A method and device for determining a vulnerability to be patched, a computer device and a storage medium

Abstract

The application relates to the technical field of information security, and discloses a to-be-repaired vulnerability determination method and device, computer equipment and a storage medium, which comprises the following steps: obtaining vulnerability information of an executor; constructing an executor vulnerability matrix according to the vulnerability information; generating a service variant vulnerability matrix according to the executor vulnerability matrix and the containing relationship between the service variant and the executor; performing first-round screening on the vulnerability based on the service variant vulnerability matrix, and if the number of first candidate vulnerabilities is one, taking the first candidate vulnerability as a to-be-repaired vulnerability; if the number of first candidate vulnerabilities is not one, performing second-round screening on the first candidate vulnerability based on the service variant vulnerability matrix, and if the number of second candidate vulnerabilities is one, taking the second candidate vulnerability as a to-be-repaired vulnerability; if the number of second candidate vulnerabilities is not one, performing third-round screening on the second candidate vulnerability based on the service variant vulnerability matrix, and obtaining a to-be-repaired vulnerability. The application solves the problem that it is difficult to screen out the most recommended repaired vulnerability from existing vulnerabilities.

Description

Technical Field

[0001] This invention relates to the field of information security technology, specifically to a method, apparatus, computer device, and storage medium for identifying vulnerabilities to be patched. Background Technology

[0002] Dynamic Heterogeneous Redundancy (DHR) architecture is a typical simulation defense architecture that processes input through a service variant consisting of n heterogeneous executors and a set of k / n judgments for each form's output of that service variant. DHR architecture has been applied in various security domains, such as simulating web servers, routers, switches, and the Domain Name System (DNS).

[0003] However, with more systems adopting the DHR architecture, improving system security through vulnerability patching has become a crucial research topic. Unlike existing single-executor information system architectures, some vulnerabilities in the executors of a DHR architecture do not require immediate patching; for example, vulnerabilities existing only in no more than k executors do not need immediate patching. Therefore, vulnerability severity-based patching strategies for single-executor information system architectures are not applicable to DHR architectures. Furthermore, heterogeneous executors exhibit significant internal differences, meaning the workload required to patch common vulnerabilities varies. Therefore, there is an urgent need for a method that can select the most recommended vulnerabilities for patching under limited resources, bringing maximum security advantages to systems adopting the DHR architecture.

[0004] Therefore, existing technologies have the problem of making it difficult to select the most recommended vulnerabilities from existing vulnerabilities for patching. Summary of the Invention

[0005] In view of this, the present invention provides a method, apparatus, computer device and storage medium for determining vulnerabilities to be patched, in order to solve the problem of difficulty in selecting the most recommended vulnerabilities from existing vulnerabilities.

[0006] In a first aspect, the present invention provides a method for determining vulnerabilities to be patched, the method comprising:

[0007] Obtain vulnerability information contained in the executor, where the total number of executors is the first quantity;

[0008] Construct an executor vulnerability matrix based on the vulnerability information;

[0009] Based on the executor vulnerability matrix and the inclusion relationship between service variants and executors, a service variant vulnerability matrix is ​​generated. The service variant vulnerability matrix is ​​used to characterize the vulnerability status of service variants, and the total number of service variants is the second number.

[0010] Based on the service variant vulnerability matrix, the first round of vulnerability screening is carried out. The first round of screening is used to determine the first candidate vulnerability. If the number of first candidate vulnerabilities is one, the first candidate vulnerability is regarded as the vulnerability to be patched.

[0011] If there are multiple first candidate vulnerabilities, a second round of screening is conducted based on the service variant vulnerability matrix. The second round of screening is used to determine the second candidate vulnerabilities. If there is only one second candidate vulnerability, the second candidate vulnerability is taken as a vulnerability to be patched.

[0012] If there are multiple candidate vulnerabilities, a third round of screening is conducted based on the service variant vulnerability matrix to obtain the vulnerabilities to be patched.

[0013] The method for determining vulnerabilities to be patched provided in this embodiment first uses an executor vulnerability matrix to characterize the vulnerability information of executors; second, it generates a service variant vulnerability matrix to characterize the vulnerability information of service variants; finally, based on the service variant vulnerability matrix, a target matrix is ​​obtained through three rounds of screening, so as to achieve the effect of evaluating and screening the optimal vulnerabilities in the DHR system that should be patched first. This solves the problem in existing technologies of selecting the most recommended vulnerabilities to be patched from existing vulnerabilities.

[0014] In one optional implementation, an executor vulnerability matrix is ​​constructed based on vulnerability information, including:

[0015] Based on the vulnerability information, identify all existing vulnerabilities;

[0016] If the executor contains a vulnerability, then the first element corresponding to both the executor and the vulnerability is set to the first preset value;

[0017] If the executor does not contain a vulnerability, then the first element corresponding to both the executor and the vulnerability is set to the second preset value;

[0018] Construct the executor vulnerability matrix based on the first element.

[0019] In this embodiment, an executor vulnerability matrix is ​​constructed to represent the vulnerability information contained in each executor, which facilitates the subsequent generation of a service variant vulnerability matrix.

[0020] In one optional implementation, a service variant vulnerability matrix is ​​generated based on the executor vulnerability matrix and the inclusion relationship between service variants and executors, including:

[0021] Based on the executor vulnerability matrix, the total number of rows or columns in the executor vulnerability matrix, and the number of rows or columns to be selected from the total number of rows or columns in the executor vulnerability matrix, a third number of submatrices are selected, wherein the total number of rows or columns in the submatrices is equal to the number of rows or columns to be selected, and the number of rows and columns to be selected is obtained based on the inclusion relationship;

[0022] Summing all rows or columns of each submatrix yields a third number of vectors;

[0023] Determine whether the second element in the vector is greater than or equal to the first preset threshold;

[0024] If the second element is greater than or equal to the first preset threshold, then the third element corresponding to the second element is set to the third preset value;

[0025] If the second element is less than the first preset threshold, then the third element corresponding to the second element is set to the fourth preset value;

[0026] Generate a service variant vulnerability matrix based on the third element.

[0027] In this embodiment, a service variant vulnerability matrix is ​​generated based on the executor vulnerability matrix and the inclusion relationship between service variants and executors. The service variant vulnerability matrix describes the vulnerability availability of all service variants, providing a basis for subsequent screening of vulnerabilities to be patched.

[0028] In one alternative implementation, vulnerabilities are first-round filtered based on a service variant vulnerability matrix, including:

[0029] Determine the fourth number of third elements in each column or row of the service variant vulnerability matrix that are not equal to the fourth preset value;

[0030] The column or row corresponding to the fourth largest number is selected as a candidate column / row, and the vulnerability corresponding to the candidate column or row is selected as the first candidate vulnerability.

[0031] In this implementation, vulnerabilities are first screened based on a service variant vulnerability matrix. First, the fourth number of third elements in each column or row of the service variant vulnerability matrix that is not equal to a fourth preset value is determined. Then, the vulnerability corresponding to the largest fourth number is selected as the first candidate vulnerability. This method is suitable for DHR systems, simple and easy to implement, and can provide system administrators with the vulnerabilities that should be patched first, or provide a basis for the second round of screening.

