Artificial Intelligence Network Security Vulnerability Scanning System

Abstract

The present invention relates to the field of network security technology, and discloses an artificial intelligence network security vulnerability scanning system, including a vulnerability identification module, a vulnerability classification module, a risk assessment module, an early warning response module and an abnormality detection module; the vulnerability identification module specifically includes: a vulnerability matching module and a vulnerability monitoring module; the vulnerability matching module, an external scanning engine performs an external scan on the target software, and matches the vulnerabilities updated in real time in the vulnerability library according to the acquired external scanning information and dynamic taint analysis information, and the early warning response module responds and warns in real time when matching information appears. The present invention investigates the external vulnerability status of the target software through external scanning and vulnerability matching, and monitors the target software from the inside itself through the monitoring module to monitor whether the target software has abnormalities. This internal and external combined investigation method can greatly improve the accuracy of vulnerability identification.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an artificial intelligence network security vulnerability scanning system. Background Art

[0002] With the development of the Internet, people are increasingly relying on the Internet for their daily lives and work. However, network security issues are also coming along. Network security vulnerabilities are errors or defects in network systems and applications, which can be used by hackers to attack and invade systems, causing data leakage, information damage, service interruption and other hazards. Therefore, scanning and repairing network security vulnerabilities has become crucial.

[0003] The existing patent discloses a method and system for network security vulnerability scanning using artificial intelligence (publication number CN117579395A). The target traffic detection neural network used adopts the distribution consistency corresponding to the traffic attack characterization carrier of the access data packet in the non-obfuscated access data packet example set and the obfuscated access data packet example set in the learning debugging sample. In the technology disclosed in this patent, only the vulnerability scanning and monitoring of the internal framework structure of the target software is performed, and the vulnerability detection of the target software's external portal is lacking, which also increases the risk of vulnerability. Summary of the invention

[0004] The main technical problem solved by the present invention is to provide an artificial intelligence network security vulnerability scanning system, which solves the problems in the above-mentioned background technology.

[0005] To solve the above technical problems, according to one aspect of the present invention, more specifically, an artificial intelligence network security vulnerability scanning system includes a vulnerability identification module, a vulnerability classification module, a priority sorting module, a risk assessment module, an early warning response module and an anomaly detection module; the vulnerability identification module specifically includes: a vulnerability matching module and a vulnerability monitoring module;

[0006] The vulnerability matching module uses an external scanning engine to perform external scanning on the target software, and matches the vulnerabilities updated in real time in the vulnerability library based on the external scanning information and dynamic taint analysis information obtained. When matching information appears, the early warning response module responds and warns in real time;

[0007] The vulnerability monitoring module uses an internal scanning engine to perform internal scanning on the target software, and monitors and verifies the internal scanning information and the feedback dynamic taint analysis information according to the system's pre-customized configuration rules. The early warning response module responds in real time to information that fails the monitoring and verification.

[0008] Furthermore, the vulnerability matching module determines whether the external scanning information contains a vulnerability that matches the vulnerability library based on the similarity of the functions or modules affected by the external scanning information and the similarity of the targets pointed to by the external scanning information and the vulnerability. Then:

[0009]

[0010] In the formula, Indicates the probability coefficient that the external scan information matches the vulnerability information in the vulnerability database. Indicates the similarity between the external scan information and the vulnerabilities in the vulnerability library in terms of the affected functions or modules. Indicates the similarity between external scan information and the vulnerability pointing to the target;

[0011] when , it means that the external scan information is overly consistent with the vulnerability library, that is, the scanned external information contains known vulnerabilities.

[0012] Furthermore, the similarity between the external scan information and the vulnerabilities in the vulnerability library in the affected functions or modules is determined based on the data similarity between the affected functions or modules and the probability of being called or triggered. The similarity is:

[0013]

[0014] In the formula, Indicates the similarity between the external scan information and the vulnerabilities in the vulnerability library in terms of the affected functions or modules. Indicates the data similarity between the functions or modules affected by the two. Indicates the probability of being called or triggered between the two affected functions or modules.

