Vulnerability clustering method, device, electronic device and storage medium

Abstract

The embodiments of the present disclosure disclose a vulnerability clustering method, apparatus, electronic device and storage medium, comprising: dividing an initial vulnerability set into at least two defined vulnerability sets according to preset conditions, and then determining cluster centers of each process; clustering the initial vulnerability set based on the cluster centers of each process to determine clustered vulnerability sets; if there is at least one clustered vulnerability set that is different from the corresponding defined vulnerability set, then for each clustered vulnerability set, taking the intersection of the clustered vulnerability set and the corresponding defined vulnerability set as a new defined vulnerability set; updating the initial vulnerability set according to each defined vulnerability set, and returning to the step of determining the cluster centers of each process until each clustered vulnerability set and the corresponding defined vulnerability set are the same; otherwise, taking the cluster centers of each process as target cluster centers, clustering the initial vulnerability set according to each target cluster center to obtain each target vulnerability set, so as to cluster vulnerabilities according to requirements and improve the practicality of vulnerability classification.

Description

Technical Field

[0001] The present disclosure relates to the field of data analysis technology, and in particular to a vulnerability clustering method, device, electronic device, and storage medium. Background Art

[0002] In the autonomous driving scenario, there are a certain number of vulnerabilities (bugs). Effective analysis of these vulnerabilities can improve the effectiveness of autonomous driving development.

[0003] However, since different technicians focus on different types of vulnerabilities, judging them one by one will consume a lot of manpower, and the categories obtained by directly using clustering algorithms for classification cannot meet the expectations of different technicians.

[0004] Therefore, how to effectively classify vulnerabilities based on the needs of technicians is an area that urgently needs research in the field of autonomous driving. Summary of the Invention

[0005] In order to solve the above technical problems or at least partially solve the above technical problems, the embodiments of the present disclosure provide a vulnerability clustering method, device, electronic device and storage medium, which can effectively and quickly cluster vulnerabilities accurately according to the needs of technical personnel, thereby improving the practicality of vulnerability classification.

[0006] In a first aspect, an embodiment of the present disclosure provides a vulnerability clustering method, the method comprising:

[0007] Dividing the initial vulnerability set into at least two defined vulnerability sets according to a preset condition, and determining a process cluster center corresponding to each of the defined vulnerability sets;

[0008] Determine, based on the initial vulnerability set and at least two process cluster centers, a cluster vulnerability set corresponding to each process cluster center;

[0009] If there is at least one cluster vulnerability set that is different from the defined vulnerability set corresponding to the cluster vulnerability set, then for each cluster vulnerability set, the intersection of the cluster vulnerability set and the defined vulnerability set corresponding to the cluster vulnerability set is used as a new defined vulnerability set; the initial vulnerability set is updated according to each defined vulnerability set, and the step of determining the process cluster center corresponding to each defined vulnerability set is returned to and performed until each cluster vulnerability set and the defined vulnerability set corresponding to the cluster vulnerability set are the same; wherein the cluster vulnerability set corresponding to the same process cluster center and the defined vulnerability set have a corresponding relationship;

[0010] If each of the clustered vulnerability sets is the same as the defined vulnerability set corresponding to the clustered vulnerability set, each of the process cluster centers is used as a target cluster center, and clustering is performed based on each of the target cluster centers and the initial vulnerability set to obtain each target vulnerability set.

[0011] In a second aspect, an embodiment of the present disclosure further provides a vulnerability clustering device, the device comprising:

[0012] a process cluster center determination module, configured to divide the initial vulnerability set into at least two defined vulnerability sets according to a preset condition, and determine a process cluster center corresponding to each of the defined vulnerability sets;

[0013] a cluster vulnerability set determining module, configured to determine, based on the initial vulnerability set and at least two process cluster centers, a cluster vulnerability set corresponding to each process cluster center;

[0014] a cyclic updating module configured to, if at least one of the clustered vulnerability sets is different from the defined vulnerability set corresponding to the clustered vulnerability set, use, for each clustered vulnerability set, the intersection of the clustered vulnerability set and the defined vulnerability set corresponding to the clustered vulnerability set as a new defined vulnerability set; update the initial vulnerability set according to each defined vulnerability set, and return to the step of determining the process cluster center corresponding to each defined vulnerability set until each clustered vulnerability set is the same as the defined vulnerability set corresponding to the clustered vulnerability set;

[0015] A vulnerability set classification module is used to, if each of the clustered vulnerability sets and the defined vulnerability set corresponding to the clustered vulnerability set are the same, use each of the process cluster centers as the target cluster center, and perform clustering based on each of the target cluster centers and the initial vulnerability set to obtain each target vulnerability set.

[0016] In a third aspect, an embodiment of the present disclosure further provides an electronic device, comprising: one or more processors; a storage device for storing one or more programs; and when the one or more programs are executed by the one or more processors, the one or more processors implement the vulnerability clustering method as described above.

[0017] In a fourth aspect, an embodiment of the present disclosure further provides a computer-readable storage medium having a computer program stored thereon, which implements the vulnerability clustering method described above when executed by a processor.

