Vulnerability identification method and system based on program-related information

Abstract

The present application discloses a vulnerability identification method and system based on program-related information, which relates to the field of computer security technology. While significantly improving the efficiency of vulnerability identification based on automatic vulnerability identification, the accuracy of vulnerability identification is improved by constructing vulnerability matching conditions and multiple matching strategies, effectively ensuring the overall security of the program. The method includes: determining a target program to be subject to vulnerability identification, obtaining program configuration information of the target program; sorting out the information items included in the program configuration information to obtain vulnerability matching conditions; in a local database storing preset vulnerability information, using the vulnerability matching conditions to perform fuzzy matching operations and exact matching operations, and using the matched preset vulnerability information as the vulnerability information of the target program.

Description

Technical Field

[0001] The present application relates to the field of computer security technology, and in particular to a vulnerability identification method and system based on program-related information. Background Art

[0002] With the rapid development of information technology, applications are becoming an indispensable infrastructure in modern society and are widely used in various industries. However, the complexity of applications has increased dramatically, not only in the diversification of functional modules, but also in their deep coupling with the underlying hardware, operating system and network environment. This complexity greatly increases the potential security risks of programs, and the existence of security vulnerabilities has become an important factor threatening information security.

[0003] In the related art, manual analysis and fixed rule bases are usually used to achieve vulnerability identification. The applicant realizes that although manual analysis can deeply understand the software logic and identify complex vulnerabilities, it is time-consuming and labor-intensive, and it is difficult to cope with massive codes and fast-iterative software development cycles, and the vulnerability identification efficiency is low; and the fixed rule-based method is limited by the update speed of the rule base, and it is often difficult to identify new vulnerability types or variants in a timely manner, the effectiveness of vulnerability detection is greatly reduced, the missed and false alarm rates are high, and the overall security of the program cannot be effectively guaranteed. Summary of the invention

[0004] In view of this, the present application provides a vulnerability identification method and system based on program-related information. The main purpose is to solve the current low efficiency of vulnerability identification. It is often difficult to identify new vulnerability types or variants in a timely manner, the effectiveness of vulnerability detection is greatly reduced, the missed report and false alarm rates are high, and the overall security of the program cannot be effectively guaranteed.

[0005] According to the first aspect of the present application, a vulnerability identification method based on program-related information is provided, the method comprising:

[0006] Determine a target program for which vulnerability identification is to be performed, and obtain program configuration information of the target program;

[0007] Arranging information items included in the program configuration information to obtain vulnerability matching conditions;

[0008] In a local database storing preset vulnerability information, a fuzzy matching operation and an exact matching operation are performed using the vulnerability matching condition, and the matched preset vulnerability information is used as the vulnerability information of the target program.

[0009] Optionally, determining a target program for which vulnerability identification is to be performed and obtaining program configuration information of the target program includes:

[0010] According to a preset vulnerability identification mechanism, determining the target program from a plurality of programs currently being monitored for vulnerabilities;

[0011] Calling a system interface to collect hardware information of the target program, and using the system interface to obtain operating system information of the target program;

[0012] Reading a configuration file of the target program, and obtaining installation information and running information of the target program from the configuration file;

[0013] The hardware information, the operating system information, the installation information and the running information are used as the program configuration information.

[0014] Optionally, determining the target program from a plurality of programs currently being monitored for vulnerabilities according to a preset vulnerability identification mechanism includes:

[0015] When the vulnerability identification mechanism indicates that vulnerability identification is performed periodically, a preset identification interval duration is obtained, the first historical time point when vulnerability identification was last performed on each of the programs is queried, and the program whose time interval between the first historical time point and the current time point reaches the identification interval duration among the multiple programs is taken as the target program; and / or,

[0016] When the vulnerability identification mechanism indicates that vulnerability identification is to be performed according to usage frequency or risk level, a preset frequency threshold or a preset risk level threshold is obtained, and a first program whose usage frequency reaches the frequency threshold or whose risk level reaches the risk level threshold is determined among the multiple programs; a vulnerability information database is matched for the first program according to the program type of the first program; when it is detected that the vulnerability information database is updated, the first program is used as a target program, and programs among the multiple programs except the first program are used as second programs; the preset identification interval duration is obtained, and a second historical time point when the second program last performed vulnerability identification is queried; when it is detected that the time interval between the current time point and the second historical time point reaches the identification interval duration, the second program is used as the target program.

[0017] Optionally, the using the vulnerability matching condition to perform a fuzzy matching operation and an exact matching operation, and using the matched preset vulnerability information as the vulnerability information of the target program, includes:

[0018] Obtaining a preset standard matching condition, comparing the information items included in the vulnerability matching condition with the preset information items included in the standard matching condition, and determining missing information items that are missing from the vulnerability matching condition compared to the standard matching condition;

[0019] The vulnerability matching condition is marked by using the missing information item, so that the missing information item is blurred when performing an exact matching operation, and the exact matching operation of the missing information item is omitted;

[0020] An exact matching operation is performed based on the marked vulnerability matching condition, and preset vulnerability information stored in the local database is searched for preset vulnerability information whose each information item is the same as the information item included in the marked vulnerability matching condition as vulnerability information of the target program.

[0021] Optionally, the method further comprises:

[0022] Periodically matching the latest vulnerability information through an external interface and performing data cleaning operations on the latest vulnerability information;

[0023] A standard data template is obtained, the cleaned latest vulnerability information is sorted according to the standard data template, and the sorted information is stored in the local database as preset vulnerability information.

[0024] Optionally, the method further comprises:

[0025] Obtain vulnerability prediction model;

[0026] Periodically inputting program configuration information of each program currently being monitored for vulnerabilities into the vulnerability prediction model, and obtaining predicted vulnerability information output by the vulnerability prediction model;

[0027] The predicted vulnerability information is used to mark the currently predicted program and generate a vulnerability reminder.

[0028] Optionally, obtaining a vulnerability prediction model includes:

[0029] Acquire a training set, wherein the training set includes a plurality of sample program configuration information, and each sample configuration information corresponds to sample vulnerability information;

[0030] Determine a preset neural network model, input the sample configuration information included in the training set into the preset neural network model, and obtain a prediction value output by the preset neural network model for each sample configuration information;

[0031] The loss value is calculated using the sample vulnerability information corresponding to each of the sample configuration information and the output prediction value, the model parameters of the preset neural network model are updated based on the loss value, and the sample configuration information included in the training set is re-input into the preset neural network model after the parameter update, and the loss value is recalculated, until the number of times the training set is input into the preset neural network model reaches a number threshold or the loss value reaches a loss value threshold, and the current preset neural network model is used as the vulnerability prediction model.

[0032] According to a second aspect of the present application, a vulnerability identification system based on program-related information is provided, the system comprising:

[0033] An information collection module is used to determine a target program for vulnerability identification and obtain program configuration information of the target program;

[0034] A matching analysis module, used to sort out the information items included in the program configuration information to obtain vulnerability matching conditions;

[0035] The matching analysis module is also used to perform fuzzy matching operations and exact matching operations using the vulnerability matching conditions in a local database storing preset vulnerability information, and to use the matched preset vulnerability information as vulnerability information of the target program.

[0036] Optionally, the information collection module is used to determine the target program among multiple programs currently being monitored for vulnerabilities according to a preset vulnerability identification mechanism; call a system interface to collect hardware information of the target program, and use the system interface to obtain operating system information of the target program; read a configuration file of the target program, and obtain installation information and running information of the target program from the configuration file; and use the hardware information, the operating system information, the installation information, and the running information as the program configuration information.

