Vulnerability management method and system based on adaptive architecture of host security platform

Abstract

The present application relates to the field of host security technology, and discloses a vulnerability management method and system based on an adaptive architecture of a host security platform. The method includes: collecting multi-dimensional data of the host through the host security platform, obtaining a multi-dimensional host data set and establishing a host security feature model to divide the security domain, and obtaining a host security management strategy; obtaining a local vulnerability data set and a cloud vulnerability data set and building a cloud-coordinated vulnerability knowledge base; scanning the host baseline data according to the host security management strategy, and building a corresponding attack graph; performing attack path risk calculation and vulnerability analysis on the attack graph, obtaining the host vulnerability analysis results and performing vulnerability verification and repair, and generating an initial vulnerability management strategy; tracking the vulnerability status, obtaining vulnerability security metrics and performing iterative optimization of the vulnerability management strategy, and obtaining the target vulnerability management strategy. The present application improves the vulnerability management efficiency and the overall security protection level of the host.

Description

Technical Field

[0001] The present application relates to the field of host security technology, and in particular to a vulnerability management method and system based on an adaptive architecture of a host security platform. Background Art

[0002] Traditional vulnerability management methods usually rely on static rules and manual operations, which are difficult to cope with ever-changing security threats and complex attack methods. In addition, traditional methods lack comprehensive analysis of multi-dimensional data of hosts and cannot comprehensively and accurately assess the security status and potential risks of hosts. Especially when faced with a large amount of vulnerability information, traditional methods cannot effectively perform synchronous analysis and rapid response to vulnerability information, resulting in low efficiency of vulnerability management and prone to omissions and misjudgments.

[0003] Existing vulnerability management systems are often scattered across different security platforms and lack a unified collaboration mechanism, which makes it difficult to share and communicate vulnerability information, increasing the complexity and cost of management. At the same time, traditional vulnerability management strategies lack dynamic adaptability and cannot be adjusted and optimized in real time according to the actual security status and risk changes of the host. This lack of adaptability in vulnerability management architecture is powerless in the face of complex and changing network environments and is difficult to provide comprehensive security protection. In addition, the vulnerability knowledge base of existing systems is usually based on a single source, with a slow update speed and unable to reflect the latest security threat information in a timely manner, which seriously affects the timeliness and effectiveness of vulnerability repairs. Summary of the invention

[0004] The present application provides a vulnerability management method and system based on an adaptive architecture of a host security platform, which improves the vulnerability management efficiency and the overall security protection level of the host.

[0005] In a first aspect, the present application provides a vulnerability management method based on an adaptive architecture of a host security platform, the vulnerability management method based on an adaptive architecture of a host security platform comprising:

[0006] Through the host security platform, multi-dimensional data collection of the host is carried out to obtain a multi-dimensional host data set and a host security feature model is established to divide the security domain and obtain the host security management strategy;

[0007] Obtain local vulnerability datasets and cloud vulnerability datasets and perform synchronous analysis of vulnerability information to build a cloud-based collaborative vulnerability knowledge base;

[0008] Performing a baseline scan on the host according to the host security management policy to obtain host baseline data, and constructing a corresponding attack graph according to the host baseline data and the vulnerability knowledge base;

[0009] Performing attack path risk calculation and vulnerability analysis on the attack graph, obtaining host vulnerability analysis results, performing vulnerability verification and repair, and generating an initial vulnerability management strategy;

[0010] The vulnerability status of the host is tracked according to the initial vulnerability management strategy, vulnerability security metrics are obtained, and vulnerability management strategy is iteratively optimized to obtain a target vulnerability management strategy.

[0011] In a second aspect, the present application provides a vulnerability management system based on an adaptive architecture of a host security platform, the vulnerability management system based on an adaptive architecture of a host security platform comprising:

[0012] The collection module is used to collect multi-dimensional data of the host through the host security platform, obtain a multi-dimensional host data set and establish a host security feature model to divide the security domain and obtain a host security management strategy;

[0013] The analysis module is used to obtain local vulnerability data sets and cloud vulnerability data sets and perform synchronous analysis of vulnerability information to build a cloud-coordinated vulnerability knowledge base;

[0014] A scanning module, used to perform a baseline scan on the host according to the host security management policy, obtain host baseline data, and construct a corresponding attack graph according to the host baseline data and the vulnerability knowledge base;

[0015] A repair module is used to perform attack path risk calculation and vulnerability analysis on the attack graph, obtain host vulnerability analysis results and perform vulnerability verification and repair, and generate an initial vulnerability management strategy;

[0016] The optimization module is used to track the vulnerability status of the host according to the initial vulnerability management strategy, obtain vulnerability security metrics and perform iterative optimization of the vulnerability management strategy to obtain a target vulnerability management strategy.

[0017] The third aspect of the present application provides a computer device, comprising: a memory and at least one processor, wherein the memory stores instructions; the at least one processor calls the instructions in the memory so that the computer device executes the above-mentioned vulnerability management method based on the adaptive architecture of the host security platform.

[0018] A fourth aspect of the present application provides a computer-readable storage medium, in which instructions are stored. When the computer-readable storage medium is run on a computer, the computer executes the vulnerability management method based on the adaptive architecture of the host security platform.

[0019] In the technical solution provided by this application, the operating status and potential security threats of the host are fully understood by collecting multi-dimensional data such as hardware, software, network communication and user behavior of the host. By establishing a host security feature model, clustering analysis and security domain division of the host, the vulnerability, threat and importance characteristics of the host can be accurately identified, and the refinement level of host security management can be effectively improved. By synchronously analyzing the vulnerability data of the local and cloud, a cloud-coordinated vulnerability knowledge base is built to realize the sharing and real-time update of vulnerability information. Automated vulnerability attribute completion and full life cycle management are provided to ensure the integrity and timeliness of vulnerability information, which helps to quickly identify and respond to emerging security threats. Based on the host security management strategy, the baseline scanning frequency and granularity are determined, and a comprehensive baseline scan is performed regularly to obtain the host baseline data. By comparing the baseline data and the vulnerability knowledge base, known vulnerabilities are identified and an attack graph is constructed, and the attack surface and vulnerability path on the host are described in detail, providing an accurate basis for vulnerability analysis and risk assessment. The attack graph is analyzed by graph theory and the path complexity is evaluated, an attack path risk assessment model is constructed, and the attack path risk measurement results are calculated. Sort the attack paths according to the risk measurement results, identify high-risk paths, conduct vulnerability mining and verification, generate the initial vulnerability management strategy, and ensure the timely handling and repair of high-risk vulnerabilities. Deploy the vulnerability status monitoring agent to monitor the host vulnerability repair status in real time, and perform full vulnerability scanning to evaluate the repair effect. Based on the repair effect report and security situation assessment, iteratively optimize the vulnerability management strategy to ensure the dynamic adaptability and continuous improvement of the vulnerability management strategy. When the security situation report meets the preset security goals, generate the target vulnerability management strategy to achieve dynamic and adaptive security management of the host, effectively improving the efficiency and accuracy of vulnerability management. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0021] Figure 1 A schematic diagram of an embodiment of a vulnerability management method based on an adaptive architecture of a host security platform in an embodiment of the present application;

[0022] Figure 2 A schematic diagram of an embodiment of a vulnerability management system based on an adaptive architecture of a host security platform in an embodiment of the present application. DETAILED DESCRIPTION

[0023] The embodiment of the present application provides a vulnerability management method and system for an adaptive architecture based on a host security platform. The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described here can be implemented in an order other than that illustrated or described here. In addition, the terms "including" or "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0024] For ease of understanding, the specific process of the embodiment of the present application is described below. Figure 1 In the embodiment of the present application, an embodiment of a vulnerability management method based on an adaptive architecture of a host security platform includes:

[0025] Step 101: collect multi-dimensional data of the host through the host security platform to obtain a multi-dimensional host data set and establish a host security feature model to divide the security domain and obtain a host security management strategy;

[0026] It is understandable that the execution subject of the present application can be a vulnerability management system based on an adaptive architecture of a host security platform, or a terminal or a server, which is not specifically limited here. The present application embodiment is described by taking a server as the execution subject as an example.

