Vulnerability classification method and device for unbalanced sample distribution and computer equipment

Abstract

The present application belongs to the field of data security, and relates to a vulnerability classification method and device for unbalanced sample distribution and computer equipment; the method comprises the following steps: obtaining a vulnerability classification data set, and selecting a vulnerability category with a small number of samples from the vulnerability classification data set to construct a small-sample vulnerability classification data set; inputting a vulnerability description of the small-sample vulnerability classification data set into a vulnerability description generation model; inputting the generated vulnerability description into a classification module to screen the vulnerability description; adding the screened vulnerability description, a corresponding vulnerability risk level and a vulnerability category thereof into the vulnerability classification data set as new samples to obtain a vulnerability classification enhanced data set; taking the vulnerability risk level as an external feature, fusing the external feature with a vulnerability description feature to represent, constructing and training a vulnerability description classification model, and applying the trained model to vulnerability classification; and the present application solves the problem of unbalanced sample distribution existing in a security vulnerability classification data set, and enables the model to better learn the differences between different categories of vulnerabilities.

Description

Technical Field

[0001] This invention belongs to the field of data security, specifically relating to a vulnerability classification method, apparatus, and computer equipment for imbalanced sample distribution. Background Technology

[0002] Clearly classifying vulnerabilities is fundamental to vulnerability analysis and management. The purpose of vulnerability classification is to determine vulnerability categories using sample data from security vulnerability databases, thus completing the classification of sample data. However, security vulnerability databases suffer from significant sample distribution imbalance, which leads to low accuracy in classification models for vulnerabilities with limited sample data.

[0003] To address the imbalanced distribution of vulnerability samples, some researchers have employed synonym replacement or back-translation methods. These methods replace fewer samples with synonyms without altering the data structure, thereby increasing the sample size. However, a problem with these methods is that the similarity between the replaced fewer samples and the original data is too high, significantly increasing the overfitting of the classification model. Other researchers have improved the model's ability to extract semantic features from fewer samples by fusing external features, but these methods have limited applicability. Summary of the Invention

[0004] In view of this, to address the problem of overfitting in classification models caused by synonym substitution or back-translation methods, this invention proposes a vulnerability classification method, apparatus, and computer equipment for imbalanced sample distributions. By changing the sample data structure, a pre-trained model is used to generate fewer sample data, thereby reducing the probability of overfitting in the classification model. Simultaneously, to address the poor applicability of methods that fuse external features, this invention proposes a vulnerability classification model that fuses vulnerability risk levels. This model can capture the relationship between vulnerability risk levels and semantic features of sample data, thereby improving the model's applicability and its ability to extract semantic features from fewer sample data.

[0005] To achieve the above objectives, the present invention provides the following technical solution:

[0006] In a first aspect, the present invention provides a vulnerability classification method for imbalanced sample distributions, comprising the following steps:

[0007] S1: Obtain the vulnerability classification dataset, select the vulnerability categories with fewer samples, and construct a small-sample vulnerability classification dataset;

[0008] S2: Input the vulnerability descriptions from the few-sample vulnerability classification dataset into the vulnerability description generation model, and output the vulnerability descriptions generated for each category;

[0009] S3: Input the generated vulnerability description into the classification module. Based on the similarities and differences between the vulnerability category predicted by the classification module and its corresponding vulnerability category, filter the vulnerability descriptions to obtain the filtered vulnerability descriptions.

[0010] S4: Add the filtered vulnerability descriptions, their corresponding vulnerability risk levels, and their respective vulnerability categories as new samples to the vulnerability classification dataset to obtain the enhanced vulnerability classification dataset;

[0011] S5: The vulnerability risk level is used as an external feature and fused with the vulnerability description features to construct and train a vulnerability description classification model, and the trained model is applied to vulnerability classification.

[0012] In a second aspect, the present invention also provides a vulnerability classification apparatus for imbalanced sample distributions, the apparatus comprising:

[0013] The data acquisition module selects vulnerability categories with fewer samples from the vulnerability classification dataset to obtain a small-sample vulnerability classification dataset.

[0014] The data generation module takes the vulnerability descriptions from the few-sample vulnerability classification dataset as input into the generation model and outputs vulnerability descriptions generated for each category.

[0015] The data filtering module inputs the generated vulnerability descriptions into the classification module. Based on the similarities and differences between the vulnerability categories predicted by the classification module and their respective vulnerability categories, the vulnerability descriptions are filtered to obtain the filtered vulnerability descriptions.

