Component composite vulnerability detection method, device, equipment, medium and product

Abstract

The present application discloses a component composite vulnerability detection method, device, equipment, medium and product, which relates to the field of network security. The method includes obtaining vulnerability information; determining a vulnerability data table based on the vulnerability information; obtaining a vulnerability array field based on the vulnerability data table, the vulnerability array field is used to store vulnerability components, storing the vulnerability array field in a local database to obtain a component composite vulnerability data table; obtaining a component to be detected of a device to be detected, the component to be detected includes a software component to be detected and a hardware component to be detected, comparing the component to be detected with the vulnerability component one by one, and determining whether the device to be detected has a vulnerability. The present application solves the vulnerability problem caused by the mutual influence between different components.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a method, device, equipment, medium and product for detecting component composite vulnerabilities. Background Art

[0002] In today's digital age, network security issues are becoming increasingly prominent, threatening the development of various fields. In network security, component vulnerabilities seriously threaten network security. Component vulnerabilities refer to security defects in various components of software or hardware.

[0003] Dependencies introduced during the development of a project or software running on a computer will not cause security issues when they exist alone, but will cause vulnerabilities when the software runs on a specific version of the operating system. Two open source components introduced during the software development process will not cause vulnerabilities when either is introduced alone, but will cause vulnerabilities when both components are introduced at the same time. Vulnerabilities caused by multiple factors are called compound vulnerabilities.

[0004] Existing vulnerability detection methods mainly focus on running software and hardware themselves, and do not consider vulnerabilities caused by the interaction between different components. Summary of the invention

[0005] The purpose of this application is to provide a method, device, equipment, medium and product for detecting component composite vulnerabilities, which can solve the vulnerability problems caused by the mutual influence between different components.

[0006] To achieve the above objectives, this application provides the following solutions:

[0007] In a first aspect, the present application provides a method for detecting a component composite vulnerability, comprising:

[0008] Get vulnerability information;

[0009] Determine a vulnerability data table based on the vulnerability information;

[0010] Based on the vulnerability data table, a vulnerability array field is obtained, where the vulnerability array field is used to store vulnerability components, and the vulnerability array field is stored in a local database to obtain a component composite vulnerability data table;

[0011] Obtain components to be detected of the device to be detected, wherein the components to be detected include software components to be detected and hardware components to be detected, and compare the components to be detected with the vulnerability components one by one to determine whether the device to be detected has a vulnerability.

[0012] In a second aspect, the present application provides a component composite vulnerability detection device, comprising:

[0013] A first acquisition module is used to obtain vulnerability information;

[0014] A determination module, used to determine a local vulnerability data table based on the vulnerability information;

[0015] A second acquisition module is used to acquire a vulnerability array field based on the local vulnerability data table, the vulnerability array field is used to store vulnerability component information, and store the vulnerability array field in a local database to obtain a component composite vulnerability data table;

[0016] The comparison module is used to obtain the components to be detected of the device to be detected, wherein the components to be detected include software component information to be detected and hardware component information to be detected, and compare the components to be detected with the vulnerability components one by one to determine whether the device to be detected has a vulnerability.

[0017] In a third aspect, the present application provides a computer device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the component composite vulnerability detection method described in any one of the above.

[0018] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the component composite vulnerability detection method described in any one of the above.

[0019] In a fifth aspect, the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of any of the above-mentioned component composite vulnerability detection methods.

