Offensive and defensive tool intelligent recommendation method, device, electronic device and storage medium

Abstract

The embodiments of the present application provide an attack and defense tool intelligent recommendation method, device, electronic device and storage medium, which belong to the field of network security technology. The method includes: obtaining vulnerability information and tool information; inputting the vulnerability information and tool information into a pre-trained first intelligent recommendation model, performing feature extraction processing on the vulnerability information and tool information respectively, and obtaining vulnerability key features and tool key features; determining the first technical information corresponding to the vulnerability key features and the second technical information corresponding to the tool key features based on a preset technical and tactical knowledge graph; determining the information similarity between the first technical information and the second technical information based on a pre-trained second intelligent recommendation model; when the information similarity exceeds a preset similarity threshold, determining that the tool information matches the vulnerability information, and determining the attack and defense tool corresponding to the vulnerability information based on the tool information. The present application can improve the accuracy and efficiency of attack and defense tool recommendations.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device, electronic device and storage medium for intelligently recommending attack and defense tools. Background Art

[0002] At present, network security issues are emerging in an endless stream with the continuous development of the Internet. Network security issues refer to various risks that threaten the security of network systems, and vulnerabilities are one of the root causes of network security issues. Vulnerabilities refer to errors, defects or imperfections in network systems. These vulnerabilities may be exploited by hackers or malicious users to obtain unauthorized access rights and then tamper with data or perform other malicious behaviors. Therefore, in order to maintain the security of network systems, in addition to timely discovering and patching vulnerabilities, it is usually necessary to select appropriate attack and defense tools based on the characteristics of the vulnerability in order to resist the occurrence of similar vulnerabilities in the future.

[0003] In order to find the attack and defense tools corresponding to the vulnerability, the relevant technology starts from the vulnerability itself, analyzes the vulnerability to obtain the feature information related to the vulnerability, and then, based on this feature information, selects and recommends the corresponding attack and defense tools from a large number of tools based on manual experience for subsequent attack and defense. However, this method relies too much on personal empiricism, and its accuracy and efficiency are not high. Summary of the invention

[0004] The main purpose of the embodiments of the present application is to propose an attack and defense tool intelligent recommendation method, device, electronic device and storage medium, aiming to improve the accuracy and efficiency of attack and defense tool recommendations.

[0005] To achieve the above-mentioned purpose, a first aspect of an embodiment of the present application proposes an attack and defense tool intelligent recommendation method, the method comprising:

[0006] Get vulnerability information and tool information;

[0007] Input the vulnerability information and tool information into a pre-trained first intelligent recommendation model, perform feature extraction on the vulnerability information and tool information respectively, and obtain vulnerability key features and tool key features;

[0008] Determine the first technical information corresponding to the key features of the vulnerability and the second technical information corresponding to the key features of the tool based on the preset technical and tactical knowledge graph;

[0009] Determine information similarity between the first technical information and the second technical information based on a pre-trained second intelligent recommendation model;

[0010] When the information similarity exceeds a preset similarity threshold, it is determined that the tool information matches the vulnerability information, and an attack and defense tool corresponding to the vulnerability information is determined based on the tool information.

[0011] In some embodiments, obtaining vulnerability information and tool information includes:

[0012] Obtaining first-level sub-vulnerability information, second-level sub-vulnerability information, and third-level sub-vulnerability information, wherein the second-level sub-vulnerability information has a higher priority than the third-level sub-vulnerability information, and the first-level sub-vulnerability information has a higher priority than the second-level sub-vulnerability information;

[0013] Combining the first-level sub-vulnerability information, the second-level sub-vulnerability information, and the third-level sub-vulnerability information to obtain vulnerability information;

[0014] Acquire first-level sub-tool information, second-level sub-tool information and third-level sub-tool information, wherein the second-level sub-tool information has a higher priority than the third-level sub-tool information, and the first-level sub-tool information has a higher priority than the second-level sub-tool information;

[0015] The first-level sub-tool information, the second-level sub-tool information and the third-level sub-tool information are combined to obtain tool information.

[0016] In some embodiments, the technical and tactical knowledge graph includes a plurality of technical information;

[0017] Based on the preset technical and tactical knowledge graph, the first technical information corresponding to the key features of the vulnerability and the second technical information corresponding to the key features of the tool are determined, including:

[0018] Based on the preset first vulnerability weight, extract the first sub-vulnerability key information from the first-level sub-vulnerability information; based on the preset second vulnerability weight, extract the second sub-vulnerability key information from the second-level sub-vulnerability information; based on the preset third vulnerability weight, extract the third sub-vulnerability key information from the third-level sub-vulnerability information;

[0019] Combine the first sub-vulnerability key information, the second sub-vulnerability key information and the third sub-vulnerability key information to obtain the vulnerability key information;

[0020] Compare the vulnerability key information with the multiple technical information one by one to obtain a first comparison probability value, and determine that the technical information whose first comparison probability value is not less than a preset first probability threshold is the first technical information;

[0021] Based on the preset first tool weight, extract the first sub-tool key information from the first-level sub-tool information; based on the preset second tool weight, extract the second sub-tool key information from the second-level sub-tool information; based on the preset third tool weight, extract the third sub-tool key information from the third-level sub-tool information;

[0022] Combining the first sub-tool key information, the second sub-tool key information and the third sub-tool key information to obtain tool key information;

[0023] The tool key information is compared with the multiple technical information one by one to obtain a second comparison probability value, and the technical information whose second comparison probability value is not less than a preset second probability threshold is determined as the second technical information.

[0024] In some embodiments, based on a preset first vulnerability weight, extracting first sub-vulnerability key information from the first-level sub-vulnerability information includes:

[0025] Perform word segmentation processing on the first-level sub-vulnerability information to obtain multiple word segmentation results, add part-of-speech encoding information to each word segmentation result to obtain a word segmentation sequence, and perform vectorization processing on the word segmentation sequence to obtain a word segmentation matrix;

[0026] Based on the preset first vulnerability weight, the first sub-vulnerability key information is extracted from the word segmentation matrix.

[0027] In some embodiments, after determining the information similarity between the first technical information and the second technical information, the method further includes:

[0028] If there are multiple second technical information and the information similarity between the same first technical information exceeds the preset similarity threshold, determine the tool information corresponding to each of the multiple second technical information;

[0029] According to the step-by-step matching results between the key information of each tool and the key information of the vulnerability, the sorting results of the multiple tool information are obtained, and the multiple attack and defense tools corresponding to the vulnerability information are determined in order based on the sorting results.

[0030] In some embodiments, according to the step-by-step matching results between each tool key information and vulnerability key information, a sorting result of multiple tool information is obtained, including:

[0031] Calculating a first matching value between the first sub-tool key information and the first sub-vulnerability key information, and obtaining ranking information when the first matching value is greater than a preset first priority determination threshold;

[0032] Otherwise, continue to calculate the second matching value between the second sub-tool key information and the second sub-vulnerability key information, and when the second matching value is greater than a preset second priority determination threshold, combine the first matching value and the second matching value to obtain ranking information;

[0033] Otherwise, continue to calculate the third matching value between the third sub-tool key information and the third sub-vulnerability key information, and combine the first matching value, the second matching value, and the third matching value to obtain ranking information;

[0034] Based on the sorting information, multiple tool information is sorted to obtain a sorting result.

[0035] In some embodiments, the first intelligent recommendation model is trained by the following steps:

[0036] Obtaining sample vulnerability information and sample tool information, the sample vulnerability information including a corresponding sample first technical information tag, and the sample tool information including a corresponding sample second technical information tag;

[0037] Inputting the sample vulnerability information and the sample tool information into a preset first intelligent recommendation model, performing feature extraction processing on the sample vulnerability information and the sample tool information respectively, and obtaining the sample vulnerability key features and the sample tool key features;

[0038] Determine the sample first technical information corresponding to the key features of the sample vulnerability and the sample second technical information corresponding to the key features of the sample tool based on the preset technical and tactical knowledge graph;

[0039] Determine a first loss value according to the first technical information of the sample and the first technical information label of the sample, and determine a second loss value according to the second technical information of the sample and the second technical information label of the sample;

[0040] The parameters of the first intelligent recommendation model are adjusted according to the first loss value and the second loss value to obtain the trained first intelligent recommendation model.

[0041] In some embodiments, the sample vulnerability information also includes the corresponding sample tool real label, and the sample tool information also includes the corresponding sample vulnerability real label;

[0042] The second intelligent recommendation model is trained through the following steps:

[0043] Inputting the first technical information of the sample and the second technical information of the sample into a preset second intelligent recommendation model, and determining the sample information similarity between the first technical information of the sample and the second technical information of the sample based on the second intelligent recommendation model;

[0044] When the sample information similarity exceeds a preset similarity threshold, determining a sample tool prediction label corresponding to the sample vulnerability information and a sample vulnerability prediction label corresponding to the sample tool information;

[0045] Determine a third loss value based on the sample tool prediction label and the sample tool true label, and determine a fourth loss value based on the sample vulnerability prediction label and the sample vulnerability true label;

[0046] The parameters of the second intelligent recommendation model are adjusted according to the third loss value and the fourth loss value to obtain a trained second intelligent recommendation model.