[0018] The embodiment of the present disclosure provides a vulnerability clustering method, which classifies an initial vulnerability set based on preset conditions to obtain at least two defined vulnerability sets, and calculates the process cluster center of each defined vulnerability set. Then, the initial vulnerability set is clustered according to the process cluster center to obtain each cluster vulnerability set, and it is determined whether each group of mutually corresponding cluster vulnerability sets and the defined vulnerability set are the same. If they are different, the intersection of each group of cluster vulnerability sets and the defined vulnerability set is used as a new defined vulnerability set, and the set composed of each new defined vulnerability set is used as a new initial vulnerability set, so as to repeatedly perform the step of determining each process cluster center until each group of mutually corresponding cluster vulnerability sets and the defined vulnerability set are the same; if they are the same, it indicates that the clustering algorithm has been combined with the preset conditions, and the process cluster center at this time is used as the target cluster center, and the original initial vulnerability set is clustered according to the target cluster center to obtain each target vulnerability set, thereby achieving effective and rapid accurate clustering of vulnerabilities according to the needs of technical personnel, thereby improving the practicality of vulnerability classification. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The above and other features, advantages, and aspects of the various embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that the originals and elements are not necessarily drawn to scale.

[0020] Figure 1 This is a flow chart of a vulnerability clustering method according to an embodiment of the present disclosure;

[0021] Figure 2 Schematic diagram of the structure of a vulnerability clustering device in an embodiment of the present disclosure;

[0022] Figure 3 Schematic diagram of the structure of an electronic device in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0023] The following describes embodiments of the present disclosure in more detail with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as limited to the embodiments described herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are for illustrative purposes only and are not intended to limit the scope of protection of the present disclosure.

[0024] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0025] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0026] Clustering algorithms, also known as group analysis, can solve classification problems based on sample similarities. Clustering algorithms are unsupervised algorithms; the specific categories of samples are not known in advance. Instead, they determine the categories based on the similarities between the sample's characteristic fields. The advantage of clustering algorithms is that they can automatically aggregate samples into the desired number of categories without labeling them. However, because clustering algorithms are unsupervised, when clustering vulnerabilities, the classification criteria they output may differ significantly from actual requirements.

[0027] In response to the above problems, the embodiments of the present disclosure provide a vulnerability clustering method to effectively and quickly cluster vulnerabilities accurately according to the needs of technical personnel, thereby improving the practicality of vulnerability classification.

[0028] Figure 1 This is a flow chart of a vulnerability clustering method in an embodiment of the present disclosure. The method can be executed by a vulnerability clustering device, which can be implemented in software and / or hardware, and can be configured in an electronic device. Figure 1 As shown, the method may specifically include the following steps:

[0029] S110 , dividing the initial vulnerability set into at least two defined vulnerability sets according to a preset condition, and determining a process cluster center corresponding to each defined vulnerability set.

[0030] The preset conditions can be conditions set based on requirements for preliminary classification, such as those set by technical personnel. The initial vulnerability set can be a set of pre-collected vulnerabilities that require clustering. The defined vulnerability set can be a set of vulnerabilities in the initial vulnerability set that meet different preset conditions. The process cluster center is the cluster center corresponding to each vulnerability in the defined vulnerability set.

[0031] Specifically, the initial vulnerability set is preliminarily divided according to preset conditions to determine the vulnerabilities corresponding to each preset condition. For each preset condition, the set of vulnerabilities corresponding to the preset condition is determined as a defined vulnerability set. For each defined vulnerability set, the center value of the characteristic field of each vulnerability in the defined vulnerability set constitutes the process cluster center of the defined vulnerability set. For example, the process cluster center of each defined vulnerability set is calculated based on the Euclidean distance clustering algorithm.

[0032] Based on the above example, the at least two defined vulnerability sets include defining a key vulnerability set, defining a marginal vulnerability set, and defining a common vulnerability set. The initial vulnerability set can be divided into at least two defined vulnerability sets according to preset conditions in the following manner:

[0033] According to the preset conditions corresponding to the defined edge vulnerabilities, a defined edge vulnerability set is determined from the initial vulnerability set; according to the preset conditions corresponding to the defined key vulnerabilities, a defined key vulnerability set is determined from the initial vulnerability set excluding the defined edge vulnerability set; the part of the initial vulnerability set excluding the defined key vulnerability set and the defined edge vulnerability set is used as the defined common vulnerability set.

[0034] Among them, the preset conditions corresponding to the definition of marginal vulnerabilities include vulnerabilities whose processing time is ranked before the first preset percentage from longest to shortest and whose non-update time reaches the preset number of days. The preset conditions corresponding to the definition of key vulnerabilities include vulnerabilities whose number of assigned people exceeds the preset number, whose processing time is ranked before the second preset percentage from longest to shortest and whose update frequency reaches the preset frequency. The first preset percentage and the second preset percentage are percentages set according to the needs of technical personnel, and the first preset percentage is less than the second preset percentage. The preset number of days, the preset number of people, and the preset frequency are values ​​set according to the needs of technical personnel and are not specifically limited in this embodiment.

