A vulnerability patch information acquisition method, device, equipment and storage medium

Abstract

The application discloses a vulnerability patch information acquisition method and device, equipment and a storage medium, and relates to the field of vulnerability repair, comprising the following steps: obtaining vulnerability information by using a network crawler to crawl vulnerabilities, performing a deduplication operation on the crawled vulnerabilities by a preset method, and determining target vulnerabilities; judging whether patch information of the target vulnerabilities exists in each vulnerability information public platform based on the vulnerability information of the target vulnerabilities, and if not, determining a software vendor based on the vulnerability information of the target vulnerabilities; judging whether patch information exists in a vulnerability patch page provided by the software vendor based on a network crawler of the software vendor, and if not, accessing the vulnerability patch page based on a preset rule to obtain patch information added in the vulnerability patch page; and if yes, repairing the target vulnerabilities in a third-party vulnerability information platform based on the patch information, updating the vulnerability information of the target vulnerabilities, and obtaining updated vulnerability information. Therefore, the application can accurately acquire missing patch information in a timely manner.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of vulnerability repair, and in particular to a vulnerability patch information acquisition method and device, equipment and a storage medium. BACKGROUND

[0002] When a network crawler for collecting vulnerability data is written for a vulnerability information platform, the crawler for collecting vulnerability data only acquires data for the same vulnerability of the same platform once. If the website of the unit to which the vulnerability belongs does not publish a vulnerability patch for the same vulnerability, the crawler cannot acquire the patch link of the vulnerability. After the unit to which the vulnerability belongs publishes a vulnerability patch on its official website, the new patch link cannot be acquired either. This problem affects the accuracy of data acquisition by the network crawler, causes the patch data of part of the vulnerabilities in the enterprise internal vulnerability information platform to be empty, reduces the completeness of the vulnerability information, and affects the accuracy of vulnerability repair by customers. SUMMARY

[0003] Therefore, the present application aims to provide a vulnerability patch information acquisition method, device, equipment and storage medium, which can acquire missing patch information in a timely and accurate manner, and improve the information accuracy of the vulnerability platform. The specific solutions are as follows:

[0004] In a first aspect, the present application discloses a vulnerability patch information acquisition method, comprising:

[0005] Using network crawlers of a plurality of vulnerability information public platforms to perform vulnerability crawling to obtain vulnerability information of the crawled vulnerabilities, and performing a deduplication operation on the crawled vulnerabilities of each of the vulnerability information public platforms by a preset method to determine a target vulnerability;

[0006] Determining whether patch information of the target vulnerability exists in each of the vulnerability information public platforms based on the vulnerability information of the target vulnerability, and if not, determining a software vendor corresponding to the target vulnerability based on the vulnerability information of the target vulnerability;

[0007] Determining whether the patch information exists in a vulnerability patch page provided by the software vendor based on a network crawler of the software vendor, and if not, accessing the vulnerability patch page based on a preset rule to acquire the patch information added to the vulnerability patch page by the software vendor when updating the vulnerability patch;

[0008] If the patch information exists, repairing the target vulnerability in a third-party vulnerability information platform provided by a security vendor based on the patch information, acquiring vulnerability information of the target vulnerability for updating, and obtaining updated vulnerability information.

[0009] Optionally, the de-duplication operation on the crawled vulnerabilities of each of the vulnerability information public platforms by a preset method is performed to determine the target vulnerability, including:

[0010] The same vulnerability is determined in each of the vulnerability information public platforms respectively corresponding to a vulnerability number, and the de-duplication operation is performed on the crawled vulnerabilities of each of the vulnerability information public platforms based on the number determination result to determine the target vulnerability.

[0011] Optionally, the judgment of whether the patch information of the target vulnerability exists in each of the vulnerability information public platforms based on the vulnerability information of the target vulnerability includes:

[0012] The repair suggestion for the target vulnerability is analyzed based on the vulnerability information to obtain a corresponding target repair suggestion;

[0013] The target repair suggestion and the existing repair suggestion in each of the vulnerability information public platforms are judged whether they meet a preset similarity condition in the text to obtain a corresponding judgment result;

[0014] Based on the judgment result, it is determined whether the patch information of the target vulnerability exists in each of the vulnerability information public platforms.

[0015] Optionally, the determination of whether the patch information of the target vulnerability exists in each of the vulnerability information public platforms based on the judgment result includes:

[0016] If the target repair suggestion and the existing repair suggestion in any vulnerability information public platform do not meet the preset similarity condition in the text, it is determined that the patch information of the target vulnerability does not exist in the any vulnerability information public platform;

[0017] If the target repair suggestion and the existing repair suggestion in any vulnerability information public platform meet the preset similarity condition in the text, it is determined that the patch information of the target vulnerability exists in the any vulnerability information public platform.

