Network vulnerability management method, management device and vulnerability management system

Abstract

The application provides a network vulnerability management method, a management device and a vulnerability management system. The method comprises the following steps: obtaining digital assets and verification data; verifying the digital assets in sequence according to the verification data to obtain a plurality of first vulnerability information; querying a vulnerability database according to the first vulnerability information to obtain a plurality of vulnerability levels, wherein the vulnerability database comprises the codes of various known vulnerabilities and first repair methods, and the first repair method is a vulnerability repair scheme stored in the vulnerability database; inputting the first vulnerability information into a vulnerability repair model to obtain a plurality of target repair scripts, wherein the vulnerability repair model is obtained by training a training data set, and the training data set comprises the codes of various known vulnerabilities, the first repair method and repair scripts; and running the target repair scripts in sequence according to the vulnerability levels from high to low to repair the corresponding vulnerabilities. The method solves the problem that the vulnerability management in the prior art needs to be repaired manually, and the problem that the low efficiency caused by the omission is prone to occur.

Description

Technical Field

[0001] This invention relates to the field of data communication technology, and more specifically, to a method, device, computer-readable storage medium, and vulnerability management system for managing network vulnerabilities. Background Technology

[0002] With the development of information technology, the company has put forward a clear plan for information security operation services, optimizing, integrating, and coordinating the company's security operation service model and operation and maintenance resources. This involves strengthening lean management of security, operation and maintenance, service, and testing, improving the technical equipment level of security operation services, and enhancing the ability to quickly discover, verify, and manage vulnerabilities in a closed loop. This invention will draw on advanced technologies and best practices from home and abroad, be business-demand oriented, and aim to enhance the value of information technology, comprehensively improving the company's information system network security protection capabilities.

[0003] The purpose of the automated vulnerability management platform is to solve the security management problems of internal network assets, quickly analyze the impact of vulnerabilities, and form a closed-loop governance mechanism for vulnerabilities. It optimizes and improves the vulnerability database functionality, providing functions such as vulnerability classification and categorization, vulnerability impact analysis, rapid vulnerability verification, and closed-loop vulnerability management. This improves the vulnerability management mechanism and achieves full-process control over vulnerability entry, analysis, notification and handling, and resolution. Simultaneously, it conducts vulnerability early warning work, providing vulnerability early warning information management functions based on vulnerability early warning reports submitted to the security platform data upload control component of the competent (supervisory) unit, and achieving information sharing of important vulnerabilities across the entire network.

[0004] Existing cybersecurity management solutions typically require security experts to manually analyze and fix vulnerabilities, which is inefficient and prone to omissions and oversights. Summary of the Invention

[0005] The main objective of this application is to provide a method, device, computer-readable storage medium, and vulnerability management system for managing network vulnerabilities, so as to at least solve the problem that vulnerability management in the prior art requires manual repair, which is prone to oversights and leads to low efficiency.

[0006] To achieve the above objectives, according to one aspect of this application, a method for managing network vulnerabilities is provided, comprising: acquiring digital assets and verification data, wherein the digital assets include a user's database, applications, and data files, and the verification data is used to determine whether the digital assets have vulnerabilities; sequentially verifying the digital assets according to the verification data to obtain multiple first vulnerability information, wherein the first vulnerability information is used to record code containing vulnerabilities in the digital assets; querying a vulnerability database according to each first vulnerability information to obtain multiple vulnerability levels, wherein the vulnerability database includes the code of various known vulnerabilities and a first remediation method, wherein the vulnerability level is used to characterize the processing priority of the vulnerability corresponding to the first vulnerability information, and the first remediation method is a vulnerability remediation scheme stored in the vulnerability database; inputting the multiple first vulnerability information into a vulnerability remediation model to obtain multiple target remediation scripts, wherein the target remediation scripts are used to remediate the first vulnerability information, and the target remediation scripts are remediation scripts corresponding to the first vulnerability information; the vulnerability remediation model is trained based on a training dataset, wherein the training dataset includes the code of various known vulnerabilities, the first remediation method corresponding to the code, and the remediation script corresponding to the first remediation method; and sequentially running the target remediation scripts according to the vulnerability level from high to low to remediate the corresponding vulnerabilities.

[0007] Optionally, before acquiring the digital asset and verification data, the method further includes: acquiring a target access permission and multiple preset access permissions, wherein the target access permission is the permission information included in the current user's access request to the digital asset; if there is permission information in the preset access permissions that is consistent with the target access permission, determining that the digital asset is allowed to be acquired; if there is no permission information in the preset access permissions that is consistent with the target access permission, issuing a first alarm message, wherein the first alarm message is used to indicate that the access request is abnormal.

[0008] Optionally, the digital asset is verified sequentially based on the verification data to obtain multiple first vulnerability information, including: dividing the digital asset into multiple data groups to be verified according to the service type of the digital asset, wherein the service type is determined according to the application object of the digital asset; querying a first mapping relationship according to each service type to obtain multiple target scanning nodes, wherein the first mapping relationship is a mapping relationship between the service type and the scanning node, and the scanning node is used to verify whether the digital asset of the corresponding service type has a vulnerability; sending each data group to be verified to each target scanning node according to the service type, so that the target scanning node matches the verification data with the digital asset to determine whether the digital asset has a vulnerability, thereby obtaining multiple first vulnerability information.

[0009] Optionally, multiple vulnerability levels are obtained by querying a vulnerability database based on each of the first vulnerability information, including: obtaining a target exploitation level by querying a second mapping relationship based on each of the first vulnerability information, where the second mapping relationship is a mapping relationship between the first vulnerability information and the exploitation level, and the exploitation level is used to characterize the probability that the vulnerability corresponding to the first vulnerability information is used to attack the digital asset; obtaining a target danger level by querying a third mapping relationship based on each of the first vulnerability information, where the third mapping relationship is a mapping relationship between the first vulnerability information and the danger level, and the danger level is used to characterize the severity of the damage caused by the vulnerability corresponding to the first vulnerability information being used to attack the digital asset; and obtaining multiple vulnerability levels by querying a fourth mapping relationship based on each of the target exploitation level and each of the target danger levels, where the fourth mapping relationship is a mapping relationship between the target exploitation level, the target danger level, and the vulnerability level.

[0010] Optionally, multiple first vulnerability information entries are input into a vulnerability remediation model to obtain multiple target remediation scripts, including: querying the vulnerability database based on each first vulnerability information entry to obtain each first remediation method, wherein the first vulnerability information entry and the first remediation method correspond one-to-one; obtaining a second remediation method, wherein the second remediation method is a remediation method input by the target object, and the second remediation method corresponds one-to-one with the first vulnerability information; inputting each first remediation method entry, the corresponding second remediation method, and the corresponding first vulnerability information entry into the vulnerability remediation model to obtain all the target remediation scripts corresponding to the first vulnerability information entry.

[0011] Optionally, running the target remediation scripts sequentially from high to low according to the vulnerability levels to repair the corresponding vulnerabilities includes: a first determination step, determining a target digital asset based on any one of the first vulnerability information, wherein the target digital asset is the digital asset whose code includes the first vulnerability information; a second determination step, determining the impact level of the first vulnerability information based on the number of target digital assets, wherein the impact level is used to characterize the extent of damage caused when the vulnerability corresponding to the first vulnerability information is used to attack the digital asset; repeating the first determination step and the second determination step at least once until the impact level corresponding to all the first vulnerability information is determined; when the corresponding impact levels are different, running the corresponding remediation scripts sequentially from high to low according to the impact level to repair the corresponding vulnerabilities; when the corresponding impact levels are the same, running the corresponding remediation scripts sequentially from high to low according to the vulnerability levels to repair the corresponding vulnerabilities.