[0027] Specifically, hardware configuration information of the host is collected to obtain a subset of host hardware configuration data. The hardware configuration information includes the specific configuration and status of physical devices such as CPU, memory, and hard disk. Software configuration information of the host is collected to obtain a subset of host software configuration data. This part of data involves the operating system, installed application software and its version information. Network communication information of the host is collected to obtain a subset of host network communication data, including network connection status, traffic statistics, port usage, and interaction information with other network devices. At the same time, user behavior information of the host is collected to obtain a subset of host user behavior data. These data include user login records, operation logs, access rights, etc. The host hardware configuration data subset, host software configuration data subset, host network communication data subset, and host user behavior data subset are aggregated to obtain a multidimensional host data set. Based on the multidimensional host data set, a host security feature set is extracted. The host security feature set includes host vulnerability features, host threat features, and host importance features. Among them, the host vulnerability feature mainly evaluates the host's weaknesses and potential vulnerabilities, the host threat feature describes the factors that may threaten the host, and the host importance feature reflects the host's criticality and data sensitivity in the entire business system. The host security feature set is trained to establish a host security feature model, and cluster analysis is performed through the host security feature model to obtain multiple different security domains. These security domains are divided into several groups of hosts with similar security features according to the different host security features. According to multiple different security domains, multiple corresponding security domain policies are generated. These policies are optimized and adjusted for the specific security requirements and features of hosts in different security domains. Multiple security domain policies are summarized and combined with the importance of the business system and the sensitivity of the data to generate a host security management policy.

[0028] Step 102: Obtain a local vulnerability dataset and a cloud vulnerability dataset and perform synchronous analysis of vulnerability information to build a cloud-coordinated vulnerability knowledge base;

[0029] Specifically, the host security platform obtains local vulnerability data sets and cloud vulnerability data sets, which include information and descriptions of various known vulnerabilities, as well as possible attack paths and repair solutions. Field mapping is performed on the local vulnerability data sets and the cloud vulnerability data sets to build a unified vulnerability information data model, so that data from different sources can be seamlessly connected and integrated. The vulnerability information data model includes standardized fields, such as vulnerability identification, vulnerability description, affected version, vulnerability severity, known repair methods, etc. Semantic analysis and vulnerability similarity calculation are performed on the unstructured description information of the local vulnerability data sets and the cloud vulnerability data sets. Through natural language processing technology, the key features in the vulnerability description are extracted, and the similarity between each vulnerability is calculated to obtain the vulnerability similarity matching result. Based on the matching results, the same or similar vulnerabilities are identified to avoid information duplication and conflict. According to the vulnerability similarity matching results, the local vulnerability data and the cloud vulnerability data are merged to obtain the first vulnerability library data that is initially integrated. The first vulnerability library data is automatically supplemented with vulnerability attributes. Using machine learning and rule engines, the missing attribute information is automatically supplemented according to the existing data to generate more complete and detailed second vulnerability library data. The second vulnerability database data is managed throughout its life cycle, and the operation information and timestamps of each link are recorded in the second vulnerability database data, including the time of vulnerability discovery, repair time, and execution of repair measures, etc., to ensure the transparency and traceability of the vulnerability management process. Based on the second vulnerability database data, a cloud-based collaborative vulnerability knowledge base is built. This knowledge base not only contains vulnerability information of the local system and the cloud system, but also realizes regular automatic synchronization between the two. The local system can pull the latest patch information and repair solutions from the cloud in real time, while the cloud system can collect the latest local vulnerability data, thereby continuously updating and improving the knowledge base content.

[0030] Step 103: Perform a baseline scan on the host according to the host security management policy to obtain host baseline data, and construct a corresponding attack graph based on the host baseline data and the vulnerability knowledge base;

[0031] Specifically, according to the host security management policy, the baseline scanning frequency and scanning granularity of the host are determined. The scanning frequency and granularity are determined by the security requirements and risk level of the host, ensuring that the host is fully scanned at a reasonable time interval, so as to timely discover and deal with security risks. Perform a regular and comprehensive baseline scan on the host, and form the host baseline data by collecting data such as the host's hardware, software, network configuration, and user behavior. Compare the host baseline data with the pre-set baseline standard, which includes the security requirements and best practice specifications for host configuration, and obtain the baseline scan results through comparison. Based on the baseline scan results, generate baseline scan alarm data to record any configuration or status that does not meet the baseline standard. These alarm data provide preliminary risk indications and help to quickly identify potential security issues. Associate the baseline scan alarm data with the vulnerability knowledge base to determine whether the alarm item corresponds to a known vulnerability. The vulnerability knowledge base contains a large amount of known vulnerability information, including vulnerability descriptions, impact scope, and repair methods. By comparing with the knowledge base, determine whether the alarm item in the baseline scan is associated with a known vulnerability. If it is confirmed that the alarm item corresponds to a known vulnerability, it is marked as a vulnerability risk. Identify the attack surface on the host based on the host configuration of the baseline snapshot. The attack surface refers to the entry point or weak link on the host that may be exploited by attackers. Using these attack surfaces as the starting point, build a detailed vulnerability attack path based on the vulnerability information in the vulnerability knowledge base. The attack path reflects the steps that an attacker may take and the vulnerabilities that he may exploit, starting from the attack surface, to gradually achieve penetration and control of the host system. Generate an attack graph by comprehensively analyzing the host configuration, vulnerability information, and attack path. In the attack graph, each node represents an attack surface or a specific vulnerability, and the edge represents the vulnerability attack path that may exist between adjacent nodes.

[0032] Step 104: perform attack path risk calculation and vulnerability analysis on the attack graph, obtain host vulnerability analysis results, perform vulnerability verification and repair, and generate an initial vulnerability management strategy;

[0033] Specifically, the attack graph is analyzed by graph theory, and the attack path set is obtained by analyzing the relationship between nodes and edges in the attack graph. Each attack path represents the steps that a potential attacker may take and the vulnerabilities that may be exploited. Based on the attack path set and the vulnerability knowledge base, an attack path risk assessment model is constructed. The model combines the severity, difficulty of exploitation and potential impact of each vulnerability on the system to assess the risk level of each attack path. Based on the attack path risk assessment model, the attack path risk is calculated for the attack path set to obtain the attack path risk measurement results. These measurement results reflect the risk size of each attack path and help identify the security threats that need to be dealt with most in the system. According to the attack path risk measurement results, the attack path set is sorted to determine the high-risk attack path set. The high-risk attack path set includes those paths with the highest risk measurement results. Vulnerability mining analysis is performed on the high-risk attack path set to identify the high-risk vulnerability set. The high-risk vulnerability set includes the key vulnerabilities that may be exploited by attackers in these high-risk paths. According to the high-risk vulnerability set, the relevant vulnerability verification methods are queried from the vulnerability knowledge base to obtain the vulnerability verification method set. Based on the vulnerability verification method set, the host is verified for vulnerabilities to obtain the verification result set. The verification result set contains the verification status of each high-risk vulnerability in the actual system. Based on these results, the high-risk vulnerability set is classified into a verified vulnerability set and an unverified vulnerability set. For the verified vulnerability set, the vulnerability is repaired based on the vulnerability knowledge base to generate a vulnerability repair solution set. The vulnerability repair solution set provides specific repair measures and steps for each verified vulnerability. Based on the vulnerability repair solution set and the unverified vulnerability set, the initial vulnerability management strategy is generated.

