A vulnerability correlation analysis and verification method based on multi-source data fusion

Abstract

The present invention relates to the field of network security technology, and in particular to a vulnerability association analysis and verification method of multi-source data fusion, the method comprising: real-time monitoring and deduplication of vulnerability data; calculating the confidence score of vulnerability data; monitoring and calculating the reachability score of the vulnerability; analyzing the repair level, calculating the priority score; sorting, verifying the vulnerability, correcting and outputting the result. The present invention makes full use of the data sources of various security detection tools through multi-source data fusion, and significantly improves the accuracy and comprehensiveness of vulnerability detection. By calculating the confidence score and the vulnerability reachability score, and combining the analysis of short-term fluctuations and long-term trends, the system can dynamically and intelligently adjust the priority of vulnerability repair, thereby achieving accurate and efficient vulnerability repair, improving the overall security and stability of the system, and effectively solving the problem of poor comprehensiveness and accuracy of vulnerability processing due to a single source of vulnerability data and insufficient dynamic evaluation.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a vulnerability correlation analysis and verification method for multi-source data fusion. Background Art

[0002] With the rapid development of information technology, network security has become an important concern for all walks of life. With the increasing complexity of systems and the continuous evolution of network attack methods, traditional vulnerability management methods have become inadequate. In the modern network environment, the diversity of data and the wide range of sources make it difficult for data from a single source to fully reflect the security situation of the system. Therefore, network security experts need a method that can integrate and analyze data from different security detection tools to achieve more accurate vulnerability detection and repair strategies.

[0003] The patent document with the publication number CN116775910A discloses a method for constructing an automated vulnerability reproduction knowledge base based on intelligence collection, which includes: establishing a vulnerability reproduction knowledge base, determining the CVE number, and then parsing and constructing a feature vector; based on the feature vector, collecting vulnerability information intelligence, extracting vulnerability information, and reproducing the vulnerability environment; based on the vulnerability information, collecting vulnerability proof scheme intelligence; analyzing the vulnerability proof scheme intelligence, information correlation and intelligence evaluation, and generating a vulnerability proof scheme report; generating a vulnerability exploitation script based on the vulnerability proof scheme report; starting the vulnerability environment, executing the vulnerability exploitation script to simulate the attack, and saving the vulnerability environment and the vulnerability exploitation script to the vulnerability reproduction knowledge base. It can be seen that this method is mainly based on the analysis of a single vulnerability information intelligence, and it focuses on vulnerability reproduction and exploitation script generation, resulting in the priority in vulnerability processing being not accurate enough and not real-time; this method mainly focuses on vulnerability reproduction and exploitation script generation, resulting in insufficient comprehensiveness in vulnerability processing. Summary of the invention

[0004] To this end, the present invention provides a vulnerability correlation analysis and verification method based on multi-source data fusion, so as to overcome the problems in the prior art of poor comprehensiveness and accuracy of vulnerability processing due to a single vulnerability data source and insufficient dynamic evaluation.

[0005] To achieve the above object, the present invention provides a vulnerability association analysis and verification method based on multi-source data fusion, comprising:

[0006] Real-time monitoring of vulnerability data in several security detection tools in the target system, and deduplication of the vulnerability data to obtain deduplication vulnerability data;

[0007] Obtaining data sources of the deduplication vulnerability data, determining the confidence level of each deduplication vulnerability data according to the number of the data sources and the preset number of standard sources, calculating the confidence of each deduplication vulnerability data according to the confidence level and the preset standard level, and obtaining a confidence score;

[0008] Real-time monitoring of the target system's network accessibility, business impact, and authentication strength;

[0009] Calculating a vulnerability reachability score according to the network reachability, the business impact, and the authentication strength;

[0010] Determine the short-term repair level according to all the vulnerability reachable scores of each deduplicated vulnerability data within a preset short-term fluctuation duration and a preset short-term fluctuation standard deviation range, and calculate the priority score according to the confidence score and all the vulnerability reachable scores corresponding to the short-term repair level, or draw a trend curve according to the short-term repair level and all the vulnerability reachable scores within a preset long-term trend duration, determine the long-term repair level according to the slope of the trend curve and a preset slope range, and calculate the priority score according to the confidence score and all the vulnerability reachable scores corresponding to the long-term repair level;

[0011] Prioritize the deduplicated vulnerability data according to the priority scores to obtain a priority ranking list;

[0012] Verify the existence of the vulnerabilities corresponding to each deduplicated vulnerability data in the priority sorting list, and modify the priority sorting list according to the existence and the preset standard existence, form a modified list and output it.