[0012] Optionally, after running the target remediation scripts sequentially from high to low vulnerability levels, the method further includes: sequentially verifying the digital assets based on the verification data to obtain multiple second vulnerability information, wherein the second vulnerability information is the code corresponding to the vulnerability in the digital assets after the remediation scripts have been used for remediation; adding identification information to the first remediation method and the second remediation method corresponding to each second vulnerability information, wherein the identification information is used to indicate that the first remediation method and the second remediation method are invalid; and issuing a second alarm message, wherein the second alarm message is used to indicate that the vulnerability remediation has failed.

[0013] According to another aspect of this application, a network vulnerability management device is provided, the device comprising: a first acquisition unit, configured to acquire digital assets and verification data, the digital assets including a user's database, applications, and data files, the verification data being used to determine whether the digital assets have vulnerabilities; a verification unit, configured to sequentially verify the digital assets according to the verification data to obtain multiple first vulnerability information, the first vulnerability information being used to record code containing vulnerabilities in the digital assets; and a first query unit, configured to query a vulnerability database according to each of the first vulnerability information to obtain multiple vulnerability levels, the vulnerability database including the code of various known vulnerabilities and first remediation methods, the vulnerability level being used to characterize the first vulnerability... The processing priority of the vulnerability corresponding to the vulnerability information is as follows: the first remediation method is the vulnerability remediation scheme stored in the vulnerability database; the input unit is used to input multiple first vulnerability information into the vulnerability remediation model to obtain multiple target remediation scripts, the target remediation scripts are used to remediate the first vulnerability information, the target remediation scripts are remediation scripts corresponding to the first vulnerability information, the vulnerability remediation model is trained based on a training dataset, the training dataset includes the code of various known vulnerabilities, the first remediation method corresponding to the code, and the remediation script corresponding to the first remediation method; the running unit is used to run the target remediation scripts in descending order of vulnerability level to remediate the corresponding vulnerability.

[0014] According to another aspect of this application, a computer-readable storage medium is provided, the computer-readable storage medium including a stored program, wherein, when the program is executed, it controls the device on which the computer-readable storage medium is located to perform any of the methods described.

[0015] According to another aspect of this application, a vulnerability management system is provided, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs including methods for performing any one of the methods described.

[0016] Applying the technical solution of this application, in the aforementioned method for controlling network vulnerabilities, firstly, digital assets and verification data are acquired. The digital assets include user databases, applications, and data files. The verification data is used to determine whether the digital assets possess vulnerabilities. Then, the digital assets are sequentially verified based on the verification data to obtain multiple first vulnerability information entries. These first vulnerability information entries are used to record vulnerable code within the digital assets. Subsequently, a vulnerability database is queried based on each of the first vulnerability information entries to obtain multiple vulnerability levels. The vulnerability database includes the code and first remediation methods for various known vulnerabilities. The vulnerability levels are used to characterize the vulnerability information corresponding to the first vulnerability entry. The vulnerability handling priority is as follows: the first remediation method is the vulnerability remediation scheme stored in the vulnerability database; then, multiple first vulnerability information is input into the vulnerability remediation model to obtain multiple target remediation scripts. These target remediation scripts are used to remediate the first vulnerability information, and each target remediation script corresponds to a specific first vulnerability information. The vulnerability remediation model is trained based on a training dataset, which includes the code for various known vulnerabilities, the corresponding first remediation method, and the corresponding remediation script. Finally, the target remediation scripts are run sequentially from highest to lowest vulnerability level to remediate the corresponding vulnerabilities. This application pre-stores verification code corresponding to known types of vulnerabilities in a verification database. Then, it iterates through the user's digital assets based on the verification code to obtain network vulnerabilities present in the digital assets. It then queries the national information security vulnerability database to determine the severity level, vulnerability type, and remediation method of the corresponding vulnerability. Finally, the vulnerability type and remediation method are input into the vulnerability remediation model, which generates the corresponding remediation script based on the remediation scheme to remediate the corresponding vulnerability. This application realizes the automatic processing from vulnerability monitoring to vulnerability analysis and then to vulnerability remediation, which solves the problem that the vulnerability management in the prior art requires manual remediation, which is prone to omissions and leads to low efficiency. Attached Figure Description

[0017] Figure 1 A hardware structure block diagram of a mobile terminal for managing network vulnerabilities according to an embodiment of this application is shown.

[0018] Figure 2 A flowchart illustrating a method for managing network vulnerabilities according to an embodiment of this application is shown.

[0019] Figure 3 A structural block diagram of a network vulnerability management device provided according to an embodiment of this application is shown.

[0020] The above figures include the following reference numerals:

[0021] 102. Processor; 104. Memory; 106. Transmission device; 108. Input / output device. Detailed Implementation

[0022] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0023] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0024] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this application described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0025] As described in the background section, existing network vulnerability management solutions typically require security experts to manually analyze and fix vulnerabilities. To address the issue that manual repair is necessary for vulnerability management in existing technologies, which can easily lead to oversights and low efficiency, embodiments of this application provide a network vulnerability management method, management device, computer-readable storage medium, and vulnerability management system.

[0026] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention.

[0027] The methods and embodiments provided in this application can be executed on a mobile terminal, a computer terminal, or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 This is a hardware structure block diagram of a mobile terminal for a network vulnerability management method according to an embodiment of the present invention. Figure 1 As shown, a mobile terminal may include one or more ( Figure 1Only one is shown in the diagram. A processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data are also shown. The mobile terminal may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the mobile terminal described above. For example, the mobile terminal may also include components that are more... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0028] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the device information display method in this embodiment of the invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, thereby implementing the above-described method. The memory 104 may include high-speed random access memory and non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of the aforementioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. The transmission device 106 is used to receive or send data via a network. Specific examples of the aforementioned networks may include wireless networks provided by the mobile terminal's communication provider. In one example, the transmission device 106 includes a network interface controller (NIC), which can be connected to other network devices via a base station to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0029] This embodiment provides a method for managing network vulnerabilities that runs on a mobile terminal, computer terminal, or similar computing device. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0030] Figure 2 This is a flowchart of a network vulnerability management method according to an embodiment of this application. Figure 2 As shown, the method includes the following steps:

[0031] Step S201: Obtain digital assets and verification data. The digital assets include the user's database, application, and data files. The verification data is used to determine whether the digital assets have vulnerabilities.

[0032] Specifically, the aforementioned digital assets are obtained by identifying and classifying all virtual assets in the user's network through automated asset management technology, and then the aforementioned verification data is obtained by retrieving code from a preset database used to verify different vulnerabilities.

[0033] Step S202: Verify the digital assets sequentially based on the above verification data to obtain multiple first vulnerability information. The first vulnerability information is used to record the code in the digital assets that has vulnerabilities.

[0034] Specifically, based on all the above verification data, vulnerability verification is performed on each of the above digital assets to determine whether there are vulnerabilities in the above digital assets, and multiple first vulnerability information is obtained. The first vulnerability information records the location, type and corresponding code field that caused the vulnerability.

[0035] Step S203: Query the vulnerability database according to each of the above first vulnerability information to obtain multiple vulnerability levels. The vulnerability database includes the above code and first remediation method for various known above vulnerabilities. The vulnerability level is used to characterize the processing priority of the above vulnerability corresponding to the above first vulnerability information. The first remediation method is the vulnerability remediation scheme stored in the above vulnerability database.

[0036] Specifically, based on the vulnerability codes obtained from the aforementioned digital assets, the vulnerability database is queried, and the processing priority of each vulnerability is determined according to the severity, exploitability, and scope of impact recorded in the vulnerability database, i.e., the aforementioned vulnerability level.