[0047] To achieve the above-mentioned purpose, a second aspect of an embodiment of the present application proposes an attack and defense tool intelligent recommendation device, the device comprising:

[0048] Acquisition module, used to obtain vulnerability information and tool information;

[0049] A feature extraction module, used to input vulnerability information and tool information into a pre-trained first intelligent recommendation model, perform feature extraction processing on the vulnerability information and tool information respectively, and obtain vulnerability key features and tool key features;

[0050] A technical information determination module, used to determine first technical information corresponding to the key features of the vulnerability and second technical information corresponding to the key features of the tool based on a preset technical and tactical knowledge graph;

[0051] An information similarity determination module, used to determine the information similarity between the first technical information and the second technical information based on a pre-trained second intelligent recommendation model;

[0052] The target module is used to determine that the tool information matches the vulnerability information when the information similarity exceeds a preset similarity threshold, and to determine the attack and defense tool corresponding to the vulnerability information based on the tool information.

[0053] To achieve the above-mentioned purpose, the third aspect of an embodiment of the present application proposes an electronic device, the electronic device includes a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, the intelligent recommendation method for attack and defense tools of the above-mentioned first aspect is implemented.

[0054] To achieve the above-mentioned purpose, the fourth aspect of an embodiment of the present application proposes a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the intelligent recommendation method for attack and defense tools of the above-mentioned first aspect is implemented.

[0055] The present application proposes an attack and defense tool intelligent recommendation method, device, electronic device and storage medium. The method obtains vulnerability information and tool information, wherein the vulnerability information is used to indicate a security vulnerability, and the tool information is used to indicate an attack and defense tool corresponding to repairing the security vulnerability; then, the vulnerability information and tool information are input into a pre-trained first intelligent recommendation model, and feature extraction processing is performed on the vulnerability information and tool information respectively to obtain vulnerability key features and tool key features; based on a preset technical and tactical knowledge graph, the first technical information corresponding to the vulnerability key features and the second technical information corresponding to the tool key features are determined; based on a pre-trained second intelligent recommendation model, the information similarity between the first technical information and the second technical information is determined; when the information similarity exceeds a preset similarity threshold, it is determined that the tool information matches the vulnerability information, and the attack and defense tool corresponding to the vulnerability information is determined based on the tool information; because the first technical information and the second technical information provide more comprehensive and detailed attack information, the vulnerability information and the tool information can be better associated through the first technical information and the second technical information, thereby determining the attack and defense tool for repairing the current security vulnerability, thereby improving the accuracy and efficiency of the attack and defense tool recommendation. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 It is a schematic diagram of an application scenario of the attack and defense tool intelligent recommendation device provided in an embodiment of the present application;

[0057] Figure 2 This is an optional flow chart of the attack and defense tool intelligent recommendation method provided in the embodiment of the present application;

[0058] Figure 3 yes Figure 2 A flowchart of an implementation of step 101 in FIG.

[0059] Figure 4 yes Figure 2 A flowchart of an implementation of step 103 in FIG.

[0060] Figure 5 yes Figure 4 A flowchart of an implementation of step 301 in FIG.

[0061] Figure 6 yes Figure 2 An implementation flow chart after step 104 in FIG. 1 ;

[0062] Figure 7 yes Figure 6 A flowchart of an implementation of step 502 in FIG.

[0063] Figure 8 is another optional flow chart of the attack and defense tool intelligent recommendation method provided in an embodiment of the present application;

[0064] Fig. 9 This is another optional flow chart of the attack and defense tool intelligent recommendation method provided in the embodiment of the present application;

[0065] Fig.10 It is a schematic diagram of an optional functional module of the attack and defense tool intelligent recommendation device provided in an embodiment of the present application;

[0066] Fig.11 It is a schematic diagram of the hardware structure of the electronic device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0067] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0068] It should be noted that, although the functional modules are divided in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first", "second", etc. in the specification, claims and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0069] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0070] First, some nouns involved in this application are analyzed:

[0071] A cyber range is a virtual environment that simulates a real network environment. It is often used for network security drills, penetration testing, attack and defense training, etc. In a cyber range, security experts can simulate various attack scenarios and test the weaknesses and vulnerabilities of network systems in order to promptly discover and repair security vulnerabilities and improve network security.

[0072] The Tactics and Techniques Knowledge Graph, also known as ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge), is a global knowledge base used to record and explain the strategies, techniques, and procedures of cyber attacks in order to understand the behaviors that attackers may use and improve the defense capabilities of networks and systems based on this information. ATT&CK Tactics and Techniques includes tactics, techniques, and sub-techniques, dividing attack behaviors into multiple tactics, each of which contains multiple techniques, and each technique is composed of sub-techniques.

[0073] Common Vulnerabilities and Exposures (CVE), referred to as vulnerabilities, refers to undiscovered or unpatched security weaknesses in network systems or applications. The existence of vulnerabilities may be exploited by malicious attackers to invade the system, obtain illegal access rights, steal sensitive information, or cause other malicious behaviors, thereby causing the system to suffer various types of network attacks, damaging user data, system integrity and confidentiality.

[0074] Offensive and defensive tools refer to software or hardware tools used for network attacks and network defense. Offensive and defensive tools are usually used by security researchers, penetration testers, attackers and defenders to test the security of network systems, detect vulnerabilities, simulate attacks and defensive actions, etc.

[0075] Artificial intelligence (AI) is a new technical science that studies and develops theories, methods, technologies and application systems for simulating, extending and expanding human intelligence. AI is a branch of computer science that attempts to understand the essence of intelligence and produce a new type of intelligent machine that can respond in a similar way to human intelligence. Research in this field includes robotics, speech recognition, image recognition, natural language processing and expert systems. AI can simulate the information process of human consciousness and thinking. AI is also a theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0076] At present, network security issues are emerging in an endless stream with the continuous development of the Internet. Network security issues refer to various risks that threaten the security of network systems, and vulnerabilities are one of the root causes of network security issues. Vulnerabilities refer to errors, defects or imperfections in network systems. These vulnerabilities may be exploited by hackers or malicious users to obtain unauthorized access rights and then tamper with data or perform other malicious behaviors. Therefore, in order to maintain the security of network systems, in addition to timely discovering and patching vulnerabilities, it is usually necessary to select appropriate attack and defense tools based on the characteristics of the vulnerability in order to resist the occurrence of similar vulnerabilities in the future.

[0077] In order to find the attack and defense tools corresponding to the vulnerability, the relevant technology starts from the vulnerability itself, analyzes the vulnerability to obtain the feature information related to the vulnerability, and then, based on this feature information, selects and recommends the corresponding attack and defense tools from a large number of tools based on manual experience for subsequent attack and defense. However, this method relies too much on personal empiricism, and its accuracy and efficiency are not high.

[0078] Based on this, the embodiments of the present application provide an attack and defense tool intelligent recommendation method, device, electronic device and storage medium, aiming to improve the accuracy and efficiency of attack and defense tool recommendations.

[0079] It should be noted that in the embodiments of the present application, when it comes to information related to user identity or characteristics based on user basic information, the user's permission or consent will be obtained first, and the collection, use and processing of these data will comply with relevant laws, regulations and standards. In addition, when the embodiments of the present application need to obtain sensitive personal information of the user, the user's separate permission or separate consent will be obtained first. After the user's separate permission or separate consent is clearly obtained, the necessary data for the normal operation of the embodiments of the present application will be obtained. For example, the security system currently being used by the user has a vulnerability hidden danger. In order to implement the recommendation of the security system attack and defense tool, the present application needs to obtain the vulnerability information corresponding to the security system; however, when the vulnerability corresponding to the vulnerability information breaks through the security system, the user's personal identity information and historical records stored in the security system will be obtained. Therefore, before obtaining the vulnerability information, the consent of the relevant user will be obtained first, otherwise the vulnerability information cannot be obtained.

[0080] The attack and defense tool intelligent recommendation method, device, electronic device and storage medium provided in the embodiments of the present application are specifically illustrated through the following embodiments. First, the application scenario of the attack and defense tool intelligent recommendation device in the embodiments of the present application is described.

[0081] like Figure 1 As shown, Figure 1: is a schematic diagram of an application scenario of the attack and defense tool intelligent recommendation device provided in the embodiment of the present application, wherein the attack and defense tool intelligent recommendation method provided in the embodiment of the present application can be applied to the attack and defense tool intelligent recommendation device (for ease of understanding, it can also be referred to as "recommendation device"), and the attack and defense tool intelligent recommendation method (for ease of understanding, it can also be referred to as "recommendation method") will be described later. The attack and defense tool intelligent recommendation device is provided with a trained first intelligent recommendation model and a second intelligent recommendation model, such as Figure 1 As shown, in the network range application scenario, the attack and defense tool intelligent recommendation device set in the range A can receive vulnerability information and tool information from the range A; then, the attack and defense tool intelligent recommendation device can determine the first technical information between the input vulnerability information and multiple technical information based on the attack and defense tool intelligent recommendation method provided by the embodiment of the present application, and determine the second technical information between the input tool information and multiple technical information, wherein the multiple technical information is preset in the technical and tactical knowledge graph; when the first technical information and the second technical information match, determine that the vulnerability information corresponds to the tool information match, and determine the attack and defense tool corresponding to the vulnerability information according to the tool information. Since each technical and tactical information in the technical and tactical knowledge graph records in detail the technology used by the attacker when conducting a network attack, the vulnerability information provides the specific details of the security vulnerabilities existing in the network system or application, and the tool information provides the specific details of the tools or software used for attack and / or defense, the recommendation device can respectively correspond the vulnerability information and tool information to the technical and tactical information in the technical and tactical knowledge graph, and then indirectly associate the vulnerability information and tool information, and then find the attack and defense tool for repairing the vulnerability. In this way, compared with determining the attack and defense tools based on manual experience, the recommendation device can complete the recommendation of the attack and defense tools at a faster speed and with high accuracy, and has extremely high practical application value.

