An adaptive vulnerability rule set update and application security vulnerability standardization method

Abstract

The present invention relates to the field of network security, and in particular to an adaptive vulnerability rule set update and application security vulnerability standardization method, including: determining keyword categories according to the risk coefficient of keywords; determining vulnerability status according to the quantity reference coefficient and the historical fit coefficient, and determining the vulnerability processing method according to the vulnerability status; determining the reference text confirmation method according to the text type in the first vulnerability processing method, and replacing the target label text with the reference label text with the smallest comparison difference according to the comparison difference; in the second vulnerability processing method, determining the target vulnerability text matching order according to the induced vulnerability coefficient, using regular expressions for matching and then selecting matching items for matching or sending manual processing warning information to users; and storing standardized vulnerability information in a security vulnerability standard library. The present invention can improve the vulnerability matching effect when performing vulnerability standardization.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a method for updating an adaptive vulnerability rule set and standardizing application security vulnerabilities. Background Art

[0002] When performing vulnerability text matching, the matching effect of vulnerability texts with more fuzzy keywords and specific vulnerability texts is poor. Therefore, how to improve the matching effect of vulnerability texts with more fuzzy keywords and specific vulnerability texts is a technical problem that needs to be urgently solved by technical personnel in this field.

[0003] Chinese patent publication number CN109829636B discloses a system vulnerability assessment method, device and system based on an open vulnerability assessment language, including: collecting vulnerability information and version information of the operating system updated in the vulnerability knowledge base; updating the configuration database of the operating system according to the rules of the open vulnerability assessment language based on the vulnerability information and version update information; using the configuration database to perform vulnerability scans on the device to be tested with the operating system installed, and saving the vulnerability scan results. It can be seen that the above technical solution has the following problems: when performing vulnerability standardization, the vulnerability text matching method is single, resulting in errors in the matching effect. Summary of the invention

[0004] To this end, the present invention provides an adaptive vulnerability rule set update and application security vulnerability standardization method to overcome the problem in the prior art that when performing vulnerability standardization, the vulnerability text matching method is single, resulting in errors in the matching effect.

[0005] To achieve the above objectives, the present invention provides an adaptive vulnerability rule set update and application security vulnerability standardization method, comprising:

[0006] Establish common standard labels for security vulnerabilities and establish a standard library for security vulnerabilities;

[0007] Determine the keyword category of each keyword according to the risk factor of each keyword in the target vulnerability text;

[0008] Determine the vulnerability status according to the quantity reference coefficient and the historical matching coefficient of the target vulnerability text, and determine the vulnerability processing method according to the vulnerability status of the target vulnerability text as a first vulnerability processing method of matching the keyword or a second vulnerability processing method of matching the target vulnerability text according to a regular expression;

[0009] In the first vulnerability handling method, the text type is determined according to the conventional quantity ratio, and the reference text is determined according to the text type. The confirmation method is to determine the reference matching text according to the label text character difference corresponding to the special text or to determine the reference matching text according to the collocation parameters corresponding to the conventional text, and replace the target label text with the reference label text with the smallest comparison difference according to the comparison difference;

[0010] In the second vulnerability processing method, the target vulnerability text matching order is determined according to the induced vulnerability coefficient, and the matching items are selected after matching with the target vulnerability text or the user performs autonomous warning processing;

[0011] Standardized vulnerability information is stored in the security vulnerability standard library.

[0012] Further, the keyword category of each keyword is determined according to the risk factor of each keyword in the target vulnerability text, and the keyword category includes a first category of keywords with a risk factor greater than or equal to a preset risk factor, and a second category of keywords with a risk factor less than a preset risk factor;

[0013] The risk factor of a single keyword is positively correlated with the historical effective frequency of the keyword.

[0014] Further, the vulnerability status is determined based on the quantity reference coefficient of the target vulnerability text and the historical fit coefficient;

[0015] The vulnerability status includes a first vulnerability status in which the quantity reference coefficient is less than a preset quantity reference coefficient or the historical fit coefficient is less than a preset historical fit coefficient, and a second vulnerability status in which the quantity reference coefficient is greater than or equal to the preset quantity reference coefficient and the historical fit coefficient is greater than or equal to the preset historical fit coefficient.