[0020] According to the specific embodiments provided in this application, this application discloses the following technical effects:

[0021] The present application provides a detection method, device, equipment, medium and product for component composite vulnerabilities. The vulnerability data table is determined by the acquired vulnerability information, and the vulnerability array field is obtained through the vulnerability data table. The vulnerability array field is used to store the vulnerability component. The component composite vulnerability data table is obtained by storing the vulnerability array field in the local database, and the set of all components between software and software, and between software and hardware that cause the composite vulnerability of the component is obtained, thereby improving the efficiency of vulnerability search and improving the search for composite vulnerabilities of the component. By obtaining the components to be detected of the device to be detected, wherein the components to be detected include the software components to be detected and the hardware components to be detected, the components to be detected are compared with the vulnerability components one by one to determine whether the device to be detected has a vulnerability, thereby realizing the detection of the composite vulnerability of the component. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0023] Figure 1 This is an application environment diagram of a component composite vulnerability detection method in an embodiment of the present application;

[0024] Figure 2 A schematic diagram of a method for detecting a composite vulnerability of a component provided in an embodiment of the present application;

[0025] Figure 3 A diagram of a single data structure in the vulnerability data table vulnerable_module provided in an embodiment of the present application;

[0026] Figure 4 A flowchart for determining whether a device to be detected has a vulnerability provided by an embodiment of the present application;

[0027] Figure 5 A flowchart for determining whether a component to be detected matches a vulnerable component provided by an embodiment of the present application;

[0028] Figure 6 A flowchart of a method for processing a vulnerability in a device to be detected provided in an embodiment of the present application;

[0029] Figure 7 A schematic diagram of the structure of a device for detecting a composite vulnerability of a component provided in an embodiment of the present application;

[0030] Figure 8 A schematic diagram of the structure of a computer device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0031] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0032] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0033] The present invention provides a method for detecting a composite vulnerability of a component, which can be applied to Figure 1In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be set up separately, integrated on the server 104, or placed on the cloud or other servers. The terminal 102 can send the acquired vulnerability information to the server 104. After the server 104 receives the acquired vulnerability information, for the acquired vulnerability information, the server 104 determines the vulnerability data table based on the acquired vulnerability information, obtains the vulnerability array field based on the vulnerability data table, and the vulnerability array field is used to store the vulnerability component. The server 104 stores the vulnerability array field in the local database to obtain the component composite vulnerability data table; the server 104 obtains the component to be detected of the device to be detected, and the component to be detected includes the software component to be detected and the hardware component to be detected, and compares the component to be detected with the vulnerability component one by one to determine whether the device to be detected has a vulnerability. The server 104 can feedback the detection result of whether the device to be detected has a vulnerability to the terminal 102. In addition, in some embodiments, the method for detecting component composite vulnerabilities can also be implemented independently by the server 104 or the terminal 102. For example, the terminal 102 can directly obtain vulnerability information, compare the components to be detected with the vulnerability components one by one, and determine whether there is a vulnerability in the device to be detected. The server 104 can also obtain vulnerability information from the data storage system, and compare the components to be detected with the vulnerability components one by one to determine whether there is a vulnerability in the device to be detected.

[0034] The terminal 102 may be, but is not limited to, various desktop computers, laptop computers, smart phones, tablet computers, IoT devices, and portable wearable devices. The IoT devices may be smart speakers, smart TVs, smart air conditioners, smart vehicle-mounted devices, etc. The portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc. The server 104 may be implemented as an independent server or a server cluster consisting of multiple servers, or may be a cloud server.

[0035] In an exemplary embodiment, Figure 2 As shown, a method for detecting a component composite vulnerability is provided. The method is executed by a computer device, and can be executed by a computer device such as a terminal or a server alone, or by a terminal and a server together. In the embodiment of the present application, the method is applied to Figure 1 The server 104 in the example is used as an example to illustrate, including the following steps 210 to 240. Among them:

[0036] Step 210, obtaining vulnerability information.

[0037] In one achievable manner, methods for obtaining vulnerability information include but are not limited to the following:

[0038] Use web crawler tools (such as Python's Scrapy framework) to write crawler programs and crawl vulnerability information from the National Information Security Vulnerability Impact Platform (https: / / www.cnvd.org.cn / ), the National Information Security Vulnerability Database (https: / / www.cnnvd.org.cn / ) and the US Vulnerability Database (https: / / nvd.nist.gov / ). 2. Download vulnerability information files: Some vulnerability databases provide a download function for vulnerability information files. For example, the US Vulnerability Database NVD provides the option to download vulnerability information in XML, CSV and other formats. Users can choose the appropriate format to download vulnerability information according to their needs.

