Human-computer cooperation-based component known vulnerability mining method and device

Abstract

The application discloses a kind of based on man-machine cooperation's component known vulnerability mining method and device, belong to vulnerability mining technical field, including steps: S1, build vulnerability knowledge base, the vulnerability knowledge base includes general platform enumeration item CPE;S2, obtain software bill of materials;S3, the software bill of materials of acquisition is handled, extracts key information and generates general platform enumeration item according to key information;S4, known vulnerability is searched in combination with vulnerability knowledge base, and whether CPE exists in the vulnerability knowledge base is verified and corresponding processing is carried out.The application aims at the problem and limitation of existing component known vulnerability mining, improves the accuracy and efficiency of component known vulnerability mining by man-machine cooperation method.

Description

Technical Field

[0001] This invention relates to the field of vulnerability discovery technology, and more specifically, to a method and apparatus for discovering known vulnerabilities in components based on human-machine collaboration. Background Technology

[0002] Intelligent systems are characterized by complexity, lack of interpretability, and uncertainty, potentially producing results beyond human expectations and impacting social production and daily life due to their unpredictable behavior. The development of intelligent systems and the increasing proportion of machine-based tasks have promoted the evolution from simple human-machine relationships to human-machine collaboration. Human-machine collaboration can be seen as an extension of the human-computer interaction concept, with its core purpose being to improve work efficiency. The rudiments of human-machine collaboration can be seen as early as data annotation work. Training deep learning models requires large-scale labeled data. By incorporating the cognitive wisdom of a large number of people through mechanisms such as "crowdsourcing" and "crowd-creation," the data set annotation cycle is significantly shortened, and the generation of the dataset, in turn, enhances the performance of intelligent algorithms.

[0003] The field of software vulnerability discovery can also incorporate human-machine collaboration to achieve better discovery efficiency. Software vulnerability detection methods are mainly divided into two categories: static analysis and dynamic testing. Static analysis refers to scanning software without running the code, using methods such as lexical analysis, syntax analysis, and rule matching to uncover potential defects. Dynamic testing refers to software vulnerability discovery methods that provide unexpected input to the running program under test and monitor abnormal output results. Furthermore, with the popularity of ready-to-use commercial components and open-source software, system vulnerabilities caused by the software supply chain are becoming increasingly serious. For example, the Apache log4j CVE-2021-44228 vulnerability affected more than 35,000 Java packages, impacting one-third of the world's servers. Therefore, the discovery of known vulnerabilities in the software system supply chain has gradually attracted attention. To address the challenges facing the vulnerability discovery field, in 2018, DARPA announced the CHESS project, aiming to promote software vulnerability discovery through human-machine collaboration and develop a 0-day vulnerability discovery and resolution system suitable for the ever-growing complex software ecosystem. Existing vulnerability discovery technologies suffer from low accuracy, long discovery cycles, and high barriers to entry. Summary of the Invention

[0004] The purpose of this invention is to overcome the shortcomings of the prior art and provide a method and apparatus for discovering known vulnerabilities in components based on human-machine collaboration. In view of the problems and limitations of existing known vulnerability discovery methods, this invention improves the accuracy and efficiency of known vulnerability discovery by using a human-machine collaboration approach.

[0005] The objective of this invention is achieved through the following solution:

[0006] A method for discovering known vulnerabilities in components based on human-machine collaboration includes the following steps:

[0007] S1, Construct a vulnerability knowledge base, which includes a common platform enumeration item CPE;

[0008] S2, Obtain the software bill of materials;

[0009] S3 processes the acquired software bill of materials, extracts key information, and generates general platform enumeration items based on the key information.

[0010] S4. Combine the vulnerability knowledge base to search for known vulnerabilities. First, verify whether the CPE exists in the vulnerability knowledge base. If the CPE exists, query known vulnerabilities based on the CPE information to complete the discovery of known vulnerabilities for a component in the bill of materials.

[0011] If the CPE does not exist, the first external system will determine whether the CPE does not exist due to a machine parsing error or because the CPE does not actually exist.

[0012] If the component parsing error is caused by the component parsing model, the first external system will identify the component name and version and feed the result back to the machine parsing model as a data sample for training the reinforcement learning model. After obtaining the correct component information and generating the CPE, the known vulnerability scanning results will be obtained through the knowledge base query to complete the known vulnerability mining of a component in the bill of materials. If the CPE still does not exist, it means that the component does not have a CPE, and the process will jump to the process of mining known vulnerabilities of the component through vulnerability description.