[0018] Optionally, the judgment of whether the patch information exists in the vulnerability patch page provided by the software manufacturer based on the network crawler of the software manufacturer includes:

[0019] The manufacturer page information corresponding to the target vulnerability is obtained from the vulnerability patch page provided by the software manufacturer based on the network crawler of the software manufacturer, and it is judged whether the manufacturer vulnerability number of the target vulnerability in the manufacturer page information is consistent with the vulnerability number of the target vulnerability in each of the vulnerability information public platforms;

[0020] If the vendor vulnerability number is inconsistent with the vulnerability number of the target vulnerability in any vulnerability information public platform, a corresponding relationship between the vendor vulnerability number and the vulnerability number of the target vulnerability in the any vulnerability information public platform is determined, and it is judged whether the patch information exists in the vulnerability patch page based on the corresponding relationship.

[0021] Optionally, the accessing the vulnerability patch page based on the preset rule to obtain the patch information added by the software vendor to the vulnerability patch page when updating vulnerability patches comprises:

[0022] judging the repair urgency of the target vulnerability, and determining a next access time of the vulnerability patch page based on a result of the judgment;

[0023] accessing the vulnerability patch page based on the next access time to obtain the patch information added by the software vendor to the vulnerability patch page when updating vulnerability patches.

[0024] Optionally, after the accessing the vulnerability patch page based on the preset rule to obtain the patch information added by the software vendor to the vulnerability patch page when updating vulnerability patches, the method further comprises:

[0025] determining a harm degree of the target vulnerability, and adjusting an access frequency of the vulnerability patch page based on the harm degree to obtain an adjusted access frequency;

[0026] performing a corresponding access operation on the vulnerability patch page according to the adjusted access frequency to obtain current latest patch information in the vulnerability patch page.

[0027] In a second aspect, the application discloses a vulnerability patch information acquisition device, comprising:

[0028] a target vulnerability determination module configured to perform vulnerability crawling by using network crawlers of a plurality of vulnerability information public platforms to obtain vulnerability information of corresponding crawled vulnerabilities, and perform a deduplication operation on the crawled vulnerabilities of each of the vulnerability information public platforms by a preset method to determine a target vulnerability;

[0029] a first judgment module configured to judge whether patch information of the target vulnerability exists in each of the vulnerability information public platforms based on vulnerability information of the target vulnerability, and determine a software vendor corresponding to the target vulnerability based on the vulnerability information of the target vulnerability if the patch information does not exist.

[0030] The second judging module is configured to judge, based on the network crawler of the software manufacturer, whether the patch information exists in a vulnerability patch page provided by the software manufacturer, and if not, access the vulnerability patch page based on a preset rule to obtain the patch information added by the software manufacturer to the vulnerability patch page when updating the vulnerability patch.

[0031] The information updating module is configured to, if the patch information exists, patch the target vulnerability in a third-party vulnerability information platform provided by a security manufacturer based on the patch information, obtain vulnerability information of the target vulnerability for updating, and obtain updated vulnerability information.

[0032] In a third aspect, the present application discloses an electronic device, comprising:

[0033] A memory is configured to save a computer program.

[0034] A processor is configured to execute the computer program to implement the steps of the vulnerability patch information acquisition method disclosed above.

[0035] In a fourth aspect, the present application discloses a computer readable storage medium configured to store a computer program, wherein the computer program is executed by a processor to implement the steps of the vulnerability patch information acquisition method disclosed above.

[0036] From the above, in the acquisition of the vulnerability patch information, the application firstly utilizes the network crawler of a plurality of vulnerability information public platforms to perform vulnerability crawling to obtain the vulnerability information of the corresponding crawled vulnerability, and performs a deduplication operation on the crawled vulnerability of each of the vulnerability information public platforms through a preset method to determine a target vulnerability; determines whether patch information of the target vulnerability exists in each of the vulnerability information public platforms based on the vulnerability information of the target vulnerability, if not, determines a software vendor corresponding to the target vulnerability based on the vulnerability information of the target vulnerability; determines whether the patch information exists in a vulnerability patch page provided by the software vendor based on the network crawler of the software vendor, if not, accesses the vulnerability patch page based on a preset rule to obtain the patch information added by the software vendor to the vulnerability patch page when updating the vulnerability patch; if the patch information exists, performs patching on the target vulnerability in a third-party vulnerability information platform provided by a security vendor based on the patch information, and updates the vulnerability information of the target vulnerability to obtain updated vulnerability information. It can be seen that, for the missing patch data in the vulnerability information public platform, the application monitors the vulnerability vendor website, processes and tracks the patch release of the specified vulnerability, and modifies the information of the specified vulnerability in the vulnerability information platform of the security vendor in real time according to the patch release, so that the network assets are automatically detected by comparing different data sources and tracking the update of the vendor data source, avoiding too much reliance on manual detection; the network assets are continuously detected and the vulnerability library is updated in time, effectively avoiding the lag of the database, and the missing patch information can be obtained in time and accurately without manual intervention, improving the information accuracy of the vulnerability platform. BRIEF DESCRIPTION OF DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description are only embodiments of the present application, and those skilled in the art can obtain other drawings according to the provided drawings without creative labor.