[0039] Step 220, determining a vulnerability data table based on the vulnerability information.

[0040] Specifically, the component composite vulnerability information caused by the mutual influence between software and software, the component composite vulnerability information caused by the mutual influence between software and hardware, and the component composite vulnerability information caused by the mutual influence between hardware and hardware are extracted from the vulnerability information obtained in step 210. According to the extracted component composite vulnerability information, the component information of the vulnerable component is extracted, and the component information includes: vulnerability id, vulnerability name name, vulnerability source source, published date publishedDate, vulnerability description descriptions, related links references, component vendor vendor, component product name product, component version, logical relationship between components operator, vulnerability source source, vulnerability name name, vulnerability published date publishedDate, vulnerability description descriptions, related links references and other data.

[0041] It is understandable that there is a difference between the component version information disclosed by the security vulnerability website and the version information actually released by the component, and the component version information disclosed by the security vulnerability website cannot be automatically identified and compared by the computer. Therefore, the component version information is normalized. The normalization algorithm processing of the component version can convert various versions into a format that can be uniformly identified and compared by the computer, making the component composite vulnerability search computerized. At the same time, after the vulnerability component containing the component data structure is stored in the local database, the vulnerability can be quickly found through the database retrieval technology, which improves the efficiency of vulnerability search.

[0042] Exemplarily, the component version information is serialized into a string, and the specific steps are as follows:

[0043] Step 2201: Convert the characters in the component version information to lowercase characters, and remove the component vendor (Vendor) information and product (product) information included in the component version information. The above component vendor (Vendor) information and product (product) information include both uppercase and lowercase information.

[0044] Step 2202: Uniformly replace the non - Arabic letters and non - numeric characters in the string of the vulnerable component version information with the dot character ".", and multiple consecutive dot characters are combined into one dot character.

[0045] Step 2203: Mark the following characters included in the vulnerable component version information without distinguishing between uppercase and lowercase: Pre - alpha, Dev, alpha, α, beta, β, Release Candidate, RC, GA, General Availability, Stable, Maintenance Release, Patch, LTS, Long Term Support.

[0046] Step 2204: Set each interval between two dot characters "." as an interval, and the interval between the beginning and the end of the string as an interval. According to the version string from front to back, each interval less than 16 characters is filled with leading zeros, the interval exceeding 16 characters retains the first 16 characters. If the string has less than 8 intervals, uniformly fill zeros at the back, and finally add the string "99" at the end of the string. Process each version string into a fixed 130 - character string.

[0047] Exemplarily, after processing the component version 1.22.333 according to the above steps, it is:

[0048] 000000010000002200000333000000000000000000000000000000000000000099.

[0049] Step 2205: For the strings marked in Step 1203, according to the relationship of Pre - alpha < Dev < alpha / α < beta / β < Release Candidate / RC < GA / General Availability / Stable / < MaintenanceRelease < Patch < LTS / Long Term Support, replace the last two characters of the string with 01, 02, 03,..., 09 respectively.

[0050] Exemplarily, after processing the component version 1.22.33 - beta according to the above steps, it is:

[0051] 0000000100000022000003330000000000000000000000000000000000000000004.

[0052] After normalizing the vulnerable component version information, the component data structure of the vulnerable component version information is obtained, and the vulnerable component containing the component data structure is stored in the local database to obtain the vulnerability data table vulnerable. The above vulnerability data table includes three structures: vulnerable, node, and module. Among them, node is a display of the structure of a single node node in the vulnerable table, where a single node node is extracted from the node set nodes; module is a display of the structure of a single component module in a single node node, where a single component module is extracted from the component set modules. The above-mentioned vulnerability data table vulnerable is shown in Table 1:

[0053] Table 1

[0054]