[0037] Step S204: Input multiple first vulnerability information into the vulnerability repair model to obtain multiple target repair scripts. The target repair scripts are used to repair the first vulnerability information. The target repair scripts are repair scripts corresponding to the first vulnerability information. The vulnerability repair model is trained based on a training dataset. The training dataset includes the code of various known vulnerabilities, the first repair method corresponding to the code, and the repair script corresponding to the first repair method.

[0038] Specifically, based on the first vulnerability information, the vulnerability database is queried to obtain the corresponding first remediation method. Then, the first remediation method and the first vulnerability information are input into the vulnerability remediation model. The vulnerability remediation model generates a corresponding script based on the remediation scheme in the vulnerability database. Running the script can remediate the corresponding vulnerability.

[0039] Step S205: Run the target repair scripts in descending order of vulnerability severity to repair the corresponding vulnerabilities.

[0040] Specifically, when patching vulnerabilities, priority is given to patching vulnerabilities with higher risk levels, that is, the target patching scripts are run in descending order of the corresponding vulnerability levels.

[0041] In this embodiment, firstly, digital assets and verification data are acquired. The digital assets include the user's database, applications, and data files. The verification data is used to determine whether the digital assets have vulnerabilities. Then, the digital assets are verified sequentially based on the verification data to obtain multiple first vulnerability information entries. These first vulnerability information entries record the code containing vulnerabilities in the digital assets. Next, a vulnerability database is queried based on each of the first vulnerability information entries to obtain multiple vulnerability levels. The vulnerability database includes the code for various known vulnerabilities and first remediation methods. The vulnerability level is used to characterize the processing priority of the vulnerability corresponding to the first vulnerability information entry. The first remediation method is a vulnerability remediation scheme stored in the vulnerability database. Then, the multiple first vulnerability information entries are input into a vulnerability remediation model to obtain multiple target remediation scripts. These target remediation scripts are used to remediate the first vulnerability information entries. Each target remediation script is a remediation script corresponding to a specific first vulnerability information entry. The vulnerability remediation model is trained based on a training dataset, which includes the code for various known vulnerabilities, the first remediation method corresponding to the code, and the remediation script corresponding to the first remediation method. Finally, the target remediation scripts are run sequentially from highest to lowest vulnerability level to remediate the corresponding vulnerabilities. This application pre-stores verification codes corresponding to known vulnerability types in a verification database. Then, it iterates through the user's digital assets based on the verification codes to identify existing network vulnerabilities. Next, it queries the National Information Security Vulnerability Database to determine the severity level, vulnerability type, and remediation method of each vulnerability. Finally, it inputs the vulnerability type and remediation method into a vulnerability remediation model, which generates a corresponding remediation script based on the remediation plan to fix the corresponding vulnerability. This application automates the entire process from vulnerability monitoring to vulnerability analysis to vulnerability remediation, solving the problem of inefficiency caused by manual remediation in existing vulnerability management technologies, which is prone to oversights.

[0042] To enhance the security management of the aforementioned digital assets, in one optional implementation, the method further includes the following before acquiring the digital assets and verifying the data:

[0043] Step S301: Obtain the target access permission and multiple preset access permissions. The target access permission is the permission information included in the current user's access request to the digital asset.

[0044] Specifically, in order to restrict non-user objects from accessing the aforementioned digital assets, in one embodiment, corresponding access permissions are set for different users, namely the aforementioned preset access permissions, and then the permission identifier of the current access request is obtained to determine the corresponding access permissions, namely the aforementioned target access permissions.

[0045] Step S302: If there is permission information in the preset access permissions that is consistent with the target access permissions, determine that the digital asset is allowed to be obtained.

[0046] Specifically, the target access permissions and preset access permissions are matched, and the matching determines that the current user has the access permissions and is allowed to access digital assets.

[0047] Step S303: If there is no permission information in the preset access permissions that is consistent with the target access permission, a first alarm message is issued. The first alarm message is used to indicate that the access request is abnormal.

[0048] Specifically, the target access permissions mentioned above are matched with the preset access permissions. If the match fails, it is determined that the current user does not have the access permissions, and an alarm is issued to indicate that there is abnormal access.

[0049] To improve the speed of vulnerability scanning, in one optional implementation, step S202 includes:

[0050] Step S2021: Divide the digital assets into multiple data groups to be verified according to the service type of the digital assets. The service type is determined according to the application object of the digital assets.

[0051] Specifically, in order to improve the speed of vulnerability scanning, before performing vulnerability scanning, the aforementioned digital assets are first split into multiple groups of data to be verified according to the different services provided by the functions they implement, and stored in a Redis database.

[0052] Step S2022: Based on each of the above service types, query the first mapping relationship to obtain multiple target scanning nodes. The first mapping relationship is the mapping relationship between the above service types and the scanning nodes. The scanning nodes are used to verify whether the digital assets of the corresponding service types have vulnerabilities.

[0053] Specifically, in order to distribute the load on the scanning devices and improve the speed of vulnerability scanning, each scanning node is set up to perform vulnerability scanning on digital assets corresponding to different service types, with each service type corresponding to a scanning node.

[0054] Step S2023: Each of the above-mentioned data groups to be verified is sent to each of the above-mentioned target scanning nodes according to the above-mentioned service type, so that the above-mentioned target scanning nodes match the above-mentioned verification data with the above-mentioned digital assets, determine whether the above-mentioned digital assets have vulnerabilities, and obtain multiple of the above-mentioned first vulnerability information.

[0055] Specifically, scanning tasks for digital assets are assigned to corresponding scanning nodes based on the service type of the digital assets. During the scanning process, each scanning node loads vulnerability verification code of the corresponding type, i.e., the aforementioned verification data. Based on the execution results of the vulnerability verification code, it is determined whether vulnerabilities exist in each of the aforementioned digital assets. Each verified vulnerability yields one instance of the aforementioned first vulnerability information.

[0056] To mitigate the damage caused by the vulnerability, in one optional implementation, step S203 includes:

[0057] Step S2031: Query the second mapping relationship based on each of the first vulnerability information to obtain the target exploitation level. The second mapping relationship is the mapping relationship between the first vulnerability information and the exploitation level. The exploitation level is used to characterize the probability that the vulnerability corresponding to the first vulnerability information is used to attack the digital assets.

[0058] Specifically, based on the vulnerability database synchronized and integrated from major vulnerability platforms, the vulnerability codes recorded in the aforementioned first vulnerability information are matched to determine the ease with which each of the aforementioned vulnerabilities can be used to attack the corresponding digital assets, and the probability of being attacked is expressed to obtain the aforementioned target exploitation level.

[0059] Step S2032: Query the third mapping relationship based on each of the first vulnerability information to obtain the target danger level. The third mapping relationship is the mapping relationship between the first vulnerability information and the danger level. The danger level is used to characterize the severity of the damage caused by the vulnerability corresponding to the first vulnerability information being used to attack the digital assets.

[0060] Specifically, based on the vulnerability database synchronized and integrated from major vulnerability platforms, the vulnerability code recorded in the aforementioned first vulnerability information is matched to determine the expected severity of loss when each of the aforementioned vulnerabilities is used to attack the corresponding digital assets, thus obtaining the aforementioned target danger level.

[0061] Step S2033: Based on the exploitation level and danger level of each of the above targets, query the fourth mapping relationship to obtain multiple vulnerability levels. The fourth mapping relationship is the mapping relationship between the exploitation level, danger level and vulnerability level of the above targets.

[0062] Specifically, based on the target exploitation level and target danger level corresponding to each of the above vulnerabilities, a preset mapping table is queried to determine the processing priority level of the vulnerability, thus obtaining the above vulnerability level.