[0013] Further, the calculating the vulnerability reachability score according to the network reachability, the service impact, and the authentication strength includes:

[0014] A vulnerability reachability score is calculated based on the network reachability, the business impact, the authentication strength, a preset network reachability weight, a preset business impact weight, and a preset authentication strength weight.

[0015] Further, determining the short-term repair level according to all the vulnerability attainable scores of the deduplicated vulnerability data within a preset short-term fluctuation period and a preset short-term fluctuation standard deviation range includes:

[0016] Calculate the standard deviation of all the vulnerability scores within the short-term fluctuation period to obtain the vulnerability score standard deviation. When the vulnerability score standard deviation is greater than the maximum value of the short-term fluctuation standard deviation range, determine that the short-term repair level is a high short-term repair level.

[0017] When the vulnerability achievable score standard deviation is within the short-term fluctuation standard deviation range, the short-term repair level is determined to be the repair level to be analyzed.

[0018] Further, the calculating of the priority score according to the confidence score and all the vulnerability reachable scores corresponding to the short-term repair level includes:

[0019] The priority score is calculated according to the confidence score, an average of all the vulnerability achievable scores corresponding to the high short-term fix level, a preset confidence score weight, and a preset high short-term fix weight.

[0020] Furthermore, drawing a trend curve according to the short-term repair level and all the vulnerability attainable scores within a preset long-term trend duration includes:

[0021] When the short-term repair level is determined to be the repair level to be analyzed, a trend curve is drawn according to all the vulnerability attainable scores within the long-term trend duration.

[0022] Further, determining the long-term repair level according to the slope of the trend curve and a preset slope range includes:

[0023] When the slope of the trend curve is greater than the maximum value of the slope range, the long-term repair level is determined to be a high long-term repair level.

[0024] Further, the calculating of the priority score according to all the vulnerability reachable scores corresponding to the confidence score and the long-term repair level includes:

[0025] When the long-term repair level is determined to be a high long-term repair level, the priority score is calculated based on the confidence score, the average of all the vulnerability reachable scores corresponding to the long-term repair level, the confidence score weight, and the preset long-term repair weight.

[0026] Further, the modifying the priority ranking list according to the existence degree and the preset standard existence degree includes:

[0027] When the existence degree is less than the standard existence degree, the corresponding deduplication vulnerability data is deleted from the priority sorting list.

[0028] Furthermore, determining the confidence level of each deduplication vulnerability data according to the number of data sources and the preset number of standard sources includes:

[0029] When the number of the data sources is greater than the number of the standard sources, the confidence level of the deduplication vulnerability data is determined to be the standard level.

[0030] Furthermore, the confidence of each deduplication vulnerability data is calculated according to the confidence level and the preset standard level to obtain the confidence score, which includes:

[0031] When it is determined that the confidence level of the deduplication vulnerability data is the standard level, the confidence is calculated according to a preset confidence algorithm to obtain a confidence score.

[0032] Compared with the prior art, the beneficial effect of the present invention is that, through multi-source data fusion, the data sources of various security detection tools are fully utilized, which significantly improves the accuracy and comprehensiveness of vulnerability detection. By calculating the confidence score and the vulnerability reachability score, and combining the analysis of short-term fluctuations and long-term trends, the system can dynamically and intelligently adjust the priority of vulnerability repair, thereby achieving accurate and efficient vulnerability repair. Ultimately, this method effectively reduces security risks, improves the overall security and stability of the system, provides more reliable protection for responding to potential threats, and effectively solves the problem of poor comprehensiveness and accuracy of vulnerability processing due to a single source of vulnerability data and insufficient dynamic evaluation.

[0033] Furthermore, by combining the three key factors of network reachability, business impact, and authentication strength with corresponding weights to calculate the vulnerability reachability score, this method can more accurately reflect the actual risk level of each vulnerability in the system and help prioritize the vulnerabilities that pose the greatest threat to the system.