[0013] When a component lacks a CPE, known vulnerability discovery is performed through vulnerability description identification. A natural language processing model analyzes vulnerability descriptions in the knowledge base, identifying the part-of-speech tags and dependency relationships of words. Based on predefined rules and a similarity discrimination algorithm, vulnerability descriptions matching the component under test are identified. The query results are returned, and a second external system determines whether the vulnerabilities found by this method are correct. If correct, the known vulnerability discovery for a component in the bill of materials is completed, and the vulnerability information and associated component information are added to the knowledge base in the form of nodes and relationships, thereby enhancing the knowledge base's capabilities. The results will be automatically output on the next scan. If incorrect, such as the machine misclassifying different components as the same component, the similarity threshold needs further optimization, and the threshold is corrected through the interactive interface. If the machine incorrectly identifies a situation that does not match the component under test as matching, the version conformity judgment rule needs optimization, and keywords are selected through the interactive interface to assist the machine in generating new matching rules, achieving enhanced feedback.

[0014] Furthermore, in step S1, the vulnerability knowledge base also includes vulnerability information CVE and defect information CWE that cause the vulnerability.

[0015] Furthermore, in step S1, the vulnerability knowledge base exists in the form of a knowledge graph.

[0016] Furthermore, in step S2, obtaining the software bill of materials specifically includes: using automated tools to obtain the software bill of materials and inputting it into the system.

[0017] Furthermore, in step S3, the processing of the acquired software bill of materials specifically includes normalizing the acquired software bill of materials and then parsing it, and merging similar items.

[0018] Furthermore, in step S3, the key information includes the component name.

[0019] Furthermore, in step S3, the key information includes a version number.

[0020] Furthermore, the first external system includes an existing CPE determination system.

[0021] Furthermore, the second external system includes an existing vulnerability detection and determination system.

[0022] A component known vulnerability discovery device based on human-machine collaboration includes a processor and a memory, wherein the memory stores a computer program that, when loaded by the processor, executes the method described in any of the preceding methods.

[0023] The beneficial effects of this invention include:

[0024] (1) This invention focuses on the integration of known vulnerability discovery task scenarios and human-machine collaboration mechanisms. By exploring the possibility of human-machine collaboration in specific task scenarios, it constructs a new human-machine interaction mode. It directly utilizes the advantages of human intelligence in key nodes such as decision-making, complex problem cognition, knowledge induction and deduction, and proactive intervention and interaction, and combines the advantages of machine intelligence in large-scale data analysis, adaptive learning, and large-scale computing. It conceives a computer system information gap representation method and intelligent model feedback enhancement dynamic learning mode. In the vulnerability discovery process, it conceives a new scheme for acquiring and integrating human insights, improves the interaction mode and quality between humans and machines, and forms a human-machine collaboration framework that utilizes the transaction processing mechanism of humans on the loop and in specific task scenarios. This accelerates the component vulnerability discovery process and improves the efficiency of known vulnerability discovery.

[0025] (2) This invention provides a new application method of human-computer collaboration in the field of software vulnerability mining; provides a computer system information gap representation method and intelligent model feedback enhancement dynamic learning mode; provides a way to acquire and integrate human insights in the vulnerability mining process; and improves the ability to scan known vulnerabilities of components based on improved human-computer collaboration technology.

[0026] (3) This invention proposes a new interactive collaborative method, process and mechanism for vulnerability mining scenarios, realizing dynamic learning and correction between humans and machines; this invention can run automatically, and by introducing an external system, it can directly utilize the mechanism design of humans in the loop in the external system, thereby amplifying the advantages of human decision-making and knowledge induction compared with traditional solutions, and enhancing the efficiency of known vulnerability mining of components; the operation process of this invention, by accessing the judgment of the external system, reduces the participation threshold of highly professional and difficult vulnerability mining tasks through human-machine collaboration, and reduces the total time consumption of mining tasks through human participation. Attached Figure Description

[0027] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0028] Figure 1 This is a flowchart illustrating the steps of the method in an embodiment of the present invention;

[0029] Figure 2 A research framework for human-machine collaboration;

[0030] Figure 3 The results of the vulnerability description statement analysis. Detailed Implementation

[0031] All features disclosed in all embodiments of this specification, or steps in all methods or processes implied in the disclosure, may be combined and / or extended or replaced in any way, except for mutually exclusive features and / or steps.