[0034] The attack path set is evaluated for path complexity. The path complexity evaluation takes into account the number of nodes on each path, the attributes of each node, and the overall structural complexity of the path, and the path complexity evaluation result is obtained. According to the path complexity evaluation result, the attack path set is assigned path weights. The path weights reflect the complexity and potential difficulty of each path, and a weighted attack path set is obtained. The hazard measurement data of the involved vulnerabilities are extracted from the vulnerability knowledge base. The hazard measurement data includes the potential impact of each vulnerability on the system, the possible losses, etc., to form a vulnerability hazard measurement data set. According to the vulnerability hazard measurement data set, the hazard measurement calculation is performed on each attack path in the weighted attack path set to obtain the first path hazard measurement result. This result reflects the basic hazard level of each attack path without considering other factors. The exploitability evaluation data of the involved vulnerabilities are extracted from the vulnerability knowledge base. The exploitability evaluation data includes the difficulty of exploiting the vulnerability, the conditions required for the attack, etc., to form a vulnerability exploitability evaluation data set. According to the vulnerability exploitability evaluation data set, the first path hazard measurement result is modified for exploitability, and the second path hazard measurement result is obtained. The correction reflects the difficulty for actual attackers to exploit each path, thereby more accurately assessing the risk of the path. The environmental impact factor data of the involved vulnerabilities are extracted from the vulnerability knowledge base. The environmental impact factor data includes factors such as the system's operating environment and business scenarios to form an environmental impact factor data set. According to the environmental impact factor data set, the second path hazard measurement result is environmentally corrected to obtain the third path hazard measurement result. The environmental correction takes into account the amplification or reduction effect of the specific application scenario on the vulnerability hazard, making the assessment result more practical. Based on the attack path risk assessment model, the weighted attack path set is comprehensively evaluated according to the third path hazard measurement result and the path complexity assessment result to obtain the attack path risk measurement result. The comprehensive assessment combines multiple factors such as path complexity, vulnerability hazard, exploitability and environmental impact to provide a final risk score for each attack path.

[0035] Step 105: Track the vulnerability status of the host according to the initial vulnerability management policy, obtain vulnerability security metrics, and iteratively optimize the vulnerability management policy to obtain a target vulnerability management policy.

[0036] Specifically, according to the initial vulnerability management strategy, a vulnerability status monitoring agent is deployed on the host. The agent can collect the vulnerability repair status and other relevant information of the host in real time to ensure real-time monitoring of the host status. During the monitoring process, the agent continuously tracks the repair status of each identified vulnerability, records the progress and current status of the vulnerability repair, and ensures that the security status of the host is mastered in real time. Perform a full vulnerability scan on the host to obtain a set of vulnerability scan results. Compare and analyze the vulnerability scan results with the vulnerability repair status, and evaluate the repair effect of the verified vulnerability set based on the scan results and repair status to form a repair effect evaluation report. According to the repair effect evaluation report, the initial vulnerability management strategy is revised to generate a revised vulnerability management strategy. The revised strategy is adjusted based on the actual repair effect to be closer to the actual security needs of the host. According to the revised vulnerability management strategy, the host is evaluated for vulnerability security situation to obtain vulnerability security metrics. Vulnerability security situation evaluation not only considers the current number of vulnerabilities and repair status, but also includes the performance of the host in the overall security environment, such as the frequency and success rate of attack attempts and the overall anti-attack capability of the system. Statistical analysis is performed on the vulnerability security metrics to generate a vulnerability security situation report. This report comprehensively reflects the security status of the host, analyzes the current security risks and the effects of vulnerability repair. Based on this report, the revised vulnerability management strategy is optimized through policy iteration. During the optimization process, the vulnerability management strategy is adjusted and improved to make it more efficient and effective, combining the latest progress of vulnerability repair and the security situation of the host. When the vulnerability security situation report meets the preset security goals, the target vulnerability management strategy is finally obtained. The target vulnerability management strategy can not only effectively respond to currently known security threats, but also has good adaptability. It can be continuously adjusted and optimized as new vulnerabilities are discovered and repair technologies advance, maintaining a high level of security protection capabilities for the host system.

[0037] In the embodiment of the present application, by collecting multi-dimensional data such as hardware, software, network communication and user behavior of the host, the operating status and potential security threats of the host are fully understood. A host security feature model is established, and cluster analysis and security domain division are performed on the host, which can accurately identify the vulnerability, threat and importance characteristics of the host, and effectively improve the refinement level of host security management. By synchronously analyzing the vulnerability data of the local and cloud, a cloud-coordinated vulnerability knowledge base is constructed to realize the sharing and real-time update of vulnerability information. Automated vulnerability attribute completion and full life cycle management are provided to ensure the integrity and timeliness of vulnerability information, which helps to quickly identify and respond to emerging security threats. Based on the host security management strategy, the baseline scanning frequency and granularity are determined, and a comprehensive baseline scan is performed regularly to obtain the host baseline data. By comparing the baseline data and the vulnerability knowledge base, known vulnerabilities are identified and an attack graph is constructed, and the attack surface and vulnerability path on the host are described in detail, providing an accurate basis for vulnerability analysis and risk assessment. The attack graph is subjected to graph theory analysis and path complexity evaluation, an attack path risk assessment model is constructed, and the attack path risk measurement results are calculated. Sort the attack paths according to the risk measurement results, identify high-risk paths, conduct vulnerability mining and verification, generate the initial vulnerability management strategy, and ensure the timely handling and repair of high-risk vulnerabilities. Deploy the vulnerability status monitoring agent to monitor the host vulnerability repair status in real time, and perform full vulnerability scanning to evaluate the repair effect. Based on the repair effect report and security situation assessment, iteratively optimize the vulnerability management strategy to ensure the dynamic adaptability and continuous improvement of the vulnerability management strategy. When the security situation report meets the preset security goals, generate the target vulnerability management strategy to achieve dynamic and adaptive security management of the host, effectively improving the efficiency and accuracy of vulnerability management.

[0038] In a specific embodiment, the process of executing step 101 may specifically include the following steps:

[0039] (1) Collecting hardware configuration information of the host to obtain a subset of the host hardware configuration data; collecting software configuration information of the host to obtain a subset of the host software configuration data; collecting network communication information of the host to obtain a subset of the host network communication data; collecting user behavior information of the host to obtain a subset of the host user behavior data;

[0040] (2) Aggregate the host hardware configuration data subset, host software configuration data subset, host network communication data subset, and host user behavior data subset to obtain a multi-dimensional host data set;

[0041] (3) Extracting a host security feature set based on the multi-dimensional host data set. The host security feature set includes host vulnerability features, host threat features, and host importance features.

[0042] (4) Conduct model training on the host security feature set, establish a host security feature model, and perform cluster analysis through the host security feature model to obtain multiple different security domains;

[0043] (5) Generate multiple corresponding security domain policies based on multiple different security domains, summarize the multiple security domain policies and combine them with the importance of the business system and the sensitivity of the data to generate a host security management policy.

