A vulnerability assessment method and analysis device

Abstract

The application discloses a vulnerability evaluation method and an analysis device, and belongs to the technical field of network security. The analysis device acquires a plurality of vulnerability information of a computer device, wherein the vulnerability information comprises an identifier of a vulnerability, each piece of vulnerability information indicates one vulnerability on the computer device, and the plurality of vulnerabilities indicated by the plurality of pieces of vulnerability information can be located on the same computer device or different computer devices. The analysis device evaluates the threat degree of the plurality of vulnerabilities to the computer device according to information of a threat event reported by a security device and / or a vulnerability exploitation difficulty, wherein the threat event is an event of attacking the computer device detected by the security device. The method evaluates the threat degree of the vulnerability based on the threat event detected by the security device and / or the vulnerability exploitation difficulty, and can improve the accuracy of the evaluation result.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and in particular to a vulnerability assessment method and analysis device. Background Technology

[0002] A vulnerability is a flaw in the hardware, software, or system security policies of a computer device that allows an attacker to access or damage the device without authorization. Computer devices often contain a large number of vulnerabilities, and the degree of threat posed by each vulnerability varies. To facilitate vulnerability mitigation, it is necessary to assess the threat level of each vulnerability.

[0003] Current assessment methods mostly rely on the Common Vulnerability Scoring System (CVSS) to score vulnerabilities. A vulnerability's CVSS score reflects its threat level; a higher score indicates a greater threat. CVSS is an industry-standard open standard that derives a severity score by combining attributes such as the vulnerability's attack vector, complexity, confidentiality, and integrity.

[0004] However, CVSS only considers the inherent characteristics of the vulnerability itself, so assessing the threat level of a vulnerability through CVSS is often not accurate enough. Summary of the Invention

[0005] This application provides a vulnerability assessment method and analysis device, which can improve the accuracy of assessment results when assessing the threat level of vulnerabilities.

[0006] The first aspect of this application provides a vulnerability assessment method applied to an analysis device. The analysis device acquires multiple vulnerability information entries for a computer device. For example, the analysis device scans the computer device to obtain multiple vulnerability information entries. The vulnerability information includes an identifier (e.g., a name) of the vulnerability. Each vulnerability entry indicates a vulnerability in the computer device. The multiple vulnerabilities indicated by the multiple vulnerability entries may reside in the same computer device or in different computer devices.

[0007] The analysis device receives information on multiple threat events sent by security devices. Security devices can be firewalls, honeypots, or other devices that provide protection for computer devices. A threat event is an event detected by the security device where an attacker exploits vulnerabilities in a computer device to launch an attack. Threat events can be of various types, such as botnets and malicious files. The type of threat event indicates the type of attack that triggered it. For example, if the threat event type is "botnet," it means that the threat event was generated by an attack source using a botnet. For each type, the attacker can generate multiple attack samples, each used to indicate the type of attack to be launched against a specific target. An attacker executing one attack sample generates one threat event. For the same attack sample, the attacker can execute it multiple times, and multiple attacks can generate the same threat event. The threat event information records the number of attacks. Alternatively, a single attack can generate one threat event, and the same attack sample can generate multiple threat events.

[0008] After receiving threat event information, the analysis device assesses the threat level of each vulnerability based on this information. For example, threat event information may include whether a vulnerability generates threat events, the number of threat events generated, and the severity of those threat events to evaluate the vulnerability's threat level. The more threat events generated and the more severe the threat events, the higher the threat level of the vulnerability.

[0009] Analysis tools can also assess the threat level of each vulnerability based on its exploitability difficulty. Exploitability difficulty refers to the difficulty for an attacker to exploit a vulnerability to attack a computer device. The lower the exploitability difficulty, the easier it is for an attacker to exploit the vulnerability to attack a computer device, and the greater the threat level of the vulnerability.

[0010] Analysis devices can also combine information from threat events sent by security devices with the difficulty of exploiting vulnerabilities to assess the threat level of multiple vulnerabilities.

[0011] In this solution, the analysis device can assess the threat level of vulnerabilities in computer devices based on vulnerability-related threat event information and / or vulnerability exploitation difficulty. Threat event information reflects the threat already posed by the vulnerability to the computer device, while exploitation difficulty reflects the difficulty for an attacker to exploit the vulnerability to attack the computer device. In other words, this solution assesses the threat level of a vulnerability based on the existing threat, the difficulty for an attacker to exploit the vulnerability, and the specific circumstances of the vulnerability, thus improving the accuracy of the assessment results.

[0012] In one possible implementation of the first aspect, after assessing the threat level of multiple vulnerabilities, the analysis device can determine the remediation order of the vulnerabilities based on the threat level. In this possible implementation, after determining the threat level of multiple vulnerabilities, the analysis device can sort the vulnerabilities according to the threat level so that security operations personnel can remediate the high-risk vulnerabilities first, thereby ensuring the stable operation of computer equipment as much as possible.

[0013] In one possible implementation of the first aspect, after assessing the threat level of multiple vulnerabilities, the analysis device can determine the processing priority of the vulnerabilities based on the threat level. Specifically, vulnerabilities with a high threat level pose a greater threat to computer devices and are more likely to affect the secure operation of computer devices, requiring prior remediation. Therefore, vulnerabilities with a high threat level have a high processing priority, while vulnerabilities with a low threat level have a low processing priority.

[0014] After the analysis equipment determines the processing priority of multiple vulnerabilities, it can determine the order in which the vulnerabilities are patched based on the processing priority. That is, vulnerabilities with higher processing priority are patched first, and vulnerabilities with lower processing priority are patched last. For example, if vulnerability A has a high threat level, vulnerability B has a low threat level, and vulnerability C has a medium threat level, then vulnerability A has a high processing priority, vulnerability C has a medium processing priority, and vulnerability B has a low processing priority. The analysis equipment then sorts the vulnerabilities in the order of patching based on the processing priority, that is, vulnerability A first, vulnerability C second, and vulnerability B third.

[0015] In this possible implementation, the analysis device can first determine the processing priority of the vulnerability based on the threat level of the vulnerability, and then sort the vulnerability repair order according to the processing priority, thereby improving the accuracy of the vulnerability repair order.