[0016] The data augmentation module adds the filtered vulnerability descriptions, their corresponding vulnerability risk levels, and their respective vulnerability categories as new samples to the vulnerability classification dataset, resulting in an enhanced vulnerability classification dataset.

[0017] The data classification module uses the vulnerability risk level as an external feature, integrates it with the vulnerability description features, constructs and trains a vulnerability description classification model, and applies the trained model to vulnerability classification.

[0018] In a third aspect, the present invention also provides a computer device including a processor and a memory, the memory storing at least one computer program, the at least one computer program being loaded and executed by the processor to implement the vulnerability classification method for imbalanced sample distribution as described in the first aspect of the present invention.

[0019] The present invention has at least the following beneficial effects:

[0020] This invention addresses the problem of imbalanced sample distribution in vulnerability datasets by employing an oversampling method based on a generative model to generate vulnerability descriptions, thereby augmenting the training of the vulnerability description classification model. Furthermore, by filtering the generated vulnerability descriptions, the impact of low-quality descriptions on subsequent vulnerability classification tasks is reduced.

[0021] This invention integrates vulnerability risk level as an external feature with the textual features of vulnerability description, enabling the model to better learn the intrinsic relationship between the two, thereby more accurately capturing the differences in the characteristics of different types of vulnerabilities and improving the classification accuracy of the vulnerability description classification model. Attached Figure Description

[0022] Figure 1 This is a flowchart of a vulnerability classification method for imbalanced sample distribution disclosed in an embodiment of the present invention;

[0023] Figure 2 This is a training diagram of the generative model disclosed in an embodiment of the present invention;

[0024] Figure 3 This is a generated diagram of the generative model disclosed in an embodiment of the present invention;

[0025] Figure 4 This is a schematic diagram of the vulnerability screening model structure disclosed in an embodiment of the present invention;

[0026] Figure 5 This is a schematic diagram of the vulnerability classification model structure disclosed in an embodiment of the present invention. Detailed Implementation

[0027] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0028] like Figure 1 As shown, this invention provides a vulnerability classification method for imbalanced sample distributions, comprising the following steps:

[0029] S1: Obtain the vulnerability classification dataset, select the vulnerability categories with fewer samples, and construct a small-sample vulnerability classification dataset;

[0030] In this embodiment of the invention, step S1 may include the following steps:

[0031] S11: Obtain vulnerability description, vulnerability severity level, and vulnerability category from publicly available security vulnerability databases, and construct a vulnerability classification dataset, represented as follows: ,in Indicates the first One sample, express Vulnerability description, express The vulnerability risk level, express Vulnerability categories, Indicates the number of samples;

[0032] Optionally, the publicly available security vulnerability database can be a pre-established general-purpose security vulnerability database. This database pre-stores samples of security vulnerabilities, analyzes these samples to obtain relevant vulnerability information, for example, using honeypots to obtain application samples with vulnerabilities, and then using reverse engineering and other malicious code analysis techniques to obtain the relevant vulnerabilities. To ensure the integrity of the security vulnerability database and to make it universal, security vulnerabilities can be further collected from the network. Based on the security vulnerabilities collected from the network and the security vulnerabilities obtained from the analysis of application samples with vulnerabilities, a publicly available security vulnerability database can be established.

[0033] S12: Count the number of samples for each type of vulnerability, and construct a small-sample vulnerability classification dataset using the relatively smaller number of samples from each category. The construction process is as follows: First, iterate through the vulnerability classification dataset obtained in S11. Count the number of samples for each type of vulnerability, where the first... The number of samples of a vulnerability class is expressed as , This indicates the number of vulnerability categories. Then iterate through them. ,like If it is below a threshold, for example, the threshold could be 200, then the first... The vulnerability class is set as a few-sample vulnerability. After traversal, the set of few-sample vulnerability categories is obtained as follows: , Indicates the first A small number of vulnerability categories, This indicates the number of few-sample vulnerability categories. Iterate again. ,like Then Set to a small sample size. After traversal, a few-sample vulnerability classification dataset is obtained, represented as ,in Indicates the first A small sample size, express Vulnerability description, express The vulnerability risk level, express Vulnerability categories, This indicates a small sample size.

