A system vulnerability repair method and system based on big data

Abstract

The present application discloses a method and system for repairing system vulnerabilities based on big data, which relate to the field of data security. The method comprises: acquiring big data stream data in real time; adding preset vulnerability data into the big data stream data to form a vulnerability detection data stream, wherein the preset vulnerability data is data that can be detected in the existing security detection method, and a preset identification bit is set in the preset vulnerability data, and the preset vulnerability data has no damaging effect on the system when it is not safely detected; detecting the vulnerability detection data stream by using a detection server, and adopting the current system vulnerability detection algorithm to obtain a detection result; repairing the vulnerability based on the detection result to update the current system vulnerability detection algorithm of the detection server and the running server, wherein the running server is a server for data interaction when the system is running normally, and the detection server is a server corresponding to the system for upgrading the system vulnerability detection algorithm.

Description

Technical Field

[0001] This specification relates to the field of data security, and more specifically, this application relates to a system vulnerability repair method and system based on big data. Background Art

[0002] Typically, vulnerability scanning is performed by using a vulnerability scanner based on specific vulnerability detection algorithms. These algorithms are responsible for analyzing and determining whether there are security vulnerabilities in the system. In order to improve the security of the system, these vulnerability detection algorithms need to be continuously updated and optimized. However, with the rapid development of Internet technology and the surge in the amount of data processed by servers, traditional vulnerability scanning methods may be difficult to cope with new threats. In this case, some offensive data may break through the security line in a short period of time and attack the system. In order to solve this problem, it is necessary to propose a system vulnerability repair method based on big data technology. Summary of the invention

[0003] A series of simplified concepts are introduced in the Summary of the Invention section, which will be further described in detail in the Detailed Description of the Invention section. The Summary of the Invention section of this application does not mean to attempt to define the key features and essential technical features of the claimed technical solution, nor does it mean to attempt to determine the scope of protection of the claimed technical solution.

[0004] In the first aspect, the present application proposes a system vulnerability repair method based on big data, the method comprising:

[0005] Get big data stream data in real time;

[0006] Preset vulnerability data is added to the above-mentioned big data stream to form a vulnerability detection data stream, wherein the above-mentioned preset vulnerability data is data that can be detected by the existing security detection method, and a preset identification bit is set in the above-mentioned preset vulnerability data. The above-mentioned preset vulnerability data has no damaging effect on the system when it is not safely detected;

[0007] The detection server detects the above vulnerability detection data stream and uses the current system vulnerability detection algorithm to detect and obtain the detection result;

[0008] Vulnerabilities are repaired based on the above detection results to update the current system vulnerability detection algorithm of the above detection server and the operation server, wherein the above operation server is a server that interacts with data when the system is running normally, and the above detection server is a server corresponding to the system vulnerability detection algorithm upgrade.

[0009] In a feasible implementation manner, the above-mentioned big data stream data includes direct big data stream data and derived big data stream data;

[0010] The above real-time acquisition of large data stream data includes:

[0011] Real-time access to the above direct big data stream data based on IoT devices, public datasets, data sharing protocols, and social networking platforms;

[0012] Analyze the detection data flow composition information of the above direct big data flow;

[0013] Obtaining the operation data flow composition information of the above operation detection server;

[0014] Determine data composition ratio difference information according to the detection data stream composition information and the operation data stream composition information;

[0015] In the case where the above-mentioned ratio difference information is greater than the preset ratio difference information, the above-mentioned derivative big data stream data is generated by using a data mining algorithm based on the above-mentioned direct big data stream data and the above-mentioned ratio difference information.

[0016] In a feasible implementation manner, the above-mentioned analysis of the detection data stream composition information of the above-mentioned direct big data stream includes:

[0017] Performing preprocessing operations on the above direct big data stream to obtain identification data information;

[0018] The DBSCAN algorithm and Apriori algorithm are used to identify the data type information of the above-mentioned identification data information;

[0019] Using a time series decomposition method on the above identified data information to identify the time characteristic information of the data;

[0020] The detection data stream composition information is determined based on the data type information and the time feature information.