[0037] Optionally, the information collection module is used to, when the vulnerability identification mechanism indicates that vulnerability identification is to be performed periodically, obtain a preset identification interval duration, query the first historical time point when vulnerability identification was last performed on each of the programs, and use the program whose time interval between the first historical time point and the current time point in the multiple programs reaches the identification interval duration as the target program; and / or, when the vulnerability identification mechanism indicates that vulnerability identification is to be performed according to usage frequency or risk level, obtain a preset frequency threshold or a preset risk level threshold, determine the first program whose usage frequency reaches the frequency threshold or whose risk level reaches the risk level threshold in the multiple programs, match the vulnerability information database for the first program according to the program type of the first program, use the first program as the target program when it is detected that the vulnerability information database is updated, and use the program other than the first program in the multiple programs as the second program, obtain the preset identification interval duration, query the second historical time point when vulnerability identification was last performed on the second program, and use the second program as the target program when it is detected that the time interval between the current time point and the second historical time point reaches the identification interval duration.

[0038] Optionally, the matching analysis module is used to obtain a preset standard matching condition, compare the information items included in the vulnerability matching condition with the preset information items included in the standard matching condition, and determine the missing information items that are missing from the vulnerability matching condition compared to the standard matching condition; use the missing information items to mark the vulnerability matching condition so that the missing information items are blurred when performing an exact matching operation, and the exact matching operation on the missing information items is omitted; perform an exact matching operation based on the marked vulnerability matching condition, and query the preset vulnerability information stored in the local database for preset vulnerability information in which each information item is the same as the information item included in the marked vulnerability matching condition as the vulnerability information of the target program.

[0039] Optionally, the vulnerability identification system based on program-related information further includes:

[0040] The vulnerability database module is used to periodically match the latest vulnerability information through an external interface and perform data cleaning operations on the latest vulnerability information; obtain a standard data template, organize the cleaned latest vulnerability information according to the standard data template, and store the organized information as preset vulnerability information in the local database.

[0041] Optionally, the vulnerability identification system based on program-related information further includes:

[0042] A vulnerability prediction module is used to obtain a vulnerability prediction model; periodically input the program configuration information of each program currently being monitored for vulnerabilities into the vulnerability prediction model, and obtain the predicted vulnerability information output by the vulnerability prediction model; use the predicted vulnerability information to mark the currently predicted program and generate a vulnerability reminder.

[0043] Optionally, the vulnerability prediction module is used to obtain a training set, wherein the training set includes multiple sample program configuration information, and each sample configuration information corresponds to sample vulnerability information; determine a preset neural network model, input the sample configuration information included in the training set into the preset neural network model, and obtain the prediction value output by the preset neural network model for each sample configuration information; calculate the loss value using the sample vulnerability information corresponding to each sample configuration information and the output prediction value, update the model parameters of the preset neural network model based on the loss value, and re-input the sample configuration information included in the training set into the preset neural network model after the parameter update, and recalculate the loss value, until the number of times the training set is input into the preset neural network model reaches a number threshold or the loss value reaches a loss value threshold, and the current preset neural network model is used as the vulnerability prediction model.

[0044] According to a third aspect of the present application, a computer device is provided, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any one of the methods described in the first aspect when executing the computer program.

[0045] According to a fourth aspect of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of any one of the methods described in the first aspect are implemented.

[0046] Through the above technical scheme, the present application provides a vulnerability identification method and system based on program-related information. The present application determines the target program to be subject to vulnerability identification, obtains the program configuration information of the target program, organizes the information items included in the program configuration information, obtains vulnerability matching conditions, and uses the vulnerability matching conditions to perform fuzzy matching operations and exact matching operations in a local database storing preset vulnerability information, and uses the matched preset vulnerability information as the vulnerability information of the target program. While significantly improving the vulnerability identification efficiency based on automatic vulnerability identification, the accuracy of vulnerability identification is improved by constructing vulnerability matching conditions and multiple matching strategies, thereby effectively ensuring the overall security of the program.

[0047] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0049] Figure 1 A schematic diagram of a vulnerability identification method based on program-related information provided by an embodiment of the present application is shown;

[0050] Figure 2 A schematic diagram of another vulnerability identification method based on program-related information provided by an embodiment of the present application is shown;

[0051] Figure 3 A schematic diagram of the architecture of a vulnerability identification system based on program-related information provided by an embodiment of the present application is shown;

[0052] Figure 4 A schematic diagram of the device structure of a computer device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0053] The exemplary embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0054] The present application embodiment provides a vulnerability identification method based on program related information, such as Figure 1 As shown, the method includes:

[0055] 101. Determine a target program for vulnerability identification and obtain program configuration information of the target program.

[0056] Before starting the vulnerability identification process, you first need to identify which program or programs are the targets of this identification, that is, determine the target program for vulnerability identification. The target program can be manually specified or automatically determined by the system. Once the target program is determined, the next step is to collect the configuration information of the target program so that vulnerability identification can be achieved using the program configuration information.

[0057] The program configuration information of the target program can be comprehensively collected by analyzing the configuration files, environment variables, registry entries, etc. of the target program. The program configuration information may include the operating system information, installation information and operation information of the target program, which is not specifically limited in this application.

[0058] 102. Arrange the information items included in the program configuration information to obtain vulnerability matching conditions.

[0059] After collecting the configuration information of the target program, it is necessary to organize and analyze the program configuration information to extract information items related to potential vulnerabilities, and build vulnerability matching conditions based on the information items. The vulnerability matching conditions will be used in the subsequent matching process with the preset vulnerability information.

[0060] 103. In a local database storing preset vulnerability information, a fuzzy matching operation and an exact matching operation are performed using vulnerability matching conditions, and the matched preset vulnerability information is used as vulnerability information of the target program.

[0061] The local database stores preset vulnerability information, which comes from known security vulnerability reports, research results of third-party security organizations, or findings of the internal security team. Each vulnerability information includes a detailed description, impact range, severity, and possible repair suggestions.

[0062] After determining the vulnerability matching conditions, it is necessary to perform a matching operation in the local database, and the matching operation may specifically include a fuzzy matching operation and an exact matching operation. Among them, since it is sometimes impossible to obtain accurate program configuration information, resulting in missing vulnerability matching conditions, a fuzzy matching operation will be performed in the embodiment of the present application. Fuzzy matching is intended to capture configurations that are similar to but may not be completely consistent with known vulnerability patterns, and to identify similar vulnerabilities that may exist by comparing the similarity and relevance of the currently acquired information items. On the contrary, some program configuration information is very accurate and does not lack any information items. Therefore, the embodiment of the present application will also perform an exact matching operation. For situations where the exact matching of known vulnerability configurations is performed, the existence of the vulnerability can be directly confirmed, and the corresponding vulnerability information will be reported.

[0063] It should be noted that, whether it is fuzzy matching or exact matching, once the matching preset vulnerability information is found, it will be output as the potential vulnerability information of the target program. In the actual application process, the vulnerability information can include the description of the vulnerability, the affected components, the severity rating, the possible risks, and the recommended repair steps, etc., to help users or administrators take timely measures to enhance the security of the program.

[0064] The method provided in the embodiment of the present application determines a target program for vulnerability identification, obtains program configuration information of the target program, organizes information items included in the program configuration information, obtains vulnerability matching conditions, performs fuzzy matching operations and exact matching operations in a local database storing preset vulnerability information using the vulnerability matching conditions, and uses the matched preset vulnerability information as the vulnerability information of the target program. While significantly improving the vulnerability identification efficiency based on automatic vulnerability identification, the accuracy of vulnerability identification is improved by constructing vulnerability matching conditions and multiple matching strategies, thereby effectively ensuring the overall security of the program.