[0016] Further, a vulnerability handling method is determined according to the vulnerability status of the target vulnerability text;

[0017] When the vulnerability state is the first vulnerability state, the vulnerability handling method is the first vulnerability handling method of matching the keyword;

[0018] When the vulnerability state is the second vulnerability state, the vulnerability processing method is the second vulnerability processing method of matching the target vulnerability text according to the regular expression.

[0019] Furthermore, in the first vulnerability processing mode, the text type of the target vulnerability text is determined according to the conventional quantity ratio, and the text type includes a special text whose conventional quantity ratio is less than a preset conventional quantity ratio, and a regular text whose conventional quantity ratio is greater than or equal to the preset conventional quantity ratio;

[0020] And determine the reference text confirmation method according to the text type;

[0021] If the text type is special text, the reference text confirmation method is to determine the reference matching text according to the difference between the label text characters corresponding to the special text;

[0022] If the text type is regular text, the reference text confirmation method is to determine the reference matching text according to the collocation parameters corresponding to the regular text;

[0023] The conventional quantity ratio=the number of standardized vulnerability texts with the same name and level as the target vulnerability text / the number of standardized vulnerability texts with the same name as the target vulnerability text.

[0024] Further, determining the reference matching text according to the label text character difference corresponding to the unique text includes:

[0025] Identify the name, level and reference value of the number of label text characters corresponding to each universal standard label of the special text, detect the standardized vulnerability text in the security vulnerability standard library that has the same name and level as the special text and the label text character difference is less than the preset label text character difference, and record it as the reference matching text.

[0026] Further, determining the reference matching text according to the collocation parameters corresponding to the regular text includes:

[0027] Taking punctuation marks as segmentation points, regular text is segmented into several short sentences. For a single short sentence, all keywords in the short sentence are identified, and all keywords in the single short sentence are recorded as a keyword combination. The successfully matched keyword combination is recorded as a reference keyword combination, and the standardized vulnerability text whose reference keyword combination quantity reference value is greater than a preset reference keyword combination quantity reference value and whose reference keyword combination distance reference value is less than a preset reference keyword combination distance reference value is taken as a reference matching text.

[0028] Furthermore, text replacement is performed for each universal standard label of the special text and the regular text, wherein the text replacement for a single universal standard label includes: recording the text corresponding to the universal standard label as the target label text, extracting all keywords in the target label text, converting each keyword into a keyword vector according to a word vector model, calculating the average value of each keyword vector and recording it as a reference average value, detecting the comparison difference between the reference average value and the matching average value of each reference label text, and replacing the target label text with the reference label text with the smallest comparison difference.

[0029] Furthermore, in the second vulnerability processing mode, the target vulnerability text is matched according to the order of the induced vulnerability coefficient from large to small;

[0030] The calculation formula of the induced vulnerability coefficient γ is: γ=α×ε1+β×ε2, wherein α is the reference value of the number of induced vulnerabilities, β is the reference value of the number of modules affected by induced vulnerabilities, ε1 is the weight coefficient of the reference value of the number of induced vulnerabilities, and ε2 is the weight coefficient of the reference value of the number of modules affected by induced vulnerabilities.

[0031] Furthermore, in the second matching state, the matching method is: converting the target vulnerability text into a regular expression, and matching the regular expression corresponding to the single target vulnerability text with the regular expression corresponding to each standardized vulnerability text in the security vulnerability standard library;

[0032] If there is a match, a random match is selected to match the target vulnerability text; if there is no match, the user performs autonomous warning processing;

[0033] The second matching state is that the matching order of the target vulnerability text has been confirmed according to the induced vulnerability coefficient.