[0063] To ensure the vulnerability is patched, in one optional implementation, step S204 includes:

[0064] Step S2041: Query the vulnerability database according to the first vulnerability information to obtain the first remediation method. The first vulnerability information and the first remediation method correspond one-to-one.

[0065] Specifically, the vulnerability database is queried based on the vulnerability code corresponding to the vulnerability, and the corresponding remediation solution in the vulnerability database is obtained, which is the first remediation method mentioned above.

[0066] Step S2042: Obtain the second repair method. The second repair method is the repair method input by the target object. The second repair method corresponds one-to-one with the first vulnerability information.

[0067] Specifically, to avoid the poor timeliness of the remediation methods in the vulnerability database, staff designed remediation plans based on the corresponding vulnerabilities and input them into the system, thus obtaining the second remediation method mentioned above.

[0068] Step S2043: Input each of the above-mentioned first repair methods, the corresponding above-mentioned second repair methods, and the corresponding above-mentioned first vulnerability information into the above-mentioned vulnerability repair model to obtain the above-mentioned target repair scripts corresponding to all the above-mentioned first vulnerability information.

[0069] Specifically, the first and second repair methods mentioned above, along with the corresponding vulnerability codes, are input into the vulnerability repair model. The vulnerability repair model then combines the two methods to generate the corresponding target repair script based on the corresponding vulnerability codes.

[0070] To mitigate the damage caused by the vulnerability, in one alternative implementation, step S205 includes:

[0071] Step S2051, first determination step, determine the target digital asset based on any of the above-mentioned first vulnerability information, the above-mentioned target digital asset is the above-mentioned digital asset whose corresponding code includes the above-mentioned first vulnerability information;

[0072] Specifically, the aforementioned digital assets are searched based on the vulnerability codes corresponding to the detected vulnerabilities to identify digital assets with the same codes, thus obtaining the aforementioned target digital assets.

[0073] Step S2052, the second determination step, determines the impact level of the first vulnerability information based on the quantity of the target digital assets. The impact level is used to characterize the extent of damage caused when the vulnerability corresponding to the first vulnerability information is used to attack the digital assets.

[0074] Specifically, the number of target digital assets included in the vulnerability will be used to determine the scope of the vulnerability's impact, and then the corresponding impact level will be determined.

[0075] Step S2053: Repeat the first determination step and the second determination step at least once in sequence until the impact level corresponding to all the first vulnerability information is determined.

[0076] Specifically, repeat the first determination step and the second determination step described above to determine the impact level corresponding to each vulnerability.

[0077] Step S2054: In cases where the impact levels are different, the corresponding repair scripts are run sequentially from high to low according to the impact levels to repair the corresponding vulnerabilities.

[0078] Specifically, in order to reduce the losses caused by exploitation of vulnerabilities, priority should be given to vulnerabilities with higher impact levels, that is, vulnerabilities that cause large-scale damage when exploited.

[0079] Step S2055: When the impact levels are the same, run the corresponding repair scripts in descending order of vulnerability level to repair the corresponding vulnerabilities.

[0080] Specifically, when vulnerabilities have the same impact level, meaning they cause the same amount of damage when exploited, vulnerabilities with higher risk levels should be prioritized for handling.

[0081] To avoid residual vulnerabilities due to remediation failure, in an optional implementation, after running the target remediation scripts sequentially according to the vulnerability levels from high to low, the method further includes:

[0082] Step S401: Verify the digital assets sequentially based on the above verification data to obtain multiple second vulnerability information. The second vulnerability information is the code corresponding to the above vulnerability in the digital assets after the above repair script has been repaired.

[0083] Specifically, by repeatedly verifying the aforementioned digital assets to identify unpatched vulnerabilities, the corresponding vulnerability code, vulnerability name, and vulnerability location are recorded to obtain the aforementioned second vulnerability information.

[0084] Step S402: Add identification information to the first repair method and the second repair method corresponding to each of the above-mentioned second vulnerability information. The identification information is used to indicate that the first repair method and the second repair method are invalid.

[0085] Specifically, the second vulnerability information is matched with the first vulnerability information mentioned above. For the first vulnerability information that is duplicated with the second vulnerability information mentioned above, an invalid mark is added to the first and second repair methods, that is, the repair scheme is determined to have failed.

[0086] Step S403: Issue a second alarm message, which indicates that the vulnerability fix has failed.

[0087] Specifically, to prevent vulnerabilities from causing serious damage, an alarm message will be issued if the repair fails, indicating to staff that the repair has failed and manual repair is required.

[0088] This application also provides a network vulnerability management device. It should be noted that the network vulnerability management device of this application can be used to execute the network vulnerability management method provided in this application. This device is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can refer to a combination of software and / or hardware that performs a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0089] The following describes the network vulnerability management device provided in the embodiments of this application.

[0090] Figure 3 This is a structural block diagram of a network vulnerability management device according to an embodiment of this application. Figure 3 As shown, the device includes:

[0091] The first acquisition unit 10 is used to acquire digital assets and verification data. The digital assets include the user's database, application and data file. The verification data is used to determine whether the digital assets have vulnerabilities.

[0092] Specifically, the aforementioned digital assets are obtained by identifying and classifying all virtual assets in the user's network through automated asset management technology, and then the aforementioned verification data is obtained by retrieving code from a preset database used to verify different vulnerabilities.

[0093] Verification unit 20 is used to verify the digital assets sequentially based on the verification data to obtain multiple first vulnerability information, and the first vulnerability information is used to record the code in the digital assets that has vulnerabilities.

[0094] Specifically, based on all the above verification data, vulnerability verification is performed on each of the above digital assets to determine whether there are vulnerabilities in the above digital assets, and multiple first vulnerability information is obtained. The first vulnerability information records the location, type and corresponding code field that caused the vulnerability.

[0095] The first query unit 30 is used to query the vulnerability database based on each of the first vulnerability information to obtain multiple vulnerability levels. The vulnerability database includes the code and first repair methods for various known vulnerabilities. The vulnerability level is used to characterize the processing priority of the vulnerability corresponding to the first vulnerability information. The first repair method is a vulnerability repair scheme stored in the vulnerability database.

[0096] Specifically, based on the vulnerability codes obtained from the aforementioned digital assets, the vulnerability database is queried, and the processing priority of each vulnerability is determined according to the severity, exploitability, and scope of impact recorded in the vulnerability database, i.e., the aforementioned vulnerability level.

[0097] Input unit 40 is used to input multiple first vulnerability information into vulnerability repair model to obtain multiple target repair scripts. The target repair scripts are used to repair the first vulnerability information. The target repair scripts are repair scripts corresponding to the first vulnerability information. The vulnerability repair model is trained based on a training dataset. The training dataset includes the code of various known vulnerabilities, the first repair method corresponding to the code, and the repair script corresponding to the first repair method.

[0098] Specifically, based on the first vulnerability information, the vulnerability database is queried to obtain the corresponding first remediation method. Then, the first remediation method and the first vulnerability information are input into the vulnerability remediation model. The vulnerability remediation model generates a corresponding script based on the remediation scheme in the vulnerability database. Running the script can remediate the corresponding vulnerability.

[0099] The execution unit 50 is used to run the target repair scripts in descending order of the vulnerability levels to repair the corresponding vulnerabilities.

[0100] Specifically, when patching vulnerabilities, priority is given to patching vulnerabilities with higher risk levels, that is, the target patching scripts are run in descending order of the corresponding vulnerability levels.