[0032] In one alternative implementation, a second round of screening is performed on the first candidate vulnerabilities based on a service variant vulnerability matrix, including:

[0033] The first candidate vulnerabilities are sorted to obtain the first sorting result, and the first first candidate vulnerability is selected as the first vulnerability to be patched based on the first sorting result.

[0034] In the service variant vulnerability matrix, the first vulnerability to be patched is patched to obtain the service variant vulnerability matrix after patching the first vulnerability to be patched.

[0035] Determine the fifth number of security service variants in the service variant vulnerability matrix after patching the first vulnerability to be patched, where a security service variant is a service variant that does not contain a vulnerability;

[0036] Based on the first ranking result, the next first candidate vulnerability is taken as the first vulnerability to be patched. The first vulnerability to be patched is then patched from the service variant vulnerability matrix. The subsequent steps are executed after the service variant vulnerability to be patched is obtained, until all first candidate vulnerabilities have been patched.

[0037] The first candidate vulnerability corresponding to the fifth largest number is selected as the second candidate vulnerability.

[0038] In this implementation, the more security service variants a system has, the more secure the DHR system becomes. Based on the service variant vulnerability matrix, the first candidate vulnerability that, after being patched, generates the most security service variants is selected as the second candidate vulnerability. This method is suitable for DHR systems, simple and easy to implement, and can provide system administrators with the vulnerabilities that should be patched first, or provide a basis for a third round of screening.

[0039] In one alternative implementation, a third round of screening is performed on the second candidate vulnerabilities based on the service variant vulnerability matrix, including:

[0040] The second candidate vulnerabilities are sorted to obtain a second sorting result, and the first second candidate vulnerability is selected as the second vulnerability to be patched based on the second sorting result.

[0041] In the service variant vulnerability matrix, the second vulnerability to be patched is patched to obtain the service variant vulnerability matrix after patching the second vulnerability to be patched.

[0042] Based on the service variant vulnerability matrix after patching the second vulnerability to be patched, reference indicators are obtained;

[0043] Based on the second ranking result, the next second candidate vulnerability is taken as the second vulnerability to be patched. The second vulnerability to be patched is then patched from the service variant vulnerability matrix. The subsequent steps are executed after the service variant vulnerability to be patched is obtained, until all second candidate vulnerabilities have been patched.

[0044] The second candidate vulnerability corresponding to the reference indicator with the largest value is selected as the vulnerability to be patched.

[0045] In this implementation, a reference metric is used to characterize the uniformity of the distribution of other vulnerabilities after removing a second candidate vulnerability from the service variant vulnerability matrix. The second candidate vulnerability corresponding to the reference metric with the largest value is selected as the vulnerability to be patched. This method is suitable for DHR systems, is simple and easy to implement, and can provide system administrators with the vulnerabilities that should be patched first.

[0046] In one alternative implementation, a reference index is obtained based on the service variant vulnerability matrix after patching the second vulnerability to be patched, including:

[0047] Calculate the sum of the third element in each row or column of the service variant vulnerability matrix after patching the second vulnerability to be patched, and obtain the third number of element sums;

[0048] Based on the sum of elements and a preset formula, the vulnerability entropy corresponding to the second candidate vulnerability is calculated, and the vulnerability entropy is used as a reference indicator.

[0049] In this embodiment, based on the service variant vulnerability matrix after patching the second vulnerability to be patched, vulnerability entropy is calculated, and vulnerability entropy is used as a reference indicator to provide a basis for the third round of screening.

[0050] In a second aspect, the present invention provides an apparatus for determining vulnerabilities to be patched, the apparatus comprising:

[0051] The acquisition module is used to acquire vulnerability information contained in the executor, wherein the total number of executors is the first number;

[0052] The building module is used to construct an executor vulnerability matrix based on vulnerability information;

[0053] The generation module is used to generate a service variant vulnerability matrix based on the executor vulnerability matrix and the inclusion relationship between service variants and executors. The service variant vulnerability matrix is ​​used to characterize the vulnerability status of service variants, and the total number of service variants is the second number.

[0054] The first screening module is used to perform the first round of screening of vulnerabilities based on the service variant vulnerability matrix. The first round of screening is used to determine the first candidate vulnerability. If the number of first candidate vulnerabilities is one, the first candidate vulnerability is regarded as the vulnerability to be patched.

[0055] The second screening module is used to perform a second round of screening on the first candidate vulnerability based on the service variant vulnerability matrix when there is more than one first candidate vulnerability. The second round of screening is used to determine the second candidate vulnerability. If there is only one second candidate vulnerability, the second candidate vulnerability is regarded as a vulnerability to be patched.

[0056] The third filtering module is used to perform a third round of filtering on the second candidate vulnerabilities based on the service variant vulnerability matrix when there are multiple second candidate vulnerabilities, in order to obtain the vulnerabilities to be patched.

[0057] Thirdly, the present invention provides a computer device, comprising: a memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the method for determining unpatched vulnerabilities described in the first aspect or any corresponding embodiment thereof.

[0058] Fourthly, the present invention provides a computer-readable storage medium storing computer instructions for causing a computer to execute the method for determining unpatched vulnerabilities described in the first aspect or any corresponding embodiment thereof. Attached Figure Description

[0059] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0060] Figure 1 This is a flowchart illustrating the method for determining vulnerabilities to be patched according to an embodiment of the present invention;

[0061] Figure 2 This is a flowchart illustrating the vulnerability formalization and vulnerability screening process according to an embodiment of the present invention.

[0062] Figure 3 This is a flowchart illustrating the device for determining unpatched vulnerabilities according to an embodiment of the present invention;

[0063] Figure 4 This is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. Detailed Implementation

[0064] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0065] The Dynamic Heterogeneous Redundancy Architecture (DHR architecture) processes input through service variants. Each service variant consists of n heterogeneous executors and k or n judgments on the output of each executor in that service variant, where n and k are set according to system requirements. A system using the DHR architecture (or simply a DHR system) is dynamically updated after a certain period of operation. The heterogeneous executor system pool reselects n heterogeneous executors to form a new service variant to process the input, while simultaneously cleaning up the existing n heterogeneous executors and storing them back to their initial state.

[0066] Currently, improving the security of DHR systems through vulnerability patching has become an important research topic. Due to the significant internal differences between heterogeneous executors, the workload required to patch common vulnerabilities varies. This necessitates system administrators, with limited resources, selecting and patching the optimal vulnerabilities that should be prioritized to maximize the security advantage of the DHR system. Attackers may not exploit vulnerabilities in heterogeneous executors, so determining the optimal vulnerability solely based on its severity is unsuitable for DHR architectures. In practice, administrators will not patch all vulnerabilities across all heterogeneous executors; therefore, evaluating and selecting the optimal vulnerabilities is crucial for improving the security of DHR systems.

[0067] This invention provides a method for identifying vulnerabilities to be patched. It utilizes the Executor Vulnerability Matrix (MEV) and the Service Variant Vulnerability Matrix (MSV) to describe the vulnerability information of a DHR system. Furthermore, to provide more detailed vulnerability information, this invention improves the MSV generation method. Based on MSV, this invention employs a three-round screening method, including: service variant vulnerability screening, security service variant screening, and vulnerability entropy screening. Through these three rounds of screening, the optimal vulnerabilities in the DHR system that should be patched first are evaluated and selected.