[0065] Further, as a refinement and extension of the specific implementation of the above embodiment, in order to fully illustrate the specific implementation process of this embodiment, the embodiment of the present application provides another vulnerability identification method based on program-related information, such as Figure 2 As shown, the method includes:

[0066] 201. According to a preset vulnerability identification mechanism, a target program is determined from among multiple programs currently being monitored for vulnerabilities.

[0067] The embodiment of the present application can be applied to a vulnerability identification system, which may include an information collection module, a vulnerability database module, and a matching analysis module. The information collection module is used to obtain the program configuration information of the target program to be identified for vulnerability; the vulnerability database module is used to regularly collect the latest vulnerability information and update it to the local database; the matching analysis module is used to construct a vulnerability matching condition based on the program configuration information collected by the vulnerability identification system, so as to use the vulnerability matching condition to perform fuzzy matching operations and exact matching operations in the local database, thereby determining the vulnerability information of the target program.

[0068] Before starting the vulnerability identification process, it is first necessary to clarify which program or programs are the targets of this identification, that is, to determine the target program for vulnerability identification. The target program can be manually specified, or it can also be determined by automatic scanning by the system. Therefore, in order to enable the system to determine the target program by itself, a vulnerability identification mechanism is preset in the embodiment of the present application. The system will determine the target program from multiple programs currently being monitored for vulnerabilities according to the preset vulnerability identification mechanism. Among them, the vulnerability identification mechanism can indicate periodic vulnerability identification, indicate vulnerability identification according to frequency of use or risk level, and so on.

[0069] Periodic vulnerability identification is a mechanism that performs vulnerability scans regularly at preset time intervals. This mechanism ensures that security assessments can be performed regularly regardless of how the program is used or how its risk status changes. By setting a fixed scanning period (such as daily, weekly, monthly, etc.), the system can automatically schedule scanning tasks to promptly discover and report potential security vulnerabilities. Therefore, when the vulnerability identification mechanism indicates that vulnerability identification should be performed periodically, it is necessary to first obtain the preset identification interval duration, then query the first historical time point when vulnerability identification was last performed on each program, and select the program whose time interval between the first historical time point and the current time point reaches the identification interval duration as the target program.

[0070] Vulnerability identification based on usage frequency is a strategy that dynamically selects scanning targets based on the actual usage of the program. This mechanism prioritizes resources to programs that are used more frequently by analyzing indicators such as program access volume, user activity, and API (Application Programming Interface) call frequency. This strategy assumes that programs with higher usage frequencies are more likely to become targets of attackers, so they require more frequent security checks and vulnerability scans. Vulnerability identification based on risk level is a mechanism that prioritizes scanning tasks based on the potential security risks of the program. This mechanism evaluates the risk level of each program by comprehensively considering multiple factors (such as the program's historical vulnerability records, whether sensitive services are exposed to the outside, whether sensitive data is stored, etc.), and formulates a scanning plan accordingly. High-risk programs will be scanned first to ensure that possible security vulnerabilities are discovered and repaired in a timely manner, thereby reducing the overall security risk. Therefore, when the vulnerability identification mechanism indicates that vulnerability identification is performed based on usage frequency or risk level, it is necessary to first obtain a preset frequency threshold or a preset risk level threshold. The frequency threshold is used to indicate that programs with a usage frequency higher than a certain level need to be paid extra attention, while the risk level threshold is used to indicate that programs with a risk level higher than a certain level need to be paid extra attention. Next, a first program whose usage frequency reaches a frequency threshold or whose risk level reaches a risk level threshold is determined among multiple programs, and a vulnerability information database is matched for the first program according to the program type of the first program (such as Web application, database, API service, etc.). Among them, the vulnerability information database contains known security vulnerabilities and attack modes for this type of program, and the vulnerability information database will be updated at a high frequency. Therefore, the embodiment of the present application uses the high-frequency update attribute of the vulnerability information database to realize high-frequency vulnerability identification of the program, that is, when the vulnerability information database update is detected, the first program is used as the target program, and the program other than the first program in the multiple programs is used as the second program, and the preset identification interval duration is obtained. The second historical time point when the second program last performed vulnerability identification is queried, and when it is detected that the time interval between the current time point and the second historical time point reaches the identification interval duration, the second program is used as the target program. For example, frequently used office software such as Office and WPS have extremely high requirements for security due to their wide user base and important business functions. Therefore, such programs can be used as the first program, and vulnerability identification is performed when the corresponding vulnerability database is updated to ensure that such programs can continue to provide users with safe and reliable services.

[0071] In this way, through the above process, the update frequency of vulnerability information is intelligently adjusted according to the frequency of use of the program and the security risk level, ensuring that the vulnerability information of high-risk programs is always kept up to date. It should be noted that in addition to the above method for determining the target program, an automated scanning mechanism can also be introduced to automatically identify programs with potential vulnerabilities as target programs through registry analysis, process monitoring, etc. Among them, when performing registry analysis, it is not limited to conventional key item traversal, but in-depth scanning of registry items specific to applications or services, such as the installation path, configuration options, permission settings, and other sensitive information of the program, which are crucial for identifying potential vulnerabilities. In addition to directly matching the registry features of known vulnerabilities, the vulnerability identification system in the embodiment of the present application also has the ability to detect abnormal or inconsistent registry patterns, such as identifying unauthorized changes, injection of malware, or configuration errors, etc., which may become the source of potential vulnerabilities. After completing the registry analysis, the vulnerability identification system analyzes the version number information recorded in the registry and compares it with the officially released security updates and vulnerability fix information to evaluate whether the target program may have known unpatched vulnerabilities. At the same time, it conducts a risk level assessment based on the program's release date and historical vulnerability records to determine whether to target the program.

[0072] Process monitoring is not limited to the acquisition of static information, but more importantly, it is a real-time analysis of process behavior patterns. By monitoring the process's network communications (such as TCP / IP connections), file operations (such as reading, writing, and executing), system calls, etc., abnormal or suspicious behaviors such as unauthorized access and data leakage attempts can be identified. Furthermore, the permission settings of the process and its dependencies on other system resources are analyzed to identify potential privilege escalation vulnerabilities or resource abuse paths, with special attention paid to processes with high permissions or access to sensitive resources. When abnormal behavior is monitored, the currently monitored program can be used as the target program to enable subsequent vulnerability identification of the target program.

[0073] 202. Call the system interface to collect the hardware information of the target program, and use the system interface to obtain the operating system information of the target program, read the configuration file of the target program, obtain the installation information and running information of the target program in the configuration file, and use the hardware information, operating system information, installation information and running information as program configuration information.

[0074] In the embodiment of the present application, in order to ensure a comprehensive and accurate security assessment of the target program, it is a very important step to collect its related program configuration information. The program configuration information includes but is not limited to hardware information, operating system information, installation information and operation information.

[0075] Among them, the target application provides a system interface for accessing hardware information. Therefore, the hardware information of the target program can be collected by calling the system interface. In the actual application process, the hardware information can be obtained by calling the system API. The hardware information includes but is not limited to the CPU (Central Processing Unit) model, memory size, hard disk capacity and network configuration. Similarly, the system interface can also be used to obtain the operating system information of the target program, such as obtaining the operating system type and version information of the target program by calling the target program operating system API or reading the system file.