[0021] In a feasible implementation manner, the above-mentioned generating the above-mentioned derived big data stream data by using a data mining algorithm based on the above-mentioned direct big data stream data and the above-mentioned ratio difference information includes:

[0022] Determine the excavation depth information according to the above-mentioned ratio difference information;

[0023] The derived big data stream data is generated according to the mining depth information, the direct big data stream data and the data mining algorithm.

[0024] In a feasible implementation manner, the above-mentioned adding preset vulnerability data into the above-mentioned big data stream data to form a vulnerability detection data stream includes:

[0025] Obtain historical vulnerability data detected by the above-mentioned running server;

[0026] Determine the preset vulnerability data based on the historical vulnerability data;

[0027] Obtain the historical data traffic characteristics of the above-mentioned running server;

[0028] Determine the time node information to be incorporated based on the above historical data traffic characteristics;

[0029] According to the above-mentioned preset vulnerability data and the above-mentioned mixing time node information, the preset vulnerability data is mixed into the above-mentioned big data stream data to form a vulnerability detection data stream.

[0030] In a feasible implementation manner, determining the preset vulnerability data based on the historical vulnerability data includes:

[0031] Determine vulnerability distribution pattern information of the above historical vulnerability data;

[0032] The preset vulnerability data is determined based on the vulnerability distribution pattern information.

[0033] In a feasible implementation manner, determining the incorporation time node information based on the above historical data flow characteristics includes:

[0034] Analyze the above historical data flow characteristic information based on the autoregressive integrated moving average model to obtain historical data fluctuation information;

[0035] The nodes where the historical data fluctuation information is greater than a preset fluctuation amplitude and / or greater than a preset fluctuation frequency are determined as the above-mentioned inclusion time node information.

[0036] In a feasible implementation, the vulnerability repair based on the above detection result includes:

[0037] Obtain the detected preset identification position according to the above detection result;

[0038] Determine missing preset identification position information based on the inserted preset identification position and the detected preset identification position;

[0039] Determine the vulnerability hidden information based on the missing preset identification bit information;

[0040] Based on the above vulnerability hidden information, the vulnerability is repaired.

[0041] In a feasible implementation manner, the above-mentioned determining vulnerability information according to the above-mentioned missing preset identification bit information includes:

[0042] Determine the vulnerability type information corresponding to the missing identifier according to the missing preset identifier information;

[0043] Obtain the data flow regularity information corresponding to the missing preset identification bit information;

[0044] Based on the data flow regularity information and the vulnerability type information, the vulnerability hidden information is determined.

[0045] In the second aspect, the present application proposes a system vulnerability repair system based on big data, comprising:

[0046] An acquisition unit, used for acquiring large data stream data in real time;

[0047] An incorporation unit is used to incorporate preset vulnerability data into the above-mentioned big data stream data to form a vulnerability detection data stream, wherein the above-mentioned preset vulnerability data is data that can be detected by the existing security detection method, and a preset identification bit is set in the above-mentioned preset vulnerability data. The above-mentioned preset vulnerability data has no damaging effect on the system when it is not safely detected;

[0048] A detection unit, used to detect the vulnerability detection data stream through the detection server, and use the current system vulnerability detection algorithm to detect and obtain the detection result;

[0049] The repair unit is used to repair vulnerabilities based on the above detection results to update the current system vulnerability detection algorithm of the above detection server and the operation server, wherein the above operation server is a server for interacting with data when the system is running normally, and the above detection server is a server corresponding to the system used to upgrade the system vulnerability detection algorithm.