[0068] According to an embodiment of the present invention, an embodiment of a method for determining a vulnerability to be patched is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer device with data processing capabilities. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0069] This embodiment provides a method for identifying vulnerabilities to be patched, which can be used in the aforementioned computer equipment. Figure 1 This is a flowchart of a method for determining vulnerabilities to be patched according to an embodiment of the present invention, such as... Figure 1 As shown, the process includes the following steps:

[0070] Step S101: Obtain vulnerability information contained in the executor, wherein the total number of executors is the first number.

[0071] Specifically, the vulnerability identification method of the present invention includes vulnerability formalization and vulnerability screening. Vulnerability formalization refers to formalizing the vulnerability information (i.e., vulnerability information) of the DHR system and representing it in matrix form. Vulnerability screening refers to evaluating and screening vulnerabilities to select the most recommended vulnerabilities for patching from existing vulnerabilities.

[0072] In this invention, m represents the total number of heterogeneous executors (hereinafter referred to as executors), n represents the number of executors contained in each service variant, k is the judgment mode parameter, and ω represents the total number of vulnerability types in the DHR system.

[0073] Obtain system vulnerability information of the DHR system, specifically including: vulnerability information contained in the first number of executors in the DHR system, where the first number is m.

[0074] Step S102: Construct an executor vulnerability matrix based on the vulnerability information.

[0075] Specifically, an Executor Vulnerability Matrix (MEV) can be used, where rows represent executors and columns represent vulnerabilities. The MEV contains m rows. The value of each element in the MEV indicates whether the executor in that row contains the vulnerability in that column. An element value of 1 indicates inclusion, and a value of 0 indicates exclusion. 1 and 0 are just examples; other values ​​can be used. For instance, an element in the second row and third column of the MEV has a value of 1, meaning the executor in the second row contains the vulnerability in the third column. Based on this, an Executor Vulnerability Matrix can be constructed to represent the vulnerability information of executors.

[0076] It should be noted that the columns of the matrix can also be used to represent the executor, and the rows of the matrix can be used to represent the vulnerability.

[0077] Step S103: Generate a service variant vulnerability matrix based on the executor vulnerability matrix and the inclusion relationship between service variants and executors. The service variant vulnerability matrix is ​​used to characterize the vulnerability status of service variants, and the total number of service variants is the second quantity.

[0078] Specifically, the inclusion relationship between service variants and executors is as follows: each service variant contains n executors. The DHR system has a total of m executors; therefore, the number r of service variants in the DHR system is equal to...

[0079] Let's take the example of using rows to represent executors and columns to represent vulnerabilities in the executor vulnerability matrix: Since each service variant contains n executors, we first select n rows from the m rows of the executor vulnerability matrix. These n rows can form one service variant, and the vulnerability information contained in these n rows can characterize the vulnerability situation of that service variant. Repeating the above process, we can obtain r rows, that is, the vulnerability situation of r service variants, and then generate a service variant vulnerability matrix (MSV). The service variant vulnerability matrix is ​​used to characterize the vulnerability situation of a second number of service variants, where the second number is r. Here, we can use the rows of the executor vulnerability matrix to represent executors and the columns to represent vulnerabilities, or we can use the columns of the matrix to represent executors and the rows to represent vulnerabilities.

[0080] The above content is as follows Figure 2 As shown, vulnerability formalization includes: constructing the MEV matrix based on system vulnerability information, and constructing the MSV matrix.

[0081] Step S104: Based on the service variant vulnerability matrix, perform the first round of screening of vulnerabilities. The first round of screening is used to determine the first candidate vulnerability. If the number of first candidate vulnerabilities is one, the first candidate vulnerability is taken as the vulnerability to be patched.

[0082] Specifically, the first round of screening is service variant vulnerability screening. The distribution range of vulnerabilities is the main focus of the first round of screening. The more service variants containing a certain vulnerability, the wider the distribution of that vulnerability. Therefore, in the first round of screening, the first candidate vulnerability is selected by comparing the number of service variants containing each type of vulnerability in the service variant vulnerability matrix. For example, if vulnerability 'a' exists in all 5 service variants, and the number of service variants containing other vulnerabilities is less than that of vulnerability 'a', then vulnerability 'a' is the first candidate vulnerability. In this case, there is only one first candidate vulnerability, so vulnerability 'a' is the most recommended vulnerability to be patched, i.e., the vulnerability to be patched. If both vulnerability 'a' and vulnerability 'b' exist in all 5 service variants, exceeding the number of other vulnerabilities, then both vulnerability 'a' and vulnerability 'b' are first candidate vulnerabilities, and a second round of screening is required for vulnerabilities 'a' and 'b'.

[0083] Step S105: If the number of first candidate vulnerabilities is not one, a second round of screening is performed on the first candidate vulnerabilities based on the service variant vulnerability matrix. The second round of screening is used to determine the second candidate vulnerabilities. If the number of second candidate vulnerabilities is one, the second candidate vulnerabilities are taken as vulnerabilities to be patched.

[0084] Specifically, the second round of screening is security service variant screening. This invention defines a service variant that does not contain known vulnerabilities as a security service variant, where known vulnerabilities are those present in the service variant vulnerability matrix. The more security service variants, the more secure the DHR system. Therefore, in the second round of screening, the security service variants that, after being patched, would generate the most security service variants in the DHR system are selected from all first-candidate vulnerabilities and designated as second-candidate vulnerabilities. For example, if vulnerabilities a and b are first-candidate vulnerabilities, patching vulnerability a will generate 2 security service variants, while patching vulnerability b will generate 0. Therefore, vulnerability a is a second-candidate vulnerability. Since there is only one second-candidate vulnerability, vulnerability a is the most recommended vulnerability to be patched. If patching either vulnerability a or vulnerability b will generate 2 security service variants, then both vulnerabilities a and b are second-candidate vulnerabilities, requiring a third round of screening.

[0085] Step S106: If the second candidate vulnerability is not the same, a third round of screening is performed on the second candidate vulnerability based on the service variant vulnerability matrix to obtain the vulnerability to be patched.

[0086] Specifically, the third round of screening utilizes reference metrics to characterize the uniformity of the distribution of other vulnerabilities after removing a second candidate vulnerability from the service variant vulnerability matrix. Reference metrics include, for example, Shannon entropy, cross-entropy, or other custom metrics that reflect uniformity. In this invention, a custom metric is vulnerability entropy, also known as vulnerability entropy. Therefore, the third round of screening aims to find the vulnerability with the highest corresponding reference metric. Taking vulnerability entropy as the reference metric, and with vulnerabilities a and b as second candidate vulnerabilities, after removing vulnerability a from the service variant vulnerability matrix, the vulnerability entropy of the service variant vulnerability matrix is ​​x; after removing vulnerability b from the service variant vulnerability matrix, the vulnerability entropy of the service variant vulnerability matrix is ​​y. If x > y, then vulnerability a is the most recommended vulnerability to be patched, i.e., the vulnerability to be patched; if x = y, then vulnerability a and vulnerability b are selected sequentially or randomly as the vulnerability to be patched.