[0016] In one possible implementation of the first aspect, vulnerability exploitation difficulty includes code exploitation maturity. Code exploitation maturity reflects whether a code script already exists that targets a particular vulnerability, as well as the quantity and quality of such scripts. A higher quantity and higher quality code scripts indicate higher code exploitation maturity. In other words, the higher the code exploitation maturity, the lower the cost for an attacker to exploit the vulnerability, meaning the lower the exploitation difficulty and the higher the threat level of the vulnerability.

[0017] The difficulty of exploiting a vulnerability can also include the effectiveness of computer devices in protecting against it. If an attack launched by an attacker using a vulnerability can be effectively protected against by computer devices, it indicates that the computer devices are highly effective in protecting against the vulnerability. In other words, it is very difficult for an attacker to exploit the vulnerability (i.e., the vulnerability is difficult to exploit), and the vulnerability poses a low threat to the computer devices.

[0018] In addition to the above, the difficulty of exploiting a vulnerability can also be assessed by the number of exploitable samples. The number of exploitable samples refers to the number of malware families that exist targeting a particular vulnerability, and each malware family can generate one threat event. The more exploitable samples there are, the easier the vulnerability is to exploit, and the higher the threat level of the vulnerability.

[0019] In one possible implementation of the first aspect, the analysis device can obtain the effectiveness of the computer device's protection against vulnerabilities by sending a test task to the computer device. Specifically, the test task is a simulated attack launched by the analysis device against the computer device based on vulnerability information. The computer device generates an attack result (i.e., a test result) based on the simulated attack. The analysis device can determine whether the simulated attack was successful, or in other words, whether the computer device successfully protected against the simulated attack, based on the attack result returned by the computer device. If the computer device fails to protect against the vulnerability, it indicates that the computer device's protection capability against the vulnerability corresponding to the test task is weak, meaning that it is easy for an attacker to exploit the vulnerability to attack the computer device (low vulnerability exploitation difficulty), and the vulnerability poses a high threat level.

[0020] Optionally, the analysis device can also instruct the computer device to perform simulated attacks by sending test tasks, meaning the analysis device does not initiate a simulated attack itself. For example, if the computer device has an agent program installed, the analysis device can instruct the agent program to perform corresponding attack actions by sending test tasks, and the computer device can then send the attack results back to the analysis device, thereby testing the effectiveness of the computer device's protection against vulnerabilities.

[0021] In this possible implementation, the effectiveness of the computer device in protecting against vulnerabilities can be determined by sending test tasks to the computer device, thus improving the feasibility of the solution.

[0022] In one possible implementation of the first aspect, after the analysis device obtains information about the threat events resulting from the vulnerability and / or the difficulty of exploiting the vulnerability, it can input this information and / or the difficulty of exploiting the vulnerability into a vulnerability assessment model to obtain the threat level of the vulnerability. The vulnerability assessment model is obtained by the analysis device training an artificial intelligence (AI) model based on multiple training samples. Each training sample corresponds to a vulnerability, and the training sample includes the input features of the vulnerability assessment model: information about the threat events resulting from the vulnerability and / or the difficulty of exploiting the vulnerability, and the output result of the vulnerability assessment model (i.e., the label of the training sample): the threat level of the vulnerability.

[0023] In this possible implementation, after the analysis device obtains relevant information about the vulnerability, it can assess the threat level of the vulnerability through a trained vulnerability assessment model. Compared with assessing the threat level of the vulnerability based on expert experience, this approach is not limited by the level of the expert and improves the accuracy of the assessment results.

[0024] In one possible implementation of the first aspect, after the analysis device acquires multiple vulnerability information and assesses the threat level of these vulnerabilities, it can display the vulnerabilities and their threat levels through a front-end interface in the form of tables, text, or graphics, allowing security operations personnel to quickly understand the risk situation of each vulnerability. Furthermore, the analysis device can also display information about vulnerabilities from different dimensions according to user needs, such as whether the vulnerability has generated a threat event, the number and severity of the threat events, whether the vulnerability can be protected against by computer equipment, the standard score of the vulnerability, and the number of exploitable samples.

[0025] In this possible implementation, the analysis device can display the vulnerability and its threat level in the form of tables, text, or graphics through the front-end interface. Security operations personnel can quickly and accurately understand the vulnerability situation through the information displayed on the front-end interface, and thus take rapid action.

[0026] In one possible implementation of the first aspect, the analysis device can also display the order of patching multiple vulnerabilities through a front-end interface, so that security operations personnel can patch the vulnerabilities.

[0027] In this possible implementation, the analysis device will also display the order in which multiple vulnerabilities need to be fixed on the front-end interface, so that security operations personnel can clearly know which vulnerabilities need to be addressed first.

[0028] A second aspect of this application provides an analysis apparatus, including an acquisition unit and an evaluation unit.

[0029] The acquisition unit is used to acquire multiple vulnerability information entries. Each vulnerability entry indicates a vulnerability in a computer device, and each vulnerability entry includes a vulnerability identifier.

[0030] The assessment unit evaluates the threat level of multiple vulnerabilities indicated by multiple vulnerability reports based on the number of threat events that trigger security device alerts and / or the difficulty of exploitation. A threat event is generated by the security device targeting a single attack sample.

[0031] In one possible implementation of the second aspect, the analysis device further includes a determination unit. The determination unit is used to determine the remediation order of multiple vulnerabilities based on their threat levels.

[0032] In one possible implementation of the second aspect, the determining unit is specifically used to determine the processing priority of multiple vulnerabilities based on their threat level, and to determine the remediation order of the multiple vulnerabilities based on their processing priority.

[0033] In one possible implementation of the second aspect, the difficulty of exploitation includes the maturity of code exploitation or the effectiveness of computer equipment in protecting against vulnerabilities.

[0034] In one possible implementation of the second aspect, the analysis device further includes a transmitting unit and a receiving unit.

[0035] The sending unit is used to send test tasks to computer devices, which are used to test the effectiveness of the computer devices in protecting against vulnerabilities.