[0082] It should be noted that the application scenario of the recommended device may also be an IoT security scenario, a security management and monitoring scenario, etc. The embodiment of the present application does not specifically limit the actual application scenario of the recommended device.

[0083] Next, the attack and defense tool intelligent recommendation method in the embodiment of the present application is specifically described through the following examples.

[0084] In the embodiment of the present application, the description will be made from the perspective of a recommendation device, which can be integrated into a computer device, such as a server. Figure 2 As shown, Figure 2 is an optional flowchart of the attack and defense tool intelligent recommendation method provided in an embodiment of the present application. Figure 2 The method in the embodiment may include but is not limited to steps 101 to 105. When the recommendation device executes the recommendation method, the specific process is as follows. It should be noted that the present embodiment Figure 2The order of step 101 to step 105 is not specifically limited, and the order of steps can be adjusted or some steps can be reduced or added according to actual needs.

[0085] Step 101, obtaining vulnerability information and tool information.

[0086] The following is a detailed description of step 101.

[0087] In some embodiments, vulnerability information is text information describing the corresponding vulnerability, and tool information is text information describing the attack and defense tools for attacking and / or defending the vulnerability. Vulnerability information and tool information can be obtained from a specific network system, for example, based on the vulnerabilities that may be involved in network security system A, the corresponding vulnerability information and tool information can be obtained; or, the vulnerability information and tool information obtained by the recommendation device may not be limited to a certain network system, and further, the vulnerability information and tool information can also be obtained from a vulnerability public database (Exploit Database), a tool public database, a network forum or other public databases such as a code hosting platform (Github), a code hosting laboratory (Gitlab), etc. When obtaining vulnerability information and tool information from a public database, the method used can be data crawling.

[0088] It should be noted that there are many ways to obtain vulnerability information and tool information, and the obtained vulnerability information and tool information may be only for a certain system, or generally applicable to various systems, and the embodiments of the present application do not make specific limitations.

[0089] Among them, vulnerabilities refer to defects or weaknesses in computer systems, applications, network devices or security protocols, which may be exploited by attackers to access system resources, execute malicious code, steal or tamper with data in an unauthorized manner.

[0090] It is understandable that the vulnerability information obtained by the embodiment of the present application focuses on the vulnerability itself, and the tool information focuses on the attack and defense tool itself. If the attack and defense tool corresponding to the vulnerability information is determined based on manual experience, not only is the determination efficiency low, but the matching degree between the determined attack and defense tool and the vulnerability is usually poor; for example, the attack and defense tool determined in this way can usually only superficially solve the vulnerability defects currently generated by the specific vulnerability, but cannot discover other potential attacks or weaknesses, and then the problem of not completely repairing the vulnerability occurs, so that the "repaired" vulnerability is used again, and the risk of security problems occurring again in the future is greatly increased. Therefore, the recommendation device in the embodiment of the present application will first obtain the vulnerability information and tool information, so as to associate the vulnerability information, tool information and technical information later; because the technical information provides more comprehensive and detailed attack information, the vulnerability information and tool information can be better associated through the attack information, so as to recommend the attack and defense tools that can better solve the vulnerability corresponding to the vulnerability information, thereby improving the vulnerability repair and security defense capabilities in the network system.

[0091] like Figure 3 As shown, Figure 3 yes Figure 2 In an implementation flow chart of step 101 in the embodiment, in some embodiments, obtaining vulnerability information and tool information includes the following steps 201 to 204:

[0092] Step 201, obtaining first-level sub-vulnerability information, second-level sub-vulnerability information and third-level sub-vulnerability information, wherein the second-level sub-vulnerability information has a higher priority than the third-level sub-vulnerability information, and the first-level sub-vulnerability information has a higher priority than the second-level sub-vulnerability information.

[0093] Step 202, combining the first-level sub-vulnerability information, the second-level sub-vulnerability information and the third-level sub-vulnerability information to obtain vulnerability information.

[0094] Step 203, obtaining first-level sub-tool information, second-level sub-tool information and third-level sub-tool information, wherein the second-level sub-tool information has a higher priority than the third-level sub-tool information, and the first-level sub-tool information has a higher priority than the second-level sub-tool information.

[0095] Step 204 , combining the first-level sub-tool information, the second-level sub-tool information and the third-level sub-tool information to obtain tool information.

[0096] Steps 201 to 204 are described in detail below.

[0097] In some embodiments, the vulnerability information includes three categories of content, and each category of content has a different priority level. By setting a priority level for each category of content, it helps to more quickly and accurately determine the attack and defense tools corresponding to the vulnerabilities indicated by the vulnerability information when matching the vulnerability information and tool information.

[0098] Furthermore, the first-level sub-vulnerability information may be vulnerability classification information, the second-level sub-vulnerability information may be vulnerability name information, and the third-level sub-vulnerability information may be vulnerability specific description information, wherein each level of sub-vulnerability information contains more content as the level number increases. Exemplarily, a certain vulnerability information C includes the following content: first sub-vulnerability information: injection vulnerability (Injection); second-level sub-vulnerability information: SQL injection vulnerability (SQL Injection); third-level sub-vulnerability information: SQL injection vulnerability is a common web application security vulnerability. By using user input and unfiltered or unvalidated data, attackers can insert malicious code into the application's SQL query, thereby performing malicious operations, such as obtaining sensitive data, modifying data, or executing arbitrary code.

[0099] Furthermore, the priority order corresponding to each level of sub-vulnerability information decreases as the level number increases. For example, the priority of the first-level sub-vulnerability information is I, and the priority of the second-level sub-vulnerability information is II, where I>II.

[0100] Furthermore, the fourth-level sub-vulnerability information can also be set, and the fourth-level sub-vulnerability information can be related historical vulnerability information, which describes the related vulnerability information generated by the vulnerability in the past and the corresponding repair information. In addition, the priority of the fourth-level sub-vulnerability information is lower than that of the third-level sub-vulnerability information, that is, the priority setting method can be set according to the detailed content of the information contained in the sub-vulnerability information, and the more detailed the sub-vulnerability information, the lower the corresponding priority.

[0101] It should be noted that the number of sub-vulnerability information included in the vulnerability information can be set according to actual conditions, and the category content corresponding to each sub-vulnerability information can also be set according to actual conditions, and the embodiments of the present application do not make specific limitations.

[0102] In some embodiments, the tool information includes three categories of content, and each category of content has a different priority level. By setting a priority level for each category of content, it can help speed up the matching speed between vulnerabilities and attack and defense tools. It should be noted that the number of categories included in the tool information is the same as the number of categories included in the vulnerability information, and the categories of sub-vulnerability information and sub-tool information at the same level correspond one to one. For example, the second-level sub-vulnerability information and the second-level sub-tool information are both name-related content.

[0103] Furthermore, the first-level sub-tool information may be tool classification information, the second-level sub-tool information may be tool name information, and the third-level sub-tool information may be tool specific description information, wherein each level of sub-tool information contains more content as the level number increases. Exemplarily, a certain tool information C includes the following content: first-level sub-tool information: scanning tool; second-level sub-tool information: vulnerability scanner (Nexpose); third-level sub-tool information: Nexpose can conduct a comprehensive vulnerability scan on the organization's network, automatically detect potential security vulnerabilities and configuration errors, help users discover and fix vulnerabilities in a timely manner, strengthen network security protection, and can help users track and manage various devices, applications and services in the network, helping users to fully understand their network assets.

[0104] Furthermore, the priority order corresponding to each level of sub-tool information decreases as the level number increases. Exemplarily, the priority of the second-level sub-tool information is II, and the priority of the third-level sub-tool information is I, wherein II>III.

[0105] Furthermore, the fourth-level sub-tool information can also be set, and the fourth-level sub-tool information can be a specific case when the indicated attack and defense tool is used, which describes the specific scenario and specific usage information of the attack and defense tool in the past. At this time, the priority of the fourth-level sub-tool information is lower than that of the third-level sub-tool information, that is, the priority setting method can be set according to the detailed content of the information contained in the sub-tool information, and the more detailed the sub-tool information, the lower the corresponding priority.

[0106] It should be noted that the number of sub-tool information included in the tool information can be set according to actual conditions, and the category content corresponding to each sub-tool information can also be set according to actual conditions, and the embodiments of the present application do not make specific limitations.

[0107] Furthermore, the acquired vulnerability information and tool information can be saved as a data file in the extensible markup format (xml) or object notation format (json) according to the schema data structure (schema). It should be noted that it can also be saved in data structures such as arrays, queues, trees, and graphs, and the format of the stored data file can also be a readable data serialization format (YAML), a plain text file format (CSV), etc., and the embodiments of the present application do not specifically limit this.