[0076] Furthermore, the configuration file of the target program is read, and the installation information and operation information of the target program are obtained from the configuration file. Among them, the location of the configuration file of the target program can be determined first, which can usually be found through the official documentation of the target program, the file list in the installation directory, or the environment variables and other information. Then, these configuration files are opened and parsed by writing code or using existing file reading tools. The content of the configuration file contains key information such as the program's installation path, database connection information, and operation parameters. Finally, information related to the security assessment of the target program (such as installation path, service port, permission settings, version information of the target program, dependent library information, etc.) is extracted from the configuration file.

[0077] The hardware information, operating system information collected in the above process, and the installation information and operation information extracted from the configuration file are integrated to form a complete program configuration information.

[0078] It should be noted that in the embodiments of the present application, the program configuration information is subsequently used for automatic vulnerability identification, and in the actual application process, the program configuration information can be used to form a configuration information report, and the report can be stored in an appropriate location (such as a database, file system, etc.), and further, a visual display interface or report can be generated as needed to facilitate further analysis and evaluation by staff. The present application does not specifically limit the operations performed using the program configuration information.

[0079] Furthermore, the collected program configuration information can also be encrypted and stored and access controlled. Among them, the appropriate encryption algorithm can be selected according to actual needs. For example, for sensitive information such as installation path and service port, an asymmetric encryption algorithm can be used for encryption, while for memory size and hard disk capacity, a symmetric encryption algorithm can be used. After storage, different access rights can be divided according to different user roles and business needs. For example, only administrators can view sensitive configuration information, or role-based access control (RBAC) or attribute-based access control (ABAC) and other strategies can be used to achieve fine-grained permission control. In addition, the user's access behavior to the configuration information and matching results can be recorded, including access time, access user, access content, etc., and the access log can be reviewed regularly to deal with abnormal behavior in a timely manner. In this way, by implementing the above encryption storage and access control strategies, the security and privacy of program configuration information can be effectively protected, and the risk of data leakage and abuse can be reduced.

[0080] 203. Arrange the information items included in the program configuration information to obtain vulnerability matching conditions.

[0081] In an embodiment of the present application, after the program configuration information is obtained, the information items included in the program configuration information are sorted to obtain vulnerability matching conditions to ensure that potential security vulnerabilities can be accurately and efficiently identified.

[0082] Among them, it is necessary to organize the collected program configuration information according to different dimensions to determine multiple information items. It can be seen from the content in step 202 that the program configuration information includes hardware information, operating system information, installation information and operation information, and the hardware information can specifically include manufacturer information (such as CPU manufacturer, motherboard manufacturer), model information (such as CPU model, motherboard model), and other hardware characteristics (such as memory size, hard disk type). Manufacturer information, model information, and other hardware characteristics can all be used as an information item. The operating system information can specifically include the operating system type (such as Windows, Linux), the operating system version (such as Windows 10 20H2, Ubuntu 20.04), the kernel version (for Linux system), and the architecture (such as x86, x64, ARM), and each of the above information can be used as an information item. The installation information can specifically include the program name, program version, installation path, dependent components and versions, and each of the information can be used as an information item. The operation information can specifically include startup parameters, runtime permissions, port occupancy, and service status, and each of the above information can be used as an information item.

[0083] Based on the information items organized above, it is possible to construct sophisticated vulnerability matching conditions, which will be used for comparison in the vulnerability database to identify known vulnerabilities that match the target program configuration.

[0084] 204. Obtain a preset standard matching condition, compare the information items included in the vulnerability matching condition with the preset information items included in the standard matching condition, determine the missing information items that are missing from the vulnerability matching condition compared to the standard matching condition, and use the missing information items to mark the vulnerability matching condition so that the missing information items are blurred when performing an exact matching operation, thereby omitting the exact matching operation on the missing information items.

[0085] When automatically identifying vulnerabilities, due to the limitations of program configuration information collection or format differences, complete matching conditions may not be available. At this time, a flexible strategy is needed to adapt to this situation. Therefore, this application implements dynamic processing of missing information items through preset standard matching conditions, thus realizing an effective solution.

[0086] Specifically, it is necessary to define a set of preset standard matching conditions first. The standard matching conditions cover all key information items that usually need to be considered in the vulnerability matching process. The standard matching conditions constitute the ideal state when performing vulnerability matching. For example, the standard matching conditions can include key information items such as manufacturer information, product name, product version, operating system type, operating system version, and architecture. These key information items are used as preset information items.

[0087] After completing the determination of the preset standard matching conditions, the information items included in the vulnerability matching conditions can be compared with the preset information items included in the standard matching conditions to determine the missing information items that are missing in the vulnerability matching conditions compared to the standard matching conditions. For missing information items, when performing an exact matching operation, these missing items should be ignored and not included in the consideration of the matching calculation. Therefore, in the embodiment of the present application, the missing information items are used to mark the vulnerability matching conditions so that the missing information items are blurred when performing an exact matching operation, and the exact matching operation of the missing information items is omitted. For example, if the vulnerability matching condition lacks a version number, the version number is used as a missing information item to mark the vulnerability matching condition so as to blur the concept of the version number during the matching process.

[0088] 205. Perform an exact matching operation based on the marked vulnerability matching condition, and search for preset vulnerability information stored in the local database, each of which has the same information item as the information item included in the marked vulnerability matching condition, as vulnerability information of the target program.

[0089] In the embodiment of the present application, the vulnerability matching conditions after annotation are used to perform an exact matching operation in the preset vulnerability information stored in the local database. At this time, only known information items are considered for accurate comparison. If a preset vulnerability information matches the configuration information of the target program on all these known information items, it is regarded as a potential candidate vulnerability. For missing information items marked as missing, a fuzzy matching strategy is adopted. For example, if the version number information is missing, the version number is not used as an exact matching condition when querying, but multiple version ranges that may be affected are considered or the default version assumption is used for matching. For other types of missing information, fuzzy matching techniques such as similarity comparison and regular expression matching can also be used to identify possible similar items. In addition, relying solely on exact matching and fuzzy matching may not be enough to fully discover all potential vulnerabilities. Therefore, the context information of the target program, including the operating environment, user behavior, etc., needs to be considered. Among them, different operating environments may have different effects on the behavior of the program. For example, the operating system version, hardware configuration, network status, etc. may change the execution path or data processing method of the program. Therefore, in the process of vulnerability identification, it is necessary to understand and simulate the actual operating environment of the target program to ensure the accuracy of the identification result. Furthermore, user behavior is also an important factor affecting program security. For example, user input data may contain malicious code or abnormal values, causing vulnerabilities in the program when processing this data. Therefore, in the vulnerability identification process, it is necessary to simulate various possible user behaviors, including normal and abnormal behaviors, to comprehensively evaluate the security of the program.

[0090] Among them, the local database stores preset vulnerability information, which comes from known security vulnerability reports, research results of third-party security organizations, or findings of internal security teams. Each vulnerability information contains a detailed description, impact range, severity, and possible repair suggestions. In order to ensure that the preset vulnerability information stored in the local database is the latest, so as to identify the new version of the vulnerability, in the embodiment of the present application, the latest vulnerability information will be periodically matched through the external interface. Specifically, a timer can be set to regularly (for example, every hour) obtain the latest vulnerability information from the NVD (National Vulnerability Database) and the security reports officially provided by each operating system through the API interface. Considering that there are repeated or invalid fields in the latest vulnerability information obtained, and the formats of vulnerability information from different sources are different, in the embodiment of the present application, after obtaining the latest vulnerability information, the latest vulnerability information will be cleaned, the standard data template will be obtained, and the latest vulnerability information after cleaning will be sorted according to the standard data template, and the sorted information will be stored in the local database as the preset vulnerability information, and the vulnerability information will be processed using data cleaning and standardization technology to ensure the consistency and accuracy of the data. Specifically, the cleaning operation may include the removal of redundant data operations, that is, identifying and deleting duplicate vulnerability entries or invalid fields; it may also include format unification operations, that is, formatting vulnerability information from different sources into a unified format, such as date format, version number format, etc.; it may also include field completion and correction operations, that is, filling in missing fields or correcting erroneous data based on known information or default rules. In this way, the acquired vulnerability information is stored in the local database, the most recently used vulnerability information and query results are cached locally, and the index mechanism is used to reduce repeated queries and improve response speed. It should be noted that when storing vulnerability information, the strategy of storing program configuration information in step 202 above can also be adopted to effectively protect the security and privacy of vulnerability information.