[0044] Specifically, the host's hardware configuration information is collected by installing a monitoring agent on the host or using existing management tools. The hardware configuration information includes CPU model, memory size, hard disk capacity, network card type, etc. For example, a subset of the host's hardware configuration data can be expressed as: .in, Indicates Hardware configuration items, such as CPU model, memory size, etc. Collect the host's software configuration information. Software configuration information includes operating system version, installed software and its version number, patch status, etc. The host's software configuration data subset can be expressed as: .in, Indicates Software configuration items, such as operating system version, specific software version, etc. Collect network communication information of the host. Network communication information includes the host's IP address, MAC address, open ports, active network connections, number and size of transmitted data packets, etc. The network communication data subset can be expressed as: .in, Indicates Network communication items, such as IP addresses, open ports, etc. Collect user behavior information of the host. User behavior information includes user login records, command execution records, file access records, etc. The user behavior data subset of the host can be expressed as: .in, Indicates The above four data subsets are aggregated to form a multidimensional host data set. The multidimensional data set integrates hardware, software, network communication and user behavior information, and provides a comprehensive description of the host status. Based on the multidimensional host data set, the host security feature set is extracted. The host security feature set includes the vulnerability feature, threat feature and importance feature of the host. The vulnerability feature reflects the security vulnerabilities and weaknesses of the host, which can be expressed as: .in, Indicates A vulnerability characteristic, such as the number of unpatched vulnerabilities. A threat characteristic describes the potential threats faced by the host and can be expressed as: .in, Indicates The threat characteristics include the number of malicious traffic detected. The importance characteristics reflect the criticality of the host in the business system and the sensitivity of the data, which can be expressed as: .in, Indicates Importance features, such as the number of key services hosted by the host. Model training is performed on the host security feature set to establish a host security feature model. These features are trained using a machine learning algorithm, for example, a K-means clustering algorithm is used for cluster analysis. Assume that the K-means clustering algorithm is used to cluster the hosts, and its goal is to minimize the following objective function:

[0045] ;

[0046] in, is the number of clusters, It is data points, It is clusters, It is The center point of each cluster. By clustering the host security feature model, multiple different security domains are obtained. Each security domain represents a group of hosts with similar security features, which facilitates the formulation of targeted security policies. According to multiple different security domains, multiple corresponding security domain policies are generated. Each security domain policy is optimized and adjusted according to the specific security requirements and characteristics of the hosts in the domain. For example, for security domains with high vulnerability characteristics, the security policy may focus on vulnerability repair and patch management; for security domains with high threat characteristics, the policy may focus on intrusion detection and response; for security domains with high importance characteristics, the policy may focus on data protection and access control. Aggregate multiple security domain policies, and combine the importance of the business system and the sensitivity of the data to generate a host security management policy. The policies of each security domain are integrated by the weighted average method, and the weights are allocated according to the importance of the business system and the sensitivity of the data.

[0047] In a specific embodiment, the process of executing step 102 may specifically include the following steps:

[0048] (1) Obtain local vulnerability datasets and cloud vulnerability datasets;

[0049] (2) Map the fields of the local vulnerability dataset and the cloud vulnerability dataset to obtain the vulnerability information data model;

[0050] (3) Perform semantic analysis and vulnerability similarity calculation on the unstructured description information of the local vulnerability dataset and the cloud vulnerability dataset to obtain vulnerability similarity matching results;

[0051] (4) Based on the vulnerability similarity matching results, the local vulnerability data and the cloud vulnerability data are merged to obtain the first vulnerability library data;

[0052] (5) Automatically complete the vulnerability attributes of the first vulnerability database data to obtain the second vulnerability database data and perform full life cycle management, and record the operation information and timestamp of each link in the second vulnerability database data;

[0053] (6) A cloud-based collaborative vulnerability knowledge base is constructed based on the data from the second vulnerability database. The local vulnerability dataset is automatically synchronized with the cloud vulnerability database on a regular basis. The local system can pull patch information and repair solutions from the cloud, and the cloud system can collect the latest local vulnerability data.

[0054] Specifically, obtain local vulnerability datasets and cloud vulnerability datasets. Local vulnerability datasets usually include various vulnerability information discovered internally, which comes from internal security scanning tools, penetration testing reports, and log records of security incidents. The cloud vulnerability dataset comes from third-party security databases and cloud security platforms, which usually contain the latest global vulnerability information and security threat intelligence. Field mapping is performed on the local vulnerability dataset and the cloud vulnerability dataset to unify the data structure of the two and obtain the vulnerability information data model. Field mapping is to standardize data from different sources so that it has a unified format. For example, map the "Vulnerability ID" field in the local data to the "CVEID" field in the cloud data, and map the "Description" field to the "Detailed Description" field in the cloud data. After field mapping, the obtained vulnerability information data model can be expressed as:

[0055] ;

[0056] in, Indicates the first fields, Represents the corresponding field in the cloud vulnerability dataset. Perform semantic analysis and vulnerability similarity calculation on the unstructured description information of the local vulnerability dataset and the cloud vulnerability dataset. The unstructured description information includes a detailed description of the vulnerability, the affected version, and repair suggestions. Through natural language processing technology (such as word embedding, TF-IDF, etc.), perform semantic analysis on these description information to extract key information and feature vectors. Use the cosine similarity calculation formula to compare the similarity of different description information

[0057] ;

[0058] in, and are two feature vectors describing information, the dot product represents the inner product of two vectors, and Respectively represent the norm of the vector. By calculating the similarity, the vulnerability similarity matching result is obtained, and similar or identical vulnerabilities in the local and cloud data sets are identified. According to the vulnerability similarity matching result, the local vulnerability data and the cloud vulnerability data are fused to obtain the first vulnerability library data. The fusion process includes merging similar or identical vulnerability information while retaining and integrating their different details to ensure the integrity and accuracy of the vulnerability library data. For example, if both the local data and the cloud data contain partial repair information for a vulnerability, these information will be merged during fusion to provide complete repair suggestions in the final vulnerability library. The vulnerability attribute of the first vulnerability library data is automatically completed to obtain the second vulnerability library data. Attribute completion includes automatically completing missing attribute information based on existing data, such as using machine learning models to predict the hazard level or impact range of unprovided vulnerabilities. The second vulnerability library data is managed throughout its life cycle, and the operation information and timestamp of each link are recorded in the data to ensure that the change process of each vulnerability information can be traced. These records include data collection time, field mapping time, similarity calculation time, data fusion time, and attribute completion time. Based on the second vulnerability library data, a cloud-based collaborative vulnerability knowledge base is constructed. The knowledge base integrates the latest vulnerability information from local and cloud sources, and keeps the data updated in real time through regular automatic synchronization. The local system can pull the latest patch information and repair solutions from the cloud to ensure the timeliness and effectiveness of vulnerability repairs. The cloud system can collect the latest local vulnerability data to enhance the comprehensiveness and accuracy of the global vulnerability information base.

[0059] In a specific embodiment, the process of executing step 103 may specifically include the following steps:

[0060] (1) According to the host security management policy, determine the host baseline scanning frequency and scanning granularity, perform regular comprehensive baseline scans on the host, and obtain the host baseline data;

[0061] (2) Compare the host baseline data with the baseline standard to obtain the baseline scan results, and generate baseline scan alarm data based on the baseline scan results;

[0062] (3) Associating the baseline scan alarm data with the vulnerability knowledge base, and determining whether the alarm item in the baseline scan alarm data corresponds to a known vulnerability. If so, marking the alarm item as a vulnerability risk;

[0063] (4) Identify the attack surface on the host based on the host configuration of the baseline snapshot, and use the attack surface as the starting point to construct the vulnerability attack path and generate an attack graph based on the vulnerability information in the vulnerability knowledge base. Each node in the attack graph represents the attack surface or vulnerability, and the edge represents the vulnerability attack path between adjacent nodes.