[0032] In view of the problems mentioned in the background, the present invention aims to provide a new human-machine collaborative mining scheme for software component vulnerabilities. It mainly explores the application of human-machine collaboration in the field of vulnerability mining, and addresses the problems and limitations of existing known vulnerability mining for components, solving the technical problems of low accuracy, long mining cycle and high participation threshold in known vulnerability mining.

[0033] The approach of this invention to solve the above-mentioned technical problems includes: First, establishing a human-machine collaborative research framework; analyzing the known vulnerability discovery process of components under the guidance of the framework; identifying the information gap and its representation methods that lead to low vulnerability identification accuracy due to semantic and contextual information misunderstandings; and directly utilizing existing human insights and decision-making capabilities from external systems during the discovery process to continuously enhance machine capabilities, thus forming a parallel growth of human wisdom and machine intelligence, and a spiral increase in human-machine capabilities. Further technical concepts include the following processes:

[0034] Regarding the human-machine collaboration framework proposed in this invention, as follows: Figure 2 As shown, the connotation of "machine" is not limited to intelligent systems; it can also be interpreted as automatic systems, autonomous systems, robots, and algorithms. The purpose of human-machine collaboration is to improve work efficiency by effectively utilizing the capabilities of both humans and machines. Compared to traditional human-machine relationships, the fundamental difference in human-machine collaboration lies in process design, task allocation, the uniformity of knowledge expression, mutual understanding, mutual influence, and mutual shaping between humans and machines. Much work revolves around ensuring credible and explainable decisions, ultimately focusing on the optimization and innovation of the human-machine interface. The human-machine collaboration research framework of this invention has three main points: First, automated tools are the foundation of human-machine collaboration; automated tools or intelligent algorithms must be integrated with business processes to achieve intelligent operation. Second, it involves the introduction of knowledge between humans and machines to achieve automation gains, directly utilizing the advantages of existing human wisdom in key node decision-making, complex problem cognition, knowledge induction and deduction, and proactive intervention and interaction, combined with the advantages of machine intelligence in large-scale data analysis, adaptive learning, and large-scale computation. Finally, the goal is to make the tool accessible to everyone through human-computer interaction mechanisms, such as recommendations and iterations: the machine pushes suggestions in real time for human decision-making through frequent iterative dialogues and loops, enhancing the credibility and explainability of human-machine decision-making, and answering questions such as whether the tool can be used automatically, whether it can simplify tasks that are originally difficult, require high expertise, and involve complex scenarios, and whether it can involve more people.

[0035] Regarding the known vulnerability scanning method for human-machine collaborative components of this invention: In the process of this invention, the known vulnerability scanning of components is a highly automated process. Some scanning methods use package management tools of different programming languages ​​to obtain software bill of materials information, and then identify the component version name information in the bill of materials item by item based on the vulnerability knowledge base, generating a common platform enumeration item (CPE), thereby associating known vulnerabilities. However, in practice, there is a problem of inaccurate component vulnerability scanning results, due to the following reasons: 1) Inaccurate parsing of the software bill of materials. Assuming the parsing method is (component name-component version.suffix), parsing errors occur when encountering the following strings: alsa-driver-1.0.25+dfsg.tar, biometric-authentication-0.9.63kord3~rc17.tar, bsdmainutils-11.1.2kylin3.tar, etc.; 2) Incomplete vulnerability scanning results are caused by the misalignment of component names and component CPEs. For example, the alsa-utils component does not have a CPE, but has known vulnerabilities.

[0036] To address the aforementioned technical problems, under the guidance of the human-machine collaborative framework of this invention, the issue of inaccurate bill of materials parsing is resolved by introducing the existing cognitive and decision-making capabilities of humans from an external system. Each parsed component and version number is confirmed in the external system and a directly acceptable confirmation result is returned. If the machine parsing is incorrect, the external system inputs the data, which is then used as reinforcement learning training data for the component name parsing model.