[0108] For example, the data file saved in the schema includes the following main fields: tool unique identification number (first-level sub-tool information, tool_id), tool category (second-level sub-tool information, category), tool name (third-level sub-tool information, name), tool detailed description (fourth-level sub-tool information, desc), tool reference link (fifth-level sub-tool information, refs). The tool information generated based on these fields is as follows:

[0109] {

[0110] "tool_id":"00029adb34624fce917cb9578181a6ee",

[0111] "category:0, / / 0-attack; 1-defense; 2-attack or defense,

[0112] "name":"MyPHP Forum 1.0 - SQL Injection",

[0113] "desc":"MyPHP Forum 1.0 has an SQL injection vulnerability in its search.php file, allowing attackers to bypass authentication and access ormanipulate sensitive information in the database by crafting malicious queryparameters, posing a serious security risk. To fix this vulnerability, strictinput validation and filtering must be implemented, database query results should be limited to necessary fields, and the software should be updated to the latest version to obtain official security patches.",

[0114] "refs":"https: / / github.com / advisories / GHSA-3mjc-8px4-f596"

[0115] }

[0116] Step 102: Input the vulnerability information and tool information into a pre-trained first intelligent recommendation model, perform feature extraction on the vulnerability information and tool information, and obtain vulnerability key features and tool key features.

[0117] The following is a detailed description of step 102.

[0118] In some embodiments, after obtaining vulnerability information and tool information, the vulnerability information and tool information are input into a pre-trained first intelligent recommendation model, and the first intelligent recommendation model performs feature extraction on the vulnerability information to obtain vulnerability key features, and performs feature extraction on the tool information to obtain tool key features, so as to subsequently determine the corresponding first technical information and second technical information based on the vulnerability key features and the tool key features, and determine the correlation between the vulnerability information and the tool information based on the degree of matching between the first technical information and the second technical information, and then determine the attack and defense tools corresponding to the vulnerability. It can be understood that the attack and defense tools automatically recommended by the recommendation device can repair the vulnerability well, and can perform a comprehensive scan based on the vulnerability, so as to further execute security patches or other related processing based on the scan results, and comprehensively repair the vulnerability and its related potential problems.

[0119] Furthermore, context association method, word frequency statistics and other methods can be used to perform feature extraction operations on vulnerability information and tool information. The specific settings can be made according to actual conditions, and the embodiments of the present application are not specifically limited.

[0120] Step 103, determining the first technical information corresponding to the key feature of the vulnerability and the second technical information corresponding to the key feature of the tool based on the preset technical and tactical knowledge graph.

[0121] The following is a detailed description of step 103.

[0122] In some embodiments, the technical and tactical knowledge graph includes multiple technical information. After the vulnerability key features and tool key features are extracted, the corresponding first technical information is determined from the multiple technical information based on the vulnerability key features, and the corresponding second technical information is determined from the multiple technical information based on the tool key features, so that the vulnerability information and the tool information can be associated with each other through the first technical information and the second technical information.

[0123] like Figure 4 As shown, Figure 4 yes Figure 2In an implementation flowchart of step 103 in the embodiment, in some embodiments, determining the first technical information corresponding to the key feature of the vulnerability and the second technical information corresponding to the key feature of the tool based on the preset technical and tactical knowledge graph includes the following steps 301 to 306:

[0124] Step 301, based on the preset first vulnerability weight, extract the first sub-vulnerability key information from the first-level sub-vulnerability information, based on the preset second vulnerability weight, extract the second sub-vulnerability key information from the second-level sub-vulnerability information, based on the preset third vulnerability weight, extract the third sub-vulnerability key information from the third-level sub-vulnerability information.

[0125] Step 302: Combine the first sub-vulnerability key information, the second sub-vulnerability key information and the third sub-vulnerability key information to obtain vulnerability key information.

[0126] Step 303 , compare the vulnerability key information with the multiple technical information one by one to obtain a first comparison probability value, and determine that the technical information whose first comparison probability value is not less than a preset first probability threshold is the first technical information.

[0127] Step 304: based on the preset first tool weight, extract the first sub-tool key information from the first-level sub-tool information; based on the preset second tool weight, extract the second sub-tool key information from the second-level sub-tool information; based on the preset third tool weight, extract the third sub-tool key information from the third-level sub-tool information.

[0128] Step 305: Combine the first sub-tool key information, the second sub-tool key information and the third sub-tool key information to obtain tool key information.

[0129] Step 306 , compare the tool key information with the multiple technical information one by one to obtain a second comparison probability value, and determine that the technical information whose second comparison probability value is not less than a preset second probability threshold is the second technical information.

[0130] Steps 301 to 306 are described in detail below.

[0131] In some embodiments, in order to better match vulnerability information, tool information and technical information, different degrees of feature extraction can be performed from each sub-vulnerability information and each sub-tool information. In this way, through refined feature extraction, it helps to deeply explore the potential information in the vulnerability information and tool information so as to better match it with the technical information.

[0132] Furthermore, different weights are set for sub-vulnerability information of different levels. Generally speaking, the first vulnerability weight, the second vulnerability weight, and the third vulnerability weight are different. For example, the first vulnerability weight is 0.7, the second vulnerability weight is 0.8, and the third vulnerability weight is 0.9, that is, the more detailed the sub-vulnerability information, the higher the vulnerability weight. In this way, more important and influential content can be extracted from information of different levels, and sub-vulnerability key information can be obtained based on more abundant and comprehensive sub-vulnerability information, which enhances the credibility of the final key vulnerability information and improves the matching accuracy of vulnerability information and technical information.

[0133] It should be noted that the first vulnerability weight, the second vulnerability weight and the third vulnerability weight can be set according to actual conditions, and the embodiments of the present application do not make specific restrictions. In addition, each vulnerability weight corresponds to each sub-vulnerability information one by one. When sub-vulnerability information is added, the vulnerability weight is increased accordingly and a specific value is assigned.

[0134] Furthermore, after obtaining the sub-vulnerability key information at each level, each sub-vulnerability key information is spliced ​​to obtain the vulnerability key information. The vulnerability key information is compared with multiple technical information one by one, and one or more first technical information with a higher similarity to the vulnerability key information is determined by calculating the first comparison probability value between the vulnerability key information and each technical information. The first comparison probability value can be obtained by calculating the cosine similarity, Manhattan distance, etc. between the two.

[0135] Furthermore, different weights are set for sub-tool information of different levels. Generally speaking, the first tool weight, the second tool weight and the third tool weight are different. For example, the first tool weight is 0.7, the second tool weight is 0.8, and the third tool weight is 0.9, that is, the more detailed the sub-tool information is, the higher the tool weight is. In this way, more important and influential content can be extracted from information of different levels, and sub-tool key information can be obtained based on more abundant and comprehensive sub-tool information, which enhances the credibility of the final key tool information and thus improves the matching accuracy of tool information and technical information.

[0136] It should be noted that the first tool weight, the second tool weight and the third tool weight can be set according to actual conditions, and the embodiments of the present application do not impose specific restrictions. In addition, each tool weight corresponds to each sub-tool information one by one. When sub-tool information is added, the tool weight is increased accordingly and a specific value is assigned.

[0137] Furthermore, after obtaining the sub-tool key information at each level, each sub-tool key information is spliced ​​to obtain the tool key information. The tool key information is compared with the multiple technical information one by one, and one or more second technical information with a higher similarity to the tool key information is determined by calculating the first comparison probability value between the tool key information and each technical information. The second comparison probability value can be obtained by calculating the cosine similarity, Manhattan distance, etc. between the two.

[0138] Furthermore, the first comparison probability value is used to characterize the expected degree of match between vulnerability information and technical information, and the second comparison probability value is used to characterize the expected degree of match between tool information and technical information. The first comparison probability value and the second comparison probability value can be obtained based on manual experience, or can be obtained by dynamic prediction after training with a machine learning method through an artificial intelligence model. The embodiments of the present application do not impose specific restrictions on this.

[0139] like Figure 5 As shown, Figure 5 yes Figure 4 In an implementation flowchart of step 301 in FIG. 1 , in some embodiments, based on a preset first vulnerability weight, extracting first sub-vulnerability key information from the first-level sub-vulnerability information includes the following steps 401 to 402:

[0140] Step 401 , segment the first-level sub-vulnerability information to obtain multiple segmentation results, add part-of-speech encoding information to each segmentation result to obtain a segmentation sequence, and vectorize the segmentation sequence to obtain a segmentation matrix.

[0141] Step 402: extract first sub-vulnerability key information from the word segmentation matrix based on a preset first vulnerability weight.

[0142] Steps 401 to 402 are described in detail below.

[0143] In some embodiments, taking feature extraction of first-level sub-vulnerability information as an example, in order to obtain first sub-vulnerability key information corresponding to the first-level sub-vulnerability information, it is necessary to first perform data preprocessing operations on the first-level sub-vulnerability information, and perform word segmentation processing on the preprocessed results to obtain multiple word segmentation results. In this way, by dividing the first-level sub-vulnerability information into smaller semantic units, the recommendation device is helped to better understand and analyze the semantic information of the first-level sub-vulnerability information.

[0144] Furthermore, the data preprocessing operation includes data cleaning processing and data conversion processing, etc. In this way, the data quality of the first-level sub-vulnerability information is improved by removing the noise information in the first-level sub-vulnerability information, providing a good data basis support for subsequent feature extraction operations.