[0034] S2: Input the vulnerability descriptions from the few-sample vulnerability classification dataset into the vulnerability description generation model, and output the vulnerability descriptions generated for each category; in this embodiment of the invention, step S2 includes:

[0035] S21: Use the alignment module to align the vulnerability descriptions of the few-sample vulnerability classification dataset according to the first preset length; use the word vector model to vectorize the length-aligned vulnerability descriptions to obtain vulnerability description vectors;

[0036] In this embodiment of the invention, step S21 includes padding vulnerability descriptions shorter than a first preset length with null values ​​and truncating vulnerability descriptions longer than the first preset length. Specifically:

[0037] The few-sample vulnerability classification dataset obtained in S12 according to The proportion is divided into a training set and a generation set, and the training set is represented as follows: , The number of samples in the training set is represented as and the generated set is represented as . , This indicates the number of samples in the generated set; in this embodiment of the invention, the alignment module will use the data obtained from the few-sample vulnerability classification dataset. Vulnerability description Perform length alignment, The length is aligned according to the first preset length, which is represented as: Missing words Fill in the blanks, and truncate any that are too large.

[0038] In this embodiment of the invention, step S21 further includes using Aligned Convert to a vulnerability description vector.

[0039] This invention uses a word vector model Aligned Convert to a vulnerability description vector to obtain the first vulnerability in the generated set. The vulnerability description vector of each sample is represented as follows: , , This indicates the number of samples in the generated set. express The first in Each word vector. Traversal. Obtain the set of vulnerability description vectors, represented as .

[0040] S22: Use the prediction module to predict the next word vector of the vulnerability description vector to obtain the next predicted word vector of the vulnerability description vector;

[0041] In this embodiment of the invention, step S22 includes inputting the vulnerability description vector into a pre-trained model and outputting the extracted features; inputting the extracted features into an activation layer and outputting the next predicted word vector of the vulnerability description vector, specifically:

[0042] The prediction module of this invention uses a pre-trained model. Pre-trained model It can be used to predict the subsequent content of the vulnerability description vector, and generate new vulnerability descriptions by continuously predicting the subsequent content.

[0043] Similarly, the pre-trained model also needs to go through a training phase. Therefore, during the model training phase, the following steps are taken: Vulnerability description enter , Will Vectorization, the vulnerability description vector representation is as follows ,like Figure 2 As shown, then The front of the middle Word vectors enter , Output prediction of the first Each word vector is represented as... Finally, the negative log-likelihood loss function is used to calculate the difference between the predicted and true values ​​and to optimize the pre-trained model. , represented as ,in yes of - vector, express under conditions The predicted probabilities will be used after training, and this pre-trained model will be used for training. Complete the sample generation task.

[0044] S23: Using concatenation technology, the predicted word vectors in the vector are concatenated to generate a complete vulnerability description vector with a second preset length, which is the corresponding generated vulnerability description.

[0045] In this embodiment of the invention, step S23 includes sequentially concatenating the next predicted word vector output by the prediction module to the original vulnerability description vector. When the concatenated vulnerability description vector reaches a second preset length, it becomes the corresponding generated vulnerability description. Samples in the few-sample vulnerability classification dataset are processed according to the above method to obtain the generated vulnerability descriptions for each category.

[0046] During the generation phase, module alignment S21 is obtained. Vulnerability description ,enter Vectorized and fed into the prediction module, the prediction module continuously adjusts the vectorization... The next word is predicted to generate a new vulnerability description. The vulnerability description generation process is as follows: The vulnerability description vector set... The first in Vulnerability description vector of each sample Input pre-trained model, such as Figure 3 As shown, the model first... Feature extraction is performed, the extracted features are input into the activation layer for computation, and the output is... The next word vector is represented as Finally, the prediction module will Add to At the end, comparison The length of the generated vector is the same as the set length of the generated vector, which is also the second preset length. ,like Length less than Then the pre-trained model is used again to predict. The next word vector, if Length greater than or equal to The module outputs it as a generated vector, represented as Traversal This generates a set of vectors, along with the vulnerability category, vulnerability description, and... The same applies; the generated vector set is represented as , This indicates the number of samples in the generated set.

[0047] S3: Construct a vulnerability description filtering model. Input the generated vulnerability descriptions into the classification module. Based on the similarities and differences between the vulnerability categories predicted by the classification module and their respective vulnerability categories, filter the vulnerability descriptions to obtain the filtered vulnerability descriptions.