[0035] Specifically, the set of vulnerabilities in the initial vulnerability set that are ranked before the first preset percentage after processing time is arranged from longest to short and have not been updated for a preset number of days can be used as the definition edge vulnerability set. For example, the set of vulnerabilities in the initial vulnerability set that are ranked in the top 10% (processing time exceeds 90% of the number of vulnerabilities) in processing time and have not been updated for more than 21 days can be used as the definition edge vulnerability set. The definition edge vulnerability set is excluded from the initial vulnerability set, and the set of vulnerabilities in the remaining part that have more than a preset number of assigned people, are ranked before the second preset percentage after processing time is arranged from longest to short, and have an update frequency that reaches a preset frequency can be used as the definition key vulnerability set. For example, the set of vulnerabilities in the initial vulnerability set excluding the definition edge vulnerability set that have more than 3 assigned R&D personnel, are ranked in the top 25% (processing time exceeds 3 / 4 of the number of vulnerabilities), and have a frequent status update frequency can be used as the definition key vulnerability set. Furthermore, the set of vulnerabilities in the initial vulnerability set excluding the definition key vulnerability set and the definition edge vulnerability set can be used as the definition common vulnerability set.

[0036] S120 : Determine, based on the initial vulnerability set and at least two process cluster centers, a cluster vulnerability set corresponding to each process cluster center.

[0037] The clustered vulnerability set may be a vulnerability set obtained by clustering each vulnerability in the initial vulnerability set with the process cluster center as the center.

[0038] Specifically, the vulnerabilities in the initial vulnerability set are clustered according to the calculated process cluster centers, for example, based on the Euclidean distance clustering algorithm, the k-means algorithm, etc., to obtain a clustered vulnerability set centered on each process cluster center.

[0039] Based on the above example, the cluster vulnerability set corresponding to each process cluster center can be determined based on the initial vulnerability set and at least two process cluster centers in the following manner:

[0040] According to the initial vulnerability set and the fields to be trained, the clustering field set corresponding to the initial vulnerability set is determined; based on the preset clustering algorithm, the clustering field set is clustered with each process cluster center as the center to obtain the clustering vulnerability set corresponding to each process cluster center.

[0041] The training fields can be fields included in the vulnerability for clustering, such as vehicle model, project, proposer, assigner, department, start time, and update time. The clustering field set can be the set of training fields corresponding to each vulnerability in the initial vulnerability set. The pre-set clustering algorithm can be a Euclidean distance clustering algorithm, a k-means algorithm, or other algorithms.

[0042] Specifically, based on clustering requirements, fields to be trained are determined, and information about the fields to be trained is extracted from each vulnerability in the initial vulnerability set to obtain a clustered field set. It is understood that the process cluster center also includes information corresponding to each field to be trained. Furthermore, a preset clustering algorithm can be used to cluster the clustered field set around each process cluster center, with the vulnerabilities corresponding to the partial clustered field set corresponding to each process cluster center being considered the clustered vulnerability set corresponding to that process cluster center.

[0043] S130. If there is at least one cluster vulnerability set that is different from the defined vulnerability set corresponding to the cluster vulnerability set, then for each cluster vulnerability set, the intersection of the cluster vulnerability set and the defined vulnerability set corresponding to the cluster vulnerability set is used as a new defined vulnerability set; the initial vulnerability set is updated according to each defined vulnerability set, and the step of determining the process cluster center corresponding to each defined vulnerability set is returned to, until each cluster vulnerability set is the same as the defined vulnerability set corresponding to the cluster vulnerability set.

[0044] Among them, the cluster vulnerability set and the definition vulnerability set corresponding to the same process cluster center have a corresponding relationship.

[0045] Specifically, determine whether the clustered vulnerability set and the defined vulnerability set corresponding to each group are the same. If they are different, it indicates that the clustering algorithm is not fully compatible with the preset conditions. Therefore, the following processing is required: for each clustered vulnerability set, the intersection of the clustered vulnerability set and the defined vulnerability set corresponding to the clustered vulnerability set is used as a new defined vulnerability set. Then, these new defined vulnerability sets are combined together to form a new initial vulnerability set. After updating each defined vulnerability set and the initial vulnerability set, the step of determining the process cluster center corresponding to each defined vulnerability set can be returned to re-cluster to obtain a new clustered vulnerability set until the clustered vulnerability set and the defined vulnerability set corresponding to each group are the same, indicating that the clustering algorithm is fully compatible with the preset conditions, and the cluster center and clustering results can be used subsequently.

[0046] S140: If each cluster vulnerability set is the same as the defined vulnerability set corresponding to the cluster vulnerability set, each process cluster center is used as a target cluster center, and clustering is performed based on each target cluster center and the initial vulnerability set to obtain each target vulnerability set.

[0047] The target cluster center can be the cluster center used for subsequent clustering. It is the center of each clustered vulnerability set after all clustered vulnerability sets are identical to the corresponding defined vulnerability set. The target vulnerability set is the vulnerability set obtained by clustering the vulnerabilities in the initial vulnerability set based on the target cluster center. It can be understood as the final clustering result of the initial vulnerability set.

[0048] Specifically, if the clustered vulnerability sets corresponding to each group are the same as the defined vulnerability sets, it indicates that the clustering algorithm is fully adapted to the preset conditions. The process clustering center at this time is used as the target clustering center, and the vulnerabilities in the initial vulnerability set are clustered with each target clustering center as the center to obtain the clustering results corresponding to each target clustering center, that is, each target vulnerability set.

[0049] It is also understood that the original initial vulnerability set (i.e., the initial vulnerability set before the update) is clustered according to each target cluster center to obtain each target vulnerability set. If the updated initial vulnerability set is clustered, the following clustering process can be performed on the remaining vulnerabilities that have not yet been determined as target vulnerability sets.

