another embodiment of the present invention provides a vulnerability impact range reasoning system based on deep learning, which includes:

[0080] The vulnerability knowledge graph construction module is used to collect vulnerability information, obtain the relationship between software products and vulnerabilities based on the vulnerability information, and construct a vulnerability knowledge graph;

[0081] The data set construction module is used to construct a data set for the vulnerability impact range reasoning algorithm model based on the vulnerability knowledge graph;

[0082] A model building module is used to build and train a vulnerability impact range inference algorithm model using the constructed data set;

[0083] The vulnerability impact scope reasoning module is used to perform vulnerability impact scope reasoning using the trained vulnerability impact scope reasoning algorithm model.

[0084] The specific implementation process of each module refers to the above description of the method of the present invention.

[0085] Based on the same inventive concept, another embodiment of the present invention provides a computer device (computer, server, smart phone, etc.), which includes a memory and a processor, the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program includes instructions for executing each step in the method of the present invention.

[0086] Based on the same inventive concept, another embodiment of the present invention provides a computer-readable storage medium (such as ROM / RAM, disk, CD), which stores a computer program. When the computer program is executed by a computer, it implements the various steps of the method of the present invention.

[0087] The specific embodiments of the present invention disclosed above are intended to help understand the content of the present invention and implement it accordingly. It can be understood by those skilled in the art that various replacements, changes and modifications are possible without departing from the spirit and scope of the present invention. The present invention should not be limited to the contents disclosed in the embodiments of this specification, and the scope of protection of the present invention shall be subject to the scope defined in the claims.

Claims

1. A vulnerability impact range reasoning method based on deep learning, characterized in that: The following steps are involved: Collect vulnerability information, obtain the relationship between software products and vulnerabilities based on the vulnerability information, and build a vulnerability knowledge graph; Based on the vulnerability knowledge graph, a dataset for the vulnerability impact range reasoning algorithm model is constructed; Using the constructed data set, build and train the vulnerability impact range inference algorithm model; Use the trained vulnerability impact range inference algorithm model to infer the vulnerability impact range; The step of obtaining the association between software products and vulnerabilities according to the vulnerability information and constructing a vulnerability knowledge graph includes: Collect patches corresponding to the vulnerabilities from the vulnerability information release platform; According to the vulnerability patches, the software products affected by the vulnerability and their corresponding versions are obtained, and the granularity of software products is refined; Extract the knowledge graph triples <head entity, tail entity, relationship>, add them to the original vulnerability knowledge graph, and build a new vulnerability knowledge graph; The data set for constructing the vulnerability impact range reasoning algorithm model based on the vulnerability knowledge graph includes: For each node and its attributes in the vulnerability knowledge graph, PACE is used to perform initial vectorization on short text attributes, and BERT is used to perform initial vectorization on long text attributes. Divide the data in the vulnerability knowledge graph into training sets, validation sets, and test sets according to the proportions; The vulnerability impact range inference algorithm model includes GATNE-I or GATNE-T, and the training process of the vulnerability impact range inference algorithm model includes: Input training set in represents the vertex set of the graph, that is, the entity set in the vulnerability knowledge graph; ε represents the edge set of the graph, that is, the relationship set between entities in the vulnerability knowledge graph; is the attribute set of the nodes in the graph; Initialize all model parameters; Perform random walk sampling on the training set according to the batch size to generate a random walk sequence; Generate training samples from random walk sequences {(v i , v j , r)}, where r represents the node v i and node v j The type of relationship; Perform gradient updates according to the loss function to update the model parameters. The loss function is as follows: Among them, the probability distribution of nodes of type t is P t (v), c j is the node v in the random walk sequence j The context node embedding vector, v i，r For node v i Embedding vector under relation type r, σ(x) is the sigmoid activation function, L is the number of negative samples, v l，k For slave node v j The lth negative sample randomly sampled from the probability distribution of represents the expected calculation, c l，k Represents node v l，k The context embedding vector of The method further includes the step of evaluating the training results of the vulnerability impact range inference algorithm model, specifically including: Set evaluation indicators, including hit rate hit@10, average ranking MR, and average reciprocal ranking MRR. The calculation formula is as follows: in, It is an indicator function. When the input is True, the output is 1, and when the input is False, the output is 0. is the test set; r ij is a triple (v i ,v j ,r)’s ranking; For each correct triple in the test set, replace the tail node with each software product entity to generate a polluted triple; Send all polluted triplets and correct triplets to the trained model to get the prediction score; The hit@10, MR, and MRR of the correct triplet among all triples are calculated according to the calculation formula.

2. The method according to claim 1, characterized in that The random walk sampling is performed on the training set according to the batch size to generate a random walk sequence, including: setting a meta-path between multiple entities to guide the random walk algorithm to generate a random walk sequence, so that the random walk sequence contains rich vulnerability knowledge and improves the quality of training samples.

3. The method according to claim 1, characterized in that The method of using the trained vulnerability impact scope reasoning algorithm model to perform vulnerability impact scope reasoning includes: in an actual application scenario, using the trained vulnerability impact scope reasoning algorithm model, inputting vulnerabilities, software products and related attributes, calculating and processing them through the vulnerability impact scope reasoning algorithm model, and outputting vulnerability impact scope reasoning results.

4. A vulnerability impact range reasoning system based on deep learning using the method described in any one of claims 1 to 3, characterized in that: The following steps are involved: The vulnerability knowledge graph construction module is used to obtain vulnerability patches, obtain the association between software products and vulnerabilities based on the vulnerability patches, and construct a vulnerability knowledge graph; The data set construction module is used to construct a data set for the vulnerability impact range reasoning algorithm model based on the vulnerability knowledge graph; A model building module is used to build and train a vulnerability impact range inference algorithm model using the constructed data set; The vulnerability impact scope reasoning module is used to perform vulnerability impact scope reasoning using the trained vulnerability impact scope reasoning algorithm model.

5. A computer device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program comprises instructions for executing the method according to any one of claims 1 to 3.

6. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a computer, the method according to any one of claims 1 to 3 is implemented.

Images