[0036] The receiving unit is used to receive test results sent by the computer device for the test task. The test results indicate the effectiveness of the computer device in protecting against vulnerabilities.

[0037] In one possible implementation of the second aspect, the evaluation unit is further configured to evaluate the threat level of multiple vulnerabilities based on a vulnerability evaluation model, which is trained based on multiple training samples. The first training sample among the multiple training samples includes the number of attack samples that trigger security device alerts by exploiting the first vulnerability and / or the difficulty of exploiting the first vulnerability, as well as the threat level of the first vulnerability.

[0038] In one possible implementation of the second aspect, the analysis device further includes a display unit for displaying multiple vulnerabilities and the threat level of the multiple vulnerabilities.

[0039] In one possible implementation of the second aspect, the display unit is also used to display the order in which multiple vulnerabilities are fixed.

[0040] The analysis apparatus provided in the second aspect of this application is used to perform the method described in the first aspect or any possible implementation thereof.

[0041] A third aspect of this application provides an analysis apparatus, including a processor and a memory. The memory is used to store instructions, and the processor is used to retrieve the instructions stored in the memory to execute the method described in the first aspect or any implementation thereof.

[0042] A fourth aspect of this application provides a computer-readable and writable storage medium, the computer-readable and writable storage medium including instructions that, when executed on a computer, cause the computer to perform the method described in the first aspect or any possible implementation thereof.

[0043] The fifth aspect of this application provides a computer program product containing instructions that, when the computer program product is run on a computer, cause the computer to perform the method described in the first aspect or any possible implementation thereof.

[0044] The sixth aspect of this application provides a chip system including at least one processor and a communication interface, the communication interface and the at least one processor being interconnected via a line, the at least one processor being configured to run a computer program or instructions to perform the method described in the first aspect or any possible implementation thereof. Attached Figure Description

[0045] Figure 1 This is a schematic diagram illustrating the application scenario of the vulnerability assessment system in this application embodiment;

[0046] Figure 2 This is a schematic diagram of one embodiment of the vulnerability assessment method in this application;

[0047] Figure 3 This is a schematic diagram of another embodiment of the vulnerability assessment method in this application;

[0048] Figure 4 This is a schematic diagram of threat event information in an embodiment of this application;

[0049] Figure 5 This is a schematic diagram of vulnerability information in the vulnerability knowledge base in an embodiment of this application;

[0050] Figure 6 This is a schematic diagram of the vulnerability information displayed on the front-end interface in an embodiment of this application;

[0051] Figure 7 This is a schematic diagram of one embodiment of the vulnerability assessment method in this application;

[0052] Figure 8 This is a schematic diagram of the computer equipment protection effectiveness test results in an embodiment of this application;

[0053] Figure 9 This is another schematic diagram of the vulnerability information displayed on the front-end interface in the embodiments of this application;

[0054] Figure 10 This is a schematic diagram of one embodiment of the analysis device in this application;

[0055] Figure 11 This is a schematic diagram of another embodiment of the analysis device in this application;

[0056] Figure 12 This is a schematic diagram of another embodiment of the analysis device in this application. Detailed Implementation

[0057] This application provides a vulnerability assessment method and analysis device, which can improve the accuracy of assessment results when evaluating the threat level of vulnerabilities. This application also provides corresponding computer-readable storage media and computer program products, which are described in detail below.

[0058] The embodiments of this application are described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. As those skilled in the art will recognize, with the development of technology and the emergence of new scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0059] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0060] Please refer to the following: Figure 1 , Figure 1 This is a schematic diagram illustrating an application scenario of the vulnerability assessment system provided in this application embodiment.

[0061] The vulnerability assessment system in this application embodiment includes an analysis device 101, a security device 102, and multiple computer devices 103. It is understood that... Figure 1 For illustrative purposes only, in actual applications, there may be multiple analysis devices 101 and security devices 102, and the number of computer devices 103 may be more or less; no specific limit is set here.

[0062] Analysis device 101 is connected to computer device 103 via security device 102. Security device 102 provides protection for computer device 103 and can detect events that pose a threat to computer device 103. Security device 102 can be a firewall, honeypot, or security gateway, etc. Computer device 103 can be a terminal device, such as a server, personal computer, or mobile phone, or a network device, such as a switch, router, or gateway. Analysis device 101, security device 102, and computer device 103 establish a communication connection via a local area network (LAN) or the Internet. This communication connection can be a wired network connection, such as an Ethernet network or fiber optic network. It can also be a wireless network connection, such as a wireless local area network (WLAN) or a cellular wireless network.

[0063] The analysis device 101 may also connect directly to the computer device 103 without going through the security device 102. Alternatively, the security device 102 may be absent, and its functions may be implemented through software installed on the computer device.

[0064] After the analysis device 101 establishes a communication connection with the computer device 103, it can obtain vulnerability information of the computer device 103 and assess the threat level of the vulnerabilities indicated by the vulnerability information.

[0065] based on Figure 1 The vulnerability assessment system shown below, in conjunction with... Figure 2 The vulnerability assessment method provided in the embodiments of this application will be described.

[0066] like Figure 2 As shown, one embodiment of the vulnerability assessment method in this application includes steps 201 and 202.

[0067] 201. Analyze the equipment to obtain multiple vulnerability information of the computer equipment.

[0068] An analysis device obtains multiple vulnerability information about a computer device. For example, the analysis device scans a computer device to obtain multiple vulnerability information. Vulnerability information includes an identifier (e.g., a name) for the vulnerability. Each vulnerability information indicates a vulnerability in the computer device. Multiple vulnerabilities indicated by multiple vulnerability information may reside on the same computer device or on different computer devices.

[0069] In addition to vulnerability information, analysis devices can also obtain information about computer devices, such as the Internet Protocol (IP) address of the computer device.

[0070] It is understandable that vulnerability information can also be obtained by vulnerability scanners or other devices with vulnerability scanning capabilities by scanning computer devices and then sending them to analysis devices. Here, there is no limitation on the way analysis devices obtain vulnerability information.