[0050] Based on the above example, after taking each process cluster center as the target cluster center and clustering according to each target cluster center and the initial vulnerability set to obtain each target vulnerability set, we can also cluster the unclassified vulnerabilities (vulnerabilities to be classified):

[0051] Obtain the vulnerabilities to be classified, and determine the characteristic distances between the vulnerabilities to be classified and each target cluster center respectively; determine the minimum value of each characteristic distance as the target distance, and determine the target vulnerability set corresponding to the vulnerabilities to be classified based on the target cluster centers corresponding to the target distances.

[0052] Unclassified vulnerabilities are those that have not yet been clustered to determine the target vulnerability set's category. This means they haven't yet been assigned to a target cluster set. These vulnerabilities can be newly acquired vulnerabilities. The feature distance is the distance between the feature field information of the unclassified vulnerability and the feature field information of the target cluster center. The target distance is the minimum value among all feature distances.

[0053] Specifically, unclassified vulnerabilities are obtained as vulnerabilities to be classified. The distances between the characteristic field information of the vulnerabilities to be classified and the characteristic field information of each target cluster center are calculated to obtain the characteristic distance corresponding to each target cluster center. The minimum value of the characteristic distances is used as the target distance, and the target cluster center corresponding to the target distance is determined. The target vulnerability set corresponding to the target cluster center is then determined as the target vulnerability set corresponding to the vulnerabilities to be classified.

[0054] Based on the above example, after determining the vulnerability set corresponding to the vulnerability to be classified, it is also possible to determine whether to perform warning processing based on the type of the target vulnerability set. Specifically, it can be:

[0055] If the target vulnerability set corresponding to the vulnerability to be classified belongs to the warning set, warning information is generated according to the vulnerability to be classified and the target vulnerability set corresponding to the vulnerability to be classified, and the warning information is sent to the processing personnel corresponding to the vulnerability to be classified.

[0056] The warning set includes at least one target vulnerability set. For example, the target vulnerability set includes a target key vulnerability set, a target marginal vulnerability set, and a target common vulnerability set. The warning set also includes a target key vulnerability set and a target marginal vulnerability set. Of course, the scope of the warning set can also be set based on actual warning needs. Warning information is used to indicate that unclassified vulnerabilities in the warning set require timely processing. The processing personnel can be the technical personnel assigned to the unclassified vulnerability.

[0057] Specifically, after determining the target vulnerability set to which the vulnerability to be classified belongs, a determination is made as to whether the target vulnerability set belongs to the warning set. If not, the vulnerability to be classified proceeds normally. If it does, it indicates that the vulnerability to be classified requires prompt reminders and warnings. Therefore, a warning message can be generated based on the vulnerability to be classified and the target vulnerability set to which it belongs, and sent to the person handling the vulnerability to be classified, reminding them that the target vulnerability set corresponding to the vulnerability to be classified requires prompt handling.

[0058] Based on the above example, the target vulnerability set includes a target key vulnerability set, which corresponds to the defined key vulnerability set. After obtaining each target vulnerability set, the target key vulnerability set can be further subdivided, specifically:

[0059] For a target key vulnerability set, determine a key vulnerability text field in the target key vulnerability set;

[0060] Perform word segmentation on the key vulnerability text fields to obtain a set of key vulnerability keywords;

[0061] Determine the target feature set corresponding to the target key vulnerability set based on the key vulnerability keyword set and the pre-established full vulnerability vocabulary;

[0062] Based on the target feature set, free clustering is performed to obtain at least two key vulnerability subsets.

[0063] Among them, the key vulnerability text field can be understood as a large text field in each field corresponding to the vulnerability that cannot be used for clustering processing. The key vulnerability text field includes the vulnerability title field and the vulnerability solution field. The key vulnerability keyword set includes the vulnerability keywords corresponding to each key vulnerability in the target key vulnerability set. The vulnerability keyword can be the keyword obtained after keyword extraction of each key vulnerability. The full vulnerability vocabulary can be the keyword obtained after keyword extraction of each vulnerability in the vulnerability set of various categories, that is, it includes keywords for all vulnerabilities. For example, it can be a vulnerability vocabulary in the field of unmanned driving. The target feature set can be a set composed of the correspondence results between each group of keywords in the key vulnerability keyword set and each keyword in the full vulnerability vocabulary. For example, the corresponding result can be that the part of each keyword in the full vulnerability vocabulary that corresponds to each group of keywords in the key vulnerability keyword set is set to 1, and the non-corresponding part is set to 0, etc. The key vulnerability subset is the clustering result after further subdividing the key vulnerability set according to the key vulnerability text field.

[0064] Specifically, since the target key vulnerability set is a set of vulnerabilities that require special attention, it can be further subdivided and processed. Based on all vulnerability data, keyword extraction is performed on the vulnerability title field and vulnerability solution field of these vulnerability data, such as Jieba word segmentation processing, and the obtained keywords are combined to construct a full vulnerability vocabulary. Furthermore, word segmentation processing is performed on the key vulnerability text fields in the target key vulnerability set, namely the vulnerability title field and the vulnerability solution field, namely keyword extraction, which can also be Jieba word segmentation processing, and the obtained keywords are used as key vulnerability keywords. The key vulnerability keywords corresponding to each key vulnerability are combined to obtain a key vulnerability keyword set. For the key vulnerability keywords corresponding to each key vulnerability in the key vulnerability keyword set, these key vulnerability keywords are matched with each keyword in the full vulnerability vocabulary to obtain the target features corresponding to each key vulnerability. Then, a target feature set is constructed based on each target feature. Each target feature in the target feature set is subjected to free clustering processing using a clustering algorithm, and at least two groups of clustering results can be obtained, namely at least two key vulnerability subsets.