[0055] Step 230, based on the vulnerability data table, a vulnerability array field is obtained, and the vulnerability array field is used to store vulnerable components. The vulnerability array field is stored in the local database to obtain a component composite vulnerability data table vulnerable-module, as shown in Table 2:

[0056] Table 2

[0057]

[0058] In an exemplary embodiment, node data is extracted from the vulnerability data table, and all combinations of the vulnerability components are listed according to the logical relationship represented in the node data, and each combination of the vulnerability components corresponds to a vulnerability array field. When the logical relationship is represented as AND, the vulnerability components in all the vulnerability array fields are obtained to determine a combination of the vulnerability components; when the logical relationship is represented as OR, one vulnerability component is obtained from each of the vulnerability array fields to determine a combination of the vulnerability components.

[0059] Specifically, extract each node data in the node set nodes in the vulnerable data table, and list all combinations of vulnerability components in the vulnerability array field childs and the vulnerability array field modules according to the logical relationship of and or or represented by the operator in the node data. Each combination of vulnerability components corresponds to a vulnerability array field. When the logical relationship represented by the operator is "and", it indicates that a vulnerability will occur when the vulnerability components in the vulnerability array field childs and the vulnerability array field modules exist at the same time; when the logical relationship represented by the operator is "or", it indicates that a vulnerability will occur when only one of the vulnerability components in the vulnerability array field childs and the vulnerability array field modules exists. Store all the above vulnerability array fields in the local database to form a component composite vulnerability data table vulnerable_module. The above node data represents node data, and the module data represents vulnerability component data. The entire component composite vulnerability data table shows all component sets between software and software, and between software and hardware, which lead to the composite vulnerability of components. Using database retrieval technology, vulnerabilities can be quickly found, which improves the efficiency of vulnerability search and improves the search for composite vulnerabilities of components.

[0060] For example, Figure 3 As shown, Figure 3 A single data structure diagram in the vulnerability data table vulnerable_module provided for one embodiment of the present application. According to the logical relationship "or" represented by the operator in node1, an OR operation is performed on the vulnerability components module1 and module2 in the vulnerability array field childrens and the vulnerability component module3 in the vulnerability array field modules. From the logical relationship "or", it can be known that the simultaneous existence of module1 and module3 will cause a vulnerability, or the simultaneous existence of module2 and module3 will cause a vulnerability. In addition, if the logical relationship is "and", the simultaneous existence of module1, module2 and module3 will cause a vulnerability. After the logical operation, module1, module2 and module3 form the component composite vulnerability data table vulnerable_module data 1 and vulnerable_module data 2. The three data of the above component composite vulnerability data table vulnerable_module are shown in Table 3:

[0061] Table 3

[0062]

[0063] Step 240, obtaining the components to be detected of the device to be detected, the components to be detected include software components to be detected and hardware components to be detected, comparing the components to be detected with the vulnerability components one by one to determine whether the device to be detected has a vulnerability.

[0064] Specifically, the software component analysis (SCA) technology is used to obtain the software component information contained in the device to be tested, and the hardware information of the device to be tested is obtained using the hardware profiling technology. The components to be tested are compared with the vulnerable components one by one to determine whether the device to be tested has a vulnerability. The specific steps include the following:

[0065] Step 2401, when the vulnerability array field modules contains only one vulnerability component, if the component to be detected matches the above-mentioned one vulnerability component, then the device to be detected has a vulnerability.

[0066] Step 2402, when the vulnerability array field modules contains multiple vulnerability components, if the component to be detected matches multiple vulnerability components, then the device to be detected has a vulnerability.