[0071] 202. The analysis device assesses the threat level of multiple vulnerabilities based on information about threat events and / or the difficulty of exploiting vulnerabilities.

[0072] A threat event is an event detected by security equipment where an attacker exploits vulnerabilities in a computer device to launch an attack. Threat events can be of various types, such as botnets, worms, and malicious files. The type of threat event indicates the type of attack that triggered it. For example, if the type of threat event is botnet, it means that the threat event was generated by an attack source using a botnet. For each type, an attacker can generate multiple attack samples, each used to indicate the type of attack to be launched against a specific target. An attacker can generate one threat event by executing one attack sample. For the same attack sample, an attacker can execute it multiple times, and multiple attack actions can generate the same threat event. The number of attacks can be recorded in the threat event information. Alternatively, a single attack action can generate one threat event, and the same attack sample can generate multiple threat events. This embodiment uses one attack sample corresponding to one threat event as an example for illustration; specific limitations are not specified here.

[0073] After detecting a threat event, the security device sends threat event information to the analysis device. The analysis device then receives this information. Upon receiving the threat event information, the analysis device assesses the threat level of each vulnerability based on the information. Specifically, the analysis device assesses the threat level of a vulnerability based on whether it generates threat events, the number of threat events generated, and the severity of the generated threat events. The more threat events generated and the more severe the threat, the higher the threat level of the vulnerability. For example, if vulnerability A generates 5 threat events, and all 5 threat events are of a high severity level, then vulnerability A has a high threat level. If vulnerability B generates one threat event, and that threat event is of a low severity level, then vulnerability B has a low threat level.

[0074] Analysis tools can also assess the threat level of each vulnerability based on its exploitability difficulty. Exploitability difficulty refers to the difficulty for an attacker to exploit the vulnerability to attack a computer device. Exploitability difficulty includes the effectiveness of the computer device's protection against the vulnerability or the maturity of the exploit code. It can also include the number of exploitable samples, etc.

[0075] Analysis devices can conduct simulated attacks on computer devices to assess the effectiveness of the device's protection against vulnerabilities. Specifically, if a simulated attack exploiting a vulnerability is effectively protected against by the computer device, it indicates that the device is capable of protecting against that vulnerability. In other words, it is very difficult for an attacker to exploit the vulnerability (high vulnerability exploitation difficulty), and the vulnerability poses a low threat to the computer device. Of course, besides conducting simulated attacks based on one or several vulnerabilities, analysis devices can also perform in-depth and comprehensive probing of computer devices through test cases. For example, analysis devices can perform penetration testing on computer devices to determine which vulnerabilities the device can and cannot protect against.

[0076] Analysis devices can obtain information such as vulnerability exploitation maturity and the number of exploitable samples from vulnerability knowledge bases. Vulnerability knowledge bases are information repositories storing a large amount of information about published vulnerabilities. Exploitation maturity reflects whether exploitable scripts already exist, as well as the quantity and quality of these scripts; a higher quantity and quality indicate higher exploitation maturity. In other words, higher exploitation maturity means lower costs for attackers to exploit the vulnerability, thus increasing its threat level. The number of exploitable samples represents the number of malware families targeting a particular vulnerability. The number of malware families is related to the number of attack samples; each malware family can generate one attack sample. A higher number of exploitable samples indicates lower vulnerability exploitation difficulty and a higher threat level. It should be noted that the number of exploitable samples for a given vulnerability represents the theoretical number of threat events that the vulnerability could generate. However, attackers generally do not use all malware, meaning the number of threat events detected by security devices may not be the same as the number of exploitable samples.

[0077] Understandably, analysis devices can also combine information from threat events sent by security devices with the difficulty of exploiting vulnerabilities to evaluate the threat level of multiple vulnerabilities. For example, if neither vulnerability A nor vulnerability B has generated any threat events, the threat level of vulnerabilities A and B can be evaluated based on the difficulty of exploitation. Alternatively, if the analysis device has already assessed the threat level of vulnerabilities A and B based on threat event information, it can further combine this assessment with the difficulty of exploitation to improve the accuracy of the evaluation results.

[0078] Optionally, the analysis device can also combine information from other dimensions, such as the vulnerability's standard score (e.g., CVSS score), to assess the threat level of a vulnerability. For example, if the analysis device determines that vulnerability A has a low threat level based on information about the threat event and the difficulty of exploiting the vulnerability, but vulnerability A has a CVSS score of 8 (indicating high risk), then the threat level of vulnerability A will be upgraded to medium.

[0079] Threat event information related to vulnerabilities reflects the threats that vulnerabilities have already posed to computer devices, and the exploitability difficulty reflects the difficulty for attackers to attack computer devices based on the vulnerability. Therefore, in this embodiment, the analysis device assesses the threat level of vulnerabilities in computer devices based on vulnerability-related threat event information (e.g., whether the vulnerability generates threat events, the number of threat events, the level of threat events, etc.) and / or the exploitability difficulty (e.g., the effectiveness of the computer device's protection against vulnerabilities, the maturity of code exploitation, the number of exploitable samples, etc.), which can improve the accuracy of the assessment results.

[0080] In this embodiment of the application, the analysis device can assess the threat level of the vulnerability through various methods, which will be described below.

[0081] I. Assess the threat level of vulnerabilities by analyzing information about threat events sent by security devices.

[0082] In this embodiment, the analysis device assesses the threat level of a vulnerability based on information about the threat event and vulnerability information obtained from a vulnerability knowledge base. The following section combines... Figure 3 Please provide an explanation.

[0083] 301. Analyze the equipment to obtain multiple vulnerability information of the computer equipment.

[0084] The analysis device may include a vulnerability prioritization module. This module scans the computer device to obtain multiple vulnerability information entries. These entries include vulnerability identifiers (e.g., names), such as "CVE-2020-13645". Each vulnerability entry indicates a vulnerability within the computer device. Multiple vulnerability entries indicating multiple vulnerabilities may reside on the same computer device or on different computer devices.

[0085] In addition to vulnerability information, analysis devices can also obtain information about computer devices, such as the IP addresses of computer devices.