[0050] In summary, the system vulnerability repair method based on big data of the embodiment of the present application includes: obtaining big data stream data in real time; mixing preset vulnerability data into the above big data stream data to form a vulnerability detection data stream, wherein the above preset vulnerability data is data that can be detected in the existing security detection method, and the above preset vulnerability data is set with a preset identification bit, and the above preset vulnerability data has no damage effect on the system when it is not safely detected; the above vulnerability detection data stream is detected by the detection server, and the current system vulnerability detection algorithm is used to obtain the detection result; based on the above detection result, the vulnerability is repaired to update the current system vulnerability detection algorithm of the above detection server and the running server, wherein the above running server is a server for data interaction when the system is running normally, and the above detection server is a server corresponding to the system for upgrading the system vulnerability detection algorithm. A system vulnerability repair method based on big data proposed in the present application, this scheme obtains and processes a large amount of data streams in real time, and provides an environment for simulating attacks by mixing preset vulnerability data into the data stream to test and optimize the vulnerability detection algorithm. These preset vulnerability data have specific identification bits, so that the system can test and adjust the effect of the vulnerability detection algorithm without causing damage to the real operating environment. According to the vulnerability detection results, the system can automatically perform necessary algorithm updates and repairs. This adaptive update mechanism ensures that the vulnerability detection algorithm can be updated synchronously with new security threats, enhancing the security of the system. The vulnerability detection of this solution is performed on a dedicated detection server, which will not occupy the resources of the running server. During the upgrade process, the actual running server is upgraded at the same time, ensuring the synchronous upgrade of the security protection of the entire system. With the rapid development of Internet technology, the amount of data has increased sharply, and traditional vulnerability scanning technology may not be able to effectively process massive data. This solution uses big data technology to effectively manage and analyze large-scale data, and is more suitable for maintaining efficient security detection performance in current and future network environments. This method not only improves the efficiency and accuracy of vulnerability detection, but also provides more solid and advanced protection measures for network security through continuous vulnerability repair and algorithm optimization.

[0051] The system vulnerability repair method based on big data proposed in this application, and other advantages, objectives and features of this application will be reflected in part through the following description, and in part will also be understood by technical personnel in this field through research and practice of this application. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present specification. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0053] Figure 1 A schematic diagram of a process of repairing a system vulnerability based on big data provided in an embodiment of the present application;

[0054] Figure 2 A schematic diagram of the structure of a system vulnerability repair system based on big data provided in an embodiment of the present application. DETAILED DESCRIPTION

[0055] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices. The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments.

[0056] See also Figure 1 , which is a schematic diagram of a process of repairing a system vulnerability based on big data provided by an embodiment of the present application, and may specifically include:

[0057] S110. Acquire big data stream data in real time.

[0058] S120. Preset vulnerability data is added to the above-mentioned big data stream to form a vulnerability detection data stream, wherein the above-mentioned preset vulnerability data is data that can be detected by the existing security detection method, and a preset identification bit is set in the above-mentioned preset vulnerability data. The above-mentioned preset vulnerability data has no damaging effect on the system when it is not safely detected.

[0059] S130: Using the detection server to detect the vulnerability detection data stream, use the current system vulnerability detection algorithm to detect the vulnerability and obtain the detection result.

[0060] S140. Perform vulnerability repair based on the above detection results to update the current system vulnerability detection algorithm of the above detection server and the operation server, wherein the above operation server is a server that interacts with data when the system is running normally, and the above detection server is a server corresponding to the system vulnerability detection algorithm upgrade.

[0061] Exemplarily, the system collects and processes a large amount of data streams from various sources in real time. These data streams include but are not limited to network transaction data, user behavior data, application logs, etc., providing basic data for security analysis.

[0062] The system will intentionally add preset vulnerability data to the collected big data stream. These preset vulnerability data are known security vulnerability related data that can be identified by existing security detection methods. The preset vulnerability data contains specific identification bits for easy tracking and management. These data are designed to be harmless to the system and will not cause damage to the system even if they are not detected in time. This method can simulate potential security threats and help evaluate and optimize the efficiency of vulnerability detection systems.

[0063] The detection server will use the current system vulnerability detection algorithm to analyze the vulnerability detection data stream generated in the previous step. The purpose of this process is to determine whether the security system can effectively identify and respond to the inserted preset vulnerability data. The server's detection results will be used to evaluate the effectiveness of current security measures.

[0064] According to the detection results of step S130, if it is found that the existing vulnerability detection algorithm cannot effectively identify the preset vulnerability data, the system will perform necessary algorithm updates and repairs. This step ensures that the detection algorithm can adapt to new threats and vulnerabilities in a timely manner. Vulnerability repair is not only applied to the detection server, but also to other operating servers of the system, which are responsible for processing data interactions during normal operation.