[0038] Figure 1 The implementation method schematic diagram of the vulnerability patch information acquisition method provided by the present application is shown in the prior art;

[0039] Figure 2 The flowchart of the vulnerability patch information acquisition method provided by the present application is shown in the prior art;

[0040] Figure 3 The flowchart of a specific vulnerability patch information acquisition method provided by the present application is shown in the prior art;

[0041] Figure 4A vulnerability platform crawler module function schematic diagram provided for the present application;

[0042] Figure 5 A manufacturer website vulnerability crawler module function schematic diagram provided for the present application;

[0043] Figure 6 A search result schematic diagram of a CVE official website link provided for the present application;

[0044] Figure 7 A search result schematic diagram of a CNVD official website link provided for the present application;

[0045] Figure 8 A software manufacturer website search result schematic diagram provided for the present application;

[0046] Figure 9 A specific vulnerability patch information acquisition method flow chart provided for the present application;

[0047] Figure 10 A vulnerability patch information acquisition device structure schematic diagram provided for the present application;

[0048] Figure 11 An electronic device structure diagram provided for the present application. DETAILED DESCRIPTION

[0049] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0050] Prior art such as Figure 1As shown, the information of the vulnerability platform can be acquired, including a vulnerability library module, a vulnerability information display module, a vulnerability search module, an update vulnerability library module and a vulnerability library export module; the vulnerability library module classifies the detected vulnerability information; the vulnerability information display module displays specific vulnerability information under three different vulnerability library classifications of CNNVD (China National Vulnerability Database of Information Security), CNVD (China National Vulnerability Database) and CVE (Common Vulnerabilities and Exposures); the vulnerability search module performs HTML analysis and arrangement on the screened information; the update vulnerability library module stores the acquired useful information into a MongoDB database; the incremental detection module completes incremental update detection; and the vulnerability library export module exports the vulnerability. The existing technology solves the monitoring of the updated vulnerability information of the vulnerability information public platform, but since the vulnerability patch information published by the vulnerability information public platform is not continuously tracked, only through the related data of the vulnerability information public platform, part of the acquired vulnerability information lacks repair suggestions, resulting in invalid repair suggestions. In order to solve the above problems, the present application provides a vulnerability patch information acquisition method, which can acquire the missing patch information in time and accurately without manual intervention, and improves the information accuracy of the vulnerability platform.

[0051] Referring to Figure 2 As shown, the vulnerability patch information acquisition method provided by the present application comprises the following steps:

[0052] In step S11, the network crawler of the plurality of vulnerability information public platforms is utilized to perform vulnerability crawling to obtain the vulnerability information of the corresponding crawled vulnerability, and a de-duplication operation is performed on the crawled vulnerability of each vulnerability information public platform through a preset method to determine a target vulnerability.

[0053] In the present embodiment, as shown in Figure 3 As shown, firstly, it is judged whether the patch link exists through the vulnerability platform crawler module. The function diagram of the vulnerability platform crawler module is as shown in Figure 4As shown, the vulnerability data of the vulnerability information public platform for acquisition and integration is first obtained by the network crawler of different vulnerability information public platforms to obtain the vulnerability information of each vulnerability platform. The vulnerability information public platform is a platform for storing security vulnerability information, mainly used to improve the overall research level and timely prevention ability in the aspect of security vulnerability, and drive the development of related security products. The vulnerability information public platforms for obtaining vulnerability information include but are not limited to CVE, CNVD, CNNVD, etc. Then the vulnerabilities in different platforms are judged by vectorization calculation method to determine the vulnerability number corresponding to the same vulnerability in each of the vulnerability information public platforms, and the de-duplication operation is performed on the crawled vulnerabilities of each of the vulnerability information public platforms based on the number determination result to determine the target vulnerability. It can be known that the vulnerability number is a special number of the vulnerability information platform for marking and indexing the vulnerability, and the same vulnerability may correspond to different vulnerability numbers in different platforms. The network crawler is a network robot used to automatically browse the World Wide Web. The purpose is generally to compile a network index. Network search engines and other sites update their website content or their index of other websites through crawler software. The network crawler can also obtain website data according to the set rules.

[0054] Step S12, based on the vulnerability information of the target vulnerability, judge whether there is patch information of the target vulnerability in each of the vulnerability information public platforms, if not, determine the software manufacturer corresponding to the target vulnerability based on the vulnerability information of the target vulnerability.