[0067] For example, Figure 4 As shown, Figure 4A flowchart for determining whether a device to be detected has a vulnerability is provided in an embodiment of the present application. Components a, b, and c to be detected are detected using software component analysis (SCA) technology and hardware information collection (Hardware Profiling) technology. Components a, b, and c to be detected can be any of hardware components and software components, respectively. Search for matches for the components a, b, and c to be detected in the vulnerability array field modules in the composite vulnerability data table vulnerable_module one by one. If the component a to be detected matches the vulnerable component in the vulnerability array field modules, if the component a to be detected matches a component in the vulnerability array field modules, and if there is only component a in the vulnerability array field modules, then there is a vulnerability in the device to be detected; if there is not only component a in the vulnerability array field modules, then it is necessary to check whether other components in the vulnerability array field modules except component a can find matches in the components b and c detected in the device to be detected. If all can find matches, there is a vulnerability. If one does not find a match, there is no vulnerability. Otherwise, there is no vulnerability in the device to be detected; search for matches for the components a, b, and c to be detected in the vulnerability array field modules in the composite vulnerability data table vulnerable_module one by one according to the above steps. If the components a, b, and c to be detected do not match the vulnerable components in the vulnerability array field modules, then there is no vulnerability in the device to be detected.

[0068] For example, Figure 5 As shown, Figure 5A flowchart for determining whether the component to be detected matches the vulnerable component provided in the embodiment of the present application. The component to be detected is searched for a match in the vulnerability array field modules of the composite vulnerability data table vulnerable_module, and the component information to be detected is compared with the information in the composite vulnerability data table vulnerable_module. First, the component product name product and the component manufacturer vendor of the two are compared to see if they are the same. If they are the same, determine whether the component version of the component to be detected is included in the table field versionEnum. If the table field versionEnum contains the component version of the component to be detected, then the component to be detected matches the vulnerable component in the composite vulnerability data table vulnerable_module, where versionEnum represents the version enumeration of the component containing the vulnerability; if the table field versionEnum does not contain the component version of the component to be detected, determine whether the table field excludeVersion contains the component version of the component to be tested. If the table field excludeVersion contains the component version of the component to be tested, then the component to be detected does not match the vulnerable component in the composite vulnerability data table vulnerable_module, where excludeVersion does not contain the component version of the component to be tested. Version represents the enumeration of versions without vulnerabilities; if the table field excludeVersion does not contain the component version of the component to be tested, the component version of the component to be tested is normalized, and the normalized component version is searched in the table field interval [startVersion, endVersion] by comparing the string size. The inclusion relationship on the left and right sides of the interval is determined according to the fields startinclude and endinclude. If the normalized component version can be found in the table field interval by comparing the string size, the component to be tested matches the vulnerable component in the composite vulnerability data table vulnerable_module. Among them, startVersion represents the starting version containing the vulnerability, endVersion represents the ending version containing the vulnerability, startinclude represents whether the starting version is included, and endinclude represents whether the ending version is included; if the normalized component version is not found in the table field interval by comparing the string size, the component to be tested does not match the vulnerable component in the composite vulnerability data table vulnerable_module.

[0069] In another exemplary embodiment of the present application, when a vulnerability exists in the device to be detected, it is necessary to provide feedback to the user on repair suggestions. The component vulnerability detection method provided in this embodiment includes the following steps:

[0070] Step 2501: If a vulnerability exists in the device to be detected, determine the component to be detected corresponding to the vulnerability. There is at least one group of components to be detected, and each group of components to be detected corresponds to a current version. When there is only one group of components to be detected, find out whether the current version corresponding to this group of components to be detected comes with official repair suggestions. When there are multiple groups of components to be detected, find out whether the current versions corresponding to the multiple groups of components to be detected respectively come with official repair suggestions.

[0071] Step 2502: If the current version comes with official repair suggestions, all official repair suggestions are fed back to the user;

[0072] Step 2503: If the current version does not come with the official repair suggestion, query a higher version corresponding to the current version, wherein the higher version is obtained by using a component library used in Software Composition Analysis (SCA) technology.

[0073] Step 2504: If no higher version corresponding to the current version is found, the current version is the highest version.