[0065] In summary, the present application proposes a method for repairing system vulnerabilities based on big data. The present solution obtains and processes a large amount of data streams in real time, and provides an environment for simulating attacks by incorporating preset vulnerability data into the data stream to test and optimize the vulnerability detection algorithm. These preset vulnerability data carry specific identification bits, so that the system can test and adjust the effect of the vulnerability detection algorithm without causing damage to the real operating environment. According to the vulnerability detection results, the system can automatically perform necessary algorithm updates and repairs. This adaptive update mechanism ensures that the vulnerability detection algorithm can be updated synchronously with new security threats, thereby enhancing the security of the system. The vulnerability detection of the present solution is performed on a dedicated detection server, which will not occupy the resources of the running server. During the upgrade process, the actual running server is upgraded at the same time, ensuring that the security protection of the entire system is upgraded synchronously. With the rapid development of Internet technology, the amount of data has surged, and traditional vulnerability scanning technology may not be able to effectively process massive data. The present solution uses big data technology to effectively manage and analyze large-scale data, and is more suitable for maintaining efficient security detection performance in current and future network environments. This method not only improves the efficiency and accuracy of vulnerability detection, but also provides more solid and advanced protection measures for network security through continuous vulnerability repair and algorithm optimization.

[0066] In some examples, the big data stream data includes direct big data stream data and derived big data stream data;

[0067] The above real-time acquisition of large data stream data includes:

[0068] The above direct big data stream data is obtained in real time based on IoT devices, public datasets, data sharing protocols and social network platforms.

[0069] Analyze the detection data stream composition information of the above direct large data stream.

[0070] Obtain the operation data stream composition information of the above operation detection server.

[0071] According to the above detection data stream composition information and the above operation data stream composition information, the data composition ratio difference information is determined.

[0072] In the case where the above-mentioned ratio difference information is greater than the preset ratio difference information, the above-mentioned derivative big data stream data is generated by using a data mining algorithm based on the above-mentioned direct big data stream data and the above-mentioned ratio difference information.

[0073] Exemplarily, big data streams from various direct sources are acquired in real time. These data come from Internet of Things (IoT) devices, public data sets, sources that follow specific data sharing protocols, or social network platforms. Direct big data streams are raw data without any derivative processing, reflecting the immediate status of each data source.

[0074] The system will analyze the composition information of the data stream obtained from the direct data source. This includes data type, data volume, data update frequency, etc., aiming to have a comprehensive understanding of the received data.

[0075] The data stream composition information of the running detection server is collected, and the data stream composition information of the detection server reflects the data type and structure being processed by the detection server.

[0076] Based on the composition information of the two data streams, determine the difference in ratio between the two and detect whether there are anomalies or deviations, such as excess or deficiency of certain data types.

[0077] If the above ratio difference information exceeds the preset threshold, the system will start the data mining algorithm to generate derivative big data stream data based on the data of the direct big data stream and the ratio difference information. These derivative data are created through the data mining and analysis process, and the data input to the detection server is adjusted through the derivative data to ensure that the composition information of the data detected by the detection server is kept at a consistent level with the composition information of the data running the detection server.

[0078] In summary, the method proposed in the embodiment of the present application, by identifying the proportional differences in data composition and generating derivative data when the proportional difference information exceeds a preset threshold, can ensure that the composition information of the data detected by the detection server is consistent with the data composition information of the running detection server, which helps to simulate the processing conditions of the running server in the detection server. At the same time, since the detection server is public data, the data in the running server will not be leaked, thereby improving the security and privacy of vulnerability detection.

[0079] In some examples, the analyzing the detection data stream composition information of the direct big data stream includes:

[0080] The above direct big data stream is preprocessed to obtain identification data information.

[0081] The DBSCAN algorithm and Apriori algorithm are used to identify the data type information of the above-mentioned identification data information.

[0082] The time series decomposition method is used for the above-mentioned identification data information to identify the time characteristic information of the data.

[0083] The detection data stream composition information is determined based on the data type information and the time feature information.

[0084] Exemplarily, the collected direct big data stream is first preprocessed. The purpose of preprocessing is to simplify the subsequent data analysis steps, through operations such as cleaning (removing errors and duplicate data), standardization (converting data into a consistent format) and normalization (making data more consistent) to obtain more easily analyzed identification data information. Preprocessing is a routine step in data analysis, which helps to improve data quality and analysis efficiency.