[0055] In the embodiment, after obtaining the vulnerability information, the repair suggestion of the current vulnerability is analyzed by using the vectorization calculation method, whether the target repair suggestion and the existing repair suggestion in each vulnerability information public platform satisfy the preset similarity condition in text is judged to obtain a corresponding judgment result; whether the patch information of the target vulnerability exists in each vulnerability information public platform is determined based on the judgment result. If the target repair suggestion does not satisfy the preset similarity condition in text with the existing repair suggestion in any vulnerability information public platform, it is determined that the patch information of the target vulnerability does not exist in the any vulnerability information public platform; if the target repair suggestion satisfies the preset similarity condition in text with the existing repair suggestion in any vulnerability information public platform, it is determined that the patch information of the target vulnerability exists in the any vulnerability information public platform. If the patch information exists, the result is sent to a data updating module, that is, the target vulnerability in the third-party vulnerability information platform provided by the security vendor is repaired based on the patch information, and the vulnerability information of the target vulnerability is obtained for updating to obtain updated vulnerability information. If the patch information does not exist, the vulnerability information is sent to a vendor website vulnerability crawler module, that is, the software vendor corresponding to the target vulnerability is determined based on the vulnerability information of the target vulnerability, and then the information and patch information of the specified vulnerability published by the vendor on the website of the vendor are obtained by using the vendor website vulnerability crawler module.

[0056] In step S13, whether the patch information exists in the vulnerability patch page provided by the software vendor is judged based on the network crawler of the software vendor, and if not, the vulnerability patch page is accessed based on a preset rule to obtain the patch information added to the vulnerability patch page by the software vendor when updating the vulnerability patch.

[0057] In this embodiment, after the corresponding manufacturer is determined through the vulnerability information, a web crawler for crawling the corresponding manufacturer is called. Among them, the functional diagram of the manufacturer website vulnerability crawler module is shown in Figure 5, and then it is determined whether the manufacturer uses the vulnerability number of the national vulnerability platform to mark the vulnerability. That is, the web crawler based on the software manufacturer obtains the manufacturer page information corresponding to the target vulnerability from the vulnerability patch page provided by the software manufacturer, and determines whether the manufacturer vulnerability number of the target vulnerability in the manufacturer page information is consistent with the vulnerability number of the target vulnerability in each vulnerability information public platform; if the manufacturer vulnerability number is inconsistent with the vulnerability number of the target vulnerability in any vulnerability information public platform, then the correspondence between the manufacturer vulnerability number and the vulnerability number of the target vulnerability in any vulnerability information public platform is determined, and based on the correspondence, it is determined whether the patch information exists in the vulnerability patch page, that is, the correspondence between the vulnerability and the vulnerability number of the software manufacturer website is analyzed by a vectorized calculation method, and if so, no processing is performed. If the patch information does not exist, the vulnerability patch page is accessed based on the preset rules to obtain the patch information added to the vulnerability patch page by the software manufacturer when updating the vulnerability patch.

[0058] Step S14: If the patch information exists, patch the target vulnerability in the third-party vulnerability information platform provided by the security vendor based on the patch information, and obtain vulnerability information of the target vulnerability to update and obtain updated vulnerability information.

[0059] In a specific embodiment, for the vulnerability numbered CVE-2023-27326, there is no corresponding vulnerability patch link and repair solution on any vulnerability information public platform at the current time. For example, the search results of the CVE official website link are as follows: Figure 6 As shown, the search results of CNVD official website link are as follows Figure 7 As shown, the manufacturer to which the vulnerability belongs has released the corresponding vulnerability information and related patches, and marked the software version number of the fixed vulnerability on the manufacturer's official website. The search results on the manufacturer's website are as follows Figure 8 As shown, the process for this vulnerability in this application is as follows: First, obtain the relevant vulnerability information from various public vulnerability information platforms and confirm whether the corresponding patch information for this vulnerability exists on each national vulnerability platform. Then, if the patch information does not exist, invoke a website crawler to crawl the vulnerability patch page provided by Parallels Desktop, the vendor responsible for the vulnerability, and confirm whether the correct patch link and remediation suggestions have been obtained. Finally, if the existence of the patch is confirmed, invoke the data update module to update the patch information for this vulnerability on the third-party vulnerability information platform provided by the security vendor.

[0060] As can be seen from the above, in the application, when acquiring the vulnerability patch information, firstly, the network crawler of a plurality of vulnerability information public platforms is utilized to perform vulnerability crawling to obtain the vulnerability information of the crawled vulnerability, and a de-duplication operation is performed on the crawled vulnerability of each of the vulnerability information public platforms by a preset method to determine a target vulnerability; it is determined whether patch information of the target vulnerability exists in each of the vulnerability information public platforms based on the vulnerability information of the target vulnerability, if not, a software vendor corresponding to the target vulnerability is determined based on the vulnerability information of the target vulnerability; it is determined whether the patch information exists in a vulnerability patch page provided by the software vendor based on the network crawler of the software vendor, if not, the vulnerability patch page is accessed based on a preset rule to acquire the patch information added to the vulnerability patch page by the software vendor when updating the vulnerability patch; if the patch information exists, the target vulnerability in a third-party vulnerability information platform provided by a security vendor is patched based on the patch information, and the vulnerability information of the target vulnerability is acquired to update, to obtain updated vulnerability information. It can be seen that, for the missing patch data in the vulnerability information public platform, the application monitors the vulnerability vendor website, processes and tracks the patch release of the specified vulnerability, and modifies the information of the specified vulnerability in the vulnerability information platform of the security vendor in real time according to the patch release, so that the network assets are automatically detected by comparing different data sources and tracking the update of the vendor data source, avoiding too much reliance on manual detection; the network assets are continuously detected and the vulnerability library is updated in time, effectively avoiding the lag of the database, and the missing patch information can be acquired in time and accurately without manual intervention, improving the information accuracy of the vulnerability platform.