[0015] Furthermore, the vulnerability monitoring module determines whether the scanned internal information exceeds the expectations of the system configuration preset rules according to the data throughput, data delay rate and data underreporting rate of the internal scan information under the system configuration preset rules, including:

[0016]

[0017] In the formula, Indicates the probability coefficient that the scanned internal information exceeds the expected rules of the system configuration. Indicates the data throughput of internal scanning information under the system configuration preset rules. Indicates the data delay rate of internal scanning information under the system configuration preset rules. Indicates the data leakage rate of internal scanning information under the system configuration preset rules.

[0018] Furthermore, when , it means that the internal scanned information exceeds the expectations of the system configuration preset rules, and a response and warning are required;

[0019] when , it means that the internal scanned information does not exceed the expectations of the system configuration preset rules, and no response or warning is required.

[0020] Furthermore, the vulnerability classification module is used to automatically assign a risk level to each vulnerability based on the degree of harm, exploitability and environmental information of the vulnerability.

[0021] Furthermore, the priority sorting module sorts the identified vulnerabilities according to the risk level according to the vulnerability classification module, and prioritizes the vulnerabilities with the highest risk level.

[0022] Furthermore, the risk assessment module is used to analyze the impact range, exploitability, and attack difficulty of the vulnerability through artificial intelligence, automatically assign risk scores to the vulnerability and generate corresponding repair suggestions.

[0023] Furthermore, the anomaly detection module is used to identify whether there are traces of data traffic contacting or passing through vulnerabilities, and to provide early warning and feedback on the existing traces.

[0024] Beneficial effects:

[0025] 1. The present invention determines whether the external scanning information of the target software contains vulnerabilities that match those in the vulnerability library through the scanning engine, by comparing the similarity of the affected functions or modules in the external scanning information of the target software and the similarity between the external scanning information and the vulnerabilities pointing to the target, so as to accurately identify the security status of the target software.

[0026] 2. The present invention determines whether the scanned internal information exceeds the expectations of the system configuration preset rules through the data throughput, data delay rate and data omission rate of the internal scanning information under the system configuration preset rules, and then determines whether the target software has internal defects. This method can accurately check the security status of the target software itself.

[0027] 3. The present invention detects external vulnerabilities of the target software by external scanning and vulnerability matching, and monitors the target software from within itself through a monitoring module to monitor whether there are any abnormalities in the target software. This internal and external combined detection method can greatly improve the accuracy of vulnerability identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 A schematic diagram of the structure of vulnerability identification in the present invention;

[0029] Figure 2 It is a flow chart of the present invention. DETAILED DESCRIPTION

[0030] In order to make the technical solution of the present invention clearer, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0031] like Figure 1 - 2, according to one aspect of the present invention, an artificial intelligence network security vulnerability scanning system is provided, including a vulnerability identification module, a vulnerability classification module, a priority sorting module, a risk assessment module, an early warning response module and an anomaly detection module; the vulnerability identification module specifically includes: a vulnerability matching module and a vulnerability monitoring module. The external vulnerability status of the target software is checked by external scanning and vulnerability matching, and the target software is monitored from the inside itself through the monitoring module to monitor whether the target software has anomalies. This internal and external combined troubleshooting method can greatly improve the accuracy of vulnerability identification.

[0032] Example 1

[0033] The vulnerability matching module uses an external scanning engine to perform external scanning on the target software, and matches the vulnerabilities updated in real time in the vulnerability library based on the external scanning information and dynamic taint analysis information obtained. When matching information appears, the early warning response module responds and warns in real time;

[0034] The similarity between the external scan information and the vulnerabilities in the vulnerability library in the affected functions or modules is determined based on the data similarity between the affected functions or modules and the probability of being called or triggered. The similarity is as follows:

[0035]

[0036] In the formula, Indicates the similarity between the external scan information and the vulnerabilities in the vulnerability library in terms of the affected functions or modules. Indicates the data similarity between the functions or modules affected by the two. Indicates the probability of being called or triggered between the two affected functions or modules.