[0065] Based on the above example, the target vulnerability set also includes a target edge vulnerability set and a target common vulnerability set. The target edge vulnerability set corresponds to the defined edge vulnerability set, and the target common vulnerability set corresponds to the defined common vulnerability set. Statistics can also be periodically processed for the vulnerabilities (vulnerabilities to be counted) in the newly determined target vulnerability set to generate a vulnerability analysis report to remind the target personnel:

[0066] Periodically obtain vulnerabilities to be counted and determine the target vulnerability set corresponding to each vulnerability to be counted;

[0067] Determine first statistical data for each of the vulnerabilities to be counted, wherein the target vulnerability set is a target edge vulnerability set and a target common vulnerability set;

[0068] For the vulnerabilities to be counted whose target vulnerability set is a target key vulnerability set, determining a key vulnerability subset corresponding to each vulnerability to be counted, and determining second statistical data respectively based on each key vulnerability subset;

[0069] A vulnerability analysis report is generated based on each first statistical data and each second statistical data, and the vulnerability analysis report is sent to a target person.

[0070] In particular, periodicity can be a processing method for performing statistics according to a preset period. The preset period can be determined based on statistical requirements and is not specifically limited in this embodiment. The vulnerabilities to be counted are the vulnerabilities in the target vulnerability set determined within the current period. The first statistical data includes at least one of statistical data of the module to which the vulnerability belongs, statistical data of processing time, statistical data of processing department, and statistical data of processing personnel. The second statistical data includes at least one of statistical data of the module to which the vulnerability belongs, statistical data of processing time, statistical data of processing department, and statistical data of processing personnel. The vulnerability analysis report can be a report that integrates the first statistical data and the second statistical data. The target personnel can be, for example, managers who perform statistical analysis on each vulnerability.

[0071] Specifically, when a preset period is reached, each vulnerability to be counted generated within the current period and the target vulnerability set corresponding to each vulnerability to be counted are obtained. For vulnerabilities to be counted whose target vulnerability set is a target edge vulnerability set or a target common vulnerability set, at least one of the following statistics of the module to which the vulnerability belongs, the statistical data of the processing time, the statistical data of the processing department, and the statistical data of the processing personnel are counted, and the statistical results are used as first statistical data. For vulnerabilities to be counted whose target vulnerability set is a target key vulnerability set, the key vulnerability subset to which the vulnerabilities to be counted belong is further determined. For the vulnerabilities to be counted in each key vulnerability subset, at least one of the following statistics of the module to which the vulnerability belongs, the statistical data of the processing time, the statistical data of the processing department, and the statistical data of the processing personnel are counted, and the statistical results are used as second statistical data. Furthermore, the first statistical data corresponding to the target edge vulnerability set and the target common vulnerability set and the second statistical data corresponding to each key vulnerability subset are integrated to generate a vulnerability analysis report, and the vulnerability analysis report is sent to the target personnel to provide vulnerability analysis assistance to the target personnel and improve the target personnel's analysis efficiency of the vulnerabilities in the current period.

[0072] The vulnerability clustering method provided in this embodiment classifies an initial vulnerability set based on preset conditions to obtain at least two defined vulnerability sets, and calculates the process cluster center of each defined vulnerability set. Then, the initial vulnerability set is clustered according to the process cluster center to obtain each cluster vulnerability set, and it is determined whether each group of corresponding cluster vulnerability sets and the defined vulnerability set are the same. If not, the intersection of each group of cluster vulnerability sets and the defined vulnerability set is used as a new defined vulnerability set, and the set composed of each new defined vulnerability set is used as a new initial vulnerability set, so as to repeatedly perform the step of determining each process cluster center until each group of corresponding cluster vulnerability sets and the defined vulnerability set are the same; if they are the same, it indicates that the clustering algorithm has been combined with the preset conditions, and the process cluster center at this time is used as the target cluster center. The original initial vulnerability set is clustered according to the target cluster center to obtain each target vulnerability set, thereby achieving effective and rapid accurate clustering of vulnerabilities according to the needs of technical personnel, thereby improving the practicality of vulnerability classification.

[0073] Figure 2 FIG. 1 is a schematic diagram of the structure of a vulnerability clustering device according to an embodiment of the present disclosure. Figure 2 As shown, the apparatus includes: a process cluster center determination module 210 , a cluster vulnerability set determination module 220 , a cyclic updating module 230 and a vulnerability set classification module 240 .