[0085] Next, two algorithms are used to identify the type information of the data:

[0086] The DBSCAN algorithm is a density-based spatial clustering algorithm used to identify clusters in a data set, especially in noisy data environments. DBSCAN can effectively group data points into multiple categories, helping to identify groups of data points with similar attributes.

[0087] The Apriori algorithm is an algorithm for learning association rules, mainly used to discover frequent item sets in data. Through the Apriori algorithm, the system can identify data items that often appear together, which helps to understand the relationship and pattern between different data types.

[0088] Time series decomposition is further used to identify the temporal characteristics of the data. Time series decomposition is an analytical method that decomposes time series data into trend, seasonal, and random components to more clearly understand the behavior of data over time.

[0089] Finally, based on the data type information obtained through the DBSCAN and Apriori algorithms and the time feature information obtained through time series decomposition, the system determines the composition information of the detection data stream.

[0090] In summary, the embodiment of the present application uses this method of comprehensive application of different data analysis technologies, so that the system can more deeply understand and utilize the information in the big data stream, thereby improving the accuracy and efficiency of data processing and analysis. This strategy helps to improve the quality of data-driven decision-making and enhance the ability to respond to data stream dynamics.

[0091] In some examples, the generating the derived big data stream data using a data mining algorithm based on the direct big data stream data and the ratio difference information includes:

[0092] The excavation depth information is determined based on the above-mentioned ratio difference information.

[0093] The derived big data stream data is generated according to the mining depth information, the direct big data stream data and the data mining algorithm.

[0094] Exemplarily, the system determines the depth of data mining based on the ratio difference information. The ratio difference information refers to the difference between the information composition information between the direct big data stream and the running detection server, reflecting the mismatch between the type and amount of data. The mining depth is set based on these ratio differences in order to adjust the accuracy and scope of data mining. For example, if the ratio difference information shows that there is too much or too little of a certain type of data, the mining depth will be adjusted to analyze these specific types of data more deeply to discover potential patterns or anomalies.

[0095] After determining the mining depth information, the selected data mining algorithm is used to process the direct big data stream, including but not limited to applying statistical analysis, machine learning or other data mining techniques to extract valuable information and generate derivative data to make up for the difference between the data stream composition information between the direct big data stream and the running detection server through the derivative data, so that the data entering the detection server is consistent with the data composition information of the data in the running server.

[0096] In some examples, the step of adding preset vulnerability data to the big data stream to form a vulnerability detection data stream includes:

[0097] Obtain the historical vulnerability data detected by the above running server.

[0098] The preset vulnerability data is determined based on the historical vulnerability data.

[0099] Get the historical data traffic characteristics of the above running servers.

[0100] The time node information is determined based on the above historical data traffic characteristics.

[0101] According to the above-mentioned preset vulnerability data and the above-mentioned mixing time node information, the preset vulnerability data is mixed into the above-mentioned big data stream data to form a vulnerability detection data stream.

[0102] For example, the historical vulnerability data detected is extracted from the running server. This data includes the types of vulnerabilities previously discovered, the specific circumstances in which the vulnerabilities were exploited, and the effects of vulnerability repairs. By analyzing this historical data, the system can understand which vulnerabilities have affected the system, as well as their characteristics and impacts.

[0103] Based on the historical vulnerability data obtained through analysis, the system designs corresponding preset vulnerability data. These data simulate real security vulnerabilities, but are designed not to cause actual damage to the system. The preset vulnerability data includes specific vulnerability characteristics and behaviors, and the purpose is to test the system's detection capabilities and response measures.

[0104] The system further analyzes the historical data flow characteristics of the running server, including the size, frequency, fluctuation, etc. of the data flow, and determines the typical behavior and possible abnormal points of the data flow in normal operation.

[0105] According to the traffic characteristics of historical data, the system determines the best time node to incorporate the preset vulnerability data. That is, the time point corresponding to the traffic characteristics corresponding to the vulnerability of the running server is selected as the time node information for incorporation.