[0037] To address the misalignment between component names and known vulnerabilities, this approach combines machine intelligence's natural language understanding with existing human decision-making capabilities. Furthermore, the solution outputs the machine's natural language processing logic during the process, reducing information comprehension bias and bridging the information gap. First, a natural language processing model is used to analyze the vulnerability description, performing syntactic analysis to capture the syntactic structure of the sentence sequence and the dependency relationships between words. Taking the description text of vulnerability CVE-2021-0129, "Improper access control in subsystem for BlueZ before version 5.54 may allow an unauthenticated user to potentially enable escalation of privilege.", as an example, the syntactic analysis results are as follows: Figure 3 As shown, in the above sentence sequence, the target component name "BlueZ" is the proper noun "NNP", the dependency word is the preposition "for", and the dependency relation is the prepositional modifier "pobj". A set of extraction rules for component names and version information is predefined based on part-of-speech and dependency relations. Where W(pos=′NN′,rtp=′nsubj′) represents the word extraction condition as a noun “NN” with a dependency relationship of a noun subject “nsubj”. The component information extracted through rule matching is compared with the name of the component to be tested for similarity and version compatibility. If the name similarity is greater than the threshold and the version compatibility is correct, the known vulnerability scan results are fed back, and further judgments are made as follows: 1) Determine if the known vulnerabilities of the component searched by the machine through vulnerability descriptions match the component to be tested; if not, adjust the similarity threshold; 2) Determine if the vulnerabilities matched by the machine through vulnerability descriptions are correct. For correct vulnerability descriptions, the association between the vulnerability and the component is fed back to the database in the form of knowledge, thereby enriching the database information. For incorrectly identified vulnerability descriptions, the correct component name and version information are determined on the human-computer interaction interface, extraction rules are added, and the similarity threshold is optimized to enhance the dynamic learning ability of machine vulnerability scanning, forming a closed loop. The above process conforms to the proposed human-machine collaborative framework.

[0038]

[0039] In further other embodiments, such as Figure 1 As shown, this embodiment provides a method for discovering known vulnerabilities in human-machine collaborative components, including the following steps:

[0040] Step S1: Construct a vulnerability knowledge base. In this embodiment, the vulnerability knowledge base exists in the form of a knowledge graph, mainly including vulnerability information CVE, defect information CWE that leads to the vulnerability, and software general enumeration CPE.

[0041] Step S2: Use automated tools to obtain the software bill of materials and input it into the system;

[0042] Step S3: After normalizing the software bill of materials, parse it, merge similar items, and extract key information: component name and component version number. Generate a general platform enumeration item based on the name and version number. For example, the CPE for alsa-utils version 0.6.4 is: cpe:2.3:*:*:alsa-utils:0.6.4:*:*:*:*:*:*:*;

[0043] Step S4: Search for known vulnerabilities using the vulnerability knowledge base. First, verify the existence of the CPE in the knowledge base. If the CPE exists, query known vulnerabilities based on the CPE information to complete the discovery of known vulnerabilities for a component in the bill of materials. If the CPE does not exist, the first external system determines whether the CPE's absence is due to a machine parsing error or a genuine non-existence of the CPE. Known vulnerabilities in the component need to be identified and discovered through vulnerability descriptions.

[0044] If the component parsing error is due to the component parsing model, the first external system identifies the component name and version and feeds the result back to the machine parsing model as a data sample for training the reinforcement learning model. After obtaining the correct component information and generating a CPE, the system queries the knowledge base to obtain the known vulnerability scanning results, completing the known vulnerability discovery for a component in the bill of materials. If the CPE still does not exist, it indicates that the component does not have a CPE, and the process automatically jumps to the process of discovering known vulnerabilities of the component based on the vulnerability description.

[0045] When a component lacks a CPE, known vulnerability discovery is performed through vulnerability description identification. A natural language processing model analyzes vulnerability descriptions in a knowledge base, identifying the parts of speech and dependency relationships of words. Based on predefined rules and a similarity algorithm, vulnerability descriptions matching the component under test are identified. The query results are returned, and a second external system verifies the accuracy of the vulnerability found. If correct, the discovery of known vulnerabilities for a component in the bill of materials is completed. The vulnerability information and associated component information are added to the knowledge base as nodes and relationships, enhancing its capabilities. Results will be automatically output on subsequent scans. If incorrect, such as the machine misclassifying different components as the same (e.g., alsa-utils and alsa-lib), the similarity threshold needs further optimization, which is performed via an interactive interface. If the machine incorrectly identifies a condition that does not conform to the component under test as conforming to the component under test, for example, incorrectly identifying "alsa-utils version through 1.0 has vulnerability" as conforming to the component under test alsa-utils-1.1.tar, it indicates that the version conformity judgment rule needs to be optimized. You can assist the machine in generating new matching rules by selecting keywords through the interactive interface to enhance feedback.