[0074] Step 2505: If a higher version corresponding to the current version is found, at least one group of higher version vulnerability components obtained by combining at least one group of the components to be detected are compared one by one with the vulnerability components; if the higher version vulnerability components do not have vulnerabilities, all combinations of the higher versions are sent to the user as repair suggestions; if the higher version vulnerability components have vulnerabilities, the total vulnerability scores of each group of the higher version vulnerability components are calculated, and the higher version combination corresponding to the higher version vulnerability components with the lowest total vulnerability score is fed back to the user as a repair suggestion.

[0075] For example, Figure 6 As shown, Figure 6A flowchart of a method for handling device vulnerabilities to be detected provided in an embodiment of the present application. Components a, b, c, d, e, and f to be detected are detected using software component analysis (SCA) technology and hardware information collection (Hardware Profiling) technology. Components a, b, c, d, e, and f to be detected can be any of hardware components and software components. Obtain the vulnerability component combinations a and b, the vulnerability component combinations g and h, and the vulnerability component combinations e and g in the component composite vulnerability data table. Compare the components a, b, c, d, e, and f to be detected with the vulnerable component combinations a and b, the vulnerable component combinations g and h, and the vulnerable component combinations e and g respectively. If there is a vulnerability, check whether the current version comes with official repair suggestions. If the current version comes with official repair suggestions, feedback the official repair suggestions attached to the current version to the user; if the current version does not come with official repair suggestions, switch the version combination, that is, query the higher version corresponding to the current version. If the highest version corresponding to the current version is not found, the current version is the highest version; if a higher version corresponding to the current version is found, each current version corresponds to at least one higher version, and each group of components to be detected corresponds to at least one higher version; compare a group of higher version vulnerability components obtained from a group of components to be detected with the vulnerability components one by one, or compare multiple groups of higher version vulnerability components obtained by combining multiple groups of components to be detected with the vulnerability components one by one, until the comparison of the last version combination is completed. If the higher version vulnerability component does not have a vulnerability, all higher version combinations are sent to the user as repair suggestions; if the higher version vulnerability component has a vulnerability, the total vulnerability score of each group of higher version vulnerability components is calculated, and the higher version combination corresponding to the higher version vulnerability component with the lowest total vulnerability score is sent to the user as a repair suggestion. By finding all version combinations containing vulnerable components, the solution with the least impact on the system is found according to the vulnerability scores of different version combinations. The lower the vulnerability score, the less harmful the version combination is to the system.

[0076] The present application also provides an application scenario, which applies the above-mentioned component composite vulnerability detection method. Specifically: the component composite vulnerability detection method provided in this embodiment, the component name of the device to be detected is component a, the manufacturer is Microsoft, and the version is 1.0. The above-mentioned component information can be directly compared with the component information of the vulnerability component to determine whether the component to be detected has a vulnerability. If there is a vulnerability, we need to provide a repair suggestion to find a higher version of component a, assuming it is 2.0. At this time, a new component information is formed: the component name is component a, the manufacturer is Microsoft, and the version is 2.0. This new component information is compared again with the component information of the vulnerability component to determine whether the component to be detected has a vulnerability. If there is no vulnerability, it is recommended that the user upgrade component a to version 2.0; if there is still a vulnerability, and the only version of component a higher than 1.0 is 2.0, it is necessary to compare which version of component a, 1.0 and 2.0, has the lowest vulnerability score, and which version will be sent to the user as a repair suggestion.

[0077] Based on the same inventive concept, the embodiment of the present application also provides a detection device for implementing a component composite vulnerability involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the embodiment of the detection device for one or more component composite vulnerabilities provided below can refer to the limitations of the detection method for component composite vulnerabilities above, and will not be repeated here.

[0078] In an exemplary embodiment, Figure 7 As shown, a detection device for a component composite vulnerability is provided, comprising:

[0079] On the other hand, Figure 7 FIG. 1 is a schematic diagram of the structure of a device for detecting a composite vulnerability of a component provided in an embodiment of the present application. Figure 7 As shown, the device 700 includes:

[0080] A first acquisition module 710, used to acquire vulnerability information;

[0081] A determination module 720, configured to determine a local vulnerability data table based on the vulnerability information;

[0082] The second acquisition module 730 is used to acquire a vulnerability array field based on the local vulnerability data table, where the vulnerability array field is used to store vulnerability component information, and store the vulnerability array field in the local database to obtain a component composite vulnerability data table;

[0083] The comparison module 740 is used to obtain the components to be detected of the device to be detected, which include the software component information to be detected and the hardware component information to be detected, and compare the components to be detected with the vulnerability components one by one to determine whether the device to be detected has a vulnerability.