[0037] The matching module determines whether the external scan information contains vulnerabilities that match those in the vulnerability library based on the similarity of the functions or modules affected by the external scan information and the similarity of the targets pointed to by the external scan information and the vulnerabilities. Then:

[0038]

[0039] In the formula, Indicates the probability coefficient that the external scan information matches the vulnerability information in the vulnerability database. Indicates the similarity between the external scan information and the vulnerabilities in the vulnerability library in terms of the affected functions or modules. Indicates the similarity between external scan information and the vulnerability pointing to the target;

[0040] when , it means that the external scan information is overly consistent with the vulnerability library, that is, the scanned external information contains known vulnerabilities.

[0041] Among them, the data similarity between the external scan information of the target software and the existing vulnerability information in the vulnerability library, and between the functions or modules affected by both are taken. =42% (similarity = number of identical functions or modules ÷ total number of functions or modules), the probability of the affected functions or modules being called or triggered is =32% (probability = number of active functions or modules in the related functions or modules ÷ total number of related functions or modules), then:

[0042]

[0043] From the above calculation, we can know that the similarity between the external scanning information and the vulnerabilities in the vulnerability library in the affected functions or modules is =49%.

[0044] In addition, the similarity between the external scanning information and the vulnerability pointing to the target is taken =60%, then we can conclude that:

[0045]

[0046] From the above calculations, we can know that the external scan of the target software this time has scan information that is highly matched with the vulnerability library, that is, the target software has known vulnerabilities.

[0047] This method uses the scanning engine to determine whether there are vulnerabilities in the external scanning information of the target software that match the vulnerability library, by comparing the similarity of the affected functions or modules in the external scanning information of the target software, as well as the similarity between the external scanning information and the vulnerability pointing to the target, so as to accurately identify the security status of the target software.

[0048] Example 2

[0049] The vulnerability monitoring module uses an internal scanning engine to perform internal scanning on the target software, and monitors and verifies the internal scanning information and the feedback dynamic taint analysis information according to the system's pre-customized configuration rules. The early warning response module responds in real time to information that fails the monitoring and verification.

[0050] The vulnerability monitoring module determines whether the scanned internal information exceeds the expectations of the system configuration preset rules based on the data throughput, data delay rate, and data leakage rate of the internal scan information under the system configuration preset rules, including:

[0051]

[0052] In the formula, Indicates the probability coefficient that the scanned internal information exceeds the expected rules of the system configuration. Indicates the data throughput of internal scanning information under the system configuration preset rules. Indicates the data delay rate of internal scanning information under the system configuration preset rules. Indicates the data leakage rate of internal scanning information under the system configuration preset rules.

[0053] when , it means that the internal scanned information exceeds the expectations of the system configuration preset rules, and a response and warning are required;

[0054] when , it means that the internal scanned information does not exceed the expectations of the system configuration preset rules, and no response or warning is required.

[0055] When the external scan monitors the target software, the data throughput of the internal scan information under the system configuration preset rules is =56 (Mbytes / second), the data delay rate of internal scanning information under the system configuration preset rule is = 23 (ns), the data leakage rate of internal scanning information under the system configuration preset rules is =0.18 (data underreporting rate = number of underreporting ÷ actual number of events), then:

[0056]

[0057] From the above calculation, it can be known that the internal scan of the target software did not detect any areas that exceeded the expectations of the system configuration preset rules, and no response or warning is required.

[0058] By using the data throughput, data delay rate and data omission rate of the internal scanning information under the preset rules of the system configuration to determine whether the scanned internal information exceeds the expectations of the preset rules of the system configuration, and then judging whether there are internal defects in the target software, the security status of the target software itself can be accurately checked.

[0059] Example 3

[0060] The vulnerability classification module is used to automatically assign a risk level to each vulnerability based on the vulnerability's degree of harm, exploitability, and environmental information. The priority sorting module sorts the identified vulnerabilities by risk level according to the vulnerability classification module, and prioritizes the vulnerabilities with the highest risk level. The risk assessment module is used to analyze the impact range, exploitability, and attack difficulty of the vulnerability through artificial intelligence, automatically assign risk scores to the vulnerability, and generate corresponding repair suggestions. The anomaly detection module is used to identify whether there are traces of data traffic contacting or passing through the vulnerability, and to provide early warnings and feedback on the existing traces.