[0106] According to the preset vulnerability data and the time node information, these vulnerability data are mixed into the big data stream. The vulnerability detection data stream formed in this way is used to actually test the vulnerability detection algorithm and response mechanism of the system.

[0107] In summary, the method proposed in this application can simulate real security threats in a controlled environment and effectively test and improve the security protection capabilities of the system. This method not only helps the security team understand potential security risks, but also verifies and optimizes vulnerability detection algorithms and repair strategies through actual testing.

[0108] In some examples, determining the preset vulnerability data based on the historical vulnerability data includes:

[0109] Determine the vulnerability distribution pattern information of the above historical vulnerability data.

[0110] The preset vulnerability data is determined based on the vulnerability distribution pattern information.

[0111] For example, historical vulnerability data is analyzed to identify the patterns and frequencies of vulnerability occurrences. This includes the type of vulnerability, the environments in which it often occurs, the conditions under which the vulnerability is exploited, etc. Using the identified regular information, simulated vulnerability data is designed. This data simulates the behavior of real vulnerabilities, but is constructed so that it does not cause actual harm to the system during testing. Accurately simulate and test the system's detection capabilities and response strategies for known vulnerability types.

[0112] In some examples, determining to incorporate time node information based on the above historical data traffic characteristics includes:

[0113] The above historical data traffic characteristic information is analyzed based on the autoregressive integrated moving average model to obtain historical data fluctuation information.

[0114] The nodes where the historical data fluctuation information is greater than a preset fluctuation amplitude and / or greater than a preset fluctuation frequency are determined as the above-mentioned inclusion time node information.

[0115] For example, the ARIMA model is used to analyze historical data flow, obtain data fluctuation patterns, and identify the fluctuation amplitude and frequency of data flow. The time node when the data fluctuation exceeds the preset amplitude or frequency is determined as the best time to insert the preset vulnerability data into the data flow. The system's responsiveness is tested at the moment when the data flow is most dynamic, while avoiding unnecessary interference when the data is stable.

[0116] In some examples, the vulnerability repair based on the above detection results includes:

[0117] The detected preset identification position is obtained according to the above detection results.

[0118] Based on the inserted preset identification bit and the detected preset identification bit, the missing preset identification bit information is determined.

[0119] Determine the vulnerability hidden information based on the above missing preset identification bit information.

[0120] Based on the above vulnerability hidden information, the vulnerability is repaired.

[0121] Exemplarily, the preset identification bits detected in the vulnerability detection data stream are analyzed. The preset identification bits are specific marks intentionally set in the data stream to simulate and identify potential security vulnerabilities. The detection of these identification bits can reflect the system's ability to identify vulnerabilities.

[0122] Compare the originally inserted preset markers with the actually detected markers to find out which preset markers were not recognized by the system, that is, the markers that the vulnerability detection system failed to detect. The missing marker information points to the possible blind spots or weaknesses of the detection system.

[0123] Based on the undetected preset identification bits, the system further analyzes the types and characteristics of the security vulnerabilities represented by these identification bits and their possible hidden causes.

[0124] Finally, using the vulnerability hidden information collected above, the system takes necessary repair measures. This may include updating or optimizing vulnerability detection algorithms, enhancing the system's security configuration, or modifying the system's response strategy to better identify and defend against undetected vulnerability types.

[0125] This approach ensures that the system not only identifies currently known vulnerabilities, but also improves its defense capabilities against new or more complex vulnerabilities through continuous testing and updates. This is a dynamic process designed to adapt the security system to the ever-changing threat environment and continuously improve its security performance.

[0126] In some examples, determining vulnerability information based on the missing preset identification bit information includes:

[0127] Determine the vulnerability type information corresponding to the missing identifier based on the missing preset identifier information.

[0128] Obtain the data flow regularity information corresponding to the above-mentioned missing preset identification bit information.

[0129] Based on the data flow regularity information and the vulnerability type information, the vulnerability hidden information is determined.

[0130] Exemplarily, the specific vulnerability types represented by these identifiers are analyzed and determined based on the undetected preset identifier information. Each preset identifier is associated with a specific vulnerability type, such as SQL injection, cross-site scripting (XSS), buffer overflow, etc.