[0087] The above content is as follows Figure 2 As shown, vulnerability screening includes: ① service provider vulnerability screening to obtain the best vulnerability, or ② security service provider screening to obtain the best vulnerability, or ③ vulnerability entropy screening to obtain the best vulnerability. The best vulnerability is the aforementioned vulnerability to be patched.

[0088] The method for determining vulnerabilities to be patched provided in this embodiment first uses an executor vulnerability matrix to characterize the vulnerability information of executors; second, it generates a service variant vulnerability matrix to characterize the vulnerability information of service variants; finally, based on the service variant vulnerability matrix, a target matrix is ​​obtained through three rounds of screening, so as to achieve the effect of evaluating and screening the optimal vulnerabilities in the DHR system that should be patched first. This solves the problem in existing technologies of selecting the most recommended vulnerabilities to be patched from existing vulnerabilities.

[0089] In some optional implementations, an executor vulnerability matrix is ​​constructed based on the vulnerability information, including:

[0090] Based on the vulnerability information, identify all existing vulnerabilities;

[0091] If the executor contains a vulnerability, then the first element corresponding to both the executor and the vulnerability is set to the first preset value;

[0092] If the executor does not contain a vulnerability, then the first element corresponding to both the executor and the vulnerability is set to the second preset value;

[0093] Construct the executor vulnerability matrix based on the first element.

[0094] Specifically, in this invention, m represents the total number of executors, and the executors are E1, ..., E m The vulnerability set V contains ω types of vulnerabilities. The first element is mev. i.j , where i represents the row of the executor vulnerability matrix and j represents the column of the executor vulnerability matrix.

[0095] Based on the vulnerability information, all existing vulnerabilities are identified, and this is used to determine whether each executor contains these vulnerabilities. For an executor and a set of contained vulnerabilities, this invention defines MEV = (mev i，j ) m*ω MEV stands for Executor Vulnerability Matrix. The first element is mev. i.j The value of is obtained in the form of formula (1).

[0096]

[0097] Where 1 is the first preset value, 0 is the second preset value, and E i V represents the i-th executor, 1≤i≤m. j Let ω represent the j-th vulnerability, 1≤j≤ω, where the first and second preset values ​​can be set to other values ​​according to the DHR system settings.

[0098] Based on formula (1), if the executor E i Includes vulnerability V j Then the executor E i and vulnerability Vj The first element corresponding to each is mev i，j Set to the first preset value, for example: 1. If the executor E i Not includes vulnerability V j Then the executor E i and vulnerability V j The first element corresponding to each is mev i，j Set to the second preset value, for example: 0.

[0099] Based on the first element, construct the executor vulnerability matrix, that is, construct the first element mev i，j Summarizing the values ​​of 1≤i≤m and 1≤j≤ω, we obtain the executor vulnerability matrix MEV = (mev i，j ) m*ω .

[0100] If m = 5 and ω = 6, then MEV is as follows:

[0101]

[0102] It should be noted that if i represents the row of the executor vulnerability matrix and j represents the column of the executor vulnerability matrix, then the row of the executor vulnerability matrix corresponds to the executor, and the column of the executor vulnerability matrix corresponds to the vulnerability. In this invention, i can also represent the column of the executor vulnerability matrix and j can represent the row of the executor vulnerability matrix. In this case, the rows of the executor vulnerability matrix correspond to the vulnerability, and the columns of the executor vulnerability matrix correspond to the executor. In this case, the executor vulnerability matrix is ​​equivalent to the transpose of the above-mentioned executor vulnerability matrix.

[0103] In this embodiment, an executor vulnerability matrix is ​​constructed to represent the vulnerability information contained in each executor, which facilitates the subsequent generation of a service variant vulnerability matrix.

[0104] In some optional implementations, a service variant vulnerability matrix is ​​generated based on the executor vulnerability matrix and the inclusion relationship between service variants and executors, including:

[0105] Based on the executor vulnerability matrix, the total number of rows or columns in the executor vulnerability matrix, and the number of rows or columns to be selected from the total number of rows or columns in the executor vulnerability matrix, a third number of submatrices are selected, wherein the total number of rows or columns in the submatrices is equal to the number of rows or columns to be selected, and the number of rows and columns to be selected is obtained based on the inclusion relationship;

[0106] Summing all rows or columns of each submatrix yields a third number of vectors;

[0107] Determine whether the second element in the vector is greater than or equal to the first preset threshold;

[0108] If the second element is greater than or equal to the first preset threshold, then the third element corresponding to the second element is set to the third preset value;

[0109] If the second element is less than the first preset threshold, then the third element corresponding to the second element is set to the fourth preset value;

[0110] Generate a service variant vulnerability matrix based on the third element.

[0111] Specifically, based on the executor vulnerability matrix MEV and the inclusion relationship between service variants and executors (i.e., each service variant contains n executors), a service variant vulnerability matrix MSV is generated. The specific steps are as follows:

[0112] If in the executor vulnerability matrix MEV, rows correspond to executors and columns correspond to vulnerabilities, then based on the executor vulnerability matrix MEV, the total number of rows m in the executor vulnerability matrix MEV, and the number of rows to be selected n from the total number of rows in the executor vulnerability matrix, a third number of submatrices are selected, where the third number is r, and r equals Therefore, the n rows of MEV are extracted in lexicographical order to form r submatrices {M1, M2, ..., M}. r}

[0113] With m=5, ω=6, n=4, and MEV as For example, the third quantity equals The generated submatrices are as follows:

[0114] If in the executor vulnerability matrix MEV, rows correspond to executors and columns correspond to vulnerabilities, then sum all rows of each submatrix to obtain the summation for each submatrix M. l subvectors 1≤l≤r, there are a total of r vectors.

[0115] For example: the vector calculated from submatrix M1 The vector calculated from submatrix M2 The vector calculated from submatrix M3 Vectors calculated from submatrix M4 The vector calculated from submatrix M5

[0116] If we obtain a vector μ lj The second element is represented by `j`. If the row of MSV corresponds to a service variant, then the column of MSV is the same as that of MEV, also corresponding to a vulnerability. Therefore, `j` is used to represent the column of MSV. Then MSV = (msv l，j ) r*ω msv l，j It is the third element.

[0117] Judgment Vector The second element μ lj Whether it is greater than or equal to a first preset threshold, where the first preset threshold is the judgment mode parameter k. If μ lj If it is greater than or equal to k, then μ lj The corresponding third element msv l，j Set to the third preset value, for example: μ lj -k+1. If μ lj If it is less than k, then μ lj The corresponding msv l，j Set to the fourth preset value, for example, 0. The above process is shown in formula (2):

[0118]

[0119] Based on the third element, generate the Service Variant Vulnerability Matrix (MSV), that is, the third element msv l，j Summarizing the values ​​of 1≤l≤r and 1≤j≤ω, we obtain the executor vulnerability matrix MSV = (msv l，j ) r*ω .

