Network space vulnerability clustering method based on feature value similarity calculation

Abstract

The invention belongs to the field of network security, and discloses a network space vulnerability clustering method based on feature value similarity calculation. The method comprises the following steps: (10) vulnerability data acquisition and standardized storage; (20) designing a tagged vulnerability description method; (30) specific network space vulnerability calculation; (40) network security vulnerability data classification, tagging and feature extraction; (50) clustering network security vulnerabilities based on features and a clustering algorithm; and (60) carrying out visual display on the clustered network space vulnerability categories. The method has the beneficial effects that compared with a traditional method, the method provided by the invention does not need to construct a complex network security knowledge graph for huge vulnerability data, and potential association and common points among vulnerabilities can be revealed by systematically analyzing and understanding characteristics and influences of various vulnerabilities aiming at standardized and tagged vulnerability data. By means of the vulnerability clustering method, analysis can be more rapidly and accurately carried out on categories from a large amount of vulnerability data, and therefore the security risk faced by the system is evaluated.

Description

Technical Field

[0001] The present invention relates to the field of network security, and designs a network space vulnerability clustering method based on feature value similarity calculation. Technical Background

[0002] In today's digital age, cybersecurity has become the focus of attention in all industries. For enterprises and security agencies, how to effectively manage and analyze these vulnerabilities and then formulate corresponding protection strategies has become an important and urgent task.

[0003] Network vulnerabilities refer to defects or weaknesses in computer systems, network devices or applications that can be exploited by attackers. These vulnerabilities are of various types and may be caused by system design flaws, software implementation errors or improper configuration. Common types of vulnerabilities include but are not limited to SQL injection, cross-site scripting (XSS), buffer overflow and privilege escalation vulnerabilities. Once these vulnerabilities are exploited, they may lead to sensitive information leakage, system crashes or even the paralysis of the entire network.

[0004] With the popularization of the Internet and the expansion of its application scope, the scale of cyberspace is also expanding, and the number of devices and applications involved has increased dramatically. The vulnerabilities in different devices, different applications, and different network environments vary greatly, and their manifestations and impacts are also different. This diversity and complexity makes it difficult for traditional vulnerability analysis methods to cope with it.

[0005] Current vulnerability management usually relies on manual analysis, where experts make a comprehensive assessment of the characteristics, degree of harm, and difficulty of repair of the vulnerability to determine the response strategy. However, as the number of vulnerabilities continues to increase, the efficiency of manual analysis is gradually unable to meet actual needs. First, manual analysis is time-consuming and inefficient; second, manual analysis is difficult to ensure consistency and accuracy, and differences between different analysts may lead to inconsistent results. In addition, manual analysis is difficult to handle large-scale data processing, especially when faced with new vulnerabilities and complex attack methods, the limitations of manual analysis are particularly obvious. Through automated means, the classification, analysis, and formulation of response strategies for a large number of vulnerabilities can be completed in a relatively short period of time, thereby improving the overall protection capabilities of network security.

[0006] In order to better manage and analyze a large number of vulnerabilities in cyberspace, this paper proposes a cyberspace vulnerability clustering method based on feature value similarity calculation. This method extracts and analyzes the features of the vulnerabilities and combines the clustering algorithm to classify similar vulnerabilities into the same category. Compared with the traditional manual analysis method, this automated clustering method has many advantages.

[0007] Automated clustering methods can greatly improve the efficiency of vulnerability analysis. By calculating the similarity between vulnerabilities, a large amount of vulnerability data can be automatically classified and sorted, reducing the workload of manual participation. Secondly, this method can effectively improve the consistency and accuracy of analysis results. Since the algorithm-based analysis is not affected by human factors, it can ensure that similar vulnerabilities are accurately identified and classified. In addition, the visual display of clustering results can help security personnel understand the distribution and trends of vulnerabilities more intuitively, making it easier to formulate more targeted protection measures.

[0008] The vulnerability clustering method based on feature value similarity calculation, as an automated analysis method, provides a new solution to the problem of large-scale vulnerability analysis. It can not only improve the efficiency and accuracy of vulnerability analysis, but also help security personnel better understand and manage complex vulnerability data, thereby improving the overall security protection capabilities of the cyberspace. Summary of the invention

[0009] The present invention innovatively combines feature value similarity calculation and clustering algorithm to design a method that can efficiently manage and analyze cyberspace vulnerabilities. Through the classification, labeling and feature extraction of vulnerabilities, the method can automatically group and display a large amount of complex vulnerability data, thereby reducing the workload of manual analysis and improving the efficiency and accuracy of vulnerability management.

[0010] The specific steps include:

[0011] (10) Vulnerability data acquisition and standardized storage;

[0012] (11) Define the data fields that need to be crawled and stored for network security vulnerability data, including:

[0013] Title: A brief summary of the vulnerability, including the software name and vulnerability type.

[0014] ●Identification number: includes CVE-ID and different identification numbers assigned by different vulnerability libraries;

[0015] ●Vulnerability description: description of the vulnerability principle, triggering method, vulnerability type, etc.;

[0016] ●Vulnerability type: CWE (Common Weakness Enumeration) type, or vulnerability