[0131] Next, analyze the behavior and patterns of the data stream associated with the undetected vulnerability flag. This includes analyzing the size, frequency, fluctuation pattern and other characteristics of the data stream. The purpose of this step is to find specific behaviors or anomalies in the data stream that may affect vulnerability detection. These characteristics are the reasons why the vulnerability was not detected.

[0132] Finally, by combining the data flow patterns and the identified vulnerability type information, the system will infer why the vulnerability is hidden and undetected, revealing the relationship between specific data flow behaviors and vulnerability characteristics. For example, some vulnerabilities may be more difficult to detect when the data volume is large or the data is updated frequently.

[0133] In summary, through this systematic analysis method, the weaknesses of the vulnerability detection system can be identified, allowing the security team to make targeted improvements and repairs. This includes adjusting the vulnerability detection algorithm, improving the data monitoring mechanism, or enhancing the detection capabilities of specific types of vulnerabilities to improve system security.

[0134] See also Figure 2 , a system vulnerability repair system based on big data provided by an embodiment of the present application, comprising:

[0135] The acquisition unit 21 is used to acquire large data stream data in real time.

[0136] The incorporation unit 22 is used to incorporate preset vulnerability data into the above-mentioned big data stream data to form a vulnerability detection data stream, wherein the above-mentioned preset vulnerability data is data that can be detected in the existing security detection method, and a preset identification bit is set in the above-mentioned preset vulnerability data. When the above-mentioned preset vulnerability data is not safely detected 23, it has no damaging effect on the system.

[0137] The detection unit 24 is used to detect the vulnerability detection data stream through the detection server and adopt the current system vulnerability detection algorithm to detect and obtain the detection result.

[0138] The repair unit is used to repair vulnerabilities based on the above detection results to update the current system vulnerability detection algorithm of the above detection server and the operation server, wherein the above operation server is a server for interacting with data when the system is running normally, and the above detection server is a server corresponding to the system used to upgrade the system vulnerability detection algorithm.

[0139] It should be noted that in the above embodiments, the description of each embodiment has its own emphasis, and for parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0140] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0141] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded computer, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0142] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0143] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0144] An embodiment of the present application also provides a computer program product, which includes computer software instructions. When the computer software instructions are executed on a processing device, the processing device executes the process of predicting the decomposition rate in alumina production in the corresponding embodiment.

[0145] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, a computer, a server or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can store or a data storage device such as a server or a data center that includes one or more available media integration. Available media can be magnetic media, (e.g., floppy disk, hard disk, tape), optical media (e.g., DVD), or semiconductor media (e.g., solid state disk (solid state disk, SSD)), etc.

[0146] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0147] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0148] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0149] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0150] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), disk or optical disk and other media that can store program codes.

[0151] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A system vulnerability repair method based on big data, characterized in that: include: Get big data stream data in real time; Adding preset vulnerability data to the big data stream to form a vulnerability detection data stream, wherein the preset vulnerability data is data that can be detected by an existing security detection method, a preset identification bit is set in the preset vulnerability data, and the preset vulnerability data has no damaging effect on the system when it is not safely detected; The vulnerability detection data stream is detected by the detection server, and the current system vulnerability detection algorithm is used to detect the vulnerability to obtain the detection result; Perform vulnerability repair based on the detection result to update the current system vulnerability detection algorithm of the detection server and the operation server, wherein the operation server is a server for data interaction when the system is running normally, and the detection server is a server corresponding to the system vulnerability detection algorithm upgrade; The big data stream data includes direct big data stream data and derived big data stream data; The real-time acquisition of large data stream data includes: Real-time acquisition of said direct big data stream data based on IoT devices, public data sets, data sharing protocols and social networking platforms; Analyzing the detection data stream composition information of the direct big data stream; Obtaining operation data flow composition information of the operation server; Determining data composition ratio difference information according to the detection data stream composition information and the operation data stream composition information; In the case where the ratio difference information is greater than the preset ratio difference information, the derived big data stream data is generated by using a data mining algorithm based on the direct big data stream data and the ratio difference information.