[0034] Compared with the prior art, the beneficial effect of the present invention lies in that, in the technical solution of the present invention, the keyword category of each keyword is determined according to the risk factor of each keyword in the target vulnerability text, and the semantic ambiguity of the keyword is effectively reflected through the keyword category, and then the quantitative reference coefficient and the historical fit coefficient of the target vulnerability text are determined through the keyword category, so that the determination of the subsequent vulnerability status is more in line with the actual work scenario, and the vulnerability matching effect is further improved.

[0035] Furthermore, the present invention determines the vulnerability status according to the quantitative reference coefficient and the historical matching coefficient of the target vulnerability text, and effectively reflects the matching difficulty of the target vulnerability text through the vulnerability status, so that the subsequently selected vulnerability handling method is more in line with the actual working scenario, so that the vulnerability handling method can effectively match the target vulnerability text, avoiding the problem of inaccurate matching of fuzzy keyword expressions in the target vulnerability text, thereby improving the vulnerability matching effect.

[0036] Furthermore, the present invention determines the text type according to the conventional quantity ratio, and the specificity of the target vulnerability text effectively reflected by the text type can adaptively determine the reference text confirmation method according to the text type, so that the selection of reference matching text is more in line with the actual working scenario, avoiding the problem of inaccurate target vulnerability matching due to too many reference matching texts, thereby improving the vulnerability matching effect.

[0037] Furthermore, under the second vulnerability processing mode, the present invention determines the target vulnerability text matching order according to the induced vulnerability coefficient, which can ensure that dangerous vulnerabilities are matched first, thereby optimizing resource allocation, and matching through regular expressions is conducive to accurately matching standard vulnerability texts, thereby ensuring the vulnerability matching effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 A schematic diagram of the adaptive vulnerability rule set updating and application security vulnerability standardization method of the present invention;

[0039] Figure 2 A flowchart of the present invention for determining the keyword category of each keyword according to the risk factor of each keyword in the target vulnerability text;

[0040] Figure 3 This is a flow chart of the present invention for determining vulnerability status according to the quantity reference coefficient of the target vulnerability text and the historical matching coefficient;

[0041] Figure 4 The present invention is a flow chart of determining a vulnerability processing method according to the vulnerability status of a target vulnerability text. DETAILED DESCRIPTION

[0042] In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0043] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the protection scope of the present invention.

[0044] It should be noted that, in the description of the present invention, terms such as "up", "down", "left", "right", "inside" and "outside" indicating directions or positional relationships are based on the directions or positional relationships shown in the drawings. This is merely for the convenience of description and does not indicate or imply that the device or element must have a specific orientation, be constructed and operated in a specific orientation. Therefore, it cannot be understood as a limitation on the present invention.

[0045] In addition, it should be noted that in the description of the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0046] See also Figures 1 to 4 As shown, the present invention provides an adaptive vulnerability rule set update and application security vulnerability standardization method, including:

[0047] Establish common standard labels for security vulnerabilities and establish a standard library for security vulnerabilities;

[0048] Determine the keyword category of each keyword according to the risk factor of each keyword in the target vulnerability text;

[0049] Determine the vulnerability status according to the quantity reference coefficient and the historical matching coefficient of the target vulnerability text, and determine the vulnerability processing method according to the vulnerability status of the target vulnerability text as a first vulnerability processing method of matching the keyword or a second vulnerability processing method of matching the target vulnerability text according to a regular expression;

[0050] In the first vulnerability handling method, the text type is determined according to the conventional quantity ratio, and the reference text is determined according to the text type. The confirmation method is to determine the reference matching text according to the label text character difference corresponding to the special text or to determine the reference matching text according to the collocation parameters corresponding to the conventional text, and replace the target label text with the reference label text with the smallest comparison difference according to the comparison difference;

[0051] In the second vulnerability processing method, the target vulnerability text matching order is determined according to the induced vulnerability coefficient, and the matching items are selected after matching with the target vulnerability text or the user performs autonomous warning processing;

[0052] Standardized vulnerability information is stored in the security vulnerability standard library.