[0064] Specifically, according to the host security management policy, determine the baseline scanning frequency and scanning granularity of the host. Scanning frequency refers to the time interval for performing baseline scanning, such as daily, weekly or monthly, depending on the importance of the host and the security environment it is in. Scanning granularity refers to the level of detail of the scan, covering hardware configuration, operating system version, installed software, network settings, user behavior and other aspects. After determining these parameters, configure the baseline scanning tool to perform regular and comprehensive baseline scans on the host according to the set frequency and granularity to obtain the baseline data of the host. When the baseline scan is completed, the baseline data of the host is collected, which includes the current configuration status, operating status and detailed information of the system and application of the host. Compare the baseline data with the pre-set baseline standard, which is the host configuration and security settings under the ideal state. Through comparison, identify any configuration or status that does not meet the baseline standard, and obtain the baseline scanning result. Based on these scan results, generate baseline scanning alarm data to record all abnormal items and potential security risks. Associate the baseline scanning alarm data with the vulnerability knowledge base. The vulnerability knowledge base contains known vulnerability information and its characteristics. By comparing each alarm item in the baseline scan alarm data, it is determined whether it matches the known vulnerability. If an alarm item corresponds to a known vulnerability, the alarm item is marked as a vulnerability risk. After marking the vulnerability risk, the attack surface on the host is identified based on the host configuration of the baseline snapshot. The attack surface refers to the weak points or entrances on the host that may be exploited by attackers, including open ports, vulnerable software, unpatched systems, etc. Starting from these attack surfaces, a detailed vulnerability attack path is constructed based on the vulnerability information in the vulnerability knowledge base. The attack path is the steps that an attacker may take and the vulnerabilities that he may exploit, showing the potential attack route from the attack surface to the depths of the system. In order to intuitively represent the attack path, an attack graph is generated. In the attack graph, each node represents the attack surface or a specific vulnerability, and the edge represents the vulnerability attack path between adjacent nodes. The attack graph not only shows the current security status of the system, but also provides a clear visualization tool to help the system understand and analyze potential attack paths and risk points.

[0065] In a specific embodiment, the process of executing step 104 may specifically include the following steps:

[0066] (1) Perform graph theory analysis on the attack graph to obtain the attack path set, and build an attack path risk assessment model based on the attack path set and vulnerability knowledge base;

[0067] (2) Calculate the attack path risk of the attack path set based on the attack path risk assessment model to obtain the attack path risk measurement result;

[0068] (3) Sort the attack path set according to the attack path risk measurement results to obtain a high-risk attack path set;

[0069] (4) Perform vulnerability mining analysis on the high-risk attack path set to obtain a high-risk vulnerability set, and query the vulnerability verification method from the vulnerability knowledge base based on the high-risk vulnerability set to obtain a vulnerability verification method set;

[0070] (5) Perform vulnerability verification on the host based on the vulnerability verification method set to obtain a verification result set, and classify the high-risk vulnerability set according to the verification result set to obtain a verified vulnerability set and an unverified vulnerability set;

[0071] (6) Perform vulnerability repair on the verified vulnerability set based on the vulnerability knowledge base, generate a set of vulnerability repair solutions, and generate an initial vulnerability management strategy based on the set of vulnerability repair solutions and the unverified vulnerability set.

[0072] Specifically, a graph theory analysis is performed on the attack graph. An attack graph is a graph composed of nodes and edges. Nodes represent attack surfaces or vulnerabilities in the system, and edges represent potential attack paths from one node to another. Through graph theory analysis, a set of all possible attack paths is obtained. Graph theory analysis methods include depth-first search (DFS) and breadth-first search (BFS), which are used to traverse all paths in the graph. For example, DFS can be used to find all paths from the start node to the target node. Based on the attack path set and the vulnerability knowledge base, an attack path risk assessment model is constructed. The vulnerability knowledge base contains detailed information on each vulnerability, including its severity, difficulty of exploitation, known attack methods, etc. The attack path risk assessment model is used to assess the risk level of each attack path, usually considering the severity and difficulty of exploitation of each vulnerability on each path. The following formula can be used to calculate the risk of each attack path: .in, Indicates the path The risk score of Indicates the path The severity of the vulnerability, Indicates the path The difficulty of exploiting the vulnerability, is the number of vulnerabilities on the path. Based on the attack path risk assessment model, the risk of the attack path set is calculated to obtain the attack path risk measurement result. The risk score of each attack path represents the potential threat to the system after the path is exploited. According to these risk scores, the attack paths are sorted to obtain a set of high-risk attack paths. The paths in the high-risk attack path set are those with the highest risk scores and the greatest threat to the system. Vulnerability mining analysis is performed on the high-risk attack path set. Vulnerability mining analysis includes in-depth inspection of each vulnerability in the high-risk path to determine their specific characteristics and exploitation methods. Through analysis, a set of high-risk vulnerabilities is obtained, which are the vulnerabilities that attackers are most likely to exploit. Based on the high-risk vulnerability set, vulnerability verification methods are queried from the vulnerability knowledge base to obtain a set of vulnerability verification methods. These methods provide specific steps and tools for verifying the existence and exploitability of vulnerabilities. Vulnerabilities are verified on the host based on the vulnerability verification method set to obtain a set of verification results. Vulnerability verification includes trying to exploit vulnerabilities in an actual environment to confirm their existence and threats. According to the verification result set, the high-risk vulnerability set is classified to obtain a set of verified vulnerabilities and a set of unverified vulnerabilities. The verified vulnerability set includes those vulnerabilities that have been verified to exist and pose a threat, while the unverified vulnerability set includes those vulnerabilities that have not been confirmed during the verification process. For the verified vulnerability set, vulnerability repairs are performed based on the vulnerability knowledge base to generate a set of vulnerability repair solutions. The vulnerability repair solution provides detailed repair steps, including patching, closing unnecessary ports, changing configurations, and other measures. Based on the vulnerability repair solution set and the unverified vulnerability set, an initial vulnerability management strategy is generated. The initial vulnerability management strategy comprehensively considers the repair of verified vulnerabilities and the further monitoring and analysis of unverified vulnerabilities, and provides a comprehensive vulnerability management plan. For example, suppose a company's server is found to have multiple high-risk vulnerabilities. One of the high-risk attack paths includes the following steps: entering the system through an open port, exploiting an unpatched Web server vulnerability, then escalating permissions and accessing the database server, and finally stealing sensitive data. Through graph analysis, this attack path is obtained and its risk score is calculated. Assuming that the severity score of the Web server vulnerability is 9 and the exploit difficulty score is 2, and the severity score of the database server vulnerability is 8 and the exploit difficulty score is 3, then the risk score of this path is:

[0073] ;

[0074] Based on the risk score, this path is marked as high risk. Further vulnerability mining analysis confirmed the specific characteristics of the web server vulnerability and the database server vulnerability. Through the vulnerability knowledge base, the vulnerability verification methods queried included testing with specific vulnerability exploitation tools. After verifying these vulnerabilities in the actual environment, it was confirmed that the web server vulnerability existed and could be exploited, while the database server vulnerability existed but could not be successfully exploited. For the verified web server vulnerabilities, vulnerability remediation solutions are generated, such as applying the latest security patches and strengthening access control. Unverified database server vulnerabilities require further monitoring and analysis to determine whether other protective measures are needed. Ultimately, the initial vulnerability management strategy includes immediately remediating web server vulnerabilities and continuously monitoring database server vulnerabilities, while strengthening the overall security protection measures of the system.