[0048] In this embodiment of the invention, the classification module in the screening model consists of three convolutional branches, one fully connected layer, and one activation function. To improve the model's ability to capture the relationships between word vectors and the contextual information of word vectors, the vectors are input into three convolutional branches with different kernel sizes.

[0049] In this embodiment of the invention, step S3 includes:

[0050] S31: Use three convolutional branches to extract features from the generated vulnerability description vector, use a softmax layer to process the extracted features, and predict the vulnerability probability under each vulnerability category.

[0051] S32: Take the vulnerability category with the highest probability as the predicted vulnerability category, compare the predicted vulnerability category with the vulnerability category to which the vulnerability description belongs. If they are the same, retain the generated vulnerability description; if they are different, remove the generated vulnerability description.

[0052] Similarly, the classification module also needs to be trained. During the training phase, the following methods are used: To train this module, first use Will Vectorization , This indicates the number of samples in the training set. After vectorization, it is represented as The vector dimension is * ,Will The input consists of three convolutional branches, with the first convolutional branch having a dimension of... It consists of a convolutional kernel of size 3 and a max-pooling layer of size 38; the second convolutional branch has a dimension of 1. It consists of a convolutional kernel of size 4 and a max-pooling layer of size 37; the third layer has a convolutional branch dimension of... It consists of a convolutional kernel of size 5 and a max-pooling layer of size 36. The dimension of the fully connected layer is determined by the number of vulnerability categories, ultimately resulting in a dimension of... A sequence of , denoted as , Indicates the number of vulnerability categories. Indicates the first The probability of this vulnerability occurring The final classification result is represented as , Finally, the model uses the cross-entropy loss function to calculate the difference between the classification result and the true value and optimizes it.

[0053] During the testing phase, such as Figure 4 As shown, The first in Generated vectors Input the data into this classification module for classification. The classification process is as follows: [The text abruptly ends here, likely due to an incomplete sentence or a formatting error.] Feature extraction is performed by inputting into three convolutional branches respectively, and then... Layer processing, ultimately obtaining , The final classification result is represented as , .Compare and ,like = Model Preservation , ,like Not equal to Model removal , Traversal Obtain the set of sample vectors for screening, denoted as , This indicates the number of samples generated after filtering.

[0054] S4: Add the filtered vulnerability descriptions, along with their corresponding vulnerability risk levels and vulnerability categories, as new samples to the vulnerability classification dataset to obtain the enhanced vulnerability classification dataset.

[0055] In this embodiment of the invention, using The obtained set of filter sample vectors Filtering sample vectors Convert to a screening sample. The conversion process is as follows: enter , according to - The method will Convert to the corresponding word and obtain The selected samples are represented as , The vulnerability category and corresponding vulnerability risk level are as follows: Maintain consistency. Iterate. To obtain the selected sample set, denoted as , Indicates the first Vulnerability descriptions for each selected sample. Indicates the first The vulnerability risk level of each screened sample. This indicates the number of samples generated after filtering.

[0056] In this embodiment of the invention, the sample data filtered in step S4 also needs to be fused according to the correspondence relationship. Compared with the vulnerability classification dataset in step S1 This yields an enhanced dataset for vulnerability classification. The fusion process is as follows: the filtered sample data... With the aforementioned vulnerability classification dataset according to correspond , correspond , correspond The pattern will spliced ​​to Finally, the vulnerability classification augmentation dataset is obtained, represented as = ,in Indicates the first Vulnerability description of an enhanced sample, Indicates the first The vulnerability risk level of each enhanced sample, Indicates the first Vulnerability categories of enhanced samples.

[0057] S5: The vulnerability severity level is used as an external feature and fused with vulnerability description features to construct and train a vulnerability description classification model. The trained model is then applied to vulnerability classification.

[0058] In this embodiment of the invention, the classification model consists of three convolutional branches, one fully connected layer, and one activation function. To improve the model's ability to capture the relationships and contextual information between word vectors, the kernel sizes in the three convolutional branches need to be different. The first convolutional branch has a dimension of... It consists of a convolutional kernel of size 3 and a max-pooling layer of size 38; the second convolutional branch has a dimension of 1. It consists of a convolutional kernel of size 4 and a max-pooling layer of size 37; the first layer's convolutional branch dimension is... It consists of a convolutional kernel of size 5 and a max-pooling layer of size 36. The dimension of the fully connected layer is determined by the number of vulnerability categories.