[0086] It is understandable that vulnerability information can also be obtained by vulnerability scanners or other devices with vulnerability scanning capabilities by scanning computer devices and then sending them to analysis devices. Here, there is no limitation on the way analysis devices obtain vulnerability information.

[0087] 302. Security equipment detects threat events in computer equipment.

[0088] Security devices possess protective capabilities and can detect threat events that pose a threat to computer devices. Security devices can be devices such as firewalls, honeypots, or security gateways. A threat event is an event in which an attacker exploits vulnerabilities in a computer device to launch an attack.

[0089] After a security device detects a threat event, it can obtain information about the threat event. For example, information about a threat event might include... Figure 4 The information includes the name of the vulnerability exploited in the threat event, "CVE: CVE-2013-3612"; the name of the threat event, "eventName: Weak Telnet Password Login Detected"; the type of the threat event, "eventType: 1 (e.g., 1 indicates a botnet / worm)"; the number of times the threat event occurred, "eventCount: 1"; the severity of the threat event, "severity: 5 (e.g., 5 indicates severe)"; and information such as the attack source's security zone, the attack source's IP address, the source port, the victim's security zone (destination security zone), the victim's IP address (destination IP), the destination port, and the time of occurrence. The attack source's security zone indicates whether the attacker is in a trusted zone (e.g., an intranet) or an untrusted zone; the attack source's IP address identifies the attacker; the source port indicates the port from which the attack originated; the destination security zone indicates whether the victim is in a trusted or untrusted zone; the destination IP address and destination port indicate the victim's address and port; and the time of occurrence can be the time when the attacker first launched an attack that generated a threat event, or the time of the most recent attack.

[0090] It is understandable that step 302 can occur before or after step 301; no specific limitation is made here.

[0091] 303. Security devices send information about threat events to analysis devices.

[0092] After acquiring information about threat events, the security device sends this information to the analysis device. The analysis device may also include a perimeter protection and response module, which sends information such as the vulnerability exploited by the threat event, the type, severity, and frequency of the threat event to the vulnerability prioritization module.

[0093] 304. The analysis device retrieves information on multiple vulnerabilities from the vulnerability knowledge base.

[0094] The vulnerability knowledge base stores a large amount of information on published vulnerabilities. This knowledge base can be stored on analysis devices or other devices. After obtaining multiple vulnerability information about a computer device, the analysis device retrieves the exploit difficulty of these vulnerabilities from the vulnerability knowledge base, indicating factors such as code exploit maturity and the number of exploitable samples.

[0095] Code exploit maturity reflects whether exploit scripts already exist that target a particular vulnerability, as well as the quantity and quality of these scripts. A higher quantity and quality result in higher code exploit maturity. In other words, higher code exploit maturity means lower costs for attackers to exploit the vulnerability, making it easier to exploit and thus posing a greater threat.

[0096] The number of exploitable samples represents the number of malware families that exist for a particular vulnerability. The number of malware families is related to the number of attack samples; each malware family can generate one attack sample. The more exploitable samples there are, the easier it is to exploit the vulnerability, and the higher the threat level of the vulnerability.

[0097] In addition to the difficulty of exploitation, vulnerability information obtained by the analysis device from the vulnerability knowledge base may also include other dimensions of information such as the vulnerability's standard score (e.g., CVSS score). Please refer to [link / reference] for details. Figure 5 .

[0098] 305. Analyze the equipment to assess the threat level of multiple vulnerabilities.

[0099] The analysis device combines information from threat events sent by security devices with vulnerability exploitation difficulty data obtained from a vulnerability knowledge base to assess the threat level of multiple vulnerabilities. Specifically, the analysis device can rate or score the threat level of vulnerabilities based on scoring rules and the acquired information. These scoring rules can be generated based on expert experience. For example, if vulnerability A generates 5 threat events, exceeding the preset threshold of 3, then 30 points are added; if the threat level is severe, another 30 points are added. If the code exploit maturity of vulnerability A is low, 20 points are deducted; if the number of exploitable samples is 10, exceeding the preset threshold of 3, then 20 points are added, meaning vulnerability A's threat level score is 60 points. After obtaining the vulnerability threat level score, the analysis device can convert it into a threat level rating. For example, if the scoring rules stipulate that 50-70 points correspond to medium, then vulnerability A's threat level is medium.

[0100] In addition, the analysis device can also increase or decrease the threat level score based on other dimensions of information such as standard scores obtained from the vulnerability knowledge base, which will not be elaborated here.

[0101] In addition to evaluating based on scoring rules, the analysis device can also assess the threat level of vulnerabilities by inputting the acquired information into a trained vulnerability assessment model. The vulnerability assessment model is obtained by training an AI model using multiple training samples. Each training sample corresponds to a vulnerability, and the training samples include the input features of the vulnerability assessment model: information about the threat event that the vulnerability generates and / or the difficulty of exploiting the vulnerability, as well as the output of the vulnerability assessment model (i.e., the label of the training sample): the threat level of the vulnerability.

[0102] For the input features in the training samples (i.e., information on threat events and / or vulnerability exploitation difficulty), the analysis device can quantify and classify them based on expert experience, converting the values ​​into interval levels. For example, if a vulnerability generates 5 threat events, its risk level in terms of the number of threat events is medium risk; if it generates 10 threat events, its risk level is high risk. Features in other dimensions (threat event level, code exploitation maturity, etc.) can be processed similarly. Based on the quantified and classified features of each dimension, and combined with expert experience, the analysis device assesses the threat level of the vulnerability to obtain the vulnerability's threat level (i.e., the label of the training sample). Specifically, this can be a level, such as high, medium, low, or no threat, or a score. Alternatively, the input features can be used without conversion to interval levels; the analysis device can directly evaluate the vulnerability based on the scores of each dimension's features, combined with scoring rules, to obtain the output result in the training samples (the vulnerability's threat level).

[0103] After the analysis device obtains the training samples, it inputs the training samples into the AI ​​model for training. The AI ​​model can be a decision tree, a random forest, a gradient boosting decision tree (GBDT), an optimized distributed gradient boosting library (eXtreme Gradient Boosting, XGBoost), a Bayesian network, kernel-based algorithms (such as support vector machines (SVM)), restricted Boltzmann machines (RBN), stacked autoencoders, deep neural networks (DNN), convolutional neural networks (CNN), ensemble learning, etc., and is not limited here.