[0091] In this way, the combination of fuzzy matching and exact matching can improve the comprehensiveness and accuracy of vulnerability identification. In addition, in the actual application process, multi-threading technology and caching mechanism can be used to optimize the query process, improve the efficiency of vulnerability identification, and solve the performance bottleneck problem in the query process from different angles. Among them, multi-threading technology allows the program to execute multiple tasks at the same time, thereby making full use of the computing power of multi-core processors. When identifying vulnerabilities, the identification task can be divided into multiple subtasks, each of which is executed by an independent thread. Specifically, the identification request can be divided into multiple parts that can be processed in parallel. For example, if the identification involves multiple database tables or different data types, these parts can be assigned to different threads; then, according to system resources (such as the number of CPU cores) and the nature of the identification task, an appropriate number of threads are created, and the split subtasks are assigned to these threads for execution; then, appropriate synchronization mechanisms (such as locks, semaphores, conditional variables, etc.) are used to ensure data consistency between threads and avoid race conditions, and effective inter-thread communication mechanisms are designed so that threads can share results or pass intermediate data; finally, after all threads complete their tasks, their results are merged into the final vulnerability identification result. The cache mechanism reduces the number of accesses to the original data source by storing vulnerability identification results or intermediate data, thereby speeding up the query. During the vulnerability identification process, commonly used query results or frequently accessed data can be cached. Specifically, you can first select a suitable cache strategy, such as LRU (least recently used), LFU (least frequently used), etc., to determine the cache size and expiration strategy to avoid the cache being too large or the cached data being outdated; then use the existing cache library or framework to implement the cache function. During the query process, first check whether the required data exists in the cache. If it exists, read the data directly from the cache. If it does not exist, perform a matching operation and store the result in the cache. It should be noted that when the original data source changes, it is necessary to update the data in the cache or invalidate the cache, and design a suitable cache invalidation strategy to ensure the accuracy and consistency of the cached data.

[0092] The process described above is a vulnerability identification process based on exact matching and fuzzy matching. In actual application, program vulnerability identification can also be achieved based on structure matching, behavior pattern matching, data flow matching and other means. These means are described below:

[0093] Structural matching focuses on the characteristics of the internal structure of the target program, including code structure, data layout, control flow, etc. Potential security risks are identified by comparing the differences between the structural characteristics of the target program and known vulnerability patterns or security best practices. Specifically, the source code or binary code of the target program can be parsed to extract the structural information of the program (such as function call relationships, class inheritance structure, data definitions, etc.), and matched with the structural characteristics in the security vulnerability database; for target programs without source code, their binary code can be obtained through disassembly or decompilation technology, and similar structural analysis can be performed. Alternatively, a dependency graph of the target program (such as a function call graph, control flow graph, etc.) can be constructed to analyze the complexity and potential security weaknesses of the program through graph theory methods, such as parsing the source code or binary code to identify function call instructions and then generate a function call graph; or the program code can be decomposed into basic blocks (sequences of statements executed sequentially), and these basic blocks are connected according to control flow instructions (such as conditional jumps, loops, function calls, and returns) to generate a control flow graph, and then all paths (or representative path subsets) in the control flow graph are traversed to identify abnormal paths that may cause security issues, etc.

[0094] Behavioral pattern matching focuses on the behavioral characteristics of the target program at runtime, including network communication patterns, file operation patterns, system call patterns, etc. By monitoring and analyzing these behavioral patterns, abnormal or suspicious behaviors can be identified, thereby discovering potential security vulnerabilities. Specifically, the target program can be run in a controlled environment (such as a sandbox), all its external interactions (such as network requests, file reading and writing, etc.) can be monitored, and these behavioral patterns can be matched with known security threats or abnormal behavior patterns; or, dynamic tracing technology (such as strace, sysdig, etc.) can be used to record the system calls and underlying operations of the target program in real time, and analyze whether its behavior meets the expected security specifications.

[0095] Data flow matching focuses on the source, flow and processing of data in the target program. By analyzing key points and sensitive operations in the data flow, security vulnerabilities such as data leakage and tampering can be identified. Specifically, specific input data (such as user input, external files, etc.) can be marked as "tainted" in the target program, and the propagation path of these tainted data in the target program can be tracked. Once the tainted data is used for sensitive operations (such as system calls, file writing, etc.), an alarm is triggered; or, information flow tracking technology (such as static information flow analysis, dynamic information flow tracking, etc.) is used to record the data transmission process in the program, and analyze whether the data is processed correctly or there is a potential risk of leakage; or, symbolic execution technology can be used to simulate the execution path of the program under different input conditions, and record the value changes of key data points in the program, which helps to find security vulnerabilities that are only triggered under specific conditions.

[0096] In this way, by introducing means such as structure matching, behavior pattern matching and data flow matching, it is possible to more comprehensively identify potential vulnerabilities in the target program and improve the accuracy and efficiency of security scanning. It should be noted that these means can complement and be used in combination to form a more complete and powerful vulnerability identification capability.

[0097] In another optional technical solution, the present application also introduces a machine learning algorithm to analyze historical vulnerability data, predict possible security vulnerabilities, and improve the ability to identify unseen vulnerabilities, which specifically includes the following three steps:

[0098] Step 1: Obtain vulnerability prediction model.

[0099] The vulnerability prediction model is used to predict vulnerabilities. In order to train the vulnerability prediction model, this application needs to appropriately encode and convert different types of configuration information to achieve feature extraction in order to form a training set, so that the training set includes multiple sample program configuration information, and each sample configuration information corresponds to sample vulnerability information. Among them, some hardware information, operating system information, and program information can be collected as samples, and these samples are cleaned to process missing values ​​and outliers; the data is standardized to scale the numerical features to the same range; and for the image data, more samples are generated using rotation, flipping and other techniques. After completing the above processing, feature extraction is performed on the current sample to construct a training set. Since the sample will include hardware information, operating system information and program information, the feature extraction process of hardware information, operating system information and program information is described below respectively:

[0100] Hardware information includes CPU model, memory size, hard disk capacity, and network device information. Due to the wide variety of CPU models, one-hot encoding or label encoding is used in the embodiment of the present application to encode the CPU model. Among them, if the number of CPU models is small, one-hot encoding can be used; if the number is large, consider using label encoding to reduce the feature dimension. The memory size does not require additional encoding and can be directly used as a numerical feature with a unified unit (such as GB). The hard disk capacity does not require additional encoding, and is the same as the memory size. It is directly expressed in numerical terms with a unified unit. Network device information can encode the device type and quantity separately. Among them, the device type can be encoded using one-hot encoding, and the quantity can be directly expressed in numerical terms.