[0074] Among them, the process cluster center determination module 210 is used to divide the initial vulnerability set into at least two defined vulnerability sets according to preset conditions, and determine the process cluster center corresponding to each of the defined vulnerability sets; the cluster vulnerability set determination module 220 is used to determine the cluster vulnerability set corresponding to each of the process cluster centers based on the initial vulnerability set and at least two of the process cluster centers; the cyclic update module 230 is used to, if there is at least one of the cluster vulnerability sets that is different from the defined vulnerability set corresponding to the cluster vulnerability set, then, for each cluster vulnerability set, use the intersection of the cluster vulnerability set and the defined vulnerability set corresponding to the cluster vulnerability set as a new defined vulnerability set. Vulnerability set; updating the initial vulnerability set according to each defined vulnerability set, returning to the step of determining the process cluster center corresponding to each defined vulnerability set, until each cluster vulnerability set and the defined vulnerability set corresponding to the cluster vulnerability set are the same; wherein the cluster vulnerability set corresponding to the same process cluster center and the defined vulnerability set have a corresponding relationship; a vulnerability set classification module 240 is used to, if each cluster vulnerability set and the defined vulnerability set corresponding to the cluster vulnerability set are the same, use each process cluster center as a target cluster center, and perform clustering according to each target cluster center and the initial vulnerability set to obtain each target vulnerability set.

[0075] Based on the above example, optionally, the cluster vulnerability set determination module 220 is further used to determine a cluster field set corresponding to the initial vulnerability set based on the initial vulnerability set and the field to be trained; based on a preset clustering algorithm, the cluster field set is clustered with each of the process cluster centers as the center to obtain a cluster vulnerability set corresponding to each of the process cluster centers.

[0076] Based on the above example, optionally, after taking each of the process cluster centers as the target cluster center and clustering according to each of the target cluster centers and the initial vulnerability set to obtain each target vulnerability set, the device further includes: a vulnerability classification module for obtaining the vulnerability to be classified, and determining the characteristic distance between the vulnerability to be classified and each of the target cluster centers respectively; determining the minimum value of each characteristic distance as the target distance, and determining the target vulnerability set corresponding to the vulnerability to be classified according to the target cluster center corresponding to the target distance.

[0077] Based on the above example, optionally, after determining the target vulnerability set corresponding to the vulnerability to be classified, it also includes: an early warning module, which is used to generate early warning information according to the vulnerability to be classified and the target vulnerability set corresponding to the vulnerability to be classified, if the target vulnerability set corresponding to the vulnerability to be classified belongs to a warning set, and send the early warning information to the processing personnel corresponding to the vulnerability to be classified; wherein, the early warning set includes at least one of the target vulnerability sets.

[0078] Based on the above example, optionally, the at least two defined vulnerability sets include a defined key vulnerability set, a defined edge vulnerability set, and a defined common vulnerability set, and the process cluster center determination module 210 is further used to determine a defined edge vulnerability set from the initial vulnerability set according to preset conditions corresponding to the defined edge vulnerabilities; wherein, the preset conditions corresponding to the defined edge vulnerabilities include vulnerabilities whose processing time is before a first preset percentage after arranging from long to short and whose unupdated time reaches a preset number of days; according to the preset conditions corresponding to the defined key vulnerabilities, a defined key vulnerability set is determined from the initial vulnerability set other than the defined edge vulnerability set; wherein, the preset conditions corresponding to the defined key vulnerabilities include vulnerabilities whose number of assigned persons exceeds a preset number, whose processing time is before a second preset percentage after arranging from long to short and whose update frequency reaches a preset frequency; the first preset percentage is less than the second preset percentage; and the part of the initial vulnerability set except the defined key vulnerability set and the defined edge vulnerability set is used as the defined common vulnerability set.

[0079] Based on the above example, optionally, the target vulnerability set includes a target key vulnerability set, and the target key vulnerability set corresponds to the defined key vulnerability set. After obtaining each target vulnerability set, the device further includes: a key vulnerability reclassification module, for determining, for the target key vulnerability set, a key vulnerability text field in the target key vulnerability set; the key vulnerability text field includes a vulnerability title field and a vulnerability solution field; performing word segmentation processing on the key vulnerability text field to obtain a key vulnerability keyword set; wherein, the key vulnerability keyword set includes vulnerability keywords corresponding to each key vulnerability in the target key vulnerability set; determining a target feature set corresponding to the target key vulnerability set based on the key vulnerability keyword set and a pre-established full vulnerability vocabulary; performing free clustering based on the target feature set to obtain at least two key vulnerability subsets.

[0080] Based on the above example, optionally, the target vulnerability set further includes a target edge vulnerability set and a target common vulnerability set, the target edge vulnerability set corresponding to the defined edge vulnerability set, and the target common vulnerability set corresponding to the defined common vulnerability set. The apparatus further includes: a statistical module, configured to periodically acquire vulnerabilities to be counted and determine a target vulnerability set corresponding to each of the vulnerabilities to be counted; wherein the vulnerabilities to be counted are vulnerabilities for which the target vulnerability set is determined in a current period; first statistical data are determined for the vulnerabilities to be counted whose target vulnerability set is the target edge vulnerability set and the target common vulnerability set; wherein the first statistical data include at least one of statistical data of modules to which the vulnerabilities belong, statistical data of processing time, statistical data of processing departments, and statistical data of processing personnel; for the vulnerabilities to be counted whose target vulnerability set is the target key vulnerability set, a key vulnerability subset corresponding to each of the key vulnerability subsets is determined, and second statistical data are determined for each of the key vulnerability subsets; wherein the second statistical data include at least one of statistical data of modules to which the vulnerabilities belong, statistical data of processing time, statistical data of processing departments, and statistical data of processing personnel; a vulnerability analysis report is generated based on each of the first statistical data and each of the second statistical data, and the vulnerability analysis report is sent to a target person.