[0104] During model training, the analysis device sets certain parameters. For example, for a decision tree model, the analysis device can set the segmentation quality evaluation (e.g., mean square error (MSE)), the segmentation strategy for each node (e.g., random segmentation or optimal segmentation), the maximum depth of the decision tree, and the minimum number of samples for each leaf node. After the parameters are set, a vulnerability assessment model that meets the requirements and has high segmentation quality is trained based on the input training samples.

[0105] After the analysis equipment obtains the vulnerability assessment model, it inputs the vulnerability-related information into the model, which then outputs the threat level of the vulnerability. The output threat level can be a level or a score. Specifically, when training the vulnerability assessment model, if the training samples are labeled as threat level, the model's output will also be a threat level; if the training samples are labeled as threat score, the model's output will also be a threat score. The threat level and threat score output by the vulnerability assessment model can also be converted to each other by setting a correspondence between level and score ranges.

[0106] 306. Analyze the equipment to determine the order in which to fix multiple vulnerabilities.

[0107] After analyzing the threat levels of multiple vulnerabilities, the analysis equipment can determine the remediation order based on the threat level of each vulnerability, enabling security operations personnel to address and resolve them. Specifically, the analysis equipment sorts the vulnerabilities according to their threat level, with higher-threat vulnerabilities requiring immediate attention and remediation prior to them, and lower-threat vulnerabilities remediated later. For example, if vulnerability A has a high threat level, vulnerability B has a low threat level, and vulnerability C has a medium threat level, then the remediation order would be: vulnerability A first, vulnerability C second, and vulnerability B third.

[0108] 307. The analysis device displays relevant information about the vulnerability through the front-end interface.

[0109] The analysis device also provides a front-end interface, through which it can display vulnerability-related information in the form of tables, text, or graphics. The displayed information includes... Figure 6 As shown. Figure 6 This example illustrates how a vulnerability can generate only one threat event. In practice, a vulnerability can generate multiple threat events, and the number of these events can be displayed on the front-end interface. When a vulnerability generates multiple threat events, the number of times each threat event occurs and the severity of each threat event will be displayed separately.

[0110] Understandable Figure 6 For illustrative purposes only, in actual applications, the front-end interface can display only the vulnerability and its threat level (threat level can be a score or a rating), or only the vulnerability, its threat level, and the order in which they are patched. It can also be like... Figure 6 The information shown displays the various dimensions of the vulnerability's characteristics, including information about the threat event (e.g., whether a threat event occurred and the type, number, and severity of such events) and information about the vulnerability's exploitation difficulty obtained from the vulnerability knowledge base (e.g., code exploitation maturity and the number of exploitable samples). Specific details are not limited here.

[0111] Step 304 above is optional. The analysis device may assess the threat level of the vulnerability solely based on the information of the threat event, without obtaining additional vulnerability information from the vulnerability database. When the analysis device executes step 304, it assesses the threat level of the vulnerability based on the information of the threat event and the difficulty of exploiting the vulnerability.

[0112] In this embodiment, the analysis device can assess the threat level of multiple vulnerabilities by combining information from threat events reported by security devices and / or the difficulty of exploiting vulnerabilities, thus improving the accuracy of the assessment results. Furthermore, the analysis device can sort the remediation order of multiple vulnerabilities according to their threat levels, enabling security operations personnel to subsequently remediate them. The analysis device can also display the remediation order and other relevant information about the vulnerabilities on the front-end interface, allowing security operations personnel to accurately and comprehensively understand the vulnerability situation and ensuring the stable operation of computer equipment as much as possible.

[0113] 2. Assess the threat level of vulnerabilities by evaluating the effectiveness of protection against vulnerabilities using computer equipment.

[0114] The difficulty of exploiting a vulnerability can also be assessed by the effectiveness of the computer device's protection against it. In this embodiment, the analysis device evaluates the threat level of a vulnerability by assessing the effectiveness of the computer device's protection against it. The following section combines... Figure 7 Please provide an explanation.

[0115] 701. Analyze the device to obtain multiple vulnerability information of the computer device.

[0116] Step 701 in this embodiment is the same as described above. Figure 3 Step 301 in the illustrated embodiment is similar and will not be described in detail here.

[0117] 702. The analysis equipment sends test tasks to the computer equipment.

[0118] Analysis devices can test the effectiveness of a computer's protection against vulnerabilities by sending test tasks to the computer. A test task is a simulated attack launched by the analysis device against the computer based on vulnerability information. Alternatively, a test task can also be an instruction to the computer or other devices to perform a simulated attack on the computer, meaning the analysis device does not perform a simulated attack. For example, if the computer device has an agent program installed, the analysis device can send a test task to instruct the agent program to perform corresponding attack actions.

[0119] It should be noted that testing tasks may not be based on simulated attacks launched based on one or a few vulnerabilities. Instead, they may involve conducting in-depth and comprehensive probing of computer devices through a series of test cases. For example, analyzing devices to perform penetration testing on computer devices, thereby identifying the vulnerabilities that the computer devices can and cannot protect against.

[0120] 703. The computer equipment returns the test results to the analysis equipment.

[0121] The computer equipment generates test results based on the test task and sends these results to the analysis equipment. The analysis equipment uses the test results returned by the computer equipment to determine whether the simulated attack was successful, or in other words, whether the computer equipment successfully defended against the simulated attack. If the computer equipment fails to defend, it indicates that the computer equipment lacks the ability to protect against the vulnerability corresponding to the test task; that is, it is easy for an attacker to exploit this vulnerability to attack the computer equipment (low vulnerability exploitation difficulty), and the vulnerability poses a high threat. The test results returned by the computer equipment can be combined with... Figure 8 To understand. For example Figure 8 As shown, the test results include the names of the vulnerabilities exploited in this test task, as well as information about the system and host. Figure 8 The corresponding test task exploited two vulnerabilities, "CVE-2017-0144" and "CVE-2020-0601," to attack computer devices. Understandably, Figure 8 This is for illustrative purposes only. In actual applications, the test results will also display the execution result of the test task (whether the attack on the computer device was successful). If the computer device fails to defend itself... Figure 8 The simulated attacks performed in the corresponding test tasks indicate that the computer equipment is not protected against the two vulnerabilities, CVE-2017-0144 and CVE-2020-0601.