[0034] Furthermore, by grading short-term fluctuations, the urgency of the vulnerability and the priority of repair can be determined more accurately.

[0035] Furthermore, by comprehensively considering the confidence level of the vulnerability and the difficulty of repairing it in the short term, the priority of vulnerability handling can be evaluated more accurately.

[0036] Furthermore, long-term trend analysis provides an in-depth understanding of changes in vulnerability reachability scores, which can effectively identify potential risks and trends in the long term.

[0037] Furthermore, by calculating and comparing the slopes, the long-term aggravation trend of vulnerabilities can be accurately identified, so that those vulnerabilities that change rapidly can be dealt with first.

[0038] Furthermore, by calculating and comparing the slopes, the long-term aggravation trend of vulnerabilities can be accurately identified, so that those vulnerabilities that change rapidly can be dealt with first.

[0039] Furthermore, by setting the standard existence, it is possible to effectively eliminate those vulnerabilities that are falsely reported or have a small impact, and optimize the vulnerability handling process.

[0040] Furthermore, by setting a standard number of sources, the confidence of vulnerability data can be effectively improved and misjudgments caused by insufficient or unreliable data sources can be reduced.

[0041] Furthermore, by using a preset confidence algorithm to calculate the score, it can be ensured that only vulnerability data that meets the standard level will be further analyzed. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 This is a flow chart of the vulnerability association analysis and verification method of multi-source data fusion in this embodiment;

[0043] Figure 2 A decision logic diagram for determining the short-term repair level for this embodiment;

[0044] Figure 3 A decision logic diagram for determining the long-term repair level for this embodiment;

[0045] Figure 4 The following is a decision logic diagram for determining and modifying the priority sorting list in this embodiment. DETAILED DESCRIPTION

[0046] In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0047] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the protection scope of the present invention.

[0048] It should be noted that, in the description of the present invention, terms such as "up", "down", "left", "right", "inside" and "outside" indicating directions or positional relationships are based on the directions or positional relationships shown in the drawings. This is merely for the convenience of description and does not indicate or imply that the device or element must have a specific orientation, be constructed and operated in a specific orientation. Therefore, it cannot be understood as a limitation on the present invention.

[0049] In addition, it should be noted that in the description of the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0050] See also Figure 1 As shown, it is a flow chart of the vulnerability association analysis and verification method of multi-source data fusion in this embodiment;

[0051] This embodiment provides a vulnerability association analysis and verification method based on multi-source data fusion, including:

[0052] Real-time monitoring of vulnerability data in several security detection tools in the target system, and deduplication of the vulnerability data to obtain deduplication vulnerability data;

[0053] Obtaining data sources of the deduplication vulnerability data, determining the confidence level of each deduplication vulnerability data according to the number of the data sources and the preset number of standard sources, calculating the confidence of each deduplication vulnerability data according to the confidence level and the preset standard level, and obtaining a confidence score;

[0054] Real-time monitoring of the target system's network accessibility, business impact, and authentication strength;

[0055] Calculating a vulnerability reachability score according to the network reachability, the business impact, and the authentication strength;

[0056] Determine the short-term repair level according to all the vulnerability reachable scores of each deduplicated vulnerability data within a preset short-term fluctuation duration and a preset short-term fluctuation standard deviation range, and calculate the priority score according to the confidence score and all the vulnerability reachable scores corresponding to the short-term repair level, or draw a trend curve according to the short-term repair level and all the vulnerability reachable scores within a preset long-term trend duration, determine the long-term repair level according to the slope of the trend curve and a preset slope range, and calculate the priority score according to the confidence score and all the vulnerability reachable scores corresponding to the long-term repair level;

[0057] Prioritize the deduplicated vulnerability data according to the priority scores to obtain a priority ranking list;

[0058] Verify the existence of the vulnerabilities corresponding to each deduplicated vulnerability data in the priority sorting list, and modify the priority sorting list according to the existence and the preset standard existence, form a modified list and output it.

[0059] Security detection tools are used to identify vulnerabilities in the system. Depending on the complexity and security requirements of the system, they are usually configured as a combination of multiple tools. This embodiment uses a combination of multiple common tools to ensure the comprehensiveness and diversity of vulnerability detection.

[0060] Vulnerability data is information related to system security generated by security detection tools. It depends on the system's operating environment and the capabilities of the detection tools and is usually set to all detectable data. This embodiment collects vulnerability data generated by all tools to ensure data integrity.

[0061] The data source refers to the specific source tool of the vulnerability data, which depends on the type of security detection tool used and is usually set to multiple sources. This embodiment takes into account the sources of all detection tools to ensure data diversity.

[0062] The preset number of standard sources is used to determine the baseline value of confidence, which depends on the scale and security policy of the system and is usually set to 3-5 sources. In this embodiment, it is set to 3, which ensures the reliability of the confidence calculation.

[0063] The preset standard level is a benchmark level for measuring confidence, which depends on the security needs and risk management strategies of the organization and is usually set to three levels: "high, medium, and low". This embodiment is set to a high level, which helps to accurately distinguish the confidence levels of different vulnerabilities.

[0064] Network reachability is used to evaluate the potential threat of vulnerabilities in the system to other network nodes. It is usually obtained by evaluating the reachability between nodes in the system based on the system's network topology and access control policy through network scanning tools, access control rule analysis, and network traffic monitoring. It is usually set to an evaluation value from 0 to 10. In this embodiment, the network reachability evaluation value is set to 6, reflecting the possibility of medium-risk network penetration.

[0065] The business impact is used to evaluate the potential impact of the vulnerability on the core business. It is obtained by analyzing the business process and business criticality of the system and using risk assessment tools to determine the impact of the vulnerability on the business. It is usually set to an evaluation value from 0 to 10. In this embodiment, the business impact evaluation value is set to 8, indicating that the vulnerability has a high risk to business operations.

[0066] Authentication strength is used to evaluate the strictness of the system authentication mechanism. It is based on the complexity and protection strength of the authentication means. It is obtained by reviewing the system's authentication mechanism, analyzing the complexity of the authentication strategy, and combining actual authentication protection measures to evaluate its strength. It is usually set to an evaluation value from 0 to 10. In this embodiment, the authentication strength evaluation value is set to 7, which means that the system has strong authentication protection capabilities.

[0067] The preset short-term fluctuation standard deviation range is used to identify short-term fluctuations in the vulnerability score. It depends on the security stability of the system and is usually set to the standard deviation range within a specific time period. In this embodiment, it is set to a fluctuation range of 2% to 5% to effectively capture abnormal changes in the security score.

[0068] The preset slope range is used to determine the magnitude of the vulnerability trend change, which depends on the accuracy requirements of the long-term trend analysis. It is usually set to a certain slope value range. In this embodiment, the slope range is set to 0.1 to 0.5, which helps to promptly identify significant risk rising trends.

[0069] The existence degree refers to the actual existence of the vulnerability in the system, which depends on the vulnerability verification result and is usually set according to the detection result of the verification tool. This embodiment uses the detection data of the direct verification tool to ensure the accuracy of the vulnerability repair.

[0070] The preset standard existence is used to measure the benchmark for vulnerability verification, which depends on the system's tolerance and repair strategy. It is usually set between 50% and 90%. In this embodiment, it is set to 75% standard existence to ensure effective use of repair resources.

[0071] First, multiple security detection tools in the target system are monitored in real time to collect and deduplicate vulnerability data. Subsequently, the confidence score is calculated by analyzing the number of sources of vulnerability data and the number of standard sources. At the same time, the system monitors network accessibility, business impact, and authentication strength, and comprehensively calculates the vulnerability accessibility score. Based on short-term fluctuations and long-term trends, the repair level is determined, and combined with the confidence score, the priority score is calculated to generate a priority list. Finally, by verifying the existence of the vulnerability, the priority list is corrected, and the final correction list is output.

[0072] By integrating multi-source data and making full use of the data sources of various security detection tools, the accuracy and comprehensiveness of vulnerability detection have been significantly improved. By calculating the confidence score and vulnerability reachability score, and combining the analysis of short-term fluctuations and long-term trends, the system can dynamically and intelligently adjust the priority of vulnerability repair, thereby achieving accurate and efficient vulnerability repair. Ultimately, this method effectively reduces security risks, improves the overall security and stability of the system, provides more reliable protection for responding to potential threats, and effectively solves the problem of poor comprehensiveness and accuracy of vulnerability processing due to a single source of vulnerability data and insufficient dynamic evaluation.

[0073] Specifically, calculating the vulnerability reachability score according to the network reachability, the service impact, and the authentication strength includes:

[0074] The vulnerability reachability score is calculated according to the network reachability, the business impact, the authentication strength, the preset network reachability weight, the preset business impact weight and the preset authentication strength weight, wherein S=(A×WA)+(B×WB)+(C×WC), S is the vulnerability reachability score, A is the network reachability, B is the business impact, C is the authentication strength, WA is the network reachability weight, WB is the business impact weight, and WC is the authentication strength weight.

[0075] The network reachability weight is the proportion of network reachability in the total score when calculating the vulnerability reachability score. It depends on the network architecture of the target system and the network exposure of the vulnerability. It is usually set between 20% and 50%. In this embodiment, it is set to 30%. It can effectively consider the impact of network exposure on vulnerability reachability when evaluating vulnerabilities, ensuring the appropriate weight of network factors.

[0076] The business impact weight is the proportion of the business impact in the total score when calculating the vulnerability reachability score. It depends on the potential impact of the vulnerability on business processes and system operations. It is usually set between 30% and 50%. In this embodiment, it is set to 40%. It can focus on the impact of the vulnerability on business processes and ensure the appropriate assessment of the impact of the vulnerability on key businesses.

[0077] The authentication strength weight is the proportion of the authentication strength in the total score when calculating the vulnerability accessibility score. It depends on the strictness and security of the authentication mechanism of the target system. It is usually set between 10% and 30%. This embodiment is set to 20%. It can balance the impact of the strength of the authentication mechanism on the vulnerability accessibility while ensuring the comprehensive consideration of other factors.

[0078] When calculating the vulnerability reachability score, the three core indicators of the target system's network reachability, business impact, and authentication strength are evaluated, and each indicator is weighted and calculated in combination with the preset weight parameters to obtain a comprehensive vulnerability reachability score, thereby quantifying the potential threat level of each vulnerability in the system.

[0079] The vulnerability reachability score is calculated by combining three key factors, namely network reachability, business impact, and authentication strength, with corresponding weights. This method can more accurately reflect the actual risk level of each vulnerability in the system and help prioritize the vulnerabilities that pose the greatest threat to the system.

[0080] Please continue reading Figure 2 As shown, it is a decision logic diagram for determining the short-term repair level in this embodiment;

[0081] Specifically, determining the short-term repair level according to all the vulnerability attainable scores of the deduplicated vulnerability data within a preset short-term fluctuation period and a preset short-term fluctuation standard deviation range includes:

[0082] Calculate the standard deviation of all the vulnerability scores within the short-term fluctuation period to obtain the vulnerability score standard deviation. When the vulnerability score standard deviation is greater than the maximum value of the short-term fluctuation standard deviation range, determine that the short-term repair level is a high short-term repair level.

[0083] When the standard deviation of the vulnerability score is within the range of the short-term fluctuation standard deviation, the short-term repair level is determined to be the repair level to be analyzed;

[0084] If the standard deviation is less than the minimum value of the short-term fluctuation standard deviation range, the short-term repair level is determined to be a low short-term repair level and no further analysis is required.

[0085] During the short-term fluctuation period, the system collects the reachable scores of all vulnerabilities and calculates the standard deviation of these scores. The calculated standard deviation is compared with the preset short-term fluctuation standard deviation range. If the standard deviation is greater than the maximum value of the short-term fluctuation standard deviation range, the short-term repair level of the vulnerability is determined to be "high short-term repair level"; if the standard deviation is within the short-term fluctuation standard deviation range, it is determined to be "patch level to be analyzed". The patch level to be analyzed means that when the standard deviation of the vulnerability reachable score in the short term is within the preset short-term fluctuation standard deviation range, the repair priority of the current vulnerability is uncertain, and further analysis and monitoring are required to determine the repair level. This means that the repair priority of the vulnerability requires more data and analysis to determine whether it belongs to a high priority repair or other repair level.

[0086] By grading short-term fluctuations, the urgency of vulnerabilities and the priority of repair can be more accurately determined.

[0087] Specifically, the calculating of the priority score according to the confidence score and all the vulnerability reachable scores corresponding to the short-term repair level includes:

[0088] Calculate the priority score according to the confidence score, the average of all the vulnerability reachable scores corresponding to the high short-term repair level, the preset confidence score weight, and the preset high short-term repair weight, wherein P=D×WD+E×WE, P is the priority score, D is the confidence score, E is the average of all the vulnerability reachable scores corresponding to the high short-term repair level, WD is the confidence score weight, and WE is the high short-term repair weight;

[0089] The confidence score weight reflects the degree of influence of the confidence of the vulnerability data on the priority score. It is usually set to 0.4, depending on the importance attached to the accuracy of the vulnerability data. In this embodiment, it is set to 0.4 to ensure that the data confidence has an appropriate influence on the final priority score.

[0090] The high short-term fix weight reflects the degree of influence of the short-term fix level on the priority score. It depends on the emphasis on the need for quick fixes. It is usually set to 0.6. In this embodiment, it is set to 0.6, which can highlight the importance of vulnerabilities that need to be fixed quickly and ensure timely processing.

[0091] The priority score of the vulnerability is calculated based on the average of the achievable scores of all vulnerabilities corresponding to the confidence score and the high short-term fix level, combined with the preset confidence score weight and high short-term fix weight. This calculation formula combines the confidence of the vulnerability and the severity of the short-term fix level to determine the priority of the vulnerability.

[0092] By comprehensively considering the confidence level of the vulnerability and the difficulty of repairing it in the short term, we can more accurately assess the priority of vulnerability handling.

[0093] Specifically, drawing a trend curve according to the short-term repair level and all the vulnerability attainable scores within a preset long-term trend duration includes:

[0094] When the short-term repair level is determined to be the repair level to be analyzed, a trend curve is drawn according to all the vulnerability attainable scores within the long-term trend duration.

[0095] When the short-term repair level is determined to be the repair level to be analyzed, the system will collect all vulnerability accessibility score data within the long-term trend period and use this data to draw a trend curve. This process analyzes the changes in the trend curve to understand the trend of vulnerability accessibility changes, thereby evaluating the urgency of its long-term repair.

[0096] Long-term trend analysis provides an in-depth understanding of changes in vulnerability reachability scores, which can effectively identify potential risks and trends in the long term.

[0097] Please continue reading Figure 3 As shown, it is a decision logic diagram for determining the long-term repair level in this embodiment;

[0098] Specifically, determining the long-term repair level according to the slope of the trend curve and a preset slope range includes:

[0099] When the slope of the trend curve is greater than the maximum value of the slope range, the long-term repair level is determined to be a high long-term repair level;

[0100] When the slope of the trend curve is within the slope range, determining the long-term repair level to be analyzed as the long-term repair level;

[0101] When the slope of the trend curve is less than the minimum value of the slope range, the long-term repair level is determined to be a low long-term repair level.

[0102] According to the vulnerability reachability score trend curve drawn within the long-term trend duration, the slope of the trend curve is calculated and compared with the preset slope range. If the slope of the trend curve is greater than the maximum value of the preset slope range, the long-term repair level of the vulnerability is determined to be a high long-term repair level. This process evaluates the priority of vulnerability repair by quantitatively analyzing the speed of change of the trend curve.

[0103] By calculating and comparing the slopes, we can accurately identify the long-term aggravation trend of vulnerabilities, so as to give priority to those vulnerabilities that change rapidly.

[0104] Specifically, the calculation of the priority score according to the confidence score and all the vulnerability reachable scores corresponding to the long-term repair level includes:

[0105] When it is determined that the long-term repair level is a high long-term repair level, the priority score is calculated according to the confidence score, the average value of all the vulnerability reachable scores corresponding to the long-term repair level, the confidence score weight, and the preset long-term repair weight, wherein P=D×WD+F×WF, F is the average value of all the vulnerability reachable scores corresponding to the long-term repair level, and WF is the long-term repair weight;

[0106] The long-term repair weight is a coefficient used to adjust the influence of the long-term repair level, which is used to reflect the priority of long-term repair in the priority score. It depends on the impact of the long-term repair level on the overall security of the system and the policy priority of the repair strategy. It is usually set between 0.4 and 0.6. This range can balance the impact of long-term repair with the impact of other factors (such as confidence score). This embodiment is set to 0.5 to balance the impact of the long-term repair level when calculating the priority score.

[0107] After determining that the long-term fix level of a vulnerability is a high long-term fix level, when calculating the priority score of the vulnerability, the confidence score and the average of all vulnerability achievable scores corresponding to the long-term fix level are combined, and the confidence score weight and long-term fix weight are used to weight these scores to generate the final priority score. This process ensures that the credibility of the vulnerability and the urgency of the fix are fully considered in the long-term fix priority assessment.

[0108] By comprehensively considering the vulnerability accessibility score corresponding to the confidence score and the long-term fix level, the real risk of the vulnerability and the urgency of repair can be more accurately reflected.

[0109] Please continue reading Figure 4 As shown, it is a decision logic diagram for determining and modifying the priority ranking list in this embodiment;

[0110] Specifically, the modifying the priority sorting list according to the existence degree and the preset standard existence degree includes:

[0111] When the existence degree is less than the standard existence degree, deleting the corresponding deduplication vulnerability data from the priority sorting list;

[0112] When the existence degree is greater than or equal to the standard existence degree, the corresponding deduplication vulnerability data is retained in the priority sorting list.

[0113] During the vulnerability verification phase, the system will compare the existence of each vulnerability with the preset standard existence. If the existence of a vulnerability is lower than the standard existence, it means that the vulnerability may not actually exist as expected or have a smaller impact. Therefore, this vulnerability is removed from the priority sorting list, thereby excluding those vulnerabilities that are not actually existent enough or have a smaller impact.

[0114] By setting standard existence, we can effectively eliminate those vulnerabilities that are falsely reported or have less impact, and optimize the vulnerability handling process.

[0115] Specifically, determining the confidence level of each deduplication vulnerability data according to the number of data sources and the preset number of standard sources includes:

[0116] When the number of the data sources is greater than the number of the standard sources, the confidence level of the deduplication vulnerability data is determined to be the standard level.

[0117] During the vulnerability data processing, the system evaluates the number of sources for each deduplicated vulnerability data. If the number of these sources is greater than the preset standard number of sources, the system will determine the confidence level of the vulnerability data to be the standard level. This process ensures that vulnerability data is considered to have a high confidence level only when the sources are extensive and reliable.

[0118] By setting a standard number of sources, the confidence level of vulnerability data can be effectively improved and misjudgments due to insufficient or unreliable data sources can be reduced.

[0119] Specifically, the confidence of each deduplication vulnerability data is calculated according to the confidence level and the preset standard level to obtain the confidence score, including:

[0120] When it is determined that the confidence level of the deduplication vulnerability data is the standard level, the confidence is calculated according to a preset confidence algorithm to obtain a confidence score.

[0121] The confidence algorithm is an algorithm used to calculate the confidence score of vulnerability data. This embodiment adopts a weighted average algorithm, using information from multiple sources to calculate the confidence score by weighted average.

[0122] Selecting an appropriate confidence algorithm can improve the accuracy and reliability of vulnerability assessment, making decisions in the vulnerability management process more scientific and well-founded.

[0123] When processing vulnerability data, the system determines whether the confidence level of the deduplicated vulnerability data is the standard level. If it is, the system applies the preset confidence algorithm to calculate the confidence level to generate a confidence score. This score reflects the credibility of the vulnerability data and is used for subsequent priority assessment and decision-making.

[0124] By calculating the score using a preset confidence algorithm, it ensures that only vulnerability data that meets the standard level will be further analyzed.

[0125] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

[0126] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A vulnerability association analysis and verification method based on multi-source data fusion, characterized in that: include: Real-time monitoring of vulnerability data in several security detection tools in the target system, and deduplication of the vulnerability data to obtain deduplication vulnerability data; Obtaining data sources of the deduplication vulnerability data, determining the confidence level of each deduplication vulnerability data according to the number of the data sources and the preset number of standard sources, calculating the confidence of each deduplication vulnerability data according to the confidence level and the preset standard level, and obtaining a confidence score; Real-time monitoring of the target system's network accessibility, business impact, and authentication strength; Calculating a vulnerability reachability score according to the network reachability, the business impact, and the authentication strength; Determine the short-term repair level according to all the vulnerability reachable scores of each deduplicated vulnerability data within a preset short-term fluctuation duration and a preset short-term fluctuation standard deviation range, and calculate the priority score according to the confidence score and all the vulnerability reachable scores corresponding to the short-term repair level, or draw a trend curve according to the short-term repair level and all the vulnerability reachable scores within a preset long-term trend duration, determine the long-term repair level according to the slope of the trend curve and a preset slope range, and calculate the priority score according to the confidence score and all the vulnerability reachable scores corresponding to the long-term repair level; Prioritize the deduplicated vulnerability data according to the priority scores to obtain a priority ranking list; Verify the existence of the vulnerabilities corresponding to each deduplicated vulnerability data in the priority sorting list, and modify the priority sorting list according to the existence and the preset standard existence, form a modified list and output it; Calculating the vulnerability reachability score according to the network reachability, the service impact, and the authentication strength includes: Calculating a vulnerability reachability score according to the network reachability, the business impact, the authentication strength, a preset network reachability weight, a preset business impact weight, and a preset authentication strength weight; The calculating of the priority score according to the confidence score and all the vulnerability reachable scores corresponding to the short-term repair level includes: Calculate a priority score according to the confidence score, an average of all the vulnerability achievable scores corresponding to the high short-term repair level, a preset confidence score weight, and a preset high short-term repair weight; The calculating of the priority score according to the confidence score and all the vulnerability reachable scores corresponding to the long-term repair level includes: When the long-term repair level is determined to be a high long-term repair level, the priority score is calculated based on the confidence score, the average of all the vulnerability reachable scores corresponding to the long-term repair level, the confidence score weight, and the preset long-term repair weight.

2. The vulnerability association analysis and verification method based on multi-source data fusion according to claim 1 is characterized in that: Determining the short-term repair level according to all the vulnerability attainable scores of the deduplicated vulnerability data within the preset short-term fluctuation period and the preset short-term fluctuation standard deviation range includes: Calculate the standard deviation of all the vulnerability scores within the short-term fluctuation period to obtain the vulnerability score standard deviation. When the vulnerability score standard deviation is greater than the maximum value of the short-term fluctuation standard deviation range, determine that the short-term repair level is a high short-term repair level. When the vulnerability achievable score standard deviation is within the short-term fluctuation standard deviation range, the short-term repair level is determined to be the repair level to be analyzed.

3. The vulnerability association analysis and verification method based on multi-source data fusion according to claim 2 is characterized in that: Drawing a trend curve based on the short-term repair level and all the vulnerability scores within the preset long-term trend duration includes: When the short-term repair level is determined to be the repair level to be analyzed, a trend curve is drawn according to all the vulnerability attainable scores within the long-term trend duration.

4. The vulnerability association analysis and verification method based on multi-source data fusion according to claim 3 is characterized in that: Determining the long-term repair level according to the slope of the trend curve and a preset slope range includes: When the slope of the trend curve is greater than the maximum value of the slope range, the long-term repair level is determined to be a high long-term repair level.

5. The vulnerability association analysis and verification method based on multi-source data fusion according to claim 4 is characterized in that: The modifying of the priority sorting list according to the presence and the preset standard presence comprises: When the existence degree is less than the standard existence degree, the corresponding deduplication vulnerability data is deleted from the priority sorting list.

6. The vulnerability association analysis and verification method based on multi-source data fusion according to claim 5 is characterized in that: Determining the confidence level of each deduplication vulnerability data according to the number of data sources and the preset number of standard sources includes: When the number of the data sources is greater than the number of the standard sources, the confidence level of the deduplication vulnerability data is determined to be the standard level.

7. The vulnerability association analysis and verification method based on multi-source data fusion according to claim 6 is characterized in that: The step of calculating the confidence of each deduplication vulnerability data according to the confidence level and the preset standard level to obtain the confidence score includes: When it is determined that the confidence level of the deduplication vulnerability data is the standard level, the confidence is calculated according to a preset confidence algorithm to obtain a confidence score.

Images