[0046] Ultimately, a relatively complex vulnerability discovery task, guided by the human-machine collaborative framework conceived in this invention, can be broken down and integrated into a business process that allows more non-specialists to participate, achieving the goal of improved efficiency and shaping each other's capabilities in the process, realizing the parallel growth of wisdom and intelligence. For example, using traditional methods, non-specialists cannot participate due to the need for strong vulnerability background knowledge; a professional might spend 1 minute finding a known vulnerability in a component, and a bill of materials for 500 components would take 500 minutes. Using the human-machine collaborative method, people in the external system can participate in the discovery process, leveraging their cognitive and decision-making abilities. The requirement for vulnerability background knowledge is significantly reduced, allowing the discovery task to be broken down among multiple non-specialists. Distributing a 500-minute discovery task to 10 people reduces the task execution time to 50 minutes.

[0047] It should be noted that, within the scope of protection defined in the claims of this invention, the following embodiments can be combined and / or extended or replaced in any logical manner from the above specific embodiments, such as the disclosed technical principles, disclosed technical features or implicitly disclosed technical features.

[0048] Example 1

[0049] A method for discovering known vulnerabilities in components based on human-machine collaboration includes the following steps:

[0050] S1, Construct a vulnerability knowledge base, which includes a common platform enumeration item CPE;

[0051] S2, Obtain the software bill of materials;

[0052] S3 processes the acquired software bill of materials, extracts key information, and generates general platform enumeration items based on the key information.

[0053] S4. Combine the vulnerability knowledge base to search for known vulnerabilities. First, verify whether the CPE exists in the vulnerability knowledge base. If the CPE exists, query known vulnerabilities based on the CPE information to complete the discovery of known vulnerabilities for a component in the bill of materials.

[0054] If the CPE does not exist, the first external system will determine whether the CPE does not exist due to a machine parsing error or because the CPE does not actually exist.

[0055] If the component parsing error is caused by the component parsing model, the first external system will identify the component name and version and feed the result back to the machine parsing model as a data sample for training the reinforcement learning model. After obtaining the correct component information and generating the CPE, the known vulnerability scanning results will be obtained through the knowledge base query to complete the known vulnerability mining of a component in the bill of materials. If the CPE still does not exist, it means that the component does not have a CPE, and the process will jump to the process of mining known vulnerabilities of the component through vulnerability description.

[0056] When a component lacks a CPE, known vulnerability discovery is performed through vulnerability description identification. A natural language processing model analyzes vulnerability descriptions in the knowledge base, identifying the part-of-speech tags and dependency relationships of words. Based on predefined rules and a similarity discrimination algorithm, vulnerability descriptions matching the component under test are identified. The query results are returned, and a second external system determines whether the vulnerabilities found by this method are correct. If correct, the known vulnerability discovery for a component in the bill of materials is completed, and the vulnerability information and associated component information are added to the knowledge base in the form of nodes and relationships, thereby enhancing the knowledge base's capabilities. The results will be automatically output on the next scan. If incorrect, such as the machine misclassifying different components as the same component, the similarity threshold needs further optimization, and the threshold is corrected through the interactive interface. If the machine incorrectly identifies a situation that does not match the component under test as matching, the version conformity judgment rule needs optimization, and keywords are selected through the interactive interface to assist the machine in generating new matching rules, achieving enhanced feedback.

[0057] Example 2

[0058] Based on Example 1, in step S1, the vulnerability knowledge base also includes vulnerability information CVE and defect information CWE that cause the vulnerability.

[0059] Example 3

[0060] Based on Example 1, in step S1, the vulnerability knowledge base exists in the form of a knowledge graph.

[0061] Example 4

[0062] Based on Example 1, in step S2, obtaining the software bill of materials specifically includes: using automated tools to obtain the software bill of materials and inputting it into the system.

[0063] Example 5

[0064] Based on Example 1, in step S3, the processing of the obtained software bill of materials specifically includes normalizing the obtained software bill of materials and then parsing it, and merging similar items.

[0065] Example 6

[0066] Based on Example 1, in step S3, the key information includes the component name.

[0067] Example 7

[0068] Based on Example 6, in step S3, the key information includes a version number.

[0069] Example 8

[0070] Based on Example 1, the first external system includes an existing CPE determination system.

[0071] Example 9

[0072] Based on Example 1, the second external system includes an existing vulnerability detection and determination system.

[0073] Example 10

[0074] A component known vulnerability discovery device based on human-machine collaboration includes a processor and a memory, wherein the memory stores a computer program, and when the computer program is loaded by the processor, it executes the method described in any one of Embodiments 1 to 9.

[0075] According to one aspect of the present invention, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and executes the computer instructions, causing the computer device to perform the methods provided in the various optional implementations described above.