[0122] 704. The analysis device retrieves information on multiple vulnerabilities from the vulnerability knowledge base.

[0123] Optionally, the analysis device can also obtain other information related to the difficulty of exploiting vulnerabilities from a vulnerability knowledge base.

[0124] 705. Analyze the equipment to assess the threat level of multiple vulnerabilities.

[0125] 706. Analyze the equipment to determine the order in which to fix multiple vulnerabilities.

[0126] 707. The analysis device displays relevant information about the vulnerability through the front-end interface.

[0127] Steps 704 to 707 in this embodiment are the same as those described above. Figure 3Steps 304 to 307 in the illustrated embodiment are similar, except that the exploitation difficulty in this embodiment may also include the effectiveness of the computer device's protection against the vulnerability. The analysis device assesses the threat level of the vulnerability solely based on the exploitation difficulty. In this embodiment, the information displayed on the front-end interface does not include information about threat events, but rather the effectiveness of the computer device's protection against the vulnerability. The displayed information can be combined with... Figure 9 To understand.

[0128] In this embodiment, the analysis device can combine the effectiveness of the computer device in protecting against vulnerabilities with information on the difficulty of exploiting other vulnerabilities in the vulnerability knowledge base to assess the threat level of multiple vulnerabilities. This expands the application scenarios of the solution, improves its feasibility, and further enhances the accuracy of the assessment.

[0129] Understandably, analytical equipment can also be combined with Figure 3 as well as Figure 7 The steps in the illustrated embodiment assess the threat level of the vulnerability, that is, to evaluate the threat level of the vulnerability based on information about threat events reported by the security device, the effectiveness of the computer device in protecting against the vulnerability, and vulnerability information obtained from the vulnerability knowledge base (e.g., information on the exploitation difficulty of other vulnerabilities).

[0130] The vulnerability assessment method in the embodiments of this application has been described above. The analysis device in the embodiments of this application is described below. Please refer to [link / reference]. Figure 10 One embodiment of the analysis device in this application includes an acquisition unit 1001 and an evaluation unit 1002.

[0131] The acquisition unit 1001 is used to acquire multiple vulnerability information, each of which indicates a vulnerability in a computer device, and each vulnerability information includes an identifier of a vulnerability.

[0132] Evaluation unit 1002 is used to assess the threat level of multiple vulnerabilities indicated by multiple vulnerability information based on the number of threat events that trigger security device alerts and / or the difficulty of vulnerability exploitation. A threat event is generated by the security device targeting a single attack sample.

[0133] The analysis device in the embodiments of this application is described in detail below. Please refer to [link / reference]. Figure 11 Another embodiment of the analysis device in this application includes an acquisition unit 1101 and an evaluation unit 1102.

[0134] The acquisition unit 1101 is used to acquire multiple vulnerability information, each of which indicates a vulnerability in a computer device, and each vulnerability information includes an identifier of a vulnerability.

[0135] Evaluation unit 1102 is used to assess the threat level of multiple vulnerabilities indicated by multiple vulnerability information based on the number of threat events that trigger security device alerts and / or the difficulty of vulnerability exploitation. A threat event is generated by the security device targeting a single attack sample.

[0136] Optionally, the analysis device also includes a determination unit 1103 for determining the remediation order of multiple vulnerabilities based on their threat level.

[0137] The determining unit 1103 is specifically used to determine the processing priority of multiple vulnerabilities based on their threat level, and to determine the repair order of multiple vulnerabilities based on their processing priority.

[0138] In one possible implementation, the difficulty of exploitation includes the maturity of code exploitation or the effectiveness of computer equipment in protecting against vulnerabilities.

[0139] Optionally, the analysis device further includes a sending unit 1104 for sending a test task to the computer device. The test task is used to test the effectiveness of the computer device's protection against vulnerabilities. The analysis device also includes a receiving unit 1105 for receiving the test results sent by the computer device for the test task. The test results indicate the effectiveness of the computer device's protection against vulnerabilities.

[0140] The evaluation unit 1102 is also used to evaluate the threat level of multiple vulnerabilities based on a vulnerability assessment model. The vulnerability assessment model is trained based on multiple training samples. The first training sample among the multiple training samples includes the number of attack samples that trigger security device alerts by exploiting the first vulnerability and / or the difficulty of exploiting the first vulnerability, as well as the threat level of the first vulnerability.

[0141] Optionally, the analysis device also includes a display unit 1106 for displaying multiple vulnerabilities and the threat level of the vulnerabilities.

[0142] Display unit 1106 is also used to display the order in which multiple vulnerabilities are fixed.

[0143] In this embodiment, each unit in the analysis device performs the operations described above. Figure 3 and Figure 7 The operation of the analysis device in the illustrated embodiment will not be described in detail here.

[0144] Please refer to the following: Figure 12 The diagram below illustrates a possible logical structure of the analysis device provided in this application embodiment, including:

[0145] The system includes a processor 1201, a communication interface 1202, a memory 1203, and a bus 1204. The processor 1201, communication interface 1202, and memory 1203 are interconnected via the bus 1204. In embodiments of this application, the processor 1201 is used to control and manage the operations of the analysis device; for example, the processor 1201 is used to execute... Figure 2 , Figure 3 and Figure 7 The steps in the method embodiment are described. Communication interface 1202 is used to support communication between the analysis device and other components. Memory 1203 is used to store the program code and data of the analysis device.

[0146] The processor 1201 can be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a digital signal processor and a microprocessor, etc. The bus 1204 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 12 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0147] This application also provides a computer-readable and writable storage medium, which includes instructions that, when executed on a computer, cause the computer to perform the aforementioned actions. Figure 2 , Figure 3 and Figure 7 The method in the illustrated embodiment.