[0081] The positioning device provided in the embodiment of the present disclosure can execute the steps of the vulnerability clustering method provided in the embodiment of the method of the present disclosure, and the execution steps and beneficial effects are not repeated here.

[0082] Figure 3 This is a schematic diagram of the structure of an electronic device in the embodiment of the present disclosure. Figure 3 , which shows a structural diagram of an electronic device 300 suitable for implementing the embodiments of the present disclosure. Figure 3The electronic device shown is only an example and should not limit the functions and scope of use of the embodiments of the present disclosure.

[0083] like Figure 3 As shown, the electronic device 300 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes to implement the methods of the embodiments described in the present disclosure according to the program stored in the read-only memory (ROM) 302 or the program loaded from the storage device 308 into the random access memory (RAM) 303. Various programs and data required for the operation of the electronic device 300 are also stored in the RAM 303. The processing device 301, ROM 302, and RAM 303 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0084] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart, thereby implementing the vulnerability clustering method as described above. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 309, or installed from the storage device 308, or installed from the ROM 302. When the computer program is executed by the processing device 301, the above-mentioned functions defined in the method of the embodiment of the present disclosure are performed.

[0085] It should be noted that the computer-readable medium mentioned above in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or component, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, device, or component. In the present disclosure, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. Such a propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any suitable medium, including but not limited to wires, optical cables, RF (radio frequency), etc., or any suitable combination thereof.

[0086] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device. The computer-readable medium carries one or more programs, and when the one or more programs are executed by the electronic device, the electronic device:

[0087] Dividing the initial vulnerability set into at least two defined vulnerability sets according to a preset condition, and determining a process cluster center corresponding to each of the defined vulnerability sets;

[0088] Determine, based on the initial vulnerability set and at least two process cluster centers, a cluster vulnerability set corresponding to each process cluster center;

[0089] If there is at least one of the clustered vulnerability sets that is different from the defined vulnerability set corresponding to the clustered vulnerability set, then for each of the clustered vulnerability sets, the intersection of the clustered vulnerability set and the defined vulnerability set corresponding to the clustered vulnerability set is used as a new defined vulnerability set; the initial vulnerability set is updated according to each of the defined vulnerability sets, and the step of determining the process cluster center corresponding to each of the defined vulnerability sets is returned to and performed until each of the clustered vulnerability sets and the defined vulnerability set corresponding to the clustered vulnerability set are the same;

[0090] If each of the clustered vulnerability sets is the same as the defined vulnerability set corresponding to the clustered vulnerability set, each of the process cluster centers is used as a target cluster center, and clustering is performed based on each of the target cluster centers and the initial vulnerability set to obtain each target vulnerability set.

[0091] Optionally, when the above one or more programs are executed by the electronic device, the electronic device may also execute other steps described in the above embodiments.

[0092] In the context of the present disclosure, a machine-readable medium can be a tangible medium that can contain or store a program for use by or in conjunction with an instruction execution system, device or equipment. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium can include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0093] The above description is merely a preferred embodiment of the present disclosure and an illustration of the technical principles employed. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by the specific combination of the above-mentioned technical features, but also includes other technical solutions formed by any combination of the above-mentioned technical features or their equivalents without departing from the above-mentioned disclosed concepts. For example, a technical solution formed by replacing the above-mentioned features with (but not limited to) technical features with similar functions disclosed in this disclosure.

Claims

1. A vulnerability clustering method, characterized in that: The method comprises: Dividing the initial vulnerability set into at least two defined vulnerability sets according to a preset condition, and determining a process cluster center corresponding to each of the defined vulnerability sets; Determine, based on the initial vulnerability set and at least two process cluster centers, a cluster vulnerability set corresponding to each process cluster center; If there is at least one cluster vulnerability set that is different from the defined vulnerability set corresponding to the cluster vulnerability set, then for each cluster vulnerability set, the intersection of the cluster vulnerability set and the defined vulnerability set corresponding to the cluster vulnerability set is used as a new defined vulnerability set; the initial vulnerability set is updated according to each defined vulnerability set, and the step of determining the process cluster center corresponding to each defined vulnerability set is returned to and performed until each cluster vulnerability set and the defined vulnerability set corresponding to the cluster vulnerability set are the same; wherein the cluster vulnerability set corresponding to the same process cluster center and the defined vulnerability set have a corresponding relationship; If each of the clustered vulnerability sets is the same as the defined vulnerability set corresponding to the clustered vulnerability set, each of the process cluster centers is used as a target cluster center, and clustering is performed based on each of the target cluster centers and the initial vulnerability set to obtain each target vulnerability set.

2. The method according to claim 1, characterized in that Determining, based on the initial vulnerability set and at least two process cluster centers, a cluster vulnerability set corresponding to each process cluster center includes: Determine, based on the initial vulnerability set and the fields to be trained, a clustering field set corresponding to the initial vulnerability set; Based on a preset clustering algorithm, the cluster field set is clustered with each process cluster center as the center to obtain a cluster vulnerability set corresponding to each process cluster center.

3. The method according to claim 1, characterized in that After taking each of the process cluster centers as a target cluster center and performing clustering according to each of the target cluster centers and the initial vulnerability set to obtain each target vulnerability set, the method further includes: Obtaining a vulnerability to be classified, and determining a characteristic distance between the vulnerability to be classified and each of the target cluster centers; The minimum value among the characteristic distances is determined as the target distance, and a target vulnerability set corresponding to the vulnerability to be classified is determined according to the target cluster center corresponding to the target distance.