[0061] Based on the above embodiment, the application can access the vulnerability patch page based on a preset rule to acquire the patch information added to the vulnerability patch page by the software vendor when updating the vulnerability patch. Next, the process of acquiring the patch information added to the vulnerability patch page by the software vendor when updating the vulnerability patch will be described in detail. Referring to Figure 9 The embodiment of the application discloses a specific vulnerability patch information acquisition method, which comprises the following steps:

[0062] Step S21, judging the repair urgency of the target vulnerability, and determining the next access time of the vulnerability patch page based on the judgment result.

[0063] In this embodiment, the vulnerability adaptive priority technology is used to adaptively analyze and judge the urgency of vulnerability repair in combination with 0day and 1day intelligence, and then the website of the relevant manufacturer is accessed again within a certain time to obtain patch information. The vulnerability adaptive priority technology is a technology for classifying, evaluating and processing security vulnerabilities found in a system. This technology classifies vulnerabilities into different levels and types, and ranks vulnerabilities according to their likelihood and harm, and then takes appropriate measures to solve them. "0day vulnerability" or "1day vulnerability" refers to a known but not publicly disclosed software security vulnerability. "0day vulnerability" means that the vulnerability will be exploited by attackers, and the software manufacturer has not yet repaired the patch. In contrast, "1day vulnerability" indicates that the vulnerability has been publicly disclosed but has not been repaired by the manufacturer. Attackers will exploit these vulnerabilities to gain control of the system, thereby stealing data, tampering with data, or launching attacks. Therefore, 0day or 1day vulnerability is a big security risk for enterprises and individuals, and in order to prevent attackers from exploiting it, we need to install software patches and keep the system updated in a timely manner.

[0064] Step S22, accessing the vulnerability patch page based on the next access time to obtain patch information added by the software manufacturer to the vulnerability patch page when updating the vulnerability patch.

[0065] Step S23, determining the harm degree of the target vulnerability, and adjusting the access frequency of the vulnerability patch page based on the harm degree to obtain an adjusted access frequency.

[0066] In this embodiment, when the patch information is obtained, a vulnerability adaptive priority analysis tool is used to comprehensively judge the harm degree and priority of the vulnerability, and the frequency of accessing the official website of the manufacturer to which the vulnerability belongs is increased to obtain updated vulnerability patch information as soon as possible for vulnerabilities that are easy to cause serious threats and damage.

[0067] Step S24, performing corresponding access operations on the vulnerability patch page according to the adjusted access frequency to obtain the current latest patch information in the vulnerability patch page.

[0068] In this embodiment, when the patch information is obtained, the target vulnerability in the third-party vulnerability information platform provided by the security manufacturer is repaired based on the patch information, and the vulnerability information of the target vulnerability is updated to obtain updated vulnerability information. The vulnerability information saved in the third-party vulnerability information platform provided by the security manufacturer is updated to ensure the accuracy of the patch information. When the patch information cannot be obtained, the step of determining the next access time of the vulnerability patch page based on the judgment result of the urgency of the target vulnerability to be repaired is re-executed.

[0069] From the above, the application adjusts the access time and frequency based on the harm degree of the target vulnerability and the repair urgency, can obtain the missing patch information in time and accurately without manual intervention, and improves the information accuracy of the vulnerability platform.

[0070] Referring to Figure 10 The embodiment of the application discloses a vulnerability patch information acquisition device, which comprises:

[0071] A target vulnerability determination module 11 is configured to perform vulnerability crawling by using network crawlers of a plurality of vulnerability information public platforms to obtain vulnerability information of the crawled vulnerabilities, and perform a deduplication operation on the crawled vulnerabilities of each of the vulnerability information public platforms by a preset method to determine a target vulnerability.

[0072] A first judgment module 12 is configured to determine whether patch information of the target vulnerability exists in each of the vulnerability information public platforms based on the vulnerability information of the target vulnerability, and if not, determine a software vendor corresponding to the target vulnerability based on the vulnerability information of the target vulnerability.