[0053] The application scenario of the method described in the present invention is the standardized processing of vulnerability texts, and the target vulnerability text is a vulnerability text for which a universal standard label has been established. The universal standard label includes the vulnerability name, vulnerability level, vulnerability source, and vulnerability repair solution. In the present invention, it is necessary to establish a security vulnerability standard library to store standardized vulnerability texts and historical standardized vulnerability texts. The standardized vulnerability text is the text set by the user to match the target vulnerability text. The historical standardized vulnerability text is the text after the target vulnerability text is standardized by the first vulnerability processing method or the second vulnerability processing method in the historical process. In addition, the method described in the present invention also needs to apply a vector character standard library, which is used to store word vector models and regular expression character sets corresponding to several keywords. The word vector models corresponding to the standard keywords are word vectors corresponding to several keywords set by the user in advance. The regular expression character set is used to convert the target vulnerability text into regular expression characters. The above are common technical means in this field and will not be repeated here.

[0054] Specifically, the keyword category of each keyword is determined according to the risk factor of each keyword in the target vulnerability text, and the keyword category includes a first category of keywords whose risk factor is greater than or equal to a preset risk factor, and a second category of keywords whose risk factor is less than a preset risk factor;

[0055] The risk factor of a single keyword is positively correlated with the historical effective frequency of the keyword.

[0056] The calculation formula for the risk coefficient φ of a single keyword is: φ=ρ×N, where N is the historical effective frequency of the keyword and ρ is the frequency coefficient, whose value is 1.25.

[0057] The value of the preset risk factor can be set by the user according to the actual application scenario. The greater the user's demand for accurate matching of the vulnerability text, the greater the value of the preset risk factor. A value of the preset risk factor is provided, and the average value of the risk factor of a category of keywords corresponding to all the standardized results of the vulnerability text that meet the user's needs in the detection history process is recorded as the preset risk factor;

[0058] The method for confirming the historical effective frequency is to detect all the corresponding vulnerability texts whose standardized results of the historical process meet the user's needs, which are recorded as Class I texts, and all the vulnerability texts whose standardized results do not meet the user's needs are recorded as Class II texts. For a single keyword, the difference between the number of times the keyword appears in the Class II text and the number of times it appears in the Class I text is recorded as the historical effective frequency. It can be understood that the present invention reflects the degree of influence of the multiple meanings of some keywords on the matching results through the historical effective frequency, and then determines the risk coefficient of the keywords, thereby effectively classifying the keywords and facilitating the subsequent determination of the vulnerability status.

[0059] Specifically, the vulnerability status is determined based on the quantitative reference coefficient of the target vulnerability text and the historical fit coefficient;

[0060] The vulnerability status includes a first vulnerability status in which the quantity reference coefficient is less than a preset quantity reference coefficient or the historical fit coefficient is less than a preset historical fit coefficient, and a second vulnerability status in which the quantity reference coefficient is greater than or equal to the preset quantity reference coefficient and the historical fit coefficient is greater than or equal to the preset historical fit coefficient.

[0061] Quantity reference coefficient = reference value of the number of first-category keywords / reference value of the number of second-category keywords;

[0062] The historical standardized vulnerability texts whose reference value of the number of category one keywords is the same as the reference value of the number of category one keywords of the target vulnerability text are recorded as historical reference texts, and the historical matching coefficient is the number of historical reference texts whose standardized results meet user requirements and whose reference coefficient of quantity is greater than the preset reference coefficient of quantity. The reference value of the number of category one keywords is the number of category one keywords in the target vulnerability, and the reference value of the number of category two keywords is the number of category two keywords in the target vulnerability.

[0063] The values ​​of the preset quantity reference coefficient and the preset historical match coefficient can be set by the user according to the actual application scenario. The greater the user's demand for precise matching of vulnerability texts, the larger the values ​​of the preset quantity reference coefficient and the preset historical match coefficient are. A value of a preset quantity reference coefficient and a preset historical match coefficient is provided. The preset quantity reference coefficient is the average value of the quantity reference coefficients of all vulnerability texts corresponding to the standardized results in the historical process that meet the user's needs. The preset historical match coefficient is 80% of the number of historical reference texts.