4. The method according to claim 3, characterized in that After determining the target vulnerability set corresponding to the vulnerability to be classified, the method further includes: If the target vulnerability set corresponding to the vulnerability to be classified belongs to the warning set, generating warning information according to the vulnerability to be classified and the target vulnerability set corresponding to the vulnerability to be classified, and sending the warning information to the person handling the vulnerability to be classified; The warning set includes at least one target vulnerability set.

5. The method according to claim 1, wherein The at least two defined vulnerability sets include defining a key vulnerability set, defining a marginal vulnerability set, and defining a common vulnerability set. The dividing the initial vulnerability set into the at least two defined vulnerability sets according to a preset condition includes: Determining a set of defined edge vulnerabilities from the initial set of vulnerabilities based on preset conditions corresponding to defined edge vulnerabilities, wherein the preset conditions corresponding to the defined edge vulnerabilities include vulnerabilities that are within a first preset percentage after sorting the processing time from longest to shortest and have not been updated for a preset number of days; Determining a defined key vulnerability set from the initial vulnerability set excluding the defined edge vulnerability set according to preset conditions corresponding to defined key vulnerabilities; wherein the preset conditions corresponding to the defined key vulnerabilities include vulnerabilities having a number of assigned persons exceeding a preset number, a processing time that is within a second preset percentage when sorted from longest to shortest, and an update frequency that reaches a preset frequency; and the first preset percentage is less than the second preset percentage; The portion of the initial vulnerability set excluding the defined key vulnerability set and the defined edge vulnerability set is used as a defined common vulnerability set.

6. The method according to claim 5, characterized in that The target vulnerability set includes a target key vulnerability set, and the target key vulnerability set corresponds to the defined key vulnerability set. After obtaining each target vulnerability set, the method further includes: For a target key vulnerability set, determining a key vulnerability text field in the target key vulnerability set; the key vulnerability text field includes a vulnerability title field and a vulnerability solution field; Performing word segmentation processing on the key vulnerability text field to obtain a key vulnerability keyword set; wherein the key vulnerability keyword set includes vulnerability keywords corresponding to each key vulnerability in the target key vulnerability set; Determine a target feature set corresponding to the target key vulnerability set based on the key vulnerability keyword set and a pre-established full vulnerability vocabulary; Free clustering is performed based on the target feature set to obtain at least two key vulnerability subsets.

7. The method according to claim 6, characterized in that The target vulnerability set further includes a target edge vulnerability set and a target common vulnerability set, the target edge vulnerability set corresponds to the defined edge vulnerability set, and the target common vulnerability set corresponds to the defined common vulnerability set. The method further includes: Periodically obtaining vulnerabilities to be counted and determining a target vulnerability set corresponding to each vulnerability to be counted; wherein the vulnerabilities to be counted are the vulnerabilities of the target vulnerability set determined in the current period; Determining first statistical data for each of the vulnerabilities to be counted, which are the target edge vulnerability set and the target common vulnerability set; wherein the first statistical data includes at least one of statistical data of the module to which the vulnerabilities belong, statistical data of the processing time, statistical data of the processing department, and statistical data of the processing personnel; For the target vulnerability set that is the target key vulnerability set of vulnerabilities to be counted, determining a key vulnerability subset corresponding to each of the vulnerabilities to be counted, and determining second statistical data based on each of the key vulnerability subsets; wherein the second statistical data includes at least one of statistical data of a module to which the vulnerability belongs, statistical data of a processing time, statistical data of a processing department, and statistical data of a processing personnel; A vulnerability analysis report is generated based on each of the first statistical data and each of the second statistical data, and the vulnerability analysis report is sent to a target person.

8. A vulnerability clustering device, characterized in that: include: a process cluster center determination module, configured to divide the initial vulnerability set into at least two defined vulnerability sets according to a preset condition, and determine a process cluster center corresponding to each of the defined vulnerability sets; a cluster vulnerability set determining module, configured to determine, based on the initial vulnerability set and at least two process cluster centers, a cluster vulnerability set corresponding to each process cluster center; A loop updating module is configured to, if at least one of the clustered vulnerability sets is different from the defined vulnerability set corresponding to the clustered vulnerability set, use, for each clustered vulnerability set, the intersection of the clustered vulnerability set and the defined vulnerability set corresponding to the clustered vulnerability set as a new defined vulnerability set; update the initial vulnerability set according to each defined vulnerability set, and return to the step of determining the process cluster center corresponding to each defined vulnerability set until each clustered vulnerability set and the defined vulnerability set corresponding to the clustered vulnerability set are the same; wherein the clustered vulnerability set and the defined vulnerability set corresponding to the same process cluster center have a corresponding relationship; A vulnerability set classification module is used to, if each of the clustered vulnerability sets and the defined vulnerability set corresponding to the clustered vulnerability set are the same, use each of the process cluster centers as the target cluster center, and perform clustering based on each of the target cluster centers and the initial vulnerability set to obtain each target vulnerability set.

9. An electronic device, characterized in that: The electronic device comprises: one or more processors; a storage device for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the vulnerability clustering method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the vulnerability clustering method according to any one of claims 1 to 7 is implemented.

Images