[0073] A second judgment module 13 is configured to determine whether the patch information exists in a vulnerability patch page provided by the software vendor based on a network crawler of the software vendor, and if not, access the vulnerability patch page based on a preset rule to obtain the patch information added to the vulnerability patch page by the software vendor when updating the vulnerability patch.

[0074] An information updating module 14 is configured to perform patching on the target vulnerability in a third-party vulnerability information platform provided by a security vendor based on the patch information if the patch information exists, and update the vulnerability information of the target vulnerability to obtain updated vulnerability information.

[0075] As can be seen, in the application, when acquiring the patch information of a vulnerability, firstly, a network crawler of a plurality of vulnerability information public platforms is utilized to crawl the vulnerabilities to obtain the vulnerability information of the crawled vulnerabilities, and a de-duplication operation is performed on the crawled vulnerabilities of each of the vulnerability information public platforms by a preset method to determine a target vulnerability; whether patch information of the target vulnerability exists in each of the vulnerability information public platforms is determined based on the vulnerability information of the target vulnerability, if not, a software vendor corresponding to the target vulnerability is determined based on the vulnerability information of the target vulnerability; whether the patch information exists in a vulnerability patch page provided by the software vendor is determined based on a network crawler of the software vendor, if not, the vulnerability patch page is accessed based on a preset rule to obtain the patch information added by the software vendor to the vulnerability patch page when updating the vulnerability patch; if the patch information exists, the target vulnerability in a third-party vulnerability information platform provided by a security vendor is repaired based on the patch information, and the vulnerability information of the target vulnerability is updated to obtain updated vulnerability information. It can be seen that, for the missing patch data in the vulnerability information public platform, the patch release situation of a specified vulnerability is monitored, processed and tracked by monitoring the vulnerability vendor website, and the information of the specified vulnerability in the vulnerability information platform of the security vendor is modified in real time according to the patch release situation, so that the network assets are automatically detected by comparing the data of different data sources and tracking the update situation of the data source of the vendor, avoiding over-reliance on manual detection; the network assets are continuously detected and the vulnerability library is updated in time, effectively avoiding the lag of the database, and the missing patch information can be obtained in time and accurately without manual intervention, improving the information accuracy of the vulnerability platform.

[0076] In some specific embodiments, the target vulnerability determination module 11 can include:

[0077] A target vulnerability determination unit is configured to determine the vulnerability numbers of the same vulnerability in each of the vulnerability information public platforms, and perform a de-duplication operation on the crawled vulnerabilities of each of the vulnerability information public platforms based on the number determination result to determine the target vulnerability.

[0078] In some specific embodiments, the first determination module 11 can include:

[0079] A target repair suggestion acquisition unit is configured to analyze the repair suggestions for the target vulnerability based on the vulnerability information to obtain corresponding target repair suggestions.

[0080] A determination result acquisition unit is configured to determine whether the target repair suggestions and the existing repair suggestions in each of the vulnerability information public platforms satisfy a preset similarity condition in terms of text to obtain a corresponding determination result.

[0081] The patch information determination unit is configured to determine whether patch information of the target vulnerability exists in each of the vulnerability information public platforms based on the determination result.

[0082] In some specific embodiments, the first determination module 11 can include:

[0083] The first determination unit is configured to determine that patch information of the target vulnerability does not exist in any of the vulnerability information public platforms if the target repair suggestion does not satisfy the preset similarity condition in terms of text with repair suggestions already existing in the any of the vulnerability information public platforms.

[0084] The second determination unit is configured to determine that patch information of the target vulnerability exists in any of the vulnerability information public platforms if the target repair suggestion satisfies the preset similarity condition in terms of text with repair suggestions already existing in the any of the vulnerability information public platforms.

[0085] In some specific embodiments, the second determination module 11 can include:

[0086] The number determination unit is configured to acquire manufacturer page information corresponding to the target vulnerability from a vulnerability patch page provided by the software manufacturer based on a web crawler of the software manufacturer, and determine whether a manufacturer vulnerability number of the target vulnerability in the manufacturer page information is consistent with a vulnerability number of the target vulnerability in each of the vulnerability information public platforms.

[0087] The patch information determination unit is configured to determine a correspondence relationship between the manufacturer vulnerability number and the vulnerability number of the target vulnerability in any of the vulnerability information public platforms if the manufacturer vulnerability number is not consistent with the vulnerability number of the target vulnerability in the any of the vulnerability information public platforms, and determine whether the patch information exists in the vulnerability patch page based on the correspondence relationship.

[0088] In some specific embodiments, the second determination module 11 can include:

[0089] The access time determination unit is configured to determine the repair urgency of the target vulnerability, and determine a next access time of the vulnerability patch page based on the determination result.

[0090] The patch information adding unit is configured to access the vulnerability patch page based on the next access time to acquire the patch information added by the software manufacturer to the vulnerability patch page when updating a vulnerability patch.