[0101] The operating system information includes the operating system type and version, kernel version, and security patch level. Among them, one-hot encoding can be used to represent different operating system types and versions, that is, the operating system type and version are combined into a string, and then one-hot encoding is performed using the corresponding function. For the kernel version, the kernel version number can be split into multiple parts (such as major version number, minor version number), and each part is encoded. For the security patch level, select the appropriate encoding method according to the nature of the security patch level, directly use numerical representation or one-hot encoding, that is, if the security patch level is discrete (such as SP1, SP2, etc.), one-hot encoding can be used; if it is continuous (such as the number of patches), it is directly represented by numerical values.

[0102] Application information includes application list, version number and configuration file. For the application list, one-hot encoding can be used to represent each installed application, that is, convert the application list into a string list, and then use the corresponding function for one-hot encoding. For the version number, the version number can be split into multiple parts and encoded. For the configuration file, key configuration parameters can be extracted and encoded in an appropriate encoding method. That is, if the parameter value is discrete, one-hot encoding can be used; if it is continuous, it can be directly represented by a numerical value.

[0103] In actual application, after feature extraction is completed through the above process, data preprocessing can also be performed, including processing missing values, standardizing or normalizing numerical features, etc., to ensure data quality and optimize model performance. Finally, all extracted and preprocessed features are integrated into a complete feature set, which is also the training set, for training machine learning models.

[0104] After the training set is constructed, the vulnerability prediction model can be trained. Among them, the embodiment of the present application can use a logistic regression (Logistic Regression) algorithm or a deep learning algorithm convolutional neural network (CNN) for model training. Logistic regression is a linear model for binary classification problems. Its core idea is to use a linear combination of input features and use a sigmoid function to map the results to the (0, 1) interval to obtain the probability of belonging to a certain category. CNN is an important algorithm in the field of deep learning and is good at processing data with a grid structure, such as images, audio, etc. CNN can automatically extract hierarchical features of data through structures such as convolutional layers, pooling layers, and fully connected layers, thereby realizing the recognition of complex patterns. In the embodiment of the present application, both of the above algorithms can be used as preset neural network models for model training.

[0105] When training a model, you need to initialize the model parameters (weights and biases) first, and then select a suitable optimizer (such as Adam, SGD) and loss function. Subsequently, iterative training is started on the training set, and each iteration includes forward propagation, loss calculation, and back propagation. Among them, forward propagation is to input the sample configuration information included in the training set into the preset neural network model (in an appropriate structured form), and the preset neural network model will calculate the output prediction value through the network layer, so that the prediction value output by the preset neural network model for each sample configuration information can be obtained. Calculating the loss is to use the selected loss function to calculate the difference between the predicted value and the true value, that is, to use the sample vulnerability information corresponding to each sample configuration information and the output prediction value to calculate the loss value. The loss value quantifies the poor performance of the model under the current parameter settings. Back propagation is to calculate the gradient through the chain rule and update the weights and biases of the model. The gradient indicates how the parameters should be adjusted to reduce the loss. In CNN, due to the presence of multiple layers and complex connections, back propagation needs to pass the gradient layer by layer, from the output layer to the input layer, that is, to update the model parameters of the preset neural network model based on the loss value. Next, continue to re-input the sample configuration information included in the training set into the preset neural network model after parameter update, and recalculate the loss value until the number of times the training set is input into the preset neural network model reaches the number threshold or the loss value reaches the loss value threshold, and use the current preset neural network model as the vulnerability prediction model, that is, after each iteration, the model parameters will be updated. This process will continue until a certain stopping condition is met, such as the number of training times reaches the preset threshold, the loss value drops below a certain threshold, or the performance on the validation set is no longer significantly improved (that is, overfitting occurs).

[0106] It should be noted that after each training cycle, the validation set can be used to evaluate the performance of the model. The validation set is a data set independent of the training set. It is used to monitor the performance of the model during the training process, but will not be used to train the model itself. By evaluating the performance on the validation set after each training cycle, you can understand whether the model is overfitting (i.e., performing well on the training set but poorly on unseen data) or underfitting (i.e., performing poorly on both the training set and the validation set). Validation set evaluation usually includes calculating some performance indicators, such as accuracy, recall, F1 score, AUC-ROC (Area Under the Curve-Receiver Operating Characteristic, an evaluation indicator for measuring the performance of binary classification models), etc. These indicators can help understand the performance of the model in different aspects. If the performance of the model on the validation set begins to decline (i.e., there are signs of overfitting), training can be stopped early to avoid further deterioration.

[0107] Furthermore, hyperparameter tuning can also be performed. Among them, hyperparameters are parameters that need to be set before model training. They are not learned through the training process, but need to be manually adjusted or automatically searched through algorithms. Hyperparameter tuning is the process of finding the optimal hyperparameter combination to maximize the performance of the model on the validation set. Common hyperparameter tuning methods include grid search and random search. Grid search traverses all possible hyperparameter combinations and evaluates the performance of each combination; random search randomly selects hyperparameter combinations for evaluation, and can find better hyperparameter combinations in a shorter time. In addition to grid search and random search, there are some more efficient hyperparameter tuning methods, such as Bayesian Optimization and gradient-based optimization (such as Hypergradient Descent). This application does not limit the specific method of hyperparameter tuning.

[0108] Furthermore, after the training is completed, the embodiment of the present application will also use a completely unseen data set (i.e., a test set) to evaluate the generalization ability of the model. The test set should be independent of both the training set and the validation set to ensure the fairness of the evaluation results. The purpose of the test set evaluation is to understand the performance of the model in practical applications. When evaluating the model on the test set, the embodiment of the present application uses the same performance indicators as the validation set, and compares the results with the performance on the validation set. If the performance of the model on the test set is similar to the performance on the validation set, then it can be considered that the model has good generalization ability.

[0109] After training the vulnerability prediction model, the embodiment of the present application will save the trained model parameters (including weights and biases) for subsequent use. These parameters can be saved to files on disk, such as .h5 or .tf files of TensorFlow, .pth or .pt files of PyTorch, etc. When saving the model, the architecture information of the model can also be saved so that the model structure can be correctly reconstructed when the model is loaded.

[0110] In addition, the embodiment of the present application will also deploy the vulnerability prediction model and integrate the vulnerability prediction model into an actual application or system. Specifically, the vulnerability prediction model can be embedded in a software application, a Web service, a mobile device or an IoT device to perform real-time vulnerability prediction or regular vulnerability prediction. It should be noted that during the deployment process, factors such as the performance, response time, resource consumption and security of the model need to be considered. Furthermore, in order to ensure the stability and reliability of the vulnerability prediction model in a production environment, a series of tests and verifications can be performed, such as simulating actual traffic and data in a test environment similar to a production environment to evaluate the prediction accuracy and response time of the vulnerability prediction model. At the same time, it is also necessary to ensure the security of the vulnerability prediction model to prevent unauthorized access and data leakage.

[0111] Further, the embodiment of the present application will also monitor and update the vulnerability prediction model. Vulnerability prediction model monitoring is the process of continuously monitoring the performance of the vulnerability prediction model in the production environment. Through monitoring, the degradation or abnormality of the performance of the vulnerability prediction model can be discovered in time, and corresponding measures can be taken to deal with it. The indicators monitored include performance indicators such as accuracy, recall rate, F1 score, and non-performance indicators such as response time and resource consumption. In addition, in order to ensure that the detection capability of the vulnerability prediction model can keep up with the changes in the actual environment, it is essential to regularly update the training data and retrain the vulnerability prediction model. Specifically, it can be achieved by collecting new data samples, marking them and adding them to the training data set. Then, the vulnerability prediction model can be retrained using the updated training data set, and the old vulnerability prediction model can be replaced. In addition, it is also possible to consider using methods such as online learning or incremental learning to continuously update the parameters of the vulnerability prediction model to adapt to the changing environment.