[0101] In this embodiment, the first acquisition unit acquires digital assets and verification data. The digital assets include the user's database, application, and data files. The verification data is used to determine whether the digital assets have vulnerabilities. The verification unit sequentially verifies the digital assets based on the verification data to obtain multiple first vulnerability information entries. The first vulnerability information entries are used to record the code containing vulnerabilities in the digital assets. The first query unit queries a vulnerability database based on each of the first vulnerability information entries to obtain multiple vulnerability levels. The vulnerability database includes the code for various known vulnerabilities and first remediation methods. The vulnerability level is used to characterize the processing priority of the vulnerability corresponding to the first vulnerability information. The first remediation method is a vulnerability remediation scheme stored in the vulnerability database. The input unit inputs the multiple first vulnerability information entries into a vulnerability remediation model to obtain multiple target remediation scripts. The target remediation scripts are used to remediate the first vulnerability information entries. The target remediation scripts are remediation scripts corresponding to the first vulnerability information entries. The vulnerability remediation model is trained based on a training dataset. The training dataset includes the code for various known vulnerabilities, the first remediation method corresponding to the code, and the remediation script corresponding to the first remediation method. The running unit sequentially runs the target remediation scripts according to the vulnerability level from high to low to remediate the corresponding vulnerabilities. This application pre-stores verification codes corresponding to known vulnerability types in a verification database. Then, it iterates through the user's digital assets based on the verification codes to identify existing network vulnerabilities. Next, it queries the National Information Security Vulnerability Database to determine the severity level, vulnerability type, and remediation method of each vulnerability. Finally, it inputs the vulnerability type and remediation method into a vulnerability remediation model, which generates a corresponding remediation script based on the remediation plan to fix the corresponding vulnerability. This application automates the entire process from vulnerability monitoring to vulnerability analysis to vulnerability remediation, solving the problem of inefficiency caused by manual remediation in existing vulnerability management technologies, which is prone to oversights.

[0102] To enhance the security management of the aforementioned digital assets, in one optional implementation, the apparatus further includes:

[0103] The second acquisition unit is used to acquire target access permissions and multiple preset access permissions before acquiring digital assets and verification data. The target access permissions are the permission information included in the current user's access request to the digital assets.

[0104] Specifically, in order to restrict non-user objects from accessing the aforementioned digital assets, in one embodiment, corresponding access permissions are set for different users, namely the aforementioned preset access permissions, and then the permission identifier of the current access request is obtained to determine the corresponding access permissions, namely the aforementioned target access permissions.

[0105] The first determining unit is used to determine that the digital asset is allowed to be obtained if there is permission information in the preset access permissions that is consistent with the target access permissions.

[0106] Specifically, the target access permissions and preset access permissions are matched, and the matching determines that the current user has the access permissions and is allowed to access digital assets.

[0107] The first alarm unit is used to issue a first alarm message when there is no permission information in the preset access permissions that is consistent with the target access permission. The first alarm message is used to indicate that the access request is abnormal.

[0108] Specifically, the target access permissions mentioned above are matched with the preset access permissions. If the match fails, it is determined that the current user does not have the access permissions, and an alarm is issued to indicate that there is abnormal access.

[0109] To improve the speed of vulnerability scanning, in one optional implementation, the verification unit includes:

[0110] The segmentation module is used to divide the digital assets into multiple data groups to be verified based on the service type of the digital assets. The service type is determined according to the application object of the digital assets.

[0111] Specifically, in order to improve the speed of vulnerability scanning, before performing vulnerability scanning, the aforementioned digital assets are first split into multiple groups of data to be verified according to the different services provided by the functions they implement, and stored in a Redis database.

[0112] The first query module is used to query the first mapping relationship according to each of the above service types to obtain multiple target scanning nodes. The first mapping relationship is the mapping relationship between the above service types and the scanning nodes. The scanning nodes are used to verify whether the digital assets of the corresponding above service types have vulnerabilities.

[0113] Specifically, in order to distribute the load on the scanning devices and improve the speed of vulnerability scanning, each scanning node is set up to perform vulnerability scanning on digital assets corresponding to different service types, with each service type corresponding to a scanning node.

[0114] The sending module is used to send each of the above-mentioned data groups to be verified to each of the above-mentioned target scanning nodes according to the above-mentioned service type, so that the above-mentioned target scanning nodes match the above-mentioned verification data with the above-mentioned digital assets, determine whether the above-mentioned digital assets have vulnerabilities, and obtain multiple above-mentioned first vulnerability information.

[0115] Specifically, scanning tasks for digital assets are assigned to corresponding scanning nodes based on the service type of the digital assets. During the scanning process, each scanning node loads vulnerability verification code of the corresponding type, i.e., the aforementioned verification data. Based on the execution results of the vulnerability verification code, it is determined whether vulnerabilities exist in each of the aforementioned digital assets. Each verified vulnerability yields one instance of the aforementioned first vulnerability information.

[0116] To mitigate the damage caused by the vulnerability, in one optional implementation, the first query unit includes:

[0117] The second query module is used to query the second mapping relationship based on each of the first vulnerability information to obtain the target exploitation level. The second mapping relationship is the mapping relationship between the first vulnerability information and the exploitation level. The exploitation level is used to characterize the probability that the vulnerability corresponding to the first vulnerability information is used to attack the digital assets.

[0118] Specifically, based on the vulnerability database synchronized and integrated from major vulnerability platforms, the vulnerability codes recorded in the aforementioned first vulnerability information are matched to determine the ease with which each of the aforementioned vulnerabilities can be used to attack the corresponding digital assets, and the probability of being attacked is expressed to obtain the aforementioned target exploitation level.

[0119] The third query module is used to query the third mapping relationship based on the first vulnerability information to obtain the target danger level. The third mapping relationship is the mapping relationship between the first vulnerability information and the danger level. The danger level is used to characterize the severity of the damage caused by the vulnerability corresponding to the first vulnerability information being used to attack the digital assets.

[0120] Specifically, based on the vulnerability database synchronized and integrated from major vulnerability platforms, the vulnerability code recorded in the aforementioned first vulnerability information is matched to determine the expected severity of loss when each of the aforementioned vulnerabilities is used to attack the corresponding digital assets, thus obtaining the aforementioned target danger level.

[0121] The fourth query module is used to query the fourth mapping relationship based on the exploitation level and the danger level of each of the above targets to obtain multiple vulnerability levels. The fourth mapping relationship is the mapping relationship between the exploitation level, the danger level, and the vulnerability level of the above targets.

[0122] Specifically, based on the target exploitation level and target danger level corresponding to each of the above vulnerabilities, a preset mapping table is queried to determine the processing priority level of the vulnerability, thus obtaining the above vulnerability level.

[0123] To ensure the vulnerability is patched, in one optional implementation, the input unit includes:

[0124] The fifth query module is used to query the vulnerability database based on the first vulnerability information to obtain the first remediation method. The first vulnerability information and the first remediation method correspond one-to-one.

[0125] Specifically, the vulnerability database is queried based on the vulnerability code corresponding to the vulnerability, and the corresponding remediation solution in the vulnerability database is obtained, which is the first remediation method mentioned above.

[0126] The first acquisition module is used to acquire the second repair method, which is the repair method input by the target object, and the second repair method corresponds one-to-one with the first vulnerability information.

[0127] Specifically, to avoid the poor timeliness of the remediation methods in the vulnerability database, staff designed remediation plans based on the corresponding vulnerabilities and input them into the system, thus obtaining the second remediation method mentioned above.

[0128] The input module is used to input each of the above-mentioned first repair methods, the corresponding above-mentioned second repair methods, and the corresponding above-mentioned first vulnerability information into the above-mentioned vulnerability repair model to obtain the above-mentioned target repair scripts corresponding to all the above-mentioned first vulnerability information.