[0145] Furthermore, the first-level sub-vulnerability information after preprocessing is segmented, and the recommendation device can perform segmentation by a segmentation method based on a dictionary language, a segmentation method based on statistics, or a segmentation method based on deep learning, etc., to obtain multiple segmentation results. After that, irrelevant segmentation results such as stop words and punctuation marks are first removed from the multiple segmentation results, and part-of-speech encoding information representing content features and position features is added to the multiple segmentation results after the irrelevant segmentation results are removed. The segmentation results after adding the part-of-speech encoding information are called word sequences.

[0146] Exemplarily, the part-of-speech encoding information may include a [CLS] tag and a [SEP] tag, wherein [CLS] indicates the beginning of a sequence and is used for sentence-level classification in classification tasks, and [SEP] indicates the boundary between different sentences and is used to separate different sentences. Both the [CLS] tag and the [SEP] tag are used to indicate the positional features of the corresponding word segmentation results. The part-of-speech encoding information may also include part-of-speech tags, for example, "V" indicates a verb, "N" indicates a noun, "ADJ" indicates an adjective, etc. The part-of-speech tags are used to indicate the content features of the corresponding word segmentation results.

[0147] It should be noted that the part-of-speech encoding may also include other information for indicating content features and location features. The embodiments of the present application do not impose specific restrictions on this and can be set according to actual conditions.

[0148] Furthermore, after obtaining the word segmentation sequence, it is vectorized to obtain a word segmentation matrix. Exemplarily, each word segmentation sequence can be mapped to a word embedding vector, and then all word embedding vectors are combined into a word segmentation matrix in a certain way. The word segmentation matrix can convert text data into a numerical form to help the recommendation device understand the feature information in the text data in the subsequent process, thereby improving the processing performance and processing effect of the recommendation model on the input data.

[0149] Furthermore, the word segmentation matrix is ​​a matrix obtained by converting text data into numerical representation. Each element in the word segmentation matrix is ​​used to characterize the importance of the corresponding word segmentation sequence in the text. In the process of extracting sub-vulnerability key information, more important content can be extracted from the word segmentation matrix according to the preset first weight, thereby obtaining the first sub-vulnerability key information.

[0150] Step 104: Determine the information similarity between the first technical information and the second technical information based on the pre-trained second intelligent recommendation model.

[0151] Step 104 is described in detail below.

[0152] In some embodiments, after determining the first technical information corresponding to the vulnerability information and the second technical information corresponding to the tool information, the information similarity between the first technical information and the second technical information is determined by a pre-trained second intelligent recommendation model, so that the vulnerability information and the tool information can be matched based on the similarity.

[0153] Furthermore, the second intelligent recommendation model is used to calculate the text similarity between the first technical information and the second technical information, and use the text similarity as the information similarity, so as to determine the matching degree between the first technical information and the second technical information based on the information similarity.

[0154] Step 105: When the information similarity exceeds a preset similarity threshold, it is determined that the tool information matches the vulnerability information, and an attack and defense tool corresponding to the vulnerability information is determined based on the tool information.

[0155] The following is a detailed description of step 105.

[0156] In some embodiments, the similarity threshold is used to indicate the expected degree of matching between the first technical information and the second technical information. When the information similarity exceeds a preset similarity threshold, it is determined that the vulnerability information corresponding to the first technical information matches the tool information corresponding to the second technical information.

[0157] Exemplarily, the preset similarity threshold is 0.8, the technical information corresponding to the vulnerability information A is the first technical information A, the technical information corresponding to the tool information A is the second technical information A, and the information similarity value between the first technical information A and the second technical information A is 0.9, then it is determined that the vulnerability information A matches the tool information A. Since the vulnerability information A corresponds to the vulnerability A, and the tool information A corresponds to the attack and defense tool A, the attack and defense tool A can be used to repair the vulnerability A. There is no need for relevant personnel to determine the attack and defense tools based on personal experience. The attack and defense tools are recommended by the recommendation device, thereby achieving dynamic and rapid response to vulnerabilities that need to be repaired.

[0158] like Figure 6 As shown, Figure 6 yes Figure 2 In an implementation flow chart after step 104 in the embodiment, after determining the information similarity between the first technical information and the second technical information, the following steps 501 to 502 are also included:

[0159] Step 501, if there are multiple pieces of second technical information and the same first technical information, the information similarity between them all exceeds a preset similarity threshold, determining the tool information corresponding to each piece of the multiple pieces of second technical information;

[0160] Step 502, according to the step-by-step matching results between the key information of each tool and the key information of the vulnerability, a sorting result of the multiple tool information is obtained, and based on the sorting result, multiple attack and defense tools corresponding to the vulnerability information are sequentially determined.

[0161] Steps 501 to 502 are described in detail below.

[0162] In some embodiments, ideally, one vulnerability information corresponds to one tool information, in which case the attack and defense tool indicated by the tool information can be used to repair the vulnerability. However, usually, one vulnerability information will correspond to multiple tool information. In this case, it is necessary to determine the degree of correlation between the multiple tool information and the vulnerability information to speed up the determination of the attack and defense tool.

[0163] Furthermore, when a first technical information corresponds to multiple information similarities exceeding a preset similarity threshold, it is determined that a first technical information is consistent with multiple second technical information. At this time, it is necessary to output tool information in a certain order to better determine the attack and defense tools for repairing vulnerabilities. One method is to sort the second technical information according to the size of the information similarity, and determine the corresponding tool information in turn based on the sorted results. Exemplarily, the information similarity between the first technical information B and the second technical information B1 is 0.9, the information similarity between the first technical information B and the second technical information B2 is 0.7, and the information similarity between the first technical information B and the second technical information B3 is 0.8, wherein the second technical information B1 corresponds to tool information B1, the second technical information B2 corresponds to tool information B2, and the second technical information B3 corresponds to tool information B3. Then, the sorting results can be determined as tool information B1, tool information B3, and tool information B2 according to the size of the information similarity.

[0164] Furthermore, if the optimal attack and defense tool fails, the next optimal attack and defense tool can be selected according to the sorting result, without the need to re-determine a new attack and defense tool, thereby improving the efficiency of vulnerability repair.

[0165] In some embodiments, based on the limitations of semantic understanding, the operation of matching vulnerability information and tool information only by using information similarity is relatively rough, and it only considers the overall similarity between vulnerability information and tool information, which easily makes the attack and defense tool determined by the recommendation device not the most suitable one for repairing the current vulnerability. Therefore, on the basis of preliminary matching by using information similarity, the key vulnerability information and tool key information at multiple levels can be used for step-by-step matching to more accurately determine the most suitable attack and defense tool for the current vulnerability, thereby improving the effect and efficiency of network security repair.

[0166] like Figure 7 As shown, Figure 7 yes Figure 6In some embodiments, the sorting results of multiple tool information are obtained according to the step-by-step matching results between each tool key information and the vulnerability key information, including the following steps 601 to 604:

[0167] Step 601, calculate a first matching value between first sub-tool key information and first sub-vulnerability key information, and when the first matching value is greater than a preset first priority determination threshold, determine the obtained ranking information.

[0168] Step 602, otherwise, continue to calculate the second matching value between the second sub-tool key information and the second sub-vulnerability key information, and when the second matching value is greater than the preset second priority determination threshold, combine the first matching value and the second matching value to obtain ranking information.

[0169] Step 603, otherwise, continue to calculate the third matching value between the third sub-tool key information and the third sub-vulnerability key information, and combine the first matching value, the second matching value and the third matching value to obtain the ranking information.

[0170] Step 604, sorting the plurality of tool information based on the sorting information to obtain a sorting result.

[0171] Steps 601 to 604 are described in detail below.

[0172] In some embodiments, based on the technical and tactical knowledge graph, tool information that matches vulnerability information can be quickly screened. When the first technical information and the second technical information completely correspond, it can be directly determined that the vulnerability information matches the tool information. However, when the first technical information and the second technical information do not completely correspond, but only have a certain degree of similarity, directly matching vulnerability information and tool information using information similarity is prone to the situation where the specific details of the vulnerability and tool cannot be fully covered, resulting in inaccurate matching, and then the recommended attack and defense tools cannot repair the vulnerability well. Therefore, on the basis of the preliminary screening of multiple tool information based on information similarity, the key information of the tool and the key information of the vulnerability can be matched step by step to quickly determine the most suitable attack and defense tool to repair the current vulnerability, and further improve the accuracy of the attack and defense tool recommendation.

[0173] Furthermore, the matching value refers to the similarity between the sub-vulnerability key information and the sub-tool key information at the same priority. When a vulnerability information corresponds to multiple associated tool information, the sorting information corresponding to the multiple tool information is determined in order of priority from high to low, and the sorting information is used to indicate the degree of association between the multiple tool information and the vulnerability information after screening according to the information similarity. The first priority determination threshold is used to indicate the expected matching degree between the first sub-vulnerability key information and the first sub-tool key information, and the second priority determination threshold is used to indicate the expected matching degree between the second sub-vulnerability key information and the second sub-tool key information.