[0064] Specifically, the vulnerability handling method is determined according to the vulnerability status of the target vulnerability text;

[0065] When the vulnerability state is the first vulnerability state, the vulnerability handling method is the first vulnerability handling method of matching the keyword;

[0066] When the vulnerability state is the second vulnerability state, the vulnerability processing method is the second vulnerability processing method of matching the target vulnerability text according to the regular expression.

[0067] Specifically, under the first vulnerability processing method, the text type of the target vulnerability text is determined according to the conventional quantity ratio, and the text type includes a special text whose conventional quantity ratio is less than a preset conventional quantity ratio, and a regular text whose conventional quantity ratio is greater than or equal to the preset conventional quantity ratio;

[0068] And determine the reference text confirmation method according to the text type;

[0069] If the text type is special text, the reference text confirmation method is to determine the reference matching text according to the difference between the label text characters corresponding to the special text;

[0070] If the text type is regular text, the reference text confirmation method is to determine the reference matching text according to the collocation parameters corresponding to the regular text;

[0071] The conventional quantity ratio=the number of standardized vulnerability texts with the same name and level as the target vulnerability text / the number of standardized vulnerability texts with the same name as the target vulnerability text.

[0072] The value of the preset regular quantity ratio can be set by the user according to the actual application scenario. The greater the user's demand for precise matching of the vulnerability text, the larger the value of the preset regular quantity ratio is. A value of the preset regular quantity ratio is provided, and the preset regular quantity ratio is 20%.

[0073] Specifically, determining the reference matching text according to the character difference of the label text corresponding to the specific text includes:

[0074] Identify the name, level and reference value of the number of label text characters corresponding to each universal standard label of the special text, detect the standardized vulnerability text in the security vulnerability standard library that has the same name and level as the special text and the label text character difference is less than the preset label text character difference, and record it as the reference matching text.

[0075] The method for confirming the reference value of the number of characters of the label text is that, for a single universal standard label of a single unique text, the number of characters corresponding to the universal standard label, excluding the universal standard label characters, is recorded as the reference value of the number of characters of the label text;

[0076] For a single universal standard label of a single specific text, the universal standard label is recorded as a reference specific label, and the label in the standardized vulnerability text that is the same as the reference specific label is recorded as a reference standard label, and the label text character difference is the absolute value of the difference between the reference value of the number of label text characters corresponding to the reference standard label and the reference value of the number of label text characters corresponding to the reference specific label;

[0077] The value of the preset label text character difference can be set by the user according to the actual application scenario. The greater the user's demand for precise matching of the vulnerability text, the smaller the value of the preset label text character difference is. A value of the preset label text character difference is provided, and the preset label text character difference is 10% of the reference value of the number of label text characters corresponding to the reference standard label.

[0078] Specifically, the reference matching texts are determined based on the collocation parameters corresponding to the regular texts, including:

[0079] Taking punctuation marks as segmentation points, regular text is segmented into several short sentences. For a single short sentence, all keywords in the short sentence are identified, and all keywords in the single short sentence are recorded as a keyword combination. The successfully matched keyword combination is recorded as a reference keyword combination, and the standardized vulnerability text whose reference keyword combination quantity reference value is greater than a preset reference keyword combination quantity reference value and whose reference keyword combination distance reference value is less than a preset reference keyword combination distance reference value is taken as a reference matching text.

[0080] The reference keyword combination is confirmed in the following way: for a single keyword combination, a combination of several keywords in the standardized vulnerability text that can identify each keyword in the keyword combination and has the same arrangement order as the keyword combination in the reading direction is recorded as the reference keyword combination.

[0081] The reference value of the number of reference keyword combinations is the number of reference keyword combinations in a single standardized vulnerability text;

[0082] For a single reference keyword combination, detect the number of characters between the first keyword and the last keyword in the reading direction, record it as the reference character number, and then detect the reference character number of all keyword combinations. The reference keyword combination distance reference value is the maximum value of the reference character number of all keyword combinations.