[0112] In this way, the above process can ensure that the vulnerability prediction model continues to play a role in practical applications and maintain its effectiveness and accuracy.

[0113] Step 2: Periodically input the program configuration information of each program currently being monitored for vulnerabilities into the vulnerability prediction model, and obtain the predicted vulnerability information output by the vulnerability prediction model.

[0114] After the vulnerability prediction model is trained, the program configuration information of each program currently under vulnerability monitoring can be periodically input into the vulnerability prediction model, and the predicted vulnerability information output by the vulnerability prediction model can be obtained. The program configuration information can refer to the description of the program configuration information above, which will not be repeated here.

[0115] Step 3: Use the predicted vulnerability information to mark the currently predicted program and generate a vulnerability reminder.

[0116] After obtaining the predicted vulnerability information, the embodiment of the present application will use the predicted vulnerability information to annotate the currently predicted program, and the annotation may include a detailed description of the vulnerability, severity level, possible repair solutions, etc. Furthermore, the predicted vulnerabilities can be classified according to the annotation results for subsequent processing, and the specific classification can be achieved based on factors such as the severity of the vulnerability, the scope of impact, and the difficulty of repair.

[0117] In addition, the embodiments of the present application will also generate vulnerability reminders. The vulnerability reminder specifically includes a vulnerability overview, affected programs, repair suggestions, and priority. Among them, the vulnerability overview is used to briefly describe the nature and potential impact of the vulnerability; the affected programs are used to indicate which programs or components may be affected by the vulnerability; the repair suggestions are used to provide recommended steps to repair the vulnerability or link to a detailed repair guide; the priority is used to set the priority of the repair work according to the severity and scope of the vulnerability.

[0118] After the vulnerability reminder is generated, the embodiment of the present application will send the vulnerability reminder to the relevant development team, security team or system administrator. The notification method may include email, instant message, alarm in the security management system, etc. In this way, the recipient can start the corresponding repair process or security response measures based on the information in the vulnerability reminder.

[0119] In the process of actual application, the embodiment of the present application will also track the progress of the repair of the vulnerability to ensure that the repair work is carried out as planned. In addition, after the repair is completed, a verification test can also be performed to ensure that the vulnerability has been successfully repaired and no new security issues are introduced. In addition, the embodiment of the present application will also feed back the repair results and verification results of the vulnerability into the vulnerability prediction model to optimize the performance and accuracy of the model. At the same time, according to the actual vulnerability processing experience, the preset vulnerability information library and vulnerability reminder process are continuously improved.

[0120] In this way, through the above process, potential vulnerabilities can be identified, marked and reminded more efficiently, thereby speeding up the repair of vulnerabilities and reducing security risks.

[0121] The method provided in the embodiment of the present application determines a target program for vulnerability identification, obtains program configuration information of the target program, organizes information items included in the program configuration information, obtains vulnerability matching conditions, performs fuzzy matching operations and exact matching operations in a local database storing preset vulnerability information using the vulnerability matching conditions, and uses the matched preset vulnerability information as the vulnerability information of the target program. While significantly improving the vulnerability identification efficiency based on automatic vulnerability identification, the accuracy of vulnerability identification is improved by constructing vulnerability matching conditions and multiple matching strategies, thereby effectively ensuring the overall security of the program.

[0122] Further, as Figure 1The specific implementation of the method, the embodiment of the present application provides a vulnerability identification system based on program related information, such as Figure 3 As shown, the vulnerability identification system includes: an information collection module 301 and a matching analysis module 302.

[0123] The information collection module 301 is used to determine the target program for vulnerability identification and obtain program configuration information of the target program;

[0124] The matching analysis module 302 is used to sort out the information items included in the program configuration information to obtain vulnerability matching conditions;

[0125] The matching analysis module 302 is also used to perform fuzzy matching operations and exact matching operations using the vulnerability matching conditions in a local database storing preset vulnerability information, and use the matched preset vulnerability information as vulnerability information of the target program.

[0126] In a specific application scenario, the information collection module 301 is used to determine the target program among multiple programs currently being monitored for vulnerabilities according to a preset vulnerability identification mechanism; call a system interface to collect hardware information of the target program, and use the system interface to obtain operating system information of the target program; read a configuration file of the target program, and obtain installation information and running information of the target program from the configuration file; and use the hardware information, the operating system information, the installation information, and the running information as the program configuration information.

[0127] In a specific application scenario, the information collection module 301 is used to, when the vulnerability identification mechanism indicates that vulnerability identification is performed periodically, obtain a preset identification interval duration, query the first historical time point when each of the programs last executed vulnerability identification, and use the program whose time interval between the first historical time point and the current time point in the multiple programs reaches the identification interval duration as the target program; and / or, when the vulnerability identification mechanism indicates that vulnerability identification is performed according to usage frequency or risk level, obtain a preset frequency threshold or a preset risk level threshold, determine the first program whose usage frequency reaches the frequency threshold or whose risk level reaches the risk level threshold in the multiple programs, match the vulnerability information database for the first program according to the program type of the first program, use the first program as the target program when it is detected that the vulnerability information database is updated, and use the program other than the first program in the multiple programs as the second program, obtain the preset identification interval duration, query the second historical time point when the second program last executed vulnerability identification, and use the second program as the target program when it is detected that the time interval between the current time point and the second historical time point reaches the identification interval duration.

[0128] In a specific application scenario, the matching analysis module 302 is used to obtain a preset standard matching condition, compare the information items included in the vulnerability matching condition with the preset information items included in the standard matching condition, and determine the missing information items that are missing from the vulnerability matching condition compared to the standard matching condition; use the missing information items to mark the vulnerability matching condition so that the missing information items are blurred when performing an exact matching operation, and the exact matching operation on the missing information items is omitted; perform an exact matching operation based on the marked vulnerability matching condition, and query the preset vulnerability information stored in the local database for each information item that is the same as the information item included in the marked vulnerability matching condition as the vulnerability information of the target program.

[0129] In a specific application scenario, the vulnerability identification system based on program-related information also includes:

[0130] The vulnerability database module is used to periodically match the latest vulnerability information through an external interface and perform data cleaning operations on the latest vulnerability information; obtain a standard data template, organize the cleaned latest vulnerability information according to the standard data template, and store the organized information as preset vulnerability information in the local database.

[0131] In a specific application scenario, the vulnerability identification system based on program-related information also includes:

[0132] A vulnerability prediction module is used to obtain a vulnerability prediction model; periodically input the program configuration information of each program currently being monitored for vulnerabilities into the vulnerability prediction model, and obtain the predicted vulnerability information output by the vulnerability prediction model; use the predicted vulnerability information to mark the currently predicted program and generate a vulnerability reminder.

[0133] In a specific application scenario, the vulnerability prediction module is used to obtain a training set, wherein the training set includes multiple sample program configuration information, and each sample configuration information corresponds to sample vulnerability information; determine a preset neural network model, input the sample configuration information included in the training set into the preset neural network model, and obtain the prediction value output by the preset neural network model for each sample configuration information; calculate the loss value using the sample vulnerability information corresponding to each sample configuration information and the output prediction value, update the model parameters of the preset neural network model based on the loss value, and re-input the sample configuration information included in the training set into the preset neural network model after the parameter update, and recalculate the loss value, until the number of times the training set is input into the preset neural network model reaches a number threshold or the loss value reaches a loss value threshold, and the current preset neural network model is used as the vulnerability prediction model.