[0148] This application also provides a computer program product containing instructions, which, when run on a computer, causes the computer to perform the aforementioned... Figure 2 , Figure 3 and Figure 7 The method in the illustrated embodiment.

[0149] This application also provides a chip system, which includes at least one processor and a communication interface. The communication interface and the at least one processor are interconnected via a circuit. The at least one processor is used to run computer programs or instructions to perform the aforementioned... Figure 2 , Figure 3 and Figure 7 The method in the illustrated embodiment.

[0150] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0151] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between apparatuses or units through some interfaces, and may be electrical, mechanical, or other forms.

[0152] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0153] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0154] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

Claims

1. A vulnerability assessment method, characterized in that, include: The analysis device obtains multiple vulnerability information, each of which is used to indicate a vulnerability in a computer device, and each vulnerability information includes an identifier of a vulnerability; The analysis device assesses the threat level of each vulnerability among multiple vulnerabilities indicated by the multiple vulnerability information based on the information of the threat events that trigger security device alarms and the difficulty of vulnerability exploitation. The threat event is an event detected by the security device in which an attacker exploits a vulnerability in the computer device to attack the computer device. The information of the threat event reflects the threat that the vulnerability has already posed to the computer device. The information of the threat event includes whether the vulnerability has generated a threat event, the number of threat events generated, and the level of the threat events generated. The difficulty of exploiting the vulnerability includes the effectiveness of the computer device in protecting against the vulnerability, which is obtained by sending a test task to the computer device. The test task includes a simulated attack launched against the computer device, or the test task is used to instruct the computer device to perform a simulated attack.

2. The method according to claim 1, characterized in that, The method further includes: The analysis device determines the order in which the multiple vulnerabilities are patched based on their threat level.

3. The method according to claim 2, characterized in that, The analysis device determines the remediation order of the multiple vulnerabilities based on their threat level, including: The analysis device determines the processing priority of the multiple vulnerabilities based on their threat level; The analysis device determines the order in which the multiple vulnerabilities are repaired based on their processing priorities.

4. The method according to any one of claims 1 to 3, characterized in that, The difficulty of exploiting the vulnerability also includes the maturity of the exploit code.

5. The method according to claim 1, characterized in that, The method further includes: The analysis device sends a test task to the computer device, the test task being used to test the effectiveness of the computer device in protecting against vulnerabilities; The analysis device receives test results from the computer device for the test task, and the test results indicate the effectiveness of the computer device in protecting against vulnerabilities.

6. The method according to any one of claims 1 to 3, characterized in that, The method further includes: The analysis device assesses the threat level of the multiple vulnerabilities based on a vulnerability assessment model, which is trained on at least one of the following: information on threat events that trigger security device alerts by exploiting the vulnerabilities, the difficulty of exploiting the vulnerabilities, or the threat level of the vulnerabilities.

7. The method according to any one of claims 1 to 3, characterized in that, The method further includes: The analysis device displays the threat level of the multiple vulnerabilities.

8. The method according to claim 7, characterized in that, The method further includes: The analysis device displays the order in which the multiple vulnerabilities are fixed.

9. An analytical device, characterized in that, include: An acquisition unit is used to acquire multiple vulnerability information, each of the multiple vulnerability information is used to indicate a vulnerability in a computer device, and each vulnerability information includes an identifier of a vulnerability; An evaluation unit is used to assess the threat level of each of the multiple vulnerabilities indicated by the multiple vulnerability information based on the information of the threat events that trigger security device alarms and the difficulty of vulnerability exploitation. The threat events are events detected by the security device in which an attacker exploits a vulnerability in the computer device to attack the computer device. The information of the threat events reflects the threat that the vulnerability has already posed to the computer device. The information of the threat events includes whether the vulnerability has generated a threat event, the number of threat events generated, and the level of the threat events generated. The difficulty of exploiting the vulnerability includes the effectiveness of the computer device in protecting against the vulnerability, which is obtained by sending a test task to the computer device. The test task includes a simulated attack launched against the computer device, or the test task is used to instruct the computer device to perform a simulated attack.

10. The analytical apparatus according to claim 9, characterized in that, The analytical device also includes: A determining unit is used to determine the order in which the multiple vulnerabilities are patched based on their threat level.

11. The analytical apparatus according to claim 10, characterized in that, The determining unit is specifically used for: The processing priority of the multiple vulnerabilities is determined based on their threat level; The order in which the vulnerabilities are patched is determined based on their processing priorities.

12. The analytical apparatus according to any one of claims 9 to 11, characterized in that, The difficulty of exploiting the vulnerability also includes the maturity of the exploit code.

13. The analytical apparatus according to claim 9, characterized in that, The analytical device also includes: A sending unit is used to send a test task to the computer device, the test task being used to test the effectiveness of the computer device in protecting against vulnerabilities; A receiving unit is configured to receive test results sent by the computer device for the test task, wherein the test results indicate the effectiveness of the computer device in protecting against vulnerabilities.

14. The analytical apparatus according to any one of claims 9 to 11, characterized in that, The evaluation unit is also used for: The threat level of the multiple vulnerabilities is assessed according to a vulnerability assessment model, which is trained based on at least one of the following: information on threat events that trigger security device alerts by exploiting the vulnerabilities, the difficulty of exploiting the vulnerabilities, or the threat level of the vulnerabilities.

15. The analytical apparatus according to any one of claims 9 to 11, characterized in that, The analytical device also includes: The display unit is used to display the threat level of the multiple vulnerabilities.

16. The analytical apparatus according to claim 15, characterized in that, The display unit is also used for: The order in which the various vulnerabilities are fixed is shown.

17. An analytical device, characterized in that, include: Processor and memory; The memory is used to store instructions; The processor is configured to execute instructions stored in the memory to implement the method according to any one of claims 1 to 8.

18. A computer-readable and writable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by one or more processors, it implements the method as described in any one of claims 1 to 8.

19. A computer program product containing instructions, characterized in that, When the computer program product is run on a computer, it causes the computer to perform the method as described in any one of claims 1 to 8.

Images