[0083] For a single regular text, the regular text is recorded as a reference regular text. The values ​​of the preset reference keyword combination quantity reference value and the preset keyword combination distance reference value can be set by the user according to the actual application scenario. The greater the user's demand for precise matching of the vulnerability text, the greater the value of the preset reference keyword combination quantity reference value, and the smaller the value of the preset keyword combination distance reference value. A preset reference keyword combination quantity reference value and a preset keyword combination distance reference value are provided. The preset reference keyword combination quantity reference value is 70% of the total number of keyword combinations in the reference regular text. The reference keyword combination distance reference value corresponding to the record with the same reference keyword combination quantity reference value as the current reference keyword combination quantity reference value in the detection history processing process is recorded as the average value of the reference keyword combination distance reference value whose standardized results meet the user's needs as the preset reference keyword combination distance reference value.

[0084] Specifically, text replacement is performed for each universal standard label of special text and regular text, wherein the text replacement for a single universal standard label includes: recording the text corresponding to the universal standard label as the target label text, extracting all keywords in the target label text, converting each keyword into a keyword vector according to the word vector model, calculating the average value of each keyword vector and recording it as the reference average value, detecting the comparison difference between the reference average value and the matching average value of each reference label text, and replacing the target label text with the reference label text with the smallest comparison difference.

[0085] After replacing each target label text of the target vulnerability text with the corresponding reference label text with the smallest comparison difference, the replaced text is stored in the security vulnerability standard library as standardized vulnerability information.

[0086] The method for confirming the reference label text is to record the target vulnerability text as the reference text, the universal standard label as the target label, the reference matching text corresponding to the reference text as the target reference matching text, and the text corresponding to the universal standard label in the target reference matching text that is the same as the target label as the reference label text. The matching average value is the average value of each keyword vector of the target reference matching text; the comparison difference is the absolute value of the difference between the reference average value and the matching average value.

[0087] Specifically, under the second vulnerability processing method, the target vulnerability text is matched according to the order of the induced vulnerability coefficient from large to small;

[0088] The calculation formula of the induced vulnerability coefficient γ is: γ=α×ε1+β×ε2, wherein α is the reference value of the number of induced vulnerabilities, β is the reference value of the number of modules affected by induced vulnerabilities, ε1 is the weight coefficient of the reference value of the number of induced vulnerabilities, and ε2 is the weight coefficient of the reference value of the number of modules affected by induced vulnerabilities.

[0089] For a single target vulnerability text, the reference value of the number of induced vulnerabilities is the average value of the number of vulnerabilities discovered by each user that appear at the same time as the vulnerability corresponding to the target vulnerability text and have the same vulnerability name. The reference value of the number of modules affected by the induced vulnerabilities is the number of modules that need to be repaired after the vulnerability corresponding to the target vulnerability text appears. The modules include processor modules, memory modules, storage modules, motherboard modules, display modules, and network communication modules. This is easy for those skilled in the art to understand and will not be elaborated here.

[0090] It can be understood that the weight coefficient of the reference value of the number of induced vulnerabilities and the weight coefficient of the reference value of the number of modules affected by the induced vulnerabilities are set in advance by the user, and one value of ε1 and ε2 is provided, ε1=0.5, ε2=0.5.

[0091] Specifically, in the second matching state, the matching method is: converting the target vulnerability text into a regular expression, and matching the regular expression corresponding to the single target vulnerability text with the regular expression corresponding to each standardized vulnerability text in the security vulnerability standard library;

[0092] If there is a match, a random match is selected to match the target vulnerability text; if there is no match, the user performs autonomous warning processing;

[0093] The second matching state is that the matching order of the target vulnerability text has been confirmed according to the induced vulnerability coefficient.