[0059] In this embodiment of the invention, step S5 involves constructing a vulnerability classification model, vectorizing the vulnerability description text and the vulnerability risk level respectively, aligning and concatenating them, inputting them into the vulnerability classification model, completing model training, and using the trained vulnerability classification model to complete the vulnerability classification task.

[0060] In this embodiment of the invention, step S5 includes:

[0061] S51: Use word vector model to vectorize the vulnerability descriptions in the vulnerability classification enhancement dataset to obtain enhanced vulnerability description vectors; use one-hot encoding to encode the vulnerability levels in the vulnerability classification enhancement dataset to obtain enhanced vulnerability level vectors.

[0062] S52: Check if the dimensions of the vulnerability description vector and the vulnerability level vector are consistent. If the dimensions do not match, pad the vector with the smaller dimension with zeros to ensure that the dimensions are the same. Then, use a concatenation technique to merge the two vectors into an enhanced vulnerability concatenation vector in a matrix concatenation manner;

[0063] S53: The enhanced vulnerability concatenation vector is input into the classification module for prediction processing. The classification module uses the trained model to analyze and judge the input vector, and finally outputs the predicted vulnerability category.

[0064] Similarly, this embodiment also requires training the classification model to augment the vulnerability classification dataset. The dataset is divided into a training set and a test set according to a certain ratio. The training set is represented as follows: The test set is represented as .

[0065] During the training phase of the vulnerability description classification model, the training set is used. Training the model. During the testing phase, the model will use the test set. The first in Vulnerability description of an enhanced sample With the Vulnerability risk level of each enhanced sample The vulnerability is vectorized, and the two vectors are concatenated using matrices. Finally, the concatenated vectors are used to complete the vulnerability classification task. The vulnerability classification process is as follows:

[0066] like Figure 5 As shown, the splicing technology used in this invention first uses... Will Vectorization, represented as The vector dimension is Then according to The encoding will Vectorization, represented as and use 0 to and Dimension alignment is performed, and then the two vectors are concatenated into a matrix. The concatenated vector is represented as follows: ; respectively The input consists of three convolutional branches for feature extraction, and then... Layer processing ultimately yields a dimension of The sequence is represented as , Indicates the number of vulnerability categories. Indicates the first The probability of this vulnerability occurring The final classification result is represented as . That is, determined by the model. Vulnerability categories.

[0067] It is understood that, in the preferred embodiment of the present invention, both the vulnerability screening model and the vulnerability classification model can be used as classification modules for vulnerability classification. In order to reduce the training time of the vulnerability classification model, the trained vulnerability screening model can be used as the initial model of the vulnerability classification model, and the parameters of the trained vulnerability screening model can be copied as initial parameters into the parameters of the vulnerability classification model. If there are uncorresponding parameters in the two models, they can be specified in a custom way. This method can reduce the computing resources required for model training and improve the efficiency of model training.

[0068] In a preferred embodiment of the present invention, the present invention also provides a vulnerability classification device for imbalanced sample distribution, the device comprising: a data acquisition module, which selects vulnerability categories with fewer samples from a vulnerability classification dataset to obtain a small sample vulnerability classification dataset;

[0069] The data generation module takes the vulnerability descriptions from the few-sample vulnerability classification dataset as input into the generation model and outputs vulnerability descriptions generated for each category.

[0070] The data filtering module inputs the generated vulnerability descriptions into the classification module. Based on the similarities and differences between the vulnerability categories predicted by the classification module and their respective vulnerability categories, the vulnerability descriptions are filtered to obtain the filtered vulnerability descriptions.

[0071] The data augmentation module adds the filtered vulnerability descriptions, their corresponding vulnerability risk levels, and their respective vulnerability categories as new samples to the vulnerability classification dataset, resulting in an enhanced vulnerability classification dataset.

[0072] The data classification module uses the vulnerability risk level as an external feature, integrates it with the vulnerability description features, constructs and trains a vulnerability description classification model, and applies the trained model to vulnerability classification.

[0073] In a third aspect, the present invention also provides a computer device including a processor and a memory, the memory storing at least one computer program, the at least one computer program being loaded and executed by the processor to implement the vulnerability classification method for imbalanced sample distribution as described in the first aspect of the present invention.

[0074] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, which may include ROM, RAM, disk, or optical disk, etc.