[0174] It should be noted that, in order to ensure the matching accuracy between vulnerability information and tool information, the specific values ​​of the first priority judgment threshold and the second priority judgment threshold are usually set higher to ensure that the sub-vulnerability key information and the sub-tool key information can be directly determined to match when they have a high similarity at the same level; and when the similarity is not very high, that is, there is a certain ambiguity, the matching degree between the two is continued to be determined through the more detailed sub-key information of the next level. In addition, the first priority judgment threshold can be set greater than the second priority judgment threshold to speed up the matching speed between vulnerability information and tool information with higher similarity. The specific values ​​of the first priority judgment threshold and the second priority judgment threshold can be set according to actual conditions, and the embodiments of the present application do not make specific restrictions.

[0175] In Example 1, after preliminary screening based on the technical and tactical knowledge graph, it is determined that vulnerability information D matches tool information D1, tool information D2, and tool information D3, wherein the information similarities between vulnerability information D and tool information D1, D2, and D3 are 1, 0.6, and 0.5, respectively; vulnerability information D includes first sub-vulnerability key information D, second sub-vulnerability key information D, and third sub-vulnerability key information D; tool information D2 includes first sub-tool key information D2, second sub-tool key information D2, and third sub-tool key information D2; tool information D3 includes first sub-tool key information D3, second sub-tool key information D3, and third sub-tool key information D3; based on this, it can be first determined that the attack and defense tool indicated by tool information D1 is the best attack and defense tool for vulnerability information D, that is, tool information D1 is the best attack and defense tool for vulnerability information D. The arrangement order of the first sub-tool key information D1 is 1; then, the first matching value p11 between the first sub-tool key information D2 and the first sub-vulnerability key information D is calculated. If the first matching value p11 is greater than the preset first priority judgment threshold Y1, the p11 value is recorded, and there is no need to use the second sub-tool key information D2 and the third sub-tool key information D2 of the tool information D2 for subsequent calculations; thereafter, the same method is used to determine the first matching value p12 between the first sub-tool key information D3 and the first sub-vulnerability key information D. If the first matching value p12 is not greater than the preset first priority judgment threshold Y1, the arrangement order of the tool information D2 is directly determined to be 2, and the arrangement order of the tool information D3 is 3, and the arrangement information is obtained as tool information D1>tool information D2>tool information D3.

[0176] It can be understood that both the first sub-vulnerability key information and the first sub-tool information indicate category information, that is, both highly summarize the information classification in extremely concise content. Therefore, by comparing the two, the matching of vulnerability information and tool information can be quickly determined, while ensuring the matching accuracy and the recommended speed of attack and defense tools.

[0177] Further, using Example 1 as an example, if the first matching value p12 is also greater than the preset first priority determination threshold Y1, the first matching value p11 and the first matching value p12 are compared to determine that the one with the larger value has a higher ranking. In another case, if the first matching value p11 and the first matching value p12 calculated in Example 1 are both not greater than the first priority judgment threshold Y1, then the second matching value p21 between the second sub-tool key information D2 and the second sub-vulnerability key information D is calculated in order of priority. If the second matching value p21 is greater than the preset second priority judgment threshold Y2, the p21 value is recorded, and there is no need to use the third sub-tool key information D2 of the tool information D2 for subsequent calculations. Afterwards, the same method is used to determine the second matching value p22 between the second sub-tool key information D3 and the second sub-vulnerability key information D. If the second matching value p22 is not greater than the preset second priority judgment threshold Y2, the arrangement order of tool information D2 is directly determined to be 2, and the arrangement order of tool information D3 is directly determined to be 3, and the arrangement information is obtained as tool information D1>tool information D2>tool information D3.

[0178] Further, if the second matching value p22 is also greater than the preset second priority determination threshold value Y2, the second matching value p21 and the second matching value p22 are compared to determine that the one with the larger value has a higher ranking. In another case, if the second matching value p21 and the second matching value p22 calculated in Example 1 are both less than the second priority determination threshold value Y2, then the third matching value p31 between the third sub-tool key information D2 and the third sub-vulnerability key information D, and the third matching value p32 between the third sub-tool key information D3 and the third sub-vulnerability key information D are calculated in order of priority. At this time, the third matching value p31 and the third matching value p32 are directly compared to determine the ranking order, so as to obtain the ranking information corresponding to the tool information D1, the tool information D2 and the tool information D3.

[0179] Furthermore, when the first matching values ​​corresponding to the plurality of tool information are not greater than the preset first priority judgment threshold, and the second matching value is calculated based on the second sub-tool key information and the second sub-vulnerability key information, in addition to directly obtaining the sorting information based on the second matching value, the first matching value and the second matching value can also be combined to obtain the sorting information. For example, taking Example 1 as an example, tool information D2 and tool information D3 respectively obtain the first matching value p11 and the first matching value p12, both of which are not greater than the first priority judgment threshold Y1, and the second matching value p21 and the second matching value p22, both of which are greater than the second priority judgment threshold Y2. At this time, in order to more accurately determine the sorting information, the first matching value p11 and the second matching value p21 can be weighted to obtain the first weighted value, and the first matching value p12 and the second matching value p22 can be weighted to obtain the second weighted value, and the sorting information can be determined by comparing the first weighted value and the second weighted value.

[0180] Furthermore, after calculating the third matching value based on the third sub-tool key information and the third sub-vulnerability key information, the first matching value, the second matching value, the third matching value and their respective corresponding weighted values ​​can be combined to calculate the arrangement information, so as to determine the output order of multiple tool information according to the arrangement information and determine the corresponding attack and defense tools according to the tool information.

[0181] It should be noted that the weight value used when jointly calculating the first matching value, the second matching value, and the third matching value can be set according to actual conditions, and the embodiment of the present application does not impose any specific limitation.

[0182] Furthermore, when there are tens of thousands of vulnerabilities and tens of thousands of attack and defense tools, if the mapping relationship between the vulnerabilities and the attack and defense tools is directly sought, it is ten thousand * ten thousand = one hundred million. The recommendation device in the embodiment of the present application indirectly associates the vulnerabilities and the attack and defense tools through the ATT&CK matrix. Specifically, the current ATT&CK matrix includes technical information under more than 10 major categories and more than 300 minor categories. By determining the first technical information corresponding to the vulnerability information and the second technical information corresponding to the tool information, the vulnerabilities and the attack and defense tools are indirectly associated. In this way, the level of determination of the association relationship is ten thousand * 3 million + ten thousand * 3 million = ten thousand, that is, compared with the related technology, the recommendation accuracy of the attack and defense tools is greatly improved; then, after the vulnerabilities and the attack and defense tools are preliminarily associated based on the ATT&CK matrix, the level-by-level matching method can be used to further determine the sorting results from the multiple tool information associated with the vulnerability information, so as to better recommend the attack and defense tools according to the arrangement results, thereby improving the recommendation accuracy of the attack and defense tools.

[0183] like Figure 8 As shown, Figure 8701 to 705:

[0184] Step 701, obtaining sample vulnerability information and sample tool information, the sample vulnerability information includes a corresponding sample first technical information tag, and the sample tool information includes a corresponding sample second technical information tag.

[0185] Step 702: Input the sample vulnerability information and the sample tool information into a preset first intelligent recommendation model, perform feature extraction processing on the sample vulnerability information and the sample tool information respectively, and obtain the sample vulnerability key features and the sample tool key features.

[0186] Step 703, based on the preset technical and tactical knowledge graph, determine the sample first technical information corresponding to the key features of the sample vulnerability and the sample second technical information corresponding to the key features of the sample tool.

[0187] Step 704, determining a first loss value according to the first technical information of the sample and the first technical information label of the sample, and determining a second loss value according to the second technical information of the sample and the second technical information label of the sample.

[0188] Step 705: Adjust the parameters of the first intelligent recommendation model according to the first loss value and the second loss value to obtain a trained first intelligent recommendation model.

[0189] Steps 701 to 705 are described in detail below.

[0190] In some embodiments, a first intelligent recommendation model is deployed in the recommendation device, and the first intelligent recommendation model is used to determine the corresponding first technical information for the input vulnerability information, and to determine the corresponding second technical information for the input tool information. To achieve this purpose, the first intelligent recommendation model needs to be trained, wherein the method for obtaining sample vulnerability information and sample tool information is similar to steps 201 to 204, and will not be repeated here. After obtaining the sample vulnerability information and sample tool information, the corresponding first technical information label and second technical information label will be assigned to indicate the real technical information corresponding to the sample vulnerability information and the real technical information corresponding to the sample tool information.

[0191] Furthermore, the sample vulnerability information and sample tool information can also be obtained by further expanding the initial sample set obtained by a method similar to step 201 to step 204. Specifically, a data enhancement technology such as CLAREAugmenter is used to generate an additional expanded sample set, wherein CLAREAugmenter introduces reasonable noise while maintaining the semantics of the original text through operations such as synonym replacement, random insertion, exchange and deletion, thereby obtaining an expanded sample set.

[0192] Furthermore, the sample vulnerability information and the sample tool information are processed based on the first intelligent recommendation model, and the sample first technical information corresponding to the sample vulnerability information and the sample second technical information corresponding to the sample tool information are output. Steps 702 to 703 are similar to steps 102 to 103 and will not be repeated here.

[0193] Further, a first loss value between the first technical information of the sample and the label of the first technical information of the sample, and a second loss value between the second technical information of the sample and the label of the second technical information of the sample are calculated, wherein the first loss value and the second loss value can be determined by a binary cross entropy loss function (Binary Cross-Entropy). It should be noted that the loss function used to determine the first loss value and the second loss value can also be a squared loss function (Mean Squared Error, MSE), a logarithmic loss function (Cross-Entropy Loss) or a KL divergence (Kullback-LeiblerDivergence), etc., and the embodiments of the present application do not make specific restrictions.