[0129] Specifically, the first and second repair methods mentioned above, along with the corresponding vulnerability codes, are input into the vulnerability repair model. The vulnerability repair model then combines the two methods to generate the corresponding target repair script based on the corresponding vulnerability codes.

[0130] To mitigate the damage caused by the vulnerability, in one alternative implementation, the execution unit includes:

[0131] The first determining module is used to perform the first determining step, determining the target digital asset based on any of the aforementioned first vulnerability information, wherein the target digital asset is the digital asset whose corresponding code includes the aforementioned first vulnerability information.

[0132] Specifically, the aforementioned digital assets are searched based on the vulnerability codes corresponding to the detected vulnerabilities to identify digital assets with the same codes, thus obtaining the aforementioned target digital assets.

[0133] The second determining module is used to perform the second determining step, determining the impact level of the first vulnerability information based on the quantity of the target digital assets. The impact level is used to characterize the extent of damage caused when the vulnerability corresponding to the first vulnerability information is used to attack the digital assets.

[0134] Specifically, the number of target digital assets included in the vulnerability will be used to determine the scope of the vulnerability's impact, and then the corresponding impact level will be determined.

[0135] The repeating module is used to repeat the first determination step and the second determination step at least once in sequence until the impact level corresponding to all the first vulnerability information is determined.

[0136] Specifically, repeat the first determination step and the second determination step described above to determine the impact level corresponding to each vulnerability.

[0137] The first execution module is used to run the corresponding repair scripts in order of the impact level from high to low to repair the corresponding vulnerabilities, depending on the different impact levels mentioned above.

[0138] Specifically, in order to reduce the losses caused by exploitation of vulnerabilities, priority should be given to vulnerabilities with higher impact levels, that is, vulnerabilities that cause large-scale damage when exploited.

[0139] The second execution module is used to run the corresponding repair scripts in descending order of the vulnerability level to repair the corresponding vulnerability when the impact levels are the same.

[0140] Specifically, when vulnerabilities have the same impact level, meaning they cause the same amount of damage when exploited, vulnerabilities with higher risk levels should be prioritized for handling.

[0141] To avoid residual vulnerabilities due to repair failure, in an optional implementation, the above method further includes:

[0142] The second determining unit is used to run the target repair script in descending order of the vulnerability level, and then verify the digital assets in turn according to the verification data to obtain multiple second vulnerability information. The second vulnerability information is the code corresponding to the vulnerability in the digital assets after the repair script has been repaired.

[0143] Specifically, by repeatedly verifying the aforementioned digital assets to identify unpatched vulnerabilities, the corresponding vulnerability code, vulnerability name, and vulnerability location are recorded to obtain the aforementioned second vulnerability information.

[0144] The marking unit is used to add identification information to the first repair method and the second repair method corresponding to each of the above-mentioned second vulnerability information. The identification information is used to indicate that the first repair method and the second repair method are invalid.

[0145] Specifically, the second vulnerability information is matched with the first vulnerability information mentioned above. For the first vulnerability information that is duplicated with the second vulnerability information mentioned above, an invalid mark is added to the first and second repair methods, that is, the repair scheme is determined to have failed.

[0146] The second alarm unit is used to issue a second alarm message, which indicates that the above-mentioned vulnerability repair has failed.

[0147] Specifically, to prevent vulnerabilities from causing serious damage, an alarm message will be issued if the repair fails, indicating to staff that the repair has failed and manual repair is required.

[0148] The aforementioned network vulnerability control device includes a processor and a memory. The first acquisition unit, verification unit, first query unit, input unit, and execution unit are all stored as program units in the memory, and the processor executes these program units stored in the memory to achieve the corresponding functions. All of the above modules are located in the same processor; alternatively, the above modules may be located in different processors in any combination.

[0149] The processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and adjusting kernel parameters can improve the efficiency and accuracy of vulnerability management.

[0150] The memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0151] This invention provides a computer-readable storage medium that includes a stored program, wherein, when the program is executed, it controls the device containing the computer-readable storage medium to perform the network vulnerability management method.

[0152] Specifically, methods for managing network vulnerabilities include:

[0153] Step S201: Obtain digital assets and verification data. The digital assets include the user's database, application, and data files. The verification data is used to determine whether the digital assets have vulnerabilities.

[0154] Specifically, the aforementioned digital assets are obtained by identifying and classifying all virtual assets in the user's network through automated asset management technology, and then the aforementioned verification data is obtained by retrieving code from a preset database used to verify different vulnerabilities.

[0155] Step S202: Verify the digital assets sequentially based on the above verification data to obtain multiple first vulnerability information. The first vulnerability information is used to record the code in the digital assets that has vulnerabilities.

[0156] Specifically, based on all the above verification data, vulnerability verification is performed on each of the above digital assets to determine whether there are vulnerabilities in the above digital assets, and multiple first vulnerability information is obtained. The first vulnerability information records the location, type and corresponding code field that caused the vulnerability.

[0157] Step S203: Query the vulnerability database according to each of the above first vulnerability information to obtain multiple vulnerability levels. The vulnerability database includes the above code and first remediation method for various known above vulnerabilities. The vulnerability level is used to characterize the processing priority of the above vulnerability corresponding to the above first vulnerability information. The first remediation method is the vulnerability remediation scheme stored in the above vulnerability database.

[0158] Specifically, based on the vulnerability codes obtained from the aforementioned digital assets, the vulnerability database is queried, and the processing priority of each vulnerability is determined according to the severity, exploitability, and scope of impact recorded in the vulnerability database, i.e., the aforementioned vulnerability level.

[0159] Step S204: Input multiple first vulnerability information into the vulnerability repair model to obtain multiple target repair scripts. The target repair scripts are used to repair the first vulnerability information. The target repair scripts are repair scripts corresponding to the first vulnerability information. The vulnerability repair model is trained based on a training dataset. The training dataset includes the code of various known vulnerabilities, the first repair method corresponding to the code, and the repair script corresponding to the first repair method.

[0160] Specifically, based on the first vulnerability information, the vulnerability database is queried to obtain the corresponding first remediation method. Then, the first remediation method and the first vulnerability information are input into the vulnerability remediation model. The vulnerability remediation model generates a corresponding script based on the remediation scheme in the vulnerability database. Running the script can remediate the corresponding vulnerability.

[0161] Step S205: Run the target repair scripts in descending order of vulnerability severity to repair the corresponding vulnerabilities.

[0162] Specifically, when patching vulnerabilities, priority is given to patching vulnerabilities with higher risk levels, that is, the target patching scripts are run in descending order of the corresponding vulnerability levels.

[0163] This invention provides a processor for running a program, wherein the program executes the aforementioned network vulnerability management method during runtime.

[0164] Specifically, methods for managing network vulnerabilities include:

[0165] Step S201: Obtain digital assets and verification data. The digital assets include the user's database, application, and data files. The verification data is used to determine whether the digital assets have vulnerabilities.

[0166] Specifically, the aforementioned digital assets are obtained by identifying and classifying all virtual assets in the user's network through automated asset management technology, and then the aforementioned verification data is obtained by retrieving code from a preset database used to verify different vulnerabilities.

[0167] Step S202: Verify the digital assets sequentially based on the above verification data to obtain multiple first vulnerability information. The first vulnerability information is used to record the code in the digital assets that has vulnerabilities.

[0168] Specifically, based on all the above verification data, vulnerability verification is performed on each of the above digital assets to determine whether there are vulnerabilities in the above digital assets, and multiple first vulnerability information is obtained. The first vulnerability information records the location, type and corresponding code field that caused the vulnerability.