[0075] In a specific embodiment, the execution step calculates the attack path risk of the attack path set based on the attack path risk assessment model, and the process of obtaining the attack path risk measurement result may specifically include the following steps:

[0076] (1) Perform path complexity evaluation on the attack path set to obtain the path complexity evaluation result, and assign path weights to the attack path set based on the path complexity evaluation result to obtain a weighted attack path set;

[0077] (2) Extracting the harm measurement data of the involved vulnerabilities from the vulnerability knowledge base to obtain a vulnerability harm measurement data set, and performing harm measurement calculation on each attack path in the weighted attack path set based on the vulnerability harm measurement data set to obtain a first path harm measurement result;

[0078] (3) Extracting exploitability assessment data of the involved vulnerabilities from the vulnerability knowledge base to obtain a vulnerability exploitability assessment data set, and performing exploitability correction on the first path hazard measurement result based on the vulnerability exploitability assessment data set to obtain a second path hazard measurement result;

[0079] (4) Extracting the environmental impact factor data of the involved vulnerabilities from the vulnerability knowledge base to obtain an environmental impact factor data set, and performing environmental correction on the second path hazard measurement result according to the environmental impact factor data set to obtain a third path hazard measurement result;

[0080] (5) Based on the attack path risk assessment model, a comprehensive evaluation is performed on the weighted attack path set according to the third path hazard measurement results and the path complexity assessment results to obtain the attack path risk measurement results.

[0081] Specifically, the path complexity of the attack path set is evaluated. The path complexity evaluation is to quantify the complexity of each attack path, usually considering the number of nodes on the path, the attributes of each node, the length and turning points of the path, etc. The path complexity can be expressed as a formula, for example:

[0082] ;

[0083] in, Indicates the path The complexity of is the number of nodes on the path, It is The weight of the node, It is The complexity factor of each node. By calculating the complexity of each path, the path complexity evaluation result is obtained. According to the path complexity evaluation result, the attack path set is assigned a path weight to obtain a weighted attack path set. The path weight assignment is to convert the complexity of the path into a weight value that can be used for subsequent calculations. The higher the weight value, the more complex the path is, and more resources and time are required to execute. The weighted attack path set can be expressed as:

[0084] ;

[0085] in, represents the set of weighted attack paths, Indicates attack paths, is its corresponding weight value. The hazard measurement data of the involved vulnerabilities are extracted from the vulnerability knowledge base to obtain a set of vulnerability hazard measurement data. The vulnerability hazard measurement data includes the severity, impact range and potential loss of each vulnerability. Based on these data, the hazard measurement is calculated for each attack path in the weighted attack path set. The hazard measurement of the path can be expressed as:

[0086] ;

[0087] in, Indicates the path The hazard measurement results are It is The severity of the vulnerability, is its corresponding weight value. The first path hazard measurement result is obtained by calculation. The exploitability assessment data of the involved vulnerabilities are extracted from the vulnerability knowledge base to obtain a vulnerability exploitability assessment data set. The exploitability assessment data includes the difficulty of exploiting the vulnerability, the conditions required for the attack, etc. Based on these data, the first path hazard measurement result is modified for exploitability. The exploitability modification can be expressed as: .in, Indicates the path The modified hazard measurement result is Is the path The exploitability correction coefficient is used. Through correction, the second path hazard measurement result is obtained. The environmental impact factor data of the involved vulnerabilities are extracted from the vulnerability knowledge base to obtain an environmental impact factor data set. The environmental impact factor data includes the system's operating environment, business scenarios, etc. Based on these data, the second path hazard measurement result is environmentally corrected. The environmental correction can be expressed as: .in, Indicates the path The environmentally corrected hazard measurement results are: Is the path The environmental impact factor of the attack path is calculated. Through environmental correction, the third path hazard measurement result is obtained. Based on the attack path risk assessment model, the weighted attack path set is comprehensively evaluated according to the third path hazard measurement result and the path complexity assessment result to obtain the attack path risk measurement result. The comprehensive evaluation can be expressed as:

[0088] ;

[0089] in, Indicates the path The final risk measurement result is is the hazard measurement result after environmental correction, is the result of path complexity evaluation. For example, suppose an attack path It contains three nodes: open ports, unpatched applications, and sensitive data storage. The path complexity evaluation results are: Among them, the weight , complexity factor The harm measurement data extracted from the vulnerability knowledge base are: the severity of the first vulnerability , the second vulnerability severity , the third vulnerability severity Based on these data, the first path hazard metric is calculated: The exploitability assessment data extracted from the vulnerability knowledge base is: path Availability correction factor Based on these data, we make exploitability corrections and obtain the second path hazard measurement results:

[0090] ;

[0091] The environmental impact factor data extracted from the vulnerability knowledge base is: Path Environmental factors Based on these data, the environmental correction is performed to obtain the third path hazard measurement result:

[0092] ;

[0093] Comprehensive Assessment Path The final risk measurement result is:

[0094] ;

[0095] In a specific embodiment, the process of executing step 105 may specifically include the following steps:

[0096] (1) According to the initial vulnerability management strategy, deploy the vulnerability status monitoring agent on the host and monitor the host status in real time to obtain the vulnerability repair status;

[0097] (2) Perform a full vulnerability scan on the host to obtain a set of vulnerability scan results, and evaluate the repair effect of the verified vulnerability set based on the vulnerability scan result set and the vulnerability repair status to obtain a repair effect evaluation report;

[0098] (3) According to the repair effect evaluation report, the initial vulnerability management strategy is revised to obtain a revised vulnerability management strategy, and the vulnerability security situation of the host is evaluated according to the revised vulnerability management strategy to obtain a vulnerability security metric;

[0099] (4) Perform statistical analysis on vulnerability security metrics to generate a vulnerability security situation report, and perform iterative optimization on the revised vulnerability management strategy based on the vulnerability security situation report. When the vulnerability security situation report meets the preset security goals, the target vulnerability management strategy is obtained.

[0100] Specifically, according to the initial vulnerability management strategy, vulnerability status monitoring agents are deployed on the host. These agents can monitor the status of the host in real time and collect information about the progress of vulnerability repair. The agent is installed on each host and is responsible for recording the repair operation, verifying the repair status, and transmitting this information back to the central management system. Perform a full vulnerability scan on the host to obtain a set of vulnerability scan results. Full vulnerability scanning refers to a comprehensive security check on the host to identify all existing vulnerabilities. The scanning tool will generate detailed scan results, including the description, severity, and impact range of each vulnerability. These scan results are compared with the vulnerability repair status collected by real-time monitoring to determine which vulnerabilities have been repaired and which still exist. Based on the vulnerability scan result set and the vulnerability repair status, the repair effect of the verified vulnerability set is evaluated. The purpose of the repair effect evaluation is to determine whether the vulnerability repair is successful and whether the repair measures are effective. The evaluation process includes checking whether each verified vulnerability disappears in the latest scan. If the vulnerability still exists, analyze the reasons, such as incomplete repair measures or new vulnerabilities are introduced. Based on this information, a repair effect evaluation report is generated. The evaluation report records in detail the repair status of each vulnerability, the proportion of successful repairs, and the reasons for failure. According to the repair effect evaluation report, the initial vulnerability management strategy is revised. The revised strategy is adjusted based on the actual repair effect to ensure that it is more in line with the actual situation. For example, if it is found that some repair measures are not effective for certain types of vulnerabilities, more protective measures can be added to the strategy or the existing repair methods can be improved. After obtaining the revised vulnerability management strategy, the host is evaluated for vulnerability security posture according to the new strategy. The security posture assessment includes a comprehensive analysis of the current security status of the host, an assessment of the overall security of the system, and the acquisition of vulnerability security metrics. The vulnerability security metric can be expressed using the following formula:

[0101] ;

[0102] in, represents the vulnerability security metric, Indicates The existence status of the vulnerability (1 means it exists, 0 means it does not exist), Indicates Severity ratings of the vulnerabilities, Represents the total number of vulnerabilities. Perform statistical analysis on vulnerability security metrics to generate a vulnerability security situation report. The situation report comprehensively reflects the security status of the current system, including the number and type of unrepaired vulnerabilities, the proportion of successful repairs, and the overall security score of the system. According to the situation report, the revised vulnerability management strategy is optimized through strategy iteration. The optimization process includes adjusting and improving repair measures, strengthening monitoring of high-risk vulnerabilities, and improving vulnerability response time. When the vulnerability security situation report meets the preset security goals, the target vulnerability management strategy is obtained.