[0120] If r = 5, ω = 6, and k = 3, then MSV is as follows:

[0121]

[0122] MSV describes the vulnerability availability of all service variants. It can be used to formally describe the internal structure of a DHR system, laying the foundation for subsequent vulnerability assessment and screening.

[0123] Similarly, if in the executor vulnerability matrix MEV, rows correspond to executors and columns correspond to vulnerabilities, then based on the executor vulnerability matrix MEV, the total number of columns in the executor vulnerability matrix MEV, and the number of columns to be selected from the total number of columns in the executor vulnerability matrix, a third number of sub-matrices are selected, and a service variant vulnerability matrix MSV is generated based on the sub-matrices. The generation steps are similar to those described above and will not be repeated here.

[0124] In this embodiment, a service variant vulnerability matrix is ​​generated based on the executor vulnerability matrix and the inclusion relationship between service variants and executors. The service variant vulnerability matrix describes the vulnerability availability of all service variants, providing a basis for subsequent screening of vulnerabilities to be patched.

[0125] In some alternative implementations, vulnerabilities are first-round filtered based on a service variant vulnerability matrix, including:

[0126] Determine the fourth number of third elements in each column or row of the service variant vulnerability matrix that are not equal to the fourth preset value;

[0127] The column or row corresponding to the fourth largest number is selected as a candidate column or row, and the vulnerability corresponding to the candidate column or row is selected as the first candidate vulnerability.

[0128] Specifically, in this embodiment, r=5, ω=6, the fourth preset value is 0, and the MSV service variant vulnerability matrix is... Let's take an example. In this case, the rows of MSV correspond to service variants, and the columns correspond to vulnerabilities. Therefore, we determine the third element (msv) of each non-zero column in the service variant vulnerability matrix MSV. l，j The fourth quantity is calculated as follows: the fourth quantity of the third element in the first column (not equal to 0) is 2; the fourth quantity of the second column is 2; the fourth quantity of the third column is 5; the fourth quantity of the fourth column is 2; the fourth quantity of the fifth column is 5; and the fourth quantity of the sixth column is 0. The column corresponding to the largest fourth quantity is selected as a candidate column, and the vulnerability corresponding to the candidate column is selected as the first candidate vulnerability. That is, the third and fifth columns are selected as candidate columns, and the third and fifth vulnerabilities are selected as first candidate vulnerabilities. This yields two first candidate vulnerabilities.

[0129] In addition, if only one first candidate vulnerability is obtained, it will be directly used as a vulnerability to be patched without the need for subsequent second and third rounds of screening.

[0130] Similarly, if the columns of an MSV correspond to service variants and the rows correspond to vulnerabilities, then determine the fourth number of the third element in each row of the service variant vulnerability matrix that is not equal to the fourth preset value. The row corresponding to the fourth number with the largest value will be selected as a candidate row, and the vulnerability corresponding to the candidate row will be selected as the first candidate vulnerability.

[0131] In this implementation, vulnerabilities are first screened based on a service variant vulnerability matrix. First, the fourth number of third elements in each column or row of the service variant vulnerability matrix that is not equal to a fourth preset value is determined. Then, the vulnerability corresponding to the largest fourth number is selected as the first candidate vulnerability. This method is suitable for DHR systems, simple and easy to implement, and can provide system administrators with the vulnerabilities that should be patched first, or provide a basis for the second round of screening.

[0132] In some alternative implementations, a second round of screening is performed on the first candidate vulnerabilities based on the service variant vulnerability matrix, including:

[0133] The first candidate vulnerabilities are sorted to obtain the first sorting result, and the first first candidate vulnerability is selected as the first vulnerability to be patched based on the first sorting result.

[0134] In the service variant vulnerability matrix, the first vulnerability to be patched is patched to obtain the service variant vulnerability matrix after patching the first vulnerability to be patched.

[0135] Determine the fifth number of security service variants in the service variant vulnerability matrix after patching the first vulnerability to be patched, where a security service variant is a service variant that does not contain a vulnerability;

[0136] Based on the first ranking result, the next first candidate vulnerability is taken as the first vulnerability to be patched. The first vulnerability to be patched is then patched from the service variant vulnerability matrix. The subsequent steps are executed after the service variant vulnerability to be patched is obtained, until all first candidate vulnerabilities have been patched.

[0137] The first candidate vulnerability corresponding to the fifth largest number is selected as the second candidate vulnerability.

[0138] Specifically, in this embodiment, rows correspond to service variants, r=5, ω=6, and the third and fifth columns are candidate columns. The third and fifth vulnerabilities are selected as the first candidate vulnerabilities, and the service variant vulnerability matrix MSV is as follows: Let's take an example to illustrate.

[0139] The first candidate vulnerabilities are sorted to obtain the first sorting result. Based on the first sorting result, the first first candidate vulnerability is taken as the first vulnerability to be patched. For example, if the third and fifth vulnerabilities are sorted, the third vulnerability comes first and the fifth vulnerability comes later. Therefore, the third vulnerability is taken as the first vulnerability to be patched.

[0140] This invention defines a secure service variant as a service variant that does not contain any vulnerabilities. A service variant is defined as a row where the third element of each row is 0; if all third elements are 0, then the service variant for that row is a secure service variant. In MSV (Service Vulnerability Matrix), the first vulnerability to be patched is patched by deleting the column corresponding to the first vulnerability from the MSV, resulting in a service variant vulnerability matrix after patching the first vulnerability. For example: At this point, the fifth security service variant in the vulnerability matrix after patching the first unpatched vulnerability is 0.

[0141] Based on the first ranking result, the next first candidate vulnerability is selected as the first vulnerability to be patched, that is, the 5th vulnerability is selected as the first vulnerability to be patched, and the above steps are repeated. At this time, the service variant vulnerability matrix after patching the first vulnerability to be patched is obtained, for example: The fifth quantity is also 0.

[0142] The first candidate vulnerability corresponding to the fifth largest number is selected as the second candidate vulnerability. The fifth number corresponding to the third and fifth vulnerabilities is 0. Therefore, the third and fifth vulnerabilities are both selected as the second candidate vulnerabilities.

[0143] In addition, if only one second candidate vulnerability is obtained, it will be directly used as a vulnerability to be patched without the need for a subsequent third round of screening.

[0144] Similarly, if the columns of MSV correspond to service variants and the rows correspond to vulnerabilities, the second round of screening is the same as described above, and will not be repeated here.

[0145] In this implementation, the more security service variants a system has, the more secure the DHR system becomes. Based on the service variant vulnerability matrix, the first candidate vulnerability that, after being patched, generates the most security service variants is selected as the second candidate vulnerability. This method is suitable for DHR systems, simple and easy to implement, and can provide system administrators with the vulnerabilities that should be patched first, or provide a basis for a third round of screening.

[0146] In some alternative implementations, a third round of screening is performed on the second candidate vulnerabilities based on the service variant vulnerability matrix, including:

[0147] The second candidate vulnerabilities are sorted to obtain a second sorting result, and the first second candidate vulnerability is selected as the second vulnerability to be patched based on the second sorting result.