[0169] Step S203: Query the vulnerability database according to each of the above first vulnerability information to obtain multiple vulnerability levels. The vulnerability database includes the above code and first remediation method for various known above vulnerabilities. The vulnerability level is used to characterize the processing priority of the above vulnerability corresponding to the above first vulnerability information. The first remediation method is the vulnerability remediation scheme stored in the above vulnerability database.

[0170] Specifically, based on the vulnerability codes obtained from the aforementioned digital assets, the vulnerability database is queried, and the processing priority of each vulnerability is determined according to the severity, exploitability, and scope of impact recorded in the vulnerability database, i.e., the aforementioned vulnerability level.

[0171] Step S204: Input multiple first vulnerability information into the vulnerability repair model to obtain multiple target repair scripts. The target repair scripts are used to repair the first vulnerability information. The target repair scripts are repair scripts corresponding to the first vulnerability information. The vulnerability repair model is trained based on a training dataset. The training dataset includes the code of various known vulnerabilities, the first repair method corresponding to the code, and the repair script corresponding to the first repair method.

[0172] Specifically, based on the first vulnerability information, the vulnerability database is queried to obtain the corresponding first remediation method. Then, the first remediation method and the first vulnerability information are input into the vulnerability remediation model. The vulnerability remediation model generates a corresponding script based on the remediation scheme in the vulnerability database. Running the script can remediate the corresponding vulnerability.

[0173] Step S205: Run the target repair scripts in descending order of vulnerability severity to repair the corresponding vulnerabilities.

[0174] Specifically, when patching vulnerabilities, priority is given to patching vulnerabilities with higher risk levels, that is, the target patching scripts are run in descending order of the corresponding vulnerability levels.

[0175] This invention provides a vulnerability management system, which includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, it performs at least the following steps:

[0176] Step S201: Obtain digital assets and verification data. The digital assets include the user's database, application, and data files. The verification data is used to determine whether the digital assets have vulnerabilities.

[0177] Step S202: Verify the digital assets sequentially based on the above verification data to obtain multiple first vulnerability information. The first vulnerability information is used to record the code in the digital assets that has vulnerabilities.

[0178] Step S203: Query the vulnerability database according to each of the above first vulnerability information to obtain multiple vulnerability levels. The vulnerability database includes the above code and first repair method for various known above vulnerabilities. The vulnerability level is used to characterize the processing priority of the above vulnerability corresponding to the above first vulnerability information. The first repair method is the vulnerability repair scheme stored in the above vulnerability database.

[0179] Step S204: Input multiple first vulnerability information into the vulnerability repair model to obtain multiple target repair scripts. The target repair scripts are used to repair the first vulnerability information. The target repair scripts are repair scripts corresponding to the first vulnerability information. The vulnerability repair model is trained based on a training dataset. The training dataset includes the code of various known vulnerabilities, the first repair method corresponding to the code, and the repair script corresponding to the first repair method.

[0180] Step S205: Run the target repair scripts in descending order of vulnerability severity to repair the corresponding vulnerabilities.

[0181] This application also provides a computer program product, which, when executed on a data processing device, is suitable for executing an initialization program having at least the following method steps:

[0182] Step S201: Obtain digital assets and verification data. The digital assets include the user's database, application, and data files. The verification data is used to determine whether the digital assets have vulnerabilities.

[0183] Step S202: Verify the digital assets sequentially based on the above verification data to obtain multiple first vulnerability information. The first vulnerability information is used to record the code in the digital assets that has vulnerabilities.

[0184] Step S203: Query the vulnerability database according to each of the above first vulnerability information to obtain multiple vulnerability levels. The vulnerability database includes the above code and first remediation method for various known above vulnerabilities. The vulnerability level is used to characterize the processing priority of the above vulnerability corresponding to the above first vulnerability information. The first remediation method is the vulnerability remediation scheme stored in the above vulnerability database.

[0185] Step S204: Input multiple first vulnerability information into the vulnerability repair model to obtain multiple target repair scripts. The target repair scripts are used to repair the first vulnerability information. The target repair scripts are repair scripts corresponding to the first vulnerability information. The vulnerability repair model is trained based on a training dataset. The training dataset includes the code of various known vulnerabilities, the first repair method corresponding to the code, and the repair script corresponding to the first repair method.

[0186] Step S205: Run the target repair scripts in descending order of vulnerability severity to repair the corresponding vulnerabilities.

[0187] It is obvious to those skilled in the art that the modules or steps of the present invention described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. They can be implemented using computer-executable program code, and thus can be stored in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those described herein, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0188] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0189] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0190] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0191] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0192] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0193] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0194] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0195] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0196] As can be seen from the above description, the embodiments of this application achieve the following technical effects:

[0197] 1) The network vulnerability management method of this application firstly acquires digital assets and verification data. The digital assets include user databases, applications, and data files. The verification data is used to determine whether the digital assets have vulnerabilities. Then, the digital assets are verified sequentially according to the verification data to obtain multiple first vulnerability information. The first vulnerability information is used to record the code in the digital assets that has vulnerabilities. Next, a vulnerability database is queried according to each of the first vulnerability information to obtain multiple vulnerability levels. The vulnerability database includes the code and first remediation methods for various known vulnerabilities. The vulnerability level is used to characterize the processing priority of the vulnerability corresponding to the first vulnerability information. The first remediation method is a vulnerability remediation scheme stored in the vulnerability database. Then, the multiple first vulnerability information is input into a vulnerability remediation model to obtain multiple target remediation scripts. The target remediation scripts are used to remediate the first vulnerability information. The target remediation scripts are remediation scripts corresponding to the first vulnerability information. The vulnerability remediation model is trained based on a training dataset. The training dataset includes the code for various known vulnerabilities, the first remediation methods corresponding to the code, and the remediation scripts corresponding to the first remediation methods. Finally, the target remediation scripts are run sequentially from high to low according to the vulnerability levels to remediate the corresponding vulnerabilities. This application pre-stores verification codes corresponding to known vulnerability types in a verification database. Then, it iterates through the user's digital assets based on the verification codes to identify existing network vulnerabilities. Next, it queries the National Information Security Vulnerability Database to determine the severity level, vulnerability type, and remediation method of each vulnerability. Finally, it inputs the vulnerability type and remediation method into a vulnerability remediation model, which generates a corresponding remediation script based on the remediation plan to fix the corresponding vulnerability. This application automates the entire process from vulnerability monitoring to vulnerability analysis to vulnerability remediation, solving the problem of inefficiency caused by manual remediation in existing vulnerability management technologies, which is prone to oversights.

[0198] 2) The network vulnerability management device of this application includes a first acquisition unit acquiring digital assets and verification data. The digital assets include a user's database, application, and data files. The verification data is used to determine whether the digital assets have vulnerabilities. A verification unit sequentially verifies the digital assets based on the verification data to obtain multiple first vulnerability information entries. The first vulnerability information entries are used to record the code containing vulnerabilities in the digital assets. A first query unit queries a vulnerability database based on each of the first vulnerability information entries to obtain multiple vulnerability levels. The vulnerability database includes the code for various known vulnerabilities and first remediation methods. The vulnerability levels are used to characterize the vulnerabilities corresponding to the first vulnerability information entries. The processing priority is determined by the vulnerability remediation schemes stored in the vulnerability database. The input unit inputs multiple first vulnerability information into the vulnerability remediation model to obtain multiple target remediation scripts. The target remediation scripts are used to remediate the first vulnerability information. The target remediation scripts are remediation scripts corresponding to the first vulnerability information. The vulnerability remediation model is trained based on a training dataset, which includes the code for various known vulnerabilities, the first remediation schemes corresponding to the code, and the remediation scripts corresponding to the first remediation schemes. The running unit runs the target remediation scripts sequentially from high to low vulnerability level to remediate the corresponding vulnerabilities. This application pre-stores verification code corresponding to known types of vulnerabilities in the verification database. Then, it traverses the user's digital assets based on the verification code to obtain network vulnerabilities existing in the digital assets. Then, it queries the national information security vulnerability database to determine the severity level, vulnerability type, and remediation method of the corresponding vulnerability. Then, it inputs the vulnerability type and remediation method into the vulnerability remediation model. The vulnerability remediation model generates corresponding remediation scripts based on the remediation scheme to remediate the corresponding vulnerabilities. This application realizes the automatic processing from vulnerability monitoring to vulnerability analysis and then to vulnerability remediation, which solves the problem that the vulnerability management in the prior art requires manual remediation, which is prone to omissions and leads to low efficiency.