[0094] The steps of converting the target vulnerability text into a regular expression are: extracting the fixed part and the variable part in the target vulnerability text, the fixed part includes keywords, identifiers and separators, and the variable part includes numbers, letter sequences and dates, wherein the fixed part and the variable part are converted in different ways, the fixed part is directly converted with the characters corresponding to the fixed part in the regular expression character set, and the variable part is converted using the symbols and quantifiers corresponding to the variable part in the regular expression character set, and the combination of several characters after all the fixed parts and variable parts in the text are converted into characters is the regular expression corresponding to the target vulnerability text, which is a technical content that is easy for technicians in this field to understand and will not be elaborated here.

[0095] The regular expression corresponding to a single target vulnerability text is recorded as a target regular expression. When the target regular expression is matched with the regular expressions corresponding to each standardized vulnerability text in the security vulnerability standard library, the regular expressions corresponding to each standardized vulnerability text in the security vulnerability standard library are recorded as reference regular expressions.

[0096] If there are one or more reference regular expressions with a similarity greater than or equal to a preset similarity, the standardized vulnerability text corresponding to the reference regular expression with the greatest similarity is selected as a matching item for matching, and the matched text is used as standardized vulnerability information and stored in the security vulnerability standard library;

[0097] If the similarity of each reference regular expression is less than the preset similarity, it means that there is no match, and the user performs autonomous warning processing; autonomous warning processing includes: performing manual review to standardize the target vulnerability text, and storing the standardized text in the security vulnerability standard library.

[0098] Similarity = the sum of the number of characters in each identical character segment in the reference regular expression / the number of characters in the regular expression with the larger number of characters between the reference regular expression and the target regular expression;

[0099] A character segment is a number of adjacent characters in a regular expression. An identical character segment is a character segment that the reference regular expression can identify as being identical to the character segment of the target regular expression, and whose adjacent characters at both ends are different from the adjacent characters at both ends of the corresponding target regular expression character segment, and whose character segment length is greater than a preset character segment length. The character segment length is the number of characters in a single character segment. The value of the preset character segment length can be set by the user according to the actual application scenario. The higher the user's accuracy in matching the vulnerability text, the larger the value of the preset character segment length. A value of the preset character segment length is provided, and the preset character segment length is 30% of the number of characters in the target regular expression.

[0100] The user can set the preset similarity value according to the actual application scenario. The greater the user's demand for accurate matching of the vulnerability text, the greater the preset similarity value. A preset similarity value is provided, and the preset similarity is 90%.

[0101] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

[0102] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for updating an adaptive vulnerability rule set and standardizing application security vulnerabilities, characterized in that: include: Establish common standard labels for security vulnerabilities and establish a standard library for security vulnerabilities; Determine the keyword category of each keyword according to the risk factor of each keyword in the target vulnerability text; Determine the vulnerability status according to the quantity reference coefficient and the historical matching coefficient of the target vulnerability text, and determine the vulnerability processing method according to the vulnerability status of the target vulnerability text as a first vulnerability processing method of matching the keyword or a second vulnerability processing method of matching the target vulnerability text according to a regular expression; In the first vulnerability handling method, the text type is determined according to the conventional quantity ratio, and the reference text is determined according to the text type. The confirmation method is to determine the reference matching text according to the label text character difference corresponding to the special text or to determine the reference matching text according to the collocation parameters corresponding to the conventional text, and replace the target label text with the reference label text with the smallest comparison difference according to the comparison difference; In the second vulnerability processing method, the target vulnerability text matching order is determined according to the induced vulnerability coefficient, and the matching items are selected after matching with the target vulnerability text or the user performs autonomous warning processing; Standardized vulnerability information is stored in the security vulnerability standard library; The text types include special texts whose regular quantity ratio is less than a preset regular quantity ratio, and regular texts whose regular quantity ratio is greater than or equal to a preset regular quantity ratio; The conventional quantity ratio=the number of standardized vulnerability texts with the same name and level as the target vulnerability text / the number of standardized vulnerability texts with the same name as the target vulnerability text.

2. The adaptive vulnerability rule set updating and application security vulnerability standardization method according to claim 1, characterized in that: Determine a keyword category of each keyword according to the risk factor of each keyword in the target vulnerability text, the keyword category including a first category of keywords whose risk factor is greater than or equal to a preset risk factor, and a second category of keywords whose risk factor is less than a preset risk factor; The risk factor of a single keyword is positively correlated with the historical effective frequency of the keyword.