[0084] As an optional implementation, in the prediction model building device provided in the embodiment of the present application, the determination module 720 is specifically used for:

[0085] Extract component composite vulnerability information based on vulnerability information, where the component composite vulnerability information includes software and

[0086] Composite vulnerability information of components caused by mutual influence between software, composite vulnerability information of components caused by mutual influence between software and hardware, composite vulnerability information of components caused by mutual influence between hardware and hardware;

[0087] Based on the component composite vulnerability information, the component information of the vulnerable component is extracted. The component information includes the component manufacturer, component product name and component version. The component version is normalized to obtain the component data structure of the component version. The vulnerable component containing the component data structure is stored in the local database to obtain a vulnerability data table.

[0088] As an optional implementation, in the prediction model building device provided in the embodiment of the present application, the second acquisition module 730 is specifically used for:

[0089] Node data is extracted from the vulnerability data table, and all combinations of vulnerability components are listed according to the logical relationship represented in the node data. Each combination of vulnerability components corresponds to a vulnerability array field.

[0090] As an optional implementation, in the prediction model building device provided in the embodiment of the present application, the comparison module 740 is specifically used for:

[0091] When the vulnerability array field contains only one vulnerability component, if the component to be detected matches the vulnerability component, the device to be detected has a vulnerability;

[0092] When the vulnerability array field contains multiple vulnerability components, if the component to be detected matches the vulnerability component, the device to be detected has a vulnerability.

[0093] In an exemplary embodiment, a computer device is provided. The computer device may be a server or a terminal. The internal structure diagram thereof may be as follows: Figure 8As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store video tag processing data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for detecting a component composite vulnerability is implemented.

[0094] Those skilled in the art will understand that Figure 8 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0095] In an exemplary embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0096] In an exemplary embodiment, a computer-readable storage medium is provided, storing a computer program, and when the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0097] In an exemplary embodiment, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0098] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0099] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM may be in various forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM).

[0100] The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. The non-relational database may include a distributed database based on blockchain, etc., but is not limited thereto. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but is not limited thereto.

[0101] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0102] This article uses specific examples to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method and core ideas of this application. At the same time, for those skilled in the art, according to the ideas of this application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting this application.

Claims

1. A method for detecting a component composite vulnerability, characterized in that: The detection method of the component composite vulnerability includes: Get vulnerability information; Determine a vulnerability data table based on the vulnerability information; Based on the vulnerability data table, a vulnerability array field is obtained, where the vulnerability array field is used to store vulnerability components, and the vulnerability array field is stored in a local database to obtain a component composite vulnerability data table; Obtaining components to be detected of the device to be detected, the components to be detected including software components to be detected and hardware components to be detected, comparing the components to be detected with the vulnerability components one by one, and determining whether the device to be detected has a vulnerability; Determining the vulnerability data table based on the vulnerability information specifically includes: Extract component composite vulnerability information based on the vulnerability information, wherein the component composite vulnerability information includes Including composite vulnerability information of the components caused by the mutual influence between software and software, composite vulnerability information of the components caused by the mutual influence between software and hardware, and composite vulnerability information of the components caused by the mutual influence between hardware and hardware; Extracting component information of the vulnerable component based on the component composite vulnerability information, the component information including component manufacturer, component product name and component version, normalizing the component version to obtain a component data structure of the component version, and storing the vulnerable component including the component data structure in a local database to obtain a vulnerability data table; The obtaining of vulnerability array fields based on the vulnerability data table specifically includes: Extracting node data from the vulnerability data table, and listing all combinations of the vulnerability components according to the logical relationship represented in the node data, wherein each combination of the vulnerability components corresponds to a vulnerability array field; The step of listing all combinations of the vulnerability components according to the logical relationship represented in the node data specifically includes: When the logical relationship is characterized by AND, obtaining the vulnerability components in all the vulnerability array fields to determine a combination of the vulnerability components; When the logical relationship is represented by "or", one vulnerability component is obtained from each of all the vulnerability array fields to determine a combination of the vulnerability components.