[0194] Furthermore, according to the calculated first loss value and the second loss value, the parameters of the first intelligent recommendation model are adjusted. The parameters of the first intelligent recommendation model include learning rate, hyperparameters such as batch size (Batch Size), etc. Of course, the adjusted parameters of the first intelligent recommendation model can be set according to actual conditions, and the embodiments of the present application do not make specific limitations.

[0195] like Fig. 9 As shown, Fig. 9 This is another optional flow chart of the attack and defense tool intelligent recommendation method provided in the embodiment of the present application. In some embodiments, the second intelligent recommendation model is trained by following steps 801 to 804:

[0196] Step 801: input the sample first technical information and the sample second technical information into a preset second intelligent recommendation model, and determine the sample information similarity between the sample first technical information and the sample second technical information based on the second intelligent recommendation model.

[0197] Step 802: When the sample information similarity exceeds a preset second similarity threshold, a sample tool prediction label corresponding to the sample vulnerability information and a sample vulnerability prediction label corresponding to the sample tool information are determined.

[0198] Step 803, determining a third loss value based on the sample tool prediction label and the sample tool true label, and determining a fourth loss value based on the sample vulnerability prediction label and the sample vulnerability true label.

[0199] Step 804: Adjust the parameters of the second intelligent recommendation model according to the third loss value and the fourth loss value to obtain a trained second intelligent recommendation model.

[0200] Steps 801 to 804 are described in detail below.

[0201] In some embodiments, a second intelligent recommendation model is also deployed in the recommendation device, and the second intelligent recommendation model is used to determine the association relationship between the first technical information and the second technical information, and then match the vulnerability information and the tool information. To achieve this purpose, it is necessary to train the second intelligent recommendation model, wherein the method for determining the sample information similarity between the sample first technical information and the sample second technical information is similar to step 104 and will not be repeated here. It should be noted that after obtaining the sample vulnerability information and the sample tool information, the corresponding sample tool real label and sample vulnerability real label will be assigned to them, wherein the sample tool real label is used to indicate the tool information of the attack and defense tool that repairs the vulnerability corresponding to the vulnerability information, and the sample vulnerability real label is used to indicate the vulnerability information corresponding to the vulnerability that can be repaired by the attack and defense tool corresponding to the tool information, so as to determine the third loss value and the fourth loss value based on the output sample tool prediction label and sample vulnerability prediction label.

[0202] Furthermore, after obtaining the first technical information of the sample and the second technical information of the sample, the sample information similarity between the two is calculated, wherein the method for calculating the sample information similarity is similar to the method for calculating the information similarity in step 104, which will not be repeated here.

[0203] Furthermore, a third loss value between the sample tool prediction label and the sample tool true label, and a fourth loss value between the sample vulnerability prediction label and the sample vulnerability true label are calculated, wherein the third loss value and the fourth loss value can also be determined according to the Binary Cross-Entropy loss function, or can also be determined according to other loss functions, and the embodiments of the present application do not make specific limitations.

[0204] Furthermore, according to the calculated third loss value and the fourth loss value, the parameters of the second intelligent recommendation model are adjusted, and the parameters of the second intelligent recommendation model include learning rate, hyperparameters such as the number of iterations, etc., wherein, of course, the learning rate parameter in the first intelligent recommendation model is different from the learning rate parameter in the second intelligent recommendation model. The adjusted parameters of the second intelligent recommendation model can be set according to actual conditions, and the embodiments of the present application do not make specific limitations.

[0205] Furthermore, the first intelligent recommendation model and the second intelligent recommendation model can be jointly trained, the first loss value, the second loss value, the third loss value and the fourth loss value are weightedly calculated to obtain the total loss value, and the parameters of the first intelligent recommendation model and the second intelligent recommendation model are synchronously adjusted according to the total loss value. In this way, the correlation between the first intelligent recommendation model and the second intelligent recommendation model is strengthened, so that the two models can learn together and promote each other, thereby improving the overall generalization ability of the recommendation device, better adapting to task requirements and improving prediction accuracy.

[0206] like Fig.10 As shown, Fig.10 : is a schematic diagram of an optional functional module of the attack and defense tool intelligent recommendation device provided in an embodiment of the present application, wherein the attack and defense tool intelligent recommendation device may include:

[0207] Acquisition module 901, used for acquiring the vulnerability information and tool information;

[0208] A feature extraction module 902 is used to input vulnerability information and tool information into a pre-trained first intelligent recommendation model, perform feature extraction processing on the vulnerability information and tool information, and obtain vulnerability key features and tool key features;

[0209] A technical information determination module 903, used to determine first technical information corresponding to a key feature of a vulnerability and second technical information corresponding to a key feature of a tool based on a preset technical and tactical knowledge graph;

[0210] An information similarity determination module 904, configured to determine the information similarity between the first technical information and the second technical information based on a pre-trained second intelligent recommendation model;

[0211] The target module 905 is used to determine that the tool information matches the vulnerability information when the information similarity exceeds a preset similarity threshold, and to determine the attack and defense tool corresponding to the vulnerability information based on the tool information.

[0212] The specific implementation of the attack and defense tool intelligent recommendation device is basically the same as the specific implementation of the attack and defense tool intelligent recommendation method mentioned above, and will not be repeated here.

[0213] The present application proposes an attack and defense tool intelligent recommendation method, device, electronic device and storage medium. The method obtains vulnerability information and tool information, wherein the vulnerability information is used to indicate a security vulnerability, and the tool information is used to indicate an attack and defense tool corresponding to repairing the security vulnerability; then, the vulnerability information and tool information are input into a pre-trained first intelligent recommendation model, and feature extraction processing is performed on the vulnerability information and tool information respectively to obtain vulnerability key features and tool key features; based on a preset technical and tactical knowledge graph, the first technical information corresponding to the vulnerability key features and the second technical information corresponding to the tool key features are determined; based on a pre-trained second intelligent recommendation model, the information similarity between the first technical information and the second technical information is determined; when the information similarity exceeds a preset similarity threshold, it is determined that the tool information matches the vulnerability information, and the attack and defense tool corresponding to the vulnerability information is determined based on the tool information; because the first technical information and the second technical information provide more comprehensive and detailed attack information, the vulnerability information and the tool information can be better associated through the first technical information and the second technical information, thereby determining the attack and defense tool for repairing the current security vulnerability, thereby improving the accuracy and efficiency of the attack and defense tool recommendation.

[0214] The embodiment of the present application also provides an electronic device, the electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the above-mentioned attack and defense tool intelligent recommendation method when executing the computer program. The electronic device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0215] like Fig.11 As shown, Fig.11 : is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application, the electronic device includes:

[0216] The processor 1001 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0217] The memory 1002 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1002 can store an operating system and other application programs. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 1002, and the processor 1001 calls and executes the attack and defense tool intelligent recommendation method of the embodiment of this application;

[0218] Input / output interface 1003, used to implement information input and output;

[0219] Communication interface 1004, used to realize communication interaction between the device and other devices, which can be realized through wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WIFI, Bluetooth, etc.);

[0220] A bus 1005 , which transmits information between various components of the device (e.g., the processor 1001 , the memory 1002 , the input / output interface 1003 , and the communication interface 1004 );

[0221] The processor 1001 , the memory 1002 , the input / output interface 1003 and the communication interface 1004 are connected to each other in communication within the device via the bus 1005 .

[0222] An embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned attack and defense tool intelligent recommendation method is implemented.