[0075] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A vulnerability classification method for imbalanced sample distributions, characterized in that, The method includes: S1: Obtain the vulnerability classification dataset, select the vulnerability categories with fewer samples, and construct a small-sample vulnerability classification dataset; S2: Input the vulnerability descriptions from the few-sample vulnerability classification dataset into the vulnerability description generation model, and output the vulnerability descriptions generated for each category; S3: Input the generated vulnerability description into the classification module. Based on the similarities and differences between the vulnerability category predicted by the classification module and its corresponding vulnerability category, filter the vulnerability descriptions to obtain the filtered vulnerability descriptions. S4: Add the filtered vulnerability descriptions, their corresponding vulnerability risk levels, and their respective vulnerability categories as new samples to the vulnerability classification dataset to obtain the enhanced vulnerability classification dataset; S5: The vulnerability risk level is used as an external feature and fused with the vulnerability description feature to construct and train a vulnerability description classification model, and the trained model is applied to vulnerability classification. Step S5 includes: S51: Use word vector model to vectorize the vulnerability descriptions in the vulnerability classification enhancement dataset to obtain enhanced vulnerability description vectors; use one-hot encoding to encode the vulnerability levels in the vulnerability classification enhancement dataset to obtain enhanced vulnerability level vectors. S52: Check whether the dimensions of the enhanced vulnerability description vector and the enhanced vulnerability hazard level are consistent. If the dimensions do not match, perform zero-padding on the vector with the smaller dimension to ensure that the two dimensions are the same. Use concatenation technology to merge the two vectors into an enhanced vulnerability concatenation vector in a matrix concatenation manner. S53: The enhanced vulnerability concatenation vector is input into the classification module for prediction processing. The classification module uses the trained model to analyze and judge the input vector, and finally outputs the predicted vulnerability category.

2. The vulnerability classification method for imbalanced sample distribution according to claim 1, characterized in that, Step S2 includes: S21: Use the alignment module to align the vulnerability descriptions of the few-sample vulnerability classification dataset according to the first preset length; use the word vector model to vectorize the length-aligned vulnerability descriptions to obtain vulnerability description vectors; S22: Use the prediction module to predict the next word vector of the vulnerability description vector to obtain the next predicted word vector of the vulnerability description vector; S23: Using concatenation technology, the predicted word vectors in the vector are concatenated to generate a complete vulnerability description vector with a second preset length, which is the corresponding generated vulnerability description.

3. The vulnerability classification method for imbalanced sample distribution according to claim 2, characterized in that, Step S23 includes sequentially concatenating the next predicted word vector output by the prediction module to the original vulnerability description vector. When the concatenated vulnerability description vector reaches the second preset length, it becomes the corresponding generated vulnerability description.

4. The vulnerability classification method for imbalanced sample distribution according to claim 1, characterized in that, Step S3 includes: S31: Use three convolutional branches to extract features from the generated vulnerability description vector, use a softmax layer to process the extracted features, and predict the vulnerability probability of each vulnerability category. S32: Take the vulnerability category with the highest vulnerability probability as the predicted vulnerability category, and compare it with the vulnerability category to which the generated vulnerability description belongs. If they are the same, retain the generated vulnerability description; if they are different, remove the generated vulnerability description.

5. A vulnerability classification device for imbalanced sample distribution, characterized in that, The apparatus for implementing the vulnerability classification method for imbalanced sample distribution as described in any one of claims 1 to 4, the apparatus comprising: The data acquisition module selects vulnerability categories with fewer samples from the vulnerability classification dataset to obtain a small-sample vulnerability classification dataset. The data generation module takes the vulnerability descriptions from the few-sample vulnerability classification dataset as input into the generation model and outputs vulnerability descriptions generated for each category. The data filtering module inputs the generated vulnerability descriptions into the classification module. Based on the similarities and differences between the vulnerability categories predicted by the classification module and their respective vulnerability categories, the vulnerability descriptions are filtered to obtain the filtered vulnerability descriptions. The data augmentation module adds the filtered vulnerability descriptions, their corresponding vulnerability risk levels, and their respective vulnerability categories as new samples to the vulnerability classification dataset, resulting in an enhanced vulnerability classification dataset. The data classification module uses the vulnerability risk level as an external feature, integrates it with the vulnerability description features, constructs and trains a vulnerability description classification model, and applies the trained model to vulnerability classification.

6. A computer device, characterized in that, The computer device includes a processor and a memory, the memory storing at least one computer program, which is loaded and executed by the processor to implement the vulnerability classification method for imbalanced sample distribution as described in any one of claims 1 to 4.

Images