[0148] In the service variant vulnerability matrix, the second vulnerability to be patched is patched to obtain the service variant vulnerability matrix after patching the second vulnerability to be patched.

[0149] Based on the service variant vulnerability matrix after patching the second vulnerability to be patched, reference indicators are obtained;

[0150] Based on the second ranking result, the next second candidate vulnerability is taken as the second vulnerability to be patched. The second vulnerability to be patched is then patched from the service variant vulnerability matrix. The subsequent steps are executed after the service variant vulnerability to be patched is obtained, until all second candidate vulnerabilities have been patched.

[0151] The second candidate vulnerability corresponding to the reference indicator with the largest value is selected as the vulnerability to be patched.

[0152] Specifically, in this embodiment, rows correspond to service variants, r=5, ω=6, and the third and fifth columns are candidate columns. The third and fifth vulnerabilities are selected as the first candidate vulnerabilities, and the service variant vulnerability matrix MSV is as follows: Let's take an example to illustrate.

[0153] The second candidate vulnerabilities are sorted to obtain a second sorting result. Based on the second sorting result, the first second candidate vulnerability is selected as the second vulnerability to be patched. For example, if the third and fifth vulnerabilities are sorted, the third vulnerability comes first and the fifth vulnerability comes last. Therefore, the third vulnerability is selected as the second vulnerability to be patched.

[0154] In MSV, the second unpatched vulnerability is patched by deleting the column corresponding to the second unpatched vulnerability from MSV, resulting in a service variant vulnerability matrix after patching the second unpatched vulnerability. For example: Based on the service variant vulnerability matrix after patching the second candidate vulnerability, a reference metric, r1, is calculated. This invention uses the reference metric to characterize the uniformity of the distribution of other vulnerabilities after removing a second candidate vulnerability from the service variant vulnerability matrix. Examples of reference metrics include Shannon entropy, cross-entropy, or other custom metrics that reflect uniformity. A custom metric in this invention is, for example, vulnerability entropy, also known as vulnerability depletion.

[0155] Based on the second ranking result, the next second candidate vulnerability is selected as the second vulnerability to be patched, that is, the 5th vulnerability is selected as the second vulnerability to be patched, and the above steps are repeated. At this time, the service variant vulnerability matrix after patching the second vulnerability to be patched is obtained, for example: The reference index is calculated to be r2.

[0156] The second candidate vulnerability corresponding to the reference indicator with the largest value is selected as the vulnerability to be patched. For example, if r1 > r2, then the third vulnerability is the vulnerability to be patched; if r1 = r2, it means that the third and fifth vulnerabilities have the same patching priority, and can be selected sequentially or randomly as the vulnerability to be patched.

[0157] Similarly, if the columns of MSV correspond to service variants and the rows correspond to vulnerabilities, the third round of screening is the same as described above, and will not be repeated here.

[0158] In this implementation, a reference metric is used to characterize the uniformity of the distribution of other vulnerabilities after removing a second candidate vulnerability from the service variant vulnerability matrix. The second candidate vulnerability corresponding to the reference metric with the largest value is selected as the vulnerability to be patched. This method is suitable for DHR systems, is simple and easy to implement, and can provide system administrators with the vulnerabilities that should be patched first.

[0159] In some alternative implementations, reference metrics are obtained based on the service variant vulnerability matrix after patching the second vulnerability to be patched, including:

[0160] Calculate the sum of the third element in each row or column of the service variant vulnerability matrix after patching the second vulnerability to be patched, and obtain the third number of element sums;

[0161] Based on the sum of elements and a preset formula, the vulnerability entropy corresponding to the second candidate vulnerability is calculated, and the vulnerability entropy is used as a reference indicator.

[0162] Specifically, in this embodiment, rows correspond to service variants, the reference metric is vulnerability entropy, r=5, ω=6, and the service variant vulnerability matrix after patching the second vulnerability to be patched is as follows: Let's take an example to illustrate. Vulnerability entropy is defined as the uniformity of the distribution of other vulnerabilities after a vulnerability is removed. Let V be the second vulnerability to be patched. θ .

[0163] In this embodiment, rows correspond to service variants. Therefore, the sum of the third elements in each row of the service variant vulnerability matrix after patching the second vulnerability to be patched is calculated to obtain a third number of element sums. The element sum is obtained by summing all the third elements in each row of the service variant vulnerability matrix. Therefore, the number of element sums is equal to the number of rows in the service variant vulnerability matrix, and also equal to the number of vectors constituting the service variant vulnerability matrix. The third number is r, which are δ1, ..., δ r .according to The calculated values ​​are δ1 = 3, δ2 = 3, δ3 = 4, δ4 = 4, and δ5 = 2.

[0164] Based on the elements and δ1-δ5 and a preset formula, such as formula (3), the vulnerability entropy corresponding to the second candidate vulnerability is calculated. and vulnerability entropy As a reference indicator.

[0165]

[0166] Similarly, if the columns of MSV correspond to service variants and the rows correspond to vulnerabilities, then the sum of the third element of each column in the service variant vulnerability matrix after patching the second vulnerability to be patched is calculated to obtain the element sum; according to the element sum and the preset formula, such as formula (3), the vulnerability entropy is calculated.

[0167] In this embodiment, based on the service variant vulnerability matrix after patching the second vulnerability to be patched, vulnerability entropy is calculated, and vulnerability entropy is used as a reference indicator to provide a basis for the third round of screening.

[0168] This embodiment also provides a vulnerability identification device, which is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0169] This embodiment provides a device for determining vulnerabilities to be patched, such as... Figure 3 As shown, it includes:

[0170] The acquisition module 301 is used to acquire vulnerability information contained in the executor, wherein the total number of executors is the first number;

[0171] Module 302 is used to construct an executor vulnerability matrix based on vulnerability information;

[0172] The generation module 303 is used to generate a service variant vulnerability matrix based on the executor vulnerability matrix and the inclusion relationship between service variants and executors. The service variant vulnerability matrix is ​​used to characterize the vulnerability status of service variants, and the total number of service variants is a second number.

[0173] The first screening module 304 is used to perform a first round of screening of vulnerabilities based on the service variant vulnerability matrix. The first round of screening is used to determine the first candidate vulnerability. If the number of first candidate vulnerabilities is one, the first candidate vulnerability is taken as a vulnerability to be patched.

[0174] The second screening module 305 is used to perform a second round of screening on the first candidate vulnerability based on the service variant vulnerability matrix when the first candidate vulnerability is not one. The second round of screening is used to determine the second candidate vulnerability. If the number of second candidate vulnerabilities is one, the second candidate vulnerability is regarded as a vulnerability to be patched.

[0175] The third screening module 306 is used to perform a third round of screening on the second candidate vulnerabilities based on the service variant vulnerability matrix when there are multiple second candidate vulnerabilities, to obtain the vulnerabilities to be patched.

[0176] In some alternative implementations, the construction module 302 includes:

[0177] The first determining unit is used to determine all existing vulnerabilities based on the vulnerability information;

[0178] The first setting unit is used to set the first element corresponding to both the executor and the vulnerability to a first preset value if the executor contains a vulnerability.

[0179] The second setting unit is used to set the first element corresponding to both the executor and the vulnerability to a second preset value if the executor does not contain the vulnerability.