[0091] In some specific embodiments, the second determination module 11 further includes:

[0092] The access frequency adjustment unit is configured to determine a harm degree of the target vulnerability, and adjust an access frequency of the vulnerability patch page based on the harm degree to obtain an adjusted access frequency.

[0093] The latest patch information acquisition unit is configured to perform a corresponding access operation on the vulnerability patch page according to the adjusted access frequency, to obtain current latest patch information in the vulnerability patch page.

[0094] Further, the application also discloses an electronic device, Figure 11 The electronic device 20 shown in the figure is not considered as any limitation on the use range of the application according to an exemplary embodiment.

[0095] Figure 11 The electronic device 20 provided by the embodiment of the application is shown in a structural schematic diagram. The electronic device 20 specifically can include at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25 and a communication bus 26. The memory 22 is configured to store a computer program, and the processor 21 is configured to load and execute the computer program to implement the related steps in the vulnerability patch information acquisition method disclosed in any of the preceding embodiments. In addition, the electronic device 20 in the embodiment can be an electronic computer.

[0096] In the embodiment, the power supply 23 is configured to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol followed by the communication interface 24 can be any communication protocol applicable to the technical solution of the application, which is not limited here; the input / output interface 25 is configured to obtain external input data or output data to the outside, and the specific interface type can be selected according to the specific application needs, which is not limited here.

[0097] In addition, the memory 22 as a carrier for resource storage can be a read-only memory, a random access memory, a magnetic disk or an optical disk, and the resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage mode can be temporary storage or permanent storage.

[0098] The operating system 221 is configured to manage and control each hardware device on the electronic device 20 and the computer program 222, and can be Windows Server, Netware, Unix, Linux, etc. In addition to the computer program capable of completing the vulnerability patch information acquisition method executed by the electronic device 20 disclosed in any of the preceding embodiments, the computer program 222 can further include a computer program capable of completing other specific work.

[0099] Further, the present application also discloses a computer readable storage medium for storing a computer program; wherein the computer program is executed by a processor to realize the vulnerability patch information acquisition method disclosed above. For the specific steps of the method, refer to the corresponding content disclosed in the foregoing embodiments, which will not be repeated here.

[0100] The various embodiments are described in the present specification in progressive order, and each embodiment focuses on the differences from other embodiments. For the same or similar parts between the various embodiments, refer to each other. For the device disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and refer to the method part for the relevant part.

[0101] The skilled person can further realize that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be realized by electronic hardware, computer software or a combination of both. In order to clearly show the interchangeability of hardware and software, the components and steps of the examples have been described in the above description in general. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. The skilled person can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0102] The steps of the method or algorithm described in combination with the embodiments disclosed herein can be directly implemented by hardware, software modules executed by a processor, or a combination of both. The software modules can be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0103] Finally, it should be noted that in this document, relationship terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between the entities or operations. Moreover, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. Without more limitations, the element defined by the statement "including a" does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0104] The technical solutions provided by the present application are described in detail above, and the principles and implementation manners of the present application are described by using specific examples. The above description of the examples is only used to help understand the method of the present application and its core idea; meanwhile, for those skilled in the art, according to the idea of the present application, the specific implementation manners and application ranges will be changed, and the above description of the content of the specification should not be understood as a limitation on the present application.

Claims

1. A method for obtaining vulnerability patch information, characterized in that: include: Crawling vulnerabilities using web crawlers of several vulnerability information public platforms to obtain vulnerability information of corresponding crawled vulnerabilities, and deduplicating the crawled vulnerabilities of each vulnerability information public platform using a preset method to determine the target vulnerability; Determining whether patch information for the target vulnerability exists in each vulnerability information public platform based on the vulnerability information of the target vulnerability, and if not, determining the software vendor corresponding to the target vulnerability based on the vulnerability information of the target vulnerability; determining, based on the web crawler of the software vendor, whether the patch information exists in a vulnerability patch page provided by the software vendor; and if not, accessing the vulnerability patch page based on a preset rule to obtain the patch information added to the vulnerability patch page by the software vendor when updating the vulnerability patch; If the patch information exists, patch the target vulnerability in the third-party vulnerability information platform provided by the security vendor based on the patch information, and obtain vulnerability information of the target vulnerability to update it, thereby obtaining updated vulnerability information; The determining, based on the vulnerability information of the target vulnerability, whether patch information for the target vulnerability exists in each vulnerability information public platform includes: Analyze the repair suggestions for the target vulnerability based on the vulnerability information to obtain corresponding target repair suggestions; Determine whether the target repair suggestion and the existing repair suggestions in each vulnerability information public platform meet a preset similarity condition in terms of text, so as to obtain a corresponding judgment result; Determine whether patch information for the target vulnerability exists in each vulnerability information public platform based on the judgment result; The determining, based on the judgment result, whether patch information for the target vulnerability exists in each vulnerability information public platform includes: If the target repair suggestion and the repair suggestions already in any vulnerability information public platform do not satisfy the preset similarity condition in terms of text, it is determined that patch information for the target vulnerability does not exist in any vulnerability information public platform; If the target repair suggestion and the existing repair suggestions in any vulnerability information public platform satisfy the preset similarity condition in terms of text, it is determined that patch information for the target vulnerability exists in any vulnerability information public platform.