[0134] The device provided in the embodiment of the present application determines a target program for vulnerability identification, obtains program configuration information of the target program, organizes information items included in the program configuration information, obtains vulnerability matching conditions, and uses the vulnerability matching conditions to perform fuzzy matching operations and exact matching operations in a local database storing preset vulnerability information, and uses the matched preset vulnerability information as the vulnerability information of the target program. While significantly improving the vulnerability identification efficiency based on automatic vulnerability identification, the accuracy of vulnerability identification is improved by constructing vulnerability matching conditions and multiple matching strategies, thereby effectively ensuring the overall security of the program.

[0135] It should be noted that for other corresponding descriptions of the functional units involved in the vulnerability identification system based on program-related information provided in the embodiment of the present application, reference can be made to Figure 1 and Figure 2 The corresponding description in will not be repeated here.

[0136] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0137] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0138] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

[0139] In an exemplary embodiment, see Figure 4 , and also provides a computer device, which includes a bus, a processor, a memory and a communication interface, and may also include an input and output interface and a display device, wherein each functional unit can communicate with each other through the bus. The memory stores a computer program, and the processor is used to execute the program stored in the memory and execute the vulnerability identification method based on program-related information in the above embodiment.

[0140] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the vulnerability identification method based on program-related information.

[0141] Through the description of the above implementation methods, those skilled in the art can clearly understand that the present application can be implemented by hardware, or by means of software plus necessary general hardware platforms. Based on such an understanding, the technical solution of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.), including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each implementation scenario of the present application.

[0142] Those skilled in the art will appreciate that the accompanying drawings are merely schematic diagrams of a preferred implementation scenario, and the modules or processes in the accompanying drawings are not necessarily required for implementing the present application.

[0143] Those skilled in the art will appreciate that the modules in the device in the implementation scenario can be distributed in the device in the implementation scenario according to the implementation scenario description, or can be changed accordingly and located in one or more devices different from the implementation scenario. The modules in the above implementation scenario can be combined into one module, or can be further split into multiple sub-modules.

[0144] The above application serial numbers are for description only and do not represent the advantages or disadvantages of the implementation scenarios.

[0145] The above disclosure only discloses several specific implementation scenarios of the present application. However, the present application is not limited thereto, and any changes that can be conceived by technicians in this field should fall within the scope of protection of the present application.

Claims

1. A vulnerability identification method based on program-related information, characterized in that: include: Determine a target program for which vulnerability identification is to be performed, and obtain program configuration information of the target program; Arranging information items included in the program configuration information to obtain vulnerability matching conditions; In a local database storing preset vulnerability information, fuzzy matching operations and exact matching operations are performed using the vulnerability matching conditions, and the matched preset vulnerability information is used as the vulnerability information of the target program, wherein the fuzzy matching operations and exact matching operations are performed using the vulnerability matching conditions, and the matched preset vulnerability information is used as the vulnerability information of the target program, including: obtaining a preset standard matching condition, comparing the information items included in the vulnerability matching condition with the preset information items included in the standard matching condition, and determining the missing information items that are missing from the vulnerability matching condition compared to the standard matching condition; marking the vulnerability matching condition using the missing information items so that the missing information items are blurred when performing an exact matching operation, and the exact matching operation on the missing information items is omitted; performing an exact matching operation based on the marked vulnerability matching condition, and querying the preset vulnerability information stored in the local database for preset vulnerability information whose information items are the same as the information items included in the marked vulnerability matching condition as the vulnerability information of the target program.

2. The method according to claim 1, characterized in that The step of determining a target program for which vulnerability identification is to be performed and obtaining program configuration information of the target program includes: According to a preset vulnerability identification mechanism, determining the target program from a plurality of programs currently being monitored for vulnerabilities; Calling a system interface to collect hardware information of the target program, and using the system interface to obtain operating system information of the target program; Reading a configuration file of the target program, and obtaining installation information and running information of the target program from the configuration file; The hardware information, the operating system information, the installation information and the running information are used as the program configuration information.

3. The method according to claim 2, characterized in that Determining the target program from among multiple programs currently being monitored for vulnerabilities according to a preset vulnerability identification mechanism includes: When the vulnerability identification mechanism indicates that vulnerability identification is performed periodically, a preset identification interval duration is obtained, the first historical time point when vulnerability identification was last performed on each of the programs is queried, and the program whose time interval between the first historical time point and the current time point reaches the identification interval duration among the multiple programs is taken as the target program; and / or, When the vulnerability identification mechanism indicates that vulnerability identification is to be performed according to usage frequency or risk level, a preset frequency threshold or a preset risk level threshold is obtained, and a first program whose usage frequency reaches the frequency threshold or whose risk level reaches the risk level threshold is determined among the multiple programs; a vulnerability information database is matched for the first program according to the program type of the first program; when it is detected that the vulnerability information database is updated, the first program is used as a target program, and programs among the multiple programs except the first program are used as second programs; the preset identification interval duration is obtained, and a second historical time point when the second program last performed vulnerability identification is queried; when it is detected that the time interval between the current time point and the second historical time point reaches the identification interval duration, the second program is used as the target program.

4. The method according to claim 1, characterized in that The method further comprises: Periodically matching the latest vulnerability information through an external interface and performing data cleaning operations on the latest vulnerability information; A standard data template is obtained, the cleaned latest vulnerability information is sorted according to the standard data template, and the sorted information is stored in the local database as preset vulnerability information.

5. The method according to claim 1, characterized in that The method further comprises: Obtain vulnerability prediction model; Periodically inputting program configuration information of each program currently being monitored for vulnerabilities into the vulnerability prediction model, and obtaining predicted vulnerability information output by the vulnerability prediction model; The predicted vulnerability information is used to mark the currently predicted program and generate a vulnerability reminder.

6. The method according to claim 5, characterized in that The obtaining of the vulnerability prediction model comprises: Acquire a training set, wherein the training set includes a plurality of sample program configuration information, and each sample configuration information corresponds to sample vulnerability information; Determine a preset neural network model, input the sample configuration information included in the training set into the preset neural network model, and obtain a prediction value output by the preset neural network model for each sample configuration information; The loss value is calculated using the sample vulnerability information corresponding to each of the sample configuration information and the output prediction value, the model parameters of the preset neural network model are updated based on the loss value, and the sample configuration information included in the training set is re-input into the preset neural network model after the parameter update, and the loss value is recalculated, until the number of times the training set is input into the preset neural network model reaches a number threshold or the loss value reaches a loss value threshold, and the current preset neural network model is used as the vulnerability prediction model.

7. A vulnerability identification system based on program-related information, characterized in that: include: An information collection module is used to determine a target program for vulnerability identification and obtain program configuration information of the target program; A matching analysis module, used to sort out the information items included in the program configuration information to obtain vulnerability matching conditions; The matching analysis module is also used to perform fuzzy matching operations and exact matching operations using the vulnerability matching conditions in a local database storing preset vulnerability information, and to use the matched preset vulnerability information as the vulnerability information of the target program, wherein the matching analysis module is used to obtain a preset standard matching condition, compare the information items included in the vulnerability matching condition with the preset information items included in the standard matching condition, and determine the missing information items that are missing from the vulnerability matching condition compared to the standard matching condition; use the missing information items to mark the vulnerability matching condition so that the missing information items are blurred when performing an exact matching operation, and the exact matching operation on the missing information items is omitted; perform an exact matching operation based on the marked vulnerability matching condition, and query the preset vulnerability information stored in the local database for each information item that is the same as the information item included in the marked vulnerability matching condition as the vulnerability information of the target program.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images