2. The component composite vulnerability detection method according to claim 1 is characterized in that: The step of comparing the components to be detected with the vulnerable components one by one to determine whether the device to be detected has a vulnerability specifically includes: When the vulnerability array field contains only one vulnerability component, if the component to be detected matches the vulnerability component, the device to be detected has a vulnerability; When the vulnerability array field contains a plurality of vulnerability components, if the component to be detected matches the vulnerability component, the device to be detected has a vulnerability.

3. The component composite vulnerability detection method according to claim 1 is characterized in that: The component composite vulnerability detection method further includes: If the device to be detected has a vulnerability, find out whether the current version of the component to be detected comes with an official repair suggestion based on the component to be detected that causes the vulnerability; If the current version comes with the official repair suggestion, feeding back the official repair suggestion to the user; If the current version does not come with the official repair suggestion, query a higher version corresponding to the current version; If no higher version corresponding to the current version is found, the current version is the highest version; If a higher version corresponding to the current version is found, at least one group of higher version vulnerability components obtained by combining at least one group of components to be detected are compared one by one with the vulnerability components; if the higher version vulnerability components do not have vulnerabilities, all combinations of the higher versions are sent to the user as repair suggestions; if the higher version vulnerability components have vulnerabilities, the total vulnerability scores of each group of the higher version vulnerability components are calculated, and the higher version combination corresponding to the higher version vulnerability components with the lowest total vulnerability score is fed back to the user as a repair suggestion.

4. A component composite vulnerability detection device, characterized in that: The detection device for the component composite vulnerability comprises: A first acquisition module is used to obtain vulnerability information; A determination module is used to determine a local vulnerability data table based on the vulnerability information, and is also used to: Extracting component composite vulnerability information based on the vulnerability information, wherein the component composite vulnerability information includes the component composite vulnerability information caused by the mutual influence between software and software, the component composite vulnerability information caused by the mutual influence between software and hardware, and the component composite vulnerability information caused by the mutual influence between hardware and hardware; Extracting component information of the vulnerable component based on the component composite vulnerability information, the component information including the component manufacturer, component product name and component version, normalizing the component version to obtain a component data structure of the component version, and storing the vulnerable component including the component data structure in a local database to obtain a vulnerability data table; The second acquisition module is used to acquire a vulnerability array field based on the local vulnerability data table, the vulnerability array field is used to store vulnerability component information, and the vulnerability array field is stored in the local database to obtain a component composite vulnerability data table, and is also used to: Extracting node data from the vulnerability data table, and listing all combinations of the vulnerability components according to the logical relationship represented in the node data, wherein each combination of the vulnerability components corresponds to a vulnerability array field; When the logical relationship is characterized by AND, obtaining the vulnerability components in all the vulnerability array fields to determine a combination of the vulnerability components; When the logical relationship is represented by "or", obtaining one vulnerability component from each of all vulnerability array fields to determine a combination of vulnerability components; The comparison module is used to obtain the components to be detected of the device to be detected, wherein the components to be detected include software component information to be detected and hardware component information to be detected, and compare the components to be detected with the vulnerability components one by one to determine whether the device to be detected has a vulnerability.

5. A computer device comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the component composite vulnerability detection method described in any one of claims 1-3.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the component composite vulnerability detection method described in any one of claims 1 to 3 are implemented.

7. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the component composite vulnerability detection method described in any one of claims 1 to 3 are implemented.

Images