[0199] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for managing network vulnerabilities, characterized in that, include: Acquire digital assets and verification data, wherein the digital assets include the user's database, applications, and data files, and the verification data is used to determine whether the digital assets have vulnerabilities; The digital assets are verified sequentially based on the verification data to obtain multiple first vulnerability information, which is used to record the code in the digital assets that has vulnerabilities. Based on each of the first vulnerability information, a vulnerability database is queried to obtain multiple vulnerability levels. The vulnerability database includes the code of various known vulnerabilities and a first remediation method. The vulnerability level is used to characterize the processing priority of the vulnerability corresponding to the first vulnerability information. The first remediation method is a vulnerability remediation scheme stored in the vulnerability database. Multiple first vulnerability information entries are input into the vulnerability remediation model to obtain multiple target remediation scripts. The target remediation scripts are used to remediate the first vulnerability information. The target remediation scripts are remediation scripts corresponding to the first vulnerability information. The vulnerability remediation model is trained based on a training dataset. The training dataset includes the code of various known vulnerabilities, the first remediation method corresponding to the code, and the remediation script corresponding to the first remediation method. The target remediation scripts are run sequentially from highest to lowest vulnerability level to fix the corresponding vulnerabilities.

2. The method according to claim 1, characterized in that, Prior to acquiring digital assets and verifying data, the method further includes: Obtain target access permissions and multiple preset access permissions, wherein the target access permissions are the permission information included in the current user's access request to the digital asset; If the preset access permissions contain permission information consistent with the target access permissions, it is determined that the digital asset is allowed to be accessed; If no permission information matching the target access permission exists in the preset access permissions, a first alarm message is issued, which is used to indicate that the access request is abnormal.

3. The method according to claim 1, characterized in that, Based on the verification data, the digital assets are verified sequentially to obtain multiple first vulnerability information, including: The digital assets are divided into multiple data groups to be verified based on their service types, and the service types are determined according to the application objects of the digital assets. Multiple target scanning nodes are obtained by querying the first mapping relationship according to each service type. The first mapping relationship is the mapping relationship between the service type and the scanning node. The scanning node is used to verify whether the digital asset of the corresponding service type has vulnerabilities. Each of the data groups to be verified is sent to each of the target scanning nodes according to the service type, so that the target scanning nodes match the verification data with the digital assets to determine whether the digital assets have vulnerabilities and obtain multiple first vulnerability information.

4. The method according to claim 1, characterized in that, Based on the vulnerability information of each of the first vulnerabilities, the vulnerability database is queried to obtain multiple vulnerability levels, including: The target exploitation level is obtained by querying the second mapping relationship based on each of the first vulnerability information. The second mapping relationship is the mapping relationship between the first vulnerability information and the exploitation level. The exploitation level is used to characterize the probability that the vulnerability corresponding to the first vulnerability information is used to attack the digital asset. The target risk level is obtained by querying the third mapping relationship based on each of the first vulnerability information. The third mapping relationship is the mapping relationship between the first vulnerability information and the risk level. The risk level is used to characterize the severity of the damage caused by the vulnerability corresponding to the first vulnerability information being used to attack the digital asset. Based on the target exploitation level and the target danger level, a fourth mapping relationship is queried to obtain multiple vulnerability levels. The fourth mapping relationship is a mapping relationship between the target exploitation level, the target danger level and the vulnerability level.

5. The method according to claim 1, characterized in that, Multiple instances of the first vulnerability information are input into the vulnerability remediation model to obtain multiple target remediation scripts, including: Based on each of the first vulnerability information, the vulnerability database is queried to obtain each of the first remediation methods, and the first vulnerability information and the first remediation method correspond one-to-one; Obtain a second repair method, which is the repair method input by the target object, and the second repair method corresponds one-to-one with the first vulnerability information; Each of the first repair methods, the corresponding second repair methods, and the corresponding first vulnerability information are input into the vulnerability repair model to obtain the target repair scripts corresponding to all the first vulnerability information.

6. The method according to claim 1, characterized in that, The target remediation scripts are run sequentially from highest to lowest vulnerability severity to remediate the corresponding vulnerabilities, including: The first determination step involves determining a target digital asset based on any one of the first vulnerability information, wherein the target digital asset is the digital asset whose corresponding code includes the first vulnerability information; The second determination step involves determining the impact level of the first vulnerability information based on the quantity of the target digital assets. The impact level is used to characterize the extent of damage caused when the vulnerability corresponding to the first vulnerability information is used to attack the digital assets. Repeat the first determination step and the second determination step at least once in sequence until the impact level corresponding to all the first vulnerability information is determined; In cases where the impact levels are different, the corresponding target repair scripts are run sequentially from high to low according to the impact levels to repair the corresponding vulnerabilities. When the impact levels are the same, the corresponding target remediation scripts are run sequentially from high to low according to the vulnerability levels to fix the corresponding vulnerabilities.

7. The method according to claim 5, characterized in that, After running the target remediation scripts sequentially from highest to lowest vulnerability level, the method further includes: The digital assets are verified sequentially based on the verification data to obtain multiple second vulnerability information. The second vulnerability information is the code corresponding to the vulnerability in the digital assets after the target repair script has repaired it. Add identification information to the first and second repair methods corresponding to each of the second vulnerability information, and the identification information is used to indicate that the first and second repair methods are invalid; A second alarm message is issued, which indicates that the vulnerability fix has failed.

8. A network vulnerability management device, characterized in that, The device includes: The first acquisition unit is used to acquire digital assets and verification data. The digital assets include the user's database, application, and data files. The verification data is used to determine whether the digital assets have vulnerabilities. The verification unit is used to sequentially verify the digital asset based on the verification data to obtain multiple first vulnerability information, wherein the first vulnerability information is used to record the code in the digital asset that has vulnerabilities. The first query unit is used to query the vulnerability database based on each of the first vulnerability information to obtain multiple vulnerability levels. The vulnerability database includes the code of various known vulnerabilities and a first remediation method. The vulnerability level is used to characterize the processing priority of the vulnerability corresponding to the first vulnerability information. The first remediation method is a vulnerability remediation scheme stored in the vulnerability database. The input unit is used to input multiple first vulnerability information into the vulnerability repair model to obtain multiple target repair scripts. The target repair scripts are used to repair the first vulnerability information. The target repair scripts are repair scripts corresponding to the first vulnerability information. The vulnerability repair model is trained based on a training dataset. The training dataset includes the code of various known vulnerabilities, the first repair method corresponding to the code, and the repair script corresponding to the first repair method. The execution unit is used to run the target repair scripts in descending order of vulnerability level to repair the corresponding vulnerabilities.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein, when the program is executed, it controls the device on which the computer-readable storage medium is located to perform the method according to any one of claims 1 to 7.

10. A vulnerability management system, characterized in that, include: One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs comprising methods for performing any one of claims 1 to 7.

Images