[0180] The building unit is used to construct the executor vulnerability matrix based on the first element.

[0181] In some alternative implementations, the generation module 303 includes:

[0182] The selection unit is used to select a third number of submatrices based on the executor vulnerability matrix, the total number of rows or columns of the executor vulnerability matrix, and the number of rows or columns to be selected from the total number of rows or columns of the executor vulnerability matrix. The total number of rows or columns of the submatrices is equal to the number of rows or columns to be selected, and the number of rows and columns to be selected is obtained based on the inclusion relationship.

[0183] The summation unit is used to sum all rows or all columns of each submatrix to obtain a third number of vectors;

[0184] The judgment unit is used to determine whether the second element in the vector is greater than or equal to the first preset threshold.

[0185] The third setting unit is used to set the third element corresponding to the second element to a third preset value if the second element is greater than or equal to the first preset threshold.

[0186] The fourth setting unit is used to set the third element corresponding to the second element to the fourth preset value if the second element is less than the first preset threshold.

[0187] The generation unit is used to generate a service variant vulnerability matrix based on the third element.

[0188] In some alternative implementations, the first screening module 304 includes:

[0189] The second determining unit is used to determine the fourth number of third elements in each column or row of the service variant vulnerability matrix that are not equal to the fourth preset value.

[0190] The first unit is used to select the column or row corresponding to the fourth largest number as a candidate column or candidate row, and the vulnerability corresponding to the candidate column / or candidate row as the first candidate vulnerability.

[0191] In some alternative implementations, the second screening module 305 includes:

[0192] The first sorting unit is used to sort the first candidate vulnerabilities, obtain the first sorting result, and select the first first candidate vulnerability as the first vulnerability to be patched according to the first sorting result.

[0193] The first patching unit is used to patch the first vulnerability to be patched in the service variant vulnerability matrix to obtain the service variant vulnerability matrix after patching the first vulnerability to be patched.

[0194] The third determining unit is used to determine the fifth number of security service variants in the service variant vulnerability matrix after patching the first vulnerability to be patched, wherein the security service variant is a service variant that does not contain a vulnerability.

[0195] The first loop unit is used to select the next first candidate vulnerability as the first vulnerability to be patched according to the first sorting result, and patch the first vulnerability to be patched from the service variant vulnerability matrix to obtain the service variant vulnerability matrix after patching the first vulnerability to be patched, and then execute the subsequent steps until all first candidate vulnerabilities have been patched.

[0196] The second unit is used to select the first candidate vulnerability corresponding to the fifth largest value as the second candidate vulnerability.

[0197] In some alternative implementations, the third screening module 306 includes:

[0198] The second sorting unit is used to sort the second candidate vulnerabilities to obtain a second sorting result, and to select the first second candidate vulnerability as the second vulnerability to be patched based on the second sorting result.

[0199] The second patching unit is used to patch the second vulnerability to be patched in the service variant vulnerability matrix to obtain the service variant vulnerability matrix after patching the second vulnerability to be patched.

[0200] The obtained unit is used to obtain reference metrics based on the service variant vulnerability matrix after patching the second vulnerability to be patched;

[0201] The second loop unit is used to select the next second candidate vulnerability as the second vulnerability to be patched according to the second sorting result, and patch the second vulnerability to be patched from the service variant vulnerability matrix to obtain the service variant vulnerability matrix after patching the second vulnerability to be patched, and then execute the subsequent steps until all second candidate vulnerabilities have been patched.

[0202] The third unit is used to identify the second candidate vulnerability corresponding to the reference indicator with the largest value as the vulnerability to be patched.

[0203] In some alternative implementations, the obtaining unit includes:

[0204] The first calculation submodule is used to calculate the sum of the third element in each row or column of the service variant vulnerability matrix after patching the second vulnerability to be patched, and to obtain the third number of element sums;

[0205] The second calculation submodule is used to calculate the vulnerability entropy corresponding to the second candidate vulnerability based on the sum of elements and a preset formula, and to use the vulnerability entropy as a reference indicator.

[0206] Further functional descriptions of the above modules and units are the same as those in the corresponding embodiments described above, and will not be repeated here.

[0207] In this embodiment, the device for determining the unpatched vulnerability is presented in the form of a functional unit. Here, a unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that execute one or more software or fixed programs, and / or other devices that can provide the above-mentioned functions.

[0208] This invention also provides a computer device having the above-described features. Figure 3 The device shown is for identifying vulnerabilities to be patched.

[0209] Please see Figure 4 , Figure 4 This is a schematic diagram of the structure of a computer device provided in an optional embodiment of the present invention, such as... Figure 4As shown, the computer device includes one or more processors 10, memory 20, and interfaces for connecting the components, including high-speed interfaces and low-speed interfaces. The components communicate with each other via different buses and can be mounted on a common motherboard or otherwise installed as needed. The processors can process instructions executed within the computer device, including instructions stored in or on memory to display graphical information of a GUI on external input or output devices (such as display devices coupled to the interfaces). In some alternative implementations, multiple processors and / or multiple buses can be used with multiple memories and multiple memory modules, if desired. Similarly, multiple computer devices can be connected, each providing some of the necessary operations (e.g., as a server array, a group of blade servers, or a multiprocessor system). Figure 4 Take a processor 10 as an example.

[0210] Processor 10 may be a central processing unit, a network processor, or a combination thereof. Processor 10 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The programmable logic device may be a complex programmable logic device (CAMP), a field-programmable gate array (FPGA), a general-purpose array logic (GDA), or any combination thereof.

[0211] The memory 20 stores instructions executable by at least one processor 10 to cause at least one processor 10 to perform the method shown in the above embodiments.

[0212] The memory 20 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the computer device. Furthermore, the memory 20 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some alternative embodiments, the memory 20 may optionally include memory remotely located relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0213] The memory 20 may include volatile memory, such as random access memory; the memory may also include non-volatile memory, such as flash memory, hard disk or solid-state drive; the memory 20 may also include a combination of the above types of memory.

[0214] The computer device also includes a communication interface 30 for communicating with other devices or communication networks.

[0215] This invention also provides a computer-readable storage medium. The methods described above according to embodiments of the invention can be implemented in hardware or firmware, or implemented as computer code that can be recorded on a storage medium, or implemented as computer code downloaded via a network and originally stored on a remote storage medium or a non-transitory machine-readable storage medium and then stored on a local storage medium. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code, which, when accessed and executed by the computer, processor, or hardware, implements the methods shown in the above embodiments.