2. The system vulnerability repair method based on big data according to claim 1 is characterized in that: The analyzing the detection data stream composition information of the direct big data stream includes: Performing a preprocessing operation on the direct big data stream to obtain identification data information; The DBSCAN algorithm and the Apriori algorithm are used to identify the data type information of the identified data information; Using a time series decomposition method on the identified data information to identify the time characteristic information of the data; The detected data stream composition information is determined based on the data type information and the time characteristic information.

3. The system vulnerability repair method based on big data according to claim 1 is characterized in that: The generating the derived big data stream data by using a data mining algorithm based on the direct big data stream data and the ratio difference information includes: Determine excavation depth information according to the ratio difference information; The derived big data stream data is generated according to the mining depth information, the direct big data stream data and a data mining algorithm.

4. The system vulnerability repair method based on big data according to claim 1 is characterized in that: The step of adding preset vulnerability data to the large data stream to form a vulnerability detection data stream includes: Obtaining historical vulnerability data detected by the running server; Determining the preset vulnerability data based on the historical vulnerability data; Obtaining historical data flow characteristics of the running server; Determine the incorporation time node information based on the historical data flow characteristics; According to the preset vulnerability data and the incorporation time node information, the preset vulnerability data is incorporated into the big data stream data to form a vulnerability detection data stream.

5. The system vulnerability repair method based on big data according to claim 4 is characterized in that: The determining the preset vulnerability data based on the historical vulnerability data includes: Determine vulnerability distribution pattern information of the historical vulnerability data; The preset vulnerability data is determined based on the vulnerability distribution regularity information.

6. The system vulnerability repair method based on big data according to claim 4 is characterized in that: Determining the incorporation time node information based on the historical data flow characteristics includes: Analyze the historical data flow characteristic information based on an autoregressive integrated moving average model to obtain historical data fluctuation information; The nodes where the historical data fluctuation information is greater than a preset fluctuation amplitude and / or greater than a preset fluctuation frequency are determined as the incorporated time node information.

7. The system vulnerability repair method based on big data according to claim 1 is characterized in that: The performing vulnerability repair based on the detection result includes: Acquire the detected preset identification position according to the detection result; Determining missing preset identification bit information based on the inserted preset identification bit and the detected preset identification bit; Determine vulnerability hidden information according to the missing preset identification bit information; The vulnerability is repaired based on the vulnerability hidden information.

8. The system vulnerability repair method based on big data according to claim 7 is characterized in that: The determining vulnerability information according to the missing preset identification bit information includes: Determine the vulnerability type information corresponding to the missing identifier according to the missing preset identifier information; Obtaining data flow regularity information corresponding to the missing preset identification bit information; Based on the data flow regularity information and the vulnerability type information, the vulnerability hiding information is determined.

9. A system vulnerability repair system based on big data, characterized in that: include: An acquisition unit, used for acquiring large data stream data in real time; An incorporation unit is used to incorporate preset vulnerability data into the large data stream to form a vulnerability detection data stream, wherein the preset vulnerability data is data that can be detected by an existing security detection method, a preset identification bit is set in the preset vulnerability data, and the preset vulnerability data has no damaging effect on the system when it is not safely detected; A detection unit, configured to detect the vulnerability detection data stream through a detection server and adopt a current system vulnerability detection algorithm to detect the vulnerability and obtain a detection result; A repair unit, configured to repair vulnerabilities based on the detection results, so as to update the current system vulnerability detection algorithms of the detection server and the operation server, wherein the operation server is a server for data exchange during the normal operation of the system, and the detection server is a server corresponding to the system vulnerability detection algorithm upgrade; The big data stream data includes direct big data stream data and derived big data stream data; The real-time acquisition of large data stream data includes: Real-time acquisition of said direct big data stream data based on IoT devices, public data sets, data sharing protocols and social networking platforms; Analyzing the detection data stream composition information of the direct big data stream; Obtaining operation data flow composition information of the operation server; Determining data composition ratio difference information according to the detection data stream composition information and the operation data stream composition information; In the case where the ratio difference information is greater than the preset ratio difference information, the derived big data stream data is generated by using a data mining algorithm based on the direct big data stream data and the ratio difference information.

Images