[0223] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0224] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0225] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0226] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0227] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0228] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0229] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0230] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0231] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0232] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0233] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0234] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A method for intelligently recommending attack and defense tools, characterized in that: The method comprises: Get vulnerability information and tool information; Inputting the vulnerability information and the tool information into a pre-trained first intelligent recommendation model, performing feature extraction processing on the vulnerability information and the tool information respectively, to obtain vulnerability key features and tool key features; Determine, based on a preset technical and tactical knowledge graph, first technical information corresponding to the key feature of the vulnerability and second technical information corresponding to the key feature of the tool; Determining information similarity between the first technical information and the second technical information based on a pre-trained second intelligent recommendation model; When the information similarity exceeds a preset similarity threshold, determining that the tool information matches the vulnerability information, and determining the attack and defense tool corresponding to the vulnerability information based on the tool information; The obtaining of vulnerability information and tool information includes: Acquire first-level sub-vulnerability information, second-level sub-vulnerability information, and third-level sub-vulnerability information, wherein the second-level sub-vulnerability information has a higher priority than the third-level sub-vulnerability information, and the first-level sub-vulnerability information has a higher priority than the second-level sub-vulnerability information; Combining the first-level sub-vulnerability information, the second-level sub-vulnerability information and the third-level sub-vulnerability information to obtain the vulnerability information; Acquire first-level sub-tool information, second-level sub-tool information and third-level sub-tool information, wherein the second-level sub-tool information has a higher priority than the third-level sub-tool information, and the first-level sub-tool information has a higher priority than the second-level sub-tool information; Combining the first-level sub-tool information, the second-level sub-tool information and the third-level sub-tool information to obtain the tool information; The technical and tactical knowledge graph includes a plurality of technical information; The determining, based on the preset technical and tactical knowledge graph, the first technical information corresponding to the key feature of the vulnerability and the second technical information corresponding to the key feature of the tool includes: Based on a preset first vulnerability weight, extract first sub-vulnerability key information from the first-level sub-vulnerability information; based on a preset second vulnerability weight, extract second sub-vulnerability key information from the second-level sub-vulnerability information; based on a preset third vulnerability weight, extract third sub-vulnerability key information from the third-level sub-vulnerability information; Combining the first sub-vulnerability key information, the second sub-vulnerability key information and the third sub-vulnerability key information to obtain vulnerability key information; Compare the vulnerability key information with the plurality of technical information one by one to obtain a first comparison probability value, and determine that the technical information whose first comparison probability value is not less than a preset first probability threshold is the first technical information; Based on a preset first tool weight, extracting first sub-tool key information from the first-level sub-tool information; based on a preset second tool weight, extracting second sub-tool key information from the second-level sub-tool information; based on a preset third tool weight, extracting third sub-tool key information from the third-level sub-tool information; Combining the first sub-tool key information, the second sub-tool key information and the third sub-tool key information to obtain tool key information; Comparing the tool key information with the plurality of technical information one by one to obtain a second comparison probability value, and determining the technical information whose second comparison probability value is not less than a preset second probability threshold as the second technical information; After determining the information similarity between the first technical information and the second technical information, the method further includes: If the information similarities between multiple second technical information and the same first technical information all exceed a preset similarity threshold, determine the tool information corresponding to each of the multiple second technical information; According to the step-by-step matching results between the key information of each tool and the key information of the vulnerability, a sorting result of the plurality of tool information is obtained, and based on the sorting result, a plurality of attack and defense tools corresponding to the vulnerability information are sequentially determined; The step of obtaining the sorting results of the plurality of tool information according to the step-by-step matching results between the tool key information and the vulnerability key information includes: Calculating a first matching value between the first sub-tool key information and the first sub-vulnerability key information, and obtaining ranking information when the first matching value is greater than a preset first priority determination threshold; Otherwise, continue to calculate the second matching value between the second sub-tool key information and the second sub-vulnerability key information, and when the second matching value is greater than a preset second priority determination threshold, combine the first matching value and the second matching value to obtain the ranking information; Otherwise, continue to calculate the third matching value between the third sub-tool key information and the third sub-vulnerability key information, and combine the first matching value, the second matching value and the third matching value to obtain the ranking information; Based on the sorting information, the plurality of tool information are sorted to obtain a sorting result.

2. The method according to claim 1, characterized in that The extracting the first sub-vulnerability key information from the first-level sub-vulnerability information based on the preset first vulnerability weight includes: Performing word segmentation processing on the first-level sub-vulnerability information to obtain multiple word segmentation results, adding part-of-speech encoding information to each of the word segmentation results to obtain a word segmentation sequence, and performing vectorization processing on the word segmentation sequence to obtain a word segmentation matrix; Based on a preset first vulnerability weight, first sub-vulnerability key information is extracted from the word segmentation matrix.

3. The method according to claim 1, characterized in that The first intelligent recommendation model is trained by the following steps: Acquire sample vulnerability information and sample tool information, wherein the sample vulnerability information includes a corresponding sample first technical information tag, and the sample tool information includes a corresponding sample second technical information tag; Inputting the sample vulnerability information and the sample tool information into a preset first intelligent recommendation model, performing feature extraction processing on the sample vulnerability information and the sample tool information respectively, to obtain sample vulnerability key features and sample tool key features; Determine, based on a preset technical and tactical knowledge graph, sample first technical information corresponding to the key features of the sample vulnerability and sample second technical information corresponding to the key features of the sample tool; Determine a first loss value according to the first technical information of the sample and the first technical information label of the sample, and determine a second loss value according to the second technical information of the sample and the second technical information label of the sample; The parameters of the first intelligent recommendation model are adjusted according to the first loss value and the second loss value to obtain the trained first intelligent recommendation model.

4. The method according to claim 3, characterized in that The sample vulnerability information also includes the corresponding sample tool real label, and the sample tool information also includes the corresponding sample vulnerability real label; The second intelligent recommendation model is trained by the following steps: Inputting the first technical information of the sample and the second technical information of the sample into a preset second intelligent recommendation model, and determining the sample information similarity between the first technical information of the sample and the second technical information of the sample based on the second intelligent recommendation model; When the sample information similarity exceeds a preset similarity threshold, determining a sample tool prediction label corresponding to the sample vulnerability information and a sample vulnerability prediction label corresponding to the sample tool information; Determine a third loss value according to the sample tool prediction label and the sample tool true label, and determine a fourth loss value according to the sample vulnerability prediction label and the sample vulnerability true label; The parameters of the second intelligent recommendation model are adjusted according to the third loss value and the fourth loss value to obtain the trained second intelligent recommendation model.

5. An intelligent recommendation device for attack and defense tools, characterized in that: The device comprises: Acquisition module, used to obtain vulnerability information and tool information; A feature extraction module, used for inputting the vulnerability information and the tool information into a pre-trained first intelligent recommendation model, performing feature extraction processing on the vulnerability information and the tool information respectively, and obtaining vulnerability key features and tool key features; A technical information determination module, used to determine the first technical information corresponding to the key feature of the vulnerability and the second technical information corresponding to the key feature of the tool based on a preset technical and tactical knowledge graph; an information similarity determination module, configured to determine the information similarity between the first technical information and the second technical information based on a pre-trained second intelligent recommendation model; A target module, configured to determine that the tool information matches the vulnerability information when the information similarity exceeds a preset similarity threshold, and determine the attack and defense tool corresponding to the vulnerability information based on the tool information; The obtaining of vulnerability information and tool information includes: Acquire first-level sub-vulnerability information, second-level sub-vulnerability information, and third-level sub-vulnerability information, wherein the second-level sub-vulnerability information has a higher priority than the third-level sub-vulnerability information, and the first-level sub-vulnerability information has a higher priority than the second-level sub-vulnerability information; Combining the first-level sub-vulnerability information, the second-level sub-vulnerability information and the third-level sub-vulnerability information to obtain the vulnerability information; Acquire first-level sub-tool information, second-level sub-tool information and third-level sub-tool information, wherein the second-level sub-tool information has a higher priority than the third-level sub-tool information, and the first-level sub-tool information has a higher priority than the second-level sub-tool information; Combining the first-level sub-tool information, the second-level sub-tool information and the third-level sub-tool information to obtain the tool information; The technical and tactical knowledge graph includes a plurality of technical information; The determining, based on the preset technical and tactical knowledge graph, the first technical information corresponding to the key feature of the vulnerability and the second technical information corresponding to the key feature of the tool includes: Based on a preset first vulnerability weight, extract first sub-vulnerability key information from the first-level sub-vulnerability information; based on a preset second vulnerability weight, extract second sub-vulnerability key information from the second-level sub-vulnerability information; based on a preset third vulnerability weight, extract third sub-vulnerability key information from the third-level sub-vulnerability information; Combining the first sub-vulnerability key information, the second sub-vulnerability key information and the third sub-vulnerability key information to obtain vulnerability key information; Compare the vulnerability key information with the plurality of technical information one by one to obtain a first comparison probability value, and determine that the technical information whose first comparison probability value is not less than a preset first probability threshold is the first technical information; Based on a preset first tool weight, extracting first sub-tool key information from the first-level sub-tool information; based on a preset second tool weight, extracting second sub-tool key information from the second-level sub-tool information; based on a preset third tool weight, extracting third sub-tool key information from the third-level sub-tool information; Combining the first sub-tool key information, the second sub-tool key information and the third sub-tool key information to obtain tool key information; Comparing the tool key information with the plurality of technical information one by one to obtain a second comparison probability value, and determining the technical information whose second comparison probability value is not less than a preset second probability threshold as the second technical information; After determining the information similarity between the first technical information and the second technical information, the method further includes: If the information similarities between multiple second technical information and the same first technical information all exceed a preset similarity threshold, determine the tool information corresponding to each of the multiple second technical information; According to the step-by-step matching results between the key information of each tool and the key information of the vulnerability, a sorting result of the plurality of tool information is obtained, and based on the sorting result, a plurality of attack and defense tools corresponding to the vulnerability information are sequentially determined; The step of obtaining the sorting results of the plurality of tool information according to the step-by-step matching results between the tool key information and the vulnerability key information includes: Calculating a first matching value between the first sub-tool key information and the first sub-vulnerability key information, and obtaining ranking information when the first matching value is greater than a preset first priority determination threshold; Otherwise, continue to calculate the second matching value between the second sub-tool key information and the second sub-vulnerability key information, and when the second matching value is greater than a preset second priority determination threshold, combine the first matching value and the second matching value to obtain the ranking information; Otherwise, continue to calculate the third matching value between the third sub-tool key information and the third sub-vulnerability key information, and combine the first matching value, the second matching value and the third matching value to obtain the ranking information; Based on the sorting information, the plurality of tool information are sorted to obtain a sorting result.

6. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the attack and defense tool intelligent recommendation method according to any one of claims 1 to 4 when executing the computer program.

7. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the attack and defense tool intelligent recommendation method according to any one of claims 1 to 4 is implemented.

Images