[0216] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A method for determining vulnerabilities to be patched, characterized in that, The method includes: Obtain vulnerability information contained in the executor, wherein the total number of the executor is a first number; Based on the vulnerability information, construct an executor vulnerability matrix; Based on the executor vulnerability matrix and the inclusion relationship between service variants and executors, a service variant vulnerability matrix is ​​generated, wherein the service variant vulnerability matrix is ​​used to characterize the vulnerability status of the service variants, and the total number of service variants is a second quantity; Based on the service variant vulnerability matrix, a first round of screening is performed on the vulnerabilities. The first round of screening is used to determine the first candidate vulnerability. If the number of the first candidate vulnerability is one, the first candidate vulnerability is regarded as the vulnerability to be patched. If the first candidate vulnerability is not one, a second round of screening is performed on the first candidate vulnerability based on the service variant vulnerability matrix. The second round of screening is used to determine the second candidate vulnerability. If the number of the second candidate vulnerability is one, the second candidate vulnerability is regarded as a vulnerability to be patched. If the second candidate vulnerability is not unique, a third round of screening is performed on the second candidate vulnerability based on the service variant vulnerability matrix to obtain the vulnerability to be patched. The step of generating a service variant vulnerability matrix based on the executor vulnerability matrix and the inclusion relationship between service variants and executors includes: selecting a third number of sub-matrices based on the executor vulnerability matrix, the total number of rows or columns of the executor vulnerability matrix, and the number of rows or columns to be selected from the total number of rows or columns of the executor vulnerability matrix, wherein the total number of rows or columns of the sub-matrices is equal to the number of rows or columns to be selected, and the number of rows and columns to be selected is obtained based on the inclusion relationship; summing all rows or columns of each sub-matrix to obtain a third number of vectors; determining whether the second element in the vector is greater than or equal to a first preset threshold; if the second element is greater than or equal to the first preset threshold, setting the third element corresponding to the second element to a third preset value; if the second element is less than the first preset threshold, setting the third element corresponding to the second element to a fourth preset value; and generating the service variant vulnerability matrix based on the third element.

2. The method according to claim 1, characterized in that, The step of constructing an executor vulnerability matrix based on the vulnerability information includes: Based on the vulnerability information, identify all currently existing vulnerabilities; If the executor contains the vulnerability, then the first element corresponding to both the executor and the vulnerability is set to the first preset value; If the executor does not contain the vulnerability, then the first element corresponding to both the executor and the vulnerability is set to the second preset value; Based on the first element, construct the executor vulnerability matrix.

3. The method according to claim 2, characterized in that, The first round of screening of vulnerabilities based on the service variant vulnerability matrix includes: Determine the fourth number of third elements in each column or row of the service variant vulnerability matrix that are not equal to the fourth preset value; The column corresponding to the fourth largest number is selected as a candidate column or candidate row, and the vulnerability corresponding to the candidate column or candidate row is selected as the first candidate vulnerability.

4. The method according to claim 3, characterized in that, The second round of screening of the first candidate vulnerabilities based on the service variant vulnerability matrix includes: The first candidate vulnerabilities are sorted to obtain a first sorting result, and the first first candidate vulnerability is selected as the first vulnerability to be patched based on the first sorting result. In the service variant vulnerability matrix, the first vulnerability to be patched is patched to obtain the service variant vulnerability matrix after patching the first vulnerability to be patched. Determine the fifth number of security service variants in the service variant vulnerability matrix after patching the first vulnerability to be patched, wherein the security service variant is a service variant that does not contain the vulnerability; Based on the first sorting result, the next first candidate vulnerability is taken as the first vulnerability to be patched, and the first vulnerability to be patched is patched from the service variant vulnerability matrix to obtain the service variant vulnerability matrix after patching the first vulnerability to be patched. Then, the subsequent steps are executed until all the first candidate vulnerabilities have been patched. The first candidate vulnerability corresponding to the fifth largest value is selected as the second candidate vulnerability.

5. The method according to claim 4, characterized in that, The third round of screening of the second candidate vulnerabilities based on the service variant vulnerability matrix includes: The second candidate vulnerabilities are sorted to obtain a second sorting result, and the first second candidate vulnerability is selected as the second vulnerability to be patched based on the second sorting result. In the service variant vulnerability matrix, the second vulnerability to be patched is patched to obtain the service variant vulnerability matrix after patching the second vulnerability to be patched; Based on the service variant vulnerability matrix after patching the second vulnerability to be patched, reference indicators are obtained; Based on the second sorting result, the next second candidate vulnerability is taken as the second vulnerability to be patched, and the second vulnerability to be patched is patched from the service variant vulnerability matrix to obtain the service variant vulnerability matrix after patching the second vulnerability to be patched. Then, the subsequent steps are executed until all the second candidate vulnerabilities have been patched. The second candidate vulnerability corresponding to the reference indicator with the largest value is selected as the vulnerability to be patched.

6. The method according to claim 5, characterized in that, The reference metrics obtained based on the service variant vulnerability matrix after patching the second vulnerability to be patched include: Calculate the sum of the third element in each row or column of the service variant vulnerability matrix after patching the second vulnerability to be patched, to obtain the third number of element sums; Based on the elements and the preset formula, the vulnerability entropy corresponding to the second candidate vulnerability is calculated, and the vulnerability entropy is used as the reference indicator.

7. A device for determining unpatched vulnerabilities, characterized in that, The device includes: The acquisition module is used to acquire vulnerability information contained in the executor, wherein the total number of the executors is a first number; A construction module is used to construct an executor vulnerability matrix based on the vulnerability information. The generation module is used to generate a service variant vulnerability matrix based on the executor vulnerability matrix and the inclusion relationship between service variants and executors, wherein the service variant vulnerability matrix is ​​used to characterize the vulnerability status of service variants, and the total number of service variants is a second quantity; The first screening module is used to perform a first round of screening on the vulnerabilities based on the service variant vulnerability matrix. The first round of screening is used to determine a first candidate vulnerability. If the number of the first candidate vulnerability is one, the first candidate vulnerability is regarded as a vulnerability to be patched. The second filtering module is used to perform a second round of filtering on the first candidate vulnerability based on the service variant vulnerability matrix when the first candidate vulnerability is not one. The second round of filtering is used to determine the second candidate vulnerability. If the number of the second candidate vulnerability is one, the second candidate vulnerability is regarded as a vulnerability to be patched. The third filtering module is used to perform a third round of filtering on the second candidate vulnerability based on the service variant vulnerability matrix when the second candidate vulnerability is not the same, so as to obtain the vulnerability to be patched. The generation module includes: a selection unit, configured to select a third number of sub-matrices based on the executor vulnerability matrix, the total number of rows or columns of the executor vulnerability matrix, and the number of rows or columns to be selected from the total number of rows or columns of the executor vulnerability matrix, wherein the total number of rows or columns of the sub-matrices is equal to the number of rows or columns to be selected, and the number of rows and columns to be selected are obtained according to the inclusion relationship; a summation unit, configured to sum all rows or columns of each of the sub-matrices to obtain a third number of vectors; a judgment unit, configured to judge whether the second element in the vector is greater than or equal to a first preset threshold; a third setting unit, configured to set the third element corresponding to the second element to a third preset value if the second element is greater than or equal to the first preset threshold; a fourth setting unit, configured to set the third element corresponding to the second element to a fourth preset value if the second element is less than the first preset threshold; and generate the service variant vulnerability matrix based on the third element.

8. A computer device, characterized in that, include: A memory and a processor are communicatively connected, the memory stores computer instructions, and the processor executes the computer instructions to perform the method for determining unpatched vulnerabilities according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing a computer to perform the method for determining unpatched vulnerabilities according to any one of claims 1 to 6.

Images