[0103] The vulnerability management method based on the adaptive architecture of the host security platform in the embodiment of the present application is described above. The vulnerability management system based on the adaptive architecture of the host security platform in the embodiment of the present application is described below. Figure 2 In the embodiments of the present application, an embodiment of a vulnerability management system based on an adaptive architecture of a host security platform includes:

[0104] The collection module 201 is used to collect multi-dimensional data of the host through the host security platform, obtain a multi-dimensional host data set and establish a host security feature model to divide the security domain and obtain a host security management strategy;

[0105] An analysis module 202 is used to obtain a local vulnerability dataset and a cloud vulnerability dataset and perform synchronous analysis of vulnerability information to build a cloud-coordinated vulnerability knowledge base;

[0106] Scanning module 203, used to perform baseline scanning on the host according to the host security management policy, obtain host baseline data, and build a corresponding attack graph according to the host baseline data and the vulnerability knowledge base;

[0107] Repair module 204, used to perform attack path risk calculation and vulnerability analysis on the attack graph, obtain host vulnerability analysis results and perform vulnerability verification and repair, and generate an initial vulnerability management strategy;

[0108] The optimization module 205 is used to track the vulnerability status of the host according to the initial vulnerability management policy, obtain the vulnerability security measurement and perform iterative optimization of the vulnerability management policy to obtain the target vulnerability management policy.

[0109] Through the collaboration of the above components, the host's operating status and potential security threats can be fully understood by collecting multi-dimensional data such as hardware, software, network communication and user behavior. By establishing a host security feature model, clustering analysis and security domain division of the host, the host's vulnerability, threat and importance characteristics can be accurately identified, effectively improving the refinement level of host security management. By synchronously analyzing local and cloud vulnerability data, a cloud-based collaborative vulnerability knowledge base is built to achieve sharing and real-time updating of vulnerability information. Automated vulnerability attribute completion and full life cycle management are provided to ensure the integrity and timeliness of vulnerability information, which helps to quickly identify and respond to emerging security threats. Based on the host security management strategy, the baseline scanning frequency and granularity are determined, and a comprehensive baseline scan is performed regularly to obtain host baseline data. By comparing baseline data and vulnerability knowledge base, known vulnerabilities are identified and attack graphs are constructed, and the attack surface and vulnerability path on the host are described in detail, providing an accurate basis for vulnerability analysis and risk assessment. Graph theory analysis and path complexity evaluation are performed on the attack graph, an attack path risk assessment model is constructed, and the attack path risk measurement results are calculated. Sort the attack paths according to the risk measurement results, identify high-risk paths, conduct vulnerability mining and verification, generate the initial vulnerability management strategy, and ensure the timely handling and repair of high-risk vulnerabilities. Deploy the vulnerability status monitoring agent to monitor the host vulnerability repair status in real time, and perform full vulnerability scanning to evaluate the repair effect. Based on the repair effect report and security situation assessment, iteratively optimize the vulnerability management strategy to ensure the dynamic adaptability and continuous improvement of the vulnerability management strategy. When the security situation report meets the preset security goals, generate the target vulnerability management strategy to achieve dynamic and adaptive security management of the host, effectively improving the efficiency and accuracy of vulnerability management.

[0110] The present application also provides a computer device, which includes a memory and a processor, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the processor executes the steps of the vulnerability management method based on the adaptive architecture of the host security platform in the above-mentioned embodiments.

[0111] The present application also provides a computer-readable storage medium, which may be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium. Instructions are stored in the computer-readable storage medium. When the instructions are executed on a computer, the computer executes the steps of the vulnerability management method based on the adaptive architecture of the host security platform.

[0112] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described systems, systems and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0113] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc., various media that can store program codes.

[0114] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A vulnerability management method based on an adaptive architecture of a host security platform, characterized in that: The method comprises: Through the host security platform, multi-dimensional data collection of the host is carried out to obtain a multi-dimensional host data set and a host security feature model is established to divide the security domain and obtain the host security management strategy; Obtain local vulnerability datasets and cloud vulnerability datasets and perform synchronous analysis of vulnerability information to build a cloud-based collaborative vulnerability knowledge base; Performing a baseline scan on the host according to the host security management policy to obtain host baseline data, and constructing a corresponding attack graph according to the host baseline data and the vulnerability knowledge base; specifically including: determining the baseline scan frequency and scan granularity of the host according to the host security management policy, performing a regular and comprehensive baseline scan on the host to obtain host baseline data; comparing the host baseline data with the baseline standard to obtain a baseline scan result, and generating baseline scan alarm data according to the baseline scan result; associating the baseline scan alarm data with the vulnerability knowledge base, and determining whether the alarm item in the baseline scan alarm data corresponds to a known vulnerability, and if it corresponds to a known vulnerability, marking the alarm item as a vulnerability risk; identifying the attack surface on the host according to the host configuration of the baseline snapshot, the attack surface refers to the entry point or weak link on the host that may be exploited by an attacker, and taking the attack surface as the starting point, constructing a vulnerability attack path and generating an attack graph according to the vulnerability information in the vulnerability knowledge base, wherein each node in the attack graph represents an attack surface or a vulnerability, and an edge represents a vulnerability attack path between adjacent nodes; Performing attack path risk calculation and vulnerability analysis on the attack graph, obtaining host vulnerability analysis results, performing vulnerability verification and repair, and generating an initial vulnerability management strategy; The vulnerability status of the host is tracked according to the initial vulnerability management strategy, vulnerability security metrics are obtained, and vulnerability management strategy is iteratively optimized to obtain a target vulnerability management strategy.

2. The vulnerability management method based on the adaptive architecture of the host security platform according to claim 1 is characterized in that: The host security platform collects multi-dimensional data from the host to obtain a multi-dimensional host data set and establishes a host security feature model to divide the security domain and obtain a host security management strategy, including: Collecting hardware configuration information of the host to obtain a subset of host hardware configuration data; collecting software configuration information of the host to obtain a subset of host software configuration data; collecting network communication information of the host to obtain a subset of host network communication data; collecting user behavior information of the host to obtain a subset of host user behavior data; Aggregating the host hardware configuration data subset, the host software configuration data subset, the host network communication data subset, and the host user behavior data subset to obtain a multi-dimensional host data set; Extracting a host security feature set according to the multi-dimensional host data set, wherein the host security feature set includes a host vulnerability feature, a host threat feature, and a host importance feature; Performing model training on the host security feature set to establish a host security feature model, and performing cluster analysis through the host security feature model to obtain a plurality of different security domains; A corresponding plurality of security domain policies are generated according to the plurality of different security domains, and the plurality of security domain policies are summarized and combined with the importance of the business system and the sensitivity of the data to generate a host security management policy.