[0076] In another aspect, embodiments of the present invention also provide a computer-readable medium, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device. The computer-readable medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to perform the methods described in the above embodiments.

[0077] All parts not covered in this invention are the same as or can be implemented using existing technologies.

[0078] In addition to the examples above, other embodiments may be obtained by those skilled in the art based on the above disclosure or by making modifications using knowledge or technology in related fields. The features of each embodiment may be interchanged or replaced. Modifications and changes made by those skilled in the art that do not depart from the spirit and scope of the present invention should be within the protection scope of the appended claims.

Claims

1. A method for discovering known vulnerabilities in components based on human-machine collaboration, characterized in that, Includes the following steps: S1, Construct a vulnerability knowledge base, which includes a common platform enumeration item CPE; S2, obtain the software bill of materials; S3 processes the acquired software bill of materials, extracts key information, and generates general platform enumeration items based on the key information. S4. Combine the vulnerability knowledge base to search for known vulnerabilities. First, verify whether the CPE exists in the vulnerability knowledge base. If the CPE exists, query known vulnerabilities based on the CPE information to complete the discovery of known vulnerabilities for a component in the bill of materials. If the CPE does not exist, the first external system will determine whether the CPE does not exist due to a machine parsing error or because the CPE does not actually exist. If the component parsing error is caused by the component parsing model, the first external system will identify the component name and version and feed the result back to the machine parsing model as a data sample for training the reinforcement learning model. After obtaining the correct component information and generating the CPE, the system will query the knowledge base to obtain the known vulnerability scanning results and complete the known vulnerability mining of a component in the bill of materials. If the CPE still does not exist, it means that the component does not have a CPE. In the absence of a CPE in the component, known vulnerability discovery is carried out through vulnerability description identification. The vulnerability descriptions in the knowledge base are analyzed by natural language processing models, the parts of speech and dependency relationships of words are identified by identifying the text, and vulnerability descriptions that are consistent with the component under test are found according to predefined rules and similarity discrimination algorithms. The query results are returned, and a second external system determines whether the vulnerability found by this method is correct. If correct, complete the discovery of known vulnerabilities for a component in the bill of materials, and add the vulnerability information and related component information to the knowledge base in the form of nodes and relationships, thereby enhancing the capabilities of the knowledge base. The results will be automatically output during the next scan. If an error occurs and the machine mistakenly identifies different components as the same component, it indicates that the similarity threshold needs further optimization. In this case, the threshold can be corrected through the interactive interface. If the machine mistakenly identifies a situation that does not meet the requirements of the component under test as a component that does meet the requirements of the component under test, it indicates that the version conformity judgment rule needs optimization. In this case, the machine can be assisted in generating new matching rules by selecting keywords through the interactive interface, thereby enhancing feedback.

2. The method for discovering known vulnerabilities in components based on human-machine collaboration according to claim 1, characterized in that, In step S1, the vulnerability knowledge base also includes vulnerability information CVE and defect information CWE that cause the vulnerability.

3. The method for discovering known vulnerabilities in components based on human-machine collaboration according to claim 1, characterized in that, In step S1, the vulnerability knowledge base exists in the form of a knowledge graph.

4. The method for discovering known vulnerabilities in components based on human-machine collaboration according to claim 1, characterized in that, In step S2, obtaining the software bill of materials specifically includes: using automated tools to obtain the software bill of materials and inputting it into the system.

5. The method for discovering known vulnerabilities in components based on human-machine collaboration according to claim 1, characterized in that, In step S3, the processing of the obtained software bill of materials specifically includes normalizing the obtained software bill of materials, parsing it, and merging similar items.

6. The method for discovering known vulnerabilities in components based on human-machine collaboration according to claim 1, characterized in that, In step S3, the key information includes the component name.

7. The method for discovering known vulnerabilities in components based on human-machine collaboration according to claim 6, characterized in that, In step S3, the key information includes the version number.

8. The method for discovering known vulnerabilities in components based on human-machine collaboration according to claim 1, characterized in that, The first external system includes an existing CPE determination system.

9. The method for discovering known vulnerabilities in components based on human-machine collaboration according to claim 1, characterized in that, The second external system includes existing vulnerability detection and assessment systems.

10. A component known vulnerability discovery device based on human-machine collaboration, characterized in that, It includes a processor and a memory, wherein the memory stores a computer program that, when loaded by the processor, executes the method as described in any one of claims 1 to 9.

Images