3. The adaptive vulnerability rule set updating and application security vulnerability standardization method according to claim 2, characterized in that: Determine the vulnerability status based on the quantity reference coefficient of the target vulnerability text and the historical fit coefficient; The vulnerability status includes a first vulnerability status in which the quantity reference coefficient is less than a preset quantity reference coefficient or the historical fit coefficient is less than a preset historical fit coefficient, and a second vulnerability status in which the quantity reference coefficient is greater than or equal to the preset quantity reference coefficient and the historical fit coefficient is greater than or equal to the preset historical fit coefficient.

4. The adaptive vulnerability rule set updating and application security vulnerability standardization method according to claim 3, characterized in that: Determine the vulnerability handling method based on the vulnerability status of the target vulnerability text; When the vulnerability state is the first vulnerability state, the vulnerability processing method is the first vulnerability processing method of matching the keyword; When the vulnerability state is the second vulnerability state, the vulnerability processing method is the second vulnerability processing method of matching the target vulnerability text according to the regular expression.

5. The adaptive vulnerability rule set updating and application security vulnerability standardization method according to claim 1, characterized in that: The reference matching text determined based on the difference between the label text characters corresponding to the specific text includes: Identify the name, level and reference value of the number of label text characters corresponding to each universal standard label of the special text, detect the standardized vulnerability text in the security vulnerability standard library that has the same name and level as the special text and the label text character difference is less than the preset label text character difference, and record it as the reference matching text.

6. The adaptive vulnerability rule set updating and application security vulnerability standardization method according to claim 5, characterized in that: The reference matching texts determined based on the collocation parameters corresponding to the regular texts include: Taking punctuation marks as segmentation points, regular text is segmented into several short sentences. For a single short sentence, all keywords in the short sentence are identified, and all keywords in the single short sentence are recorded as a keyword combination. The successfully matched keyword combination is recorded as a reference keyword combination, and the standardized vulnerability text whose reference keyword combination quantity reference value is greater than a preset reference keyword combination quantity reference value and whose reference keyword combination distance reference value is less than a preset reference keyword combination distance reference value is taken as a reference matching text.

7. The adaptive vulnerability rule set updating and application security vulnerability standardization method according to claim 6, characterized in that: Text replacement is performed for each universal standard label of the special text and the regular text, wherein the text replacement for a single universal standard label includes: recording the text corresponding to the universal standard label as the target label text, extracting all the keywords in the target label text, converting each keyword into a keyword vector according to the word vector model, calculating the average value of each keyword vector and recording it as the reference average value, detecting the comparison difference between the reference average value and the matching average value of each reference label text, and replacing the target label text with the reference label text with the smallest comparison difference.

8. The adaptive vulnerability rule set updating and application security vulnerability standardization method according to claim 7, characterized in that: In the second vulnerability processing method, the target vulnerability text is matched according to the order of the induced vulnerability coefficient from large to small; The calculation formula of the induced vulnerability coefficient γ is: γ=α×ε1+β×ε2, wherein α is the reference value of the number of induced vulnerabilities, β is the reference value of the number of modules affected by induced vulnerabilities, ε1 is the weight coefficient of the reference value of the number of induced vulnerabilities, and ε2 is the weight coefficient of the reference value of the number of modules affected by induced vulnerabilities.

9. The adaptive vulnerability rule set updating and application security vulnerability standardization method according to claim 4, characterized in that: In the second matching state, the matching method is: converting the target vulnerability text into a regular expression, and matching the regular expression corresponding to the single target vulnerability text with the regular expression corresponding to each standardized vulnerability text in the security vulnerability standard library; If there is a match, a random match is selected to match the target vulnerability text; if there is no match, the user performs autonomous warning processing; The second matching state is that the matching order of the target vulnerability text has been confirmed according to the induced vulnerability coefficient.

Images