2. The vulnerability patch information acquisition method according to claim 1, characterized in that: The deduplication operation is performed on the crawled vulnerabilities of each vulnerability information public platform by a preset method to determine the target vulnerability, including: Determine the vulnerability numbers corresponding to the same vulnerability on each of the vulnerability information public platforms, and perform a deduplication operation on the crawled vulnerabilities on each of the vulnerability information public platforms based on the number determination results to determine the target vulnerability.

3. The vulnerability patch information acquisition method according to claim 1, characterized in that: The web crawler based on the software vendor determines whether the patch information exists on the vulnerability patch page provided by the software vendor, including: The web crawler based on the software vendor obtains the vendor page information corresponding to the target vulnerability from the vulnerability patch page provided by the software vendor, and determines whether the vendor vulnerability number of the target vulnerability in the vendor page information is consistent with the vulnerability number of the target vulnerability in each of the vulnerability information public platforms; If the manufacturer vulnerability number is inconsistent with the vulnerability number of the target vulnerability in any vulnerability information public platform, the correspondence between the manufacturer vulnerability number and the vulnerability number of the target vulnerability in any vulnerability information public platform is determined, and based on the correspondence, it is determined whether the patch information exists in the vulnerability patch page.

4. The method for obtaining vulnerability patch information according to any one of claims 1 to 3, wherein: The accessing the vulnerability patch page based on a preset rule to obtain the patch information added to the vulnerability patch page by the software manufacturer when updating the vulnerability patch includes: Determining the urgency of the target vulnerability to be repaired, and determining the next access time of the vulnerability patch page based on the determination result; The vulnerability patch page is accessed based on the next access time to obtain the patch information added to the vulnerability patch page by the software manufacturer when the vulnerability patch is updated.

5. The vulnerability patch information acquisition method according to claim 4, characterized in that: After accessing the vulnerability patch page based on a preset rule to obtain the patch information added to the vulnerability patch page by the software manufacturer when updating the vulnerability patch, the method further includes: Determining a degree of harm of the target vulnerability, and adjusting a frequency of access to the vulnerability patch page based on the degree of harm to obtain an adjusted frequency of access; A corresponding access operation is performed on the vulnerability patch page according to the adjusted access frequency to obtain the current latest patch information in the vulnerability patch page.

6. A device for obtaining vulnerability patch information, characterized in that: include: A target vulnerability determination module is configured to crawl vulnerabilities using web crawlers of several vulnerability information public platforms to obtain vulnerability information of corresponding crawled vulnerabilities, and to perform a deduplication operation on the crawled vulnerabilities of each vulnerability information public platform using a preset method to determine the target vulnerability; a first judgment module, configured to judge whether patch information of the target vulnerability exists in each vulnerability information public platform based on the vulnerability information of the target vulnerability, and if not, determine the software vendor corresponding to the target vulnerability based on the vulnerability information of the target vulnerability; a second determination module, configured to determine, based on the software vendor's web crawler, whether the patch information exists on the vulnerability patch page provided by the software vendor; and if not, access the vulnerability patch page based on a preset rule to obtain the patch information added to the vulnerability patch page by the software vendor when updating the vulnerability patch; An information update module, configured to patch the target vulnerability in a third-party vulnerability information platform provided by a security vendor based on the patch information if the patch information exists, and obtain vulnerability information of the target vulnerability for update to obtain updated vulnerability information; The determining, based on the vulnerability information of the target vulnerability, whether patch information for the target vulnerability exists in each vulnerability information public platform includes: Analyze the repair suggestions for the target vulnerability based on the vulnerability information to obtain corresponding target repair suggestions; Determine whether the target repair suggestion and the existing repair suggestions in each vulnerability information public platform meet a preset similarity condition in terms of text, so as to obtain a corresponding judgment result; Determine whether patch information for the target vulnerability exists in each vulnerability information public platform based on the judgment result; The determining, based on the judgment result, whether patch information for the target vulnerability exists in each vulnerability information public platform includes: If the target repair suggestion and the repair suggestions already in any vulnerability information public platform do not satisfy the preset similarity condition in terms of text, it is determined that patch information for the target vulnerability does not exist in any vulnerability information public platform; If the target repair suggestion and the existing repair suggestions in any vulnerability information public platform satisfy the preset similarity condition in terms of text, it is determined that patch information for the target vulnerability exists in any vulnerability information public platform.

7. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the steps of the method for obtaining vulnerability patch information according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that Used to store computer programs; wherein, when the computer program is executed by a processor, the steps of obtaining vulnerability patch information according to any one of claims 1 to 5 are implemented.

Images