3. The vulnerability management method based on the adaptive architecture of the host security platform according to claim 1 is characterized in that: The method of obtaining a local vulnerability dataset and a cloud vulnerability dataset and performing synchronous analysis of vulnerability information to build a cloud-coordinated vulnerability knowledge base includes: Obtain local vulnerability datasets and cloud vulnerability datasets; Performing field mapping on the local vulnerability dataset and the cloud vulnerability dataset to obtain a vulnerability information data model; Performing semantic analysis and vulnerability similarity calculation on the unstructured description information of the local vulnerability dataset and the cloud vulnerability dataset to obtain a vulnerability similarity matching result; According to the vulnerability similarity matching result, the local vulnerability data and the cloud vulnerability data are merged to obtain first vulnerability library data; Automatically complete vulnerability attributes of the first vulnerability library data to obtain second vulnerability library data and perform full life cycle management, and record operation information and timestamps of each link in the second vulnerability library data; A cloud-coordinated vulnerability knowledge base is constructed based on the second vulnerability library data. The local vulnerability dataset is automatically synchronized with the cloud vulnerability library on a regular basis. The local system can pull patch information and repair solutions from the cloud, and the cloud system can collect the latest local vulnerability data.

4. The vulnerability management method based on the adaptive architecture of the host security platform according to claim 1 is characterized in that: The attack path risk calculation and vulnerability analysis are performed on the attack graph to obtain host vulnerability analysis results and perform vulnerability verification and repair to generate an initial vulnerability management strategy, including: Performing graph theory analysis on the attack graph to obtain an attack path set, and constructing an attack path risk assessment model based on the attack path set and the vulnerability knowledge base; Performing attack path risk calculation on the attack path set based on the attack path risk assessment model to obtain an attack path risk measurement result; Sorting the attack path set according to the attack path risk measurement result to obtain a high-risk attack path set; Performing vulnerability mining analysis on the high-risk attack path set to obtain a high-risk vulnerability set, and querying vulnerability verification methods from the vulnerability knowledge base according to the high-risk vulnerability set to obtain a vulnerability verification method set; Performing vulnerability verification on the host based on the vulnerability verification method set to obtain a verification result set, and classifying the high-risk vulnerability set according to the verification result set to obtain a verified vulnerability set and an unverified vulnerability set; The verified vulnerability set is repaired based on the vulnerability knowledge base to generate a vulnerability repair solution set, and an initial vulnerability management policy is generated according to the vulnerability repair solution set and the unverified vulnerability set.

5. The vulnerability management method based on the adaptive architecture of the host security platform according to claim 4 is characterized in that: The step of performing attack path risk calculation on the attack path set based on the attack path risk assessment model to obtain an attack path risk measurement result includes: Performing a path complexity evaluation on the attack path set to obtain a path complexity evaluation result, and assigning a path weight to the attack path set according to the path complexity evaluation result to obtain a weighted attack path set; Extracting the harm measurement data of the involved vulnerabilities from the vulnerability knowledge base to obtain a vulnerability harm measurement data set, and performing harm measurement calculation on each attack path in the weighted attack path set according to the vulnerability harm measurement data set to obtain a first path harm measurement result; Extracting exploitability assessment data of the involved vulnerabilities from the vulnerability knowledge base to obtain a vulnerability exploitability assessment data set, and performing exploitability correction on the first path hazard measurement result according to the vulnerability exploitability assessment data set to obtain a second path hazard measurement result; Extracting environmental impact factor data of the involved vulnerabilities from the vulnerability knowledge base to obtain an environmental impact factor data set, and performing environmental correction on the second path hazard measurement result according to the environmental impact factor data set to obtain a third path hazard measurement result; Based on the attack path risk assessment model, the weighted attack path set is comprehensively evaluated according to the third path hazard measurement result and the path complexity assessment result to obtain an attack path risk measurement result.

6. The vulnerability management method based on the adaptive architecture of the host security platform according to claim 5 is characterized in that: Tracking the vulnerability status of the host according to the initial vulnerability management strategy, obtaining vulnerability security metrics and iteratively optimizing the vulnerability management strategy to obtain a target vulnerability management strategy includes: According to the initial vulnerability management strategy, deploy a vulnerability status monitoring agent program on the host and monitor the status of the host in real time to obtain the vulnerability repair status; Performing a full vulnerability scan on the host to obtain a vulnerability scan result set, and evaluating the repair effect of the verified vulnerability set based on the vulnerability scan result set and the vulnerability repair status to obtain a repair effect evaluation report; The initial vulnerability management policy is modified according to the repair effect evaluation report to obtain a modified vulnerability management policy, and a vulnerability security situation evaluation is performed on the host according to the modified vulnerability management policy to obtain a vulnerability security metric; The vulnerability security metrics are statistically analyzed to generate a vulnerability security situation report, and the revised vulnerability management strategy is iteratively optimized based on the vulnerability security situation report. When the vulnerability security situation report meets the preset security goals, a target vulnerability management strategy is obtained.

7. A vulnerability management system based on an adaptive architecture of a host security platform, used to execute a vulnerability management method based on an adaptive architecture of a host security platform as claimed in any one of claims 1 to 6, characterized in that: The system comprises: The collection module is used to collect multi-dimensional data of the host through the host security platform, obtain a multi-dimensional host data set and establish a host security feature model to divide the security domain and obtain a host security management strategy; The analysis module is used to obtain local vulnerability data sets and cloud vulnerability data sets and perform synchronous analysis of vulnerability information to build a cloud-coordinated vulnerability knowledge base; A scanning module, used to perform a baseline scan on the host according to the host security management policy to obtain host baseline data, and to construct a corresponding attack graph according to the host baseline data and the vulnerability knowledge base; specifically including: determining the baseline scan frequency and scan granularity of the host according to the host security management policy, performing regular and comprehensive baseline scans on the host to obtain host baseline data; comparing the host baseline data with the baseline standard to obtain a baseline scan result, and generating baseline scan alarm data according to the baseline scan result; associating the baseline scan alarm data with the vulnerability knowledge base, and determining whether the alarm item in the baseline scan alarm data corresponds to a known vulnerability, and if it corresponds to a known vulnerability, marking the alarm item as a vulnerability risk; identifying the attack surface on the host according to the host configuration of the baseline snapshot, the attack surface refers to the entry point or weak link on the host that may be exploited by an attacker, and taking the attack surface as the starting point, constructing a vulnerability attack path and generating an attack graph according to the vulnerability information in the vulnerability knowledge base, wherein each node in the attack graph represents an attack surface or a vulnerability, and an edge represents a vulnerability attack path between adjacent nodes; A repair module is used to perform attack path risk calculation and vulnerability analysis on the attack graph, obtain host vulnerability analysis results and perform vulnerability verification and repair, and generate an initial vulnerability management strategy; The optimization module is used to track the vulnerability status of the host according to the initial vulnerability management strategy, obtain vulnerability security metrics and perform iterative optimization of the vulnerability management strategy to obtain a target vulnerability management strategy.

8. A computer device, characterized in that: The computer device comprises: a memory and at least one processor, wherein instructions are stored in the memory; The at least one processor calls the instructions in the memory to enable the computer device to execute the vulnerability management method based on the adaptive architecture of the host security platform according to any one of claims 1 to 6.

9. A computer-readable storage medium having instructions stored thereon, characterized in that: When the instructions are executed by the processor, the vulnerability management method of the adaptive architecture based on the host security platform as described in any one of claims 1-6 is implemented.

Images