[0061] The above-mentioned embodiments only express several implementation methods of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the patent of the present invention. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. Artificial intelligence network security vulnerability scanning system, characterized by: It includes a vulnerability identification module, a vulnerability classification module, a priority sorting module, a risk assessment module, an early warning response module and an anomaly detection module; the vulnerability identification module specifically includes: a vulnerability matching module and a vulnerability monitoring module; The vulnerability matching module uses an external scanning engine to perform external scanning on the target software, and matches the vulnerabilities updated in real time in the vulnerability library based on the external scanning information and dynamic taint analysis information obtained. When matching information appears, the early warning response module responds and warns in real time; The vulnerability matching module determines whether the external scanning information contains a vulnerability that matches the vulnerability library based on the similarity of the functions or modules affected by the external scanning information and the similarity of the targets pointed to by the external scanning information and the vulnerabilities. Then: ； In the formula, Indicates the probability coefficient that the external scan information matches the vulnerability information in the vulnerability database. Indicates the similarity between the external scan information and the vulnerabilities in the vulnerability library in terms of the affected functions or modules. Indicates the similarity between external scan information and the vulnerability pointing to the target; when , it means that the external scan information and the vulnerability library are overly consistent, that is, the scanned external information contains known vulnerabilities; The similarity between the external scan information and the vulnerabilities in the vulnerability library in the affected functions or modules is determined based on the data similarity between the affected functions or modules and the probability of being called or triggered. The similarity is as follows: ； In the formula, Indicates the similarity between the external scan information and the vulnerabilities in the vulnerability library in terms of the affected functions or modules. Indicates the data similarity between the functions or modules affected by the two. Indicates the probability of being called or triggered between the affected functions or modules; The vulnerability monitoring module uses an internal scanning engine to perform internal scanning on the target software, and monitors and verifies the internal scanning information and the feedback dynamic taint analysis information according to the system's pre-defined configuration rules. The early warning response module responds in real time to the information that fails the monitoring and verification; The vulnerability monitoring module determines whether the scanned internal information exceeds the expectations of the system configuration preset rules according to the data throughput, data delay rate and data leakage rate of the internal scan information under the system configuration preset rules, including: ； In the formula, Indicates the probability coefficient that the scanned internal information exceeds the expected rules of the system configuration. Indicates the data throughput of internal scanning information under the system configuration preset rules. Indicates the data delay rate of internal scanning information under the system configuration preset rules. Indicates the data leakage rate of internal scanning information under the system configuration preset rules.

2. The artificial intelligence network security vulnerability scanning system according to claim 1 is characterized in that: when , it means that the internal scanned information exceeds the expectations of the system configuration preset rules, and a response and warning are required; when , it means that the internal scanned information does not exceed the expectations of the system configuration preset rules, and no response or warning is required.

3. The artificial intelligence network security vulnerability scanning system according to claim 1 is characterized in that: The vulnerability classification module is used to automatically assign a risk level to each vulnerability based on the degree of harm, exploitability and environmental information of the vulnerability.

4. The artificial intelligence network security vulnerability scanning system according to claim 1, characterized in that: The priority sorting module sorts the identified vulnerabilities according to the risk level according to the vulnerability classification module, and prioritizes the vulnerabilities with the highest risk level.

5. The artificial intelligence network security vulnerability scanning system according to claim 1, characterized in that: The risk assessment module is used to analyze the impact scope, exploitability, and attack difficulty of the vulnerability through artificial intelligence, automatically assign risk scores to the vulnerability and generate corresponding repair suggestions.

6. The artificial intelligence network security vulnerability scanning system according to claim 1, characterized in that: The anomaly detection module is used to identify whether there are traces of data traffic contacting or passing through vulnerabilities, and to provide early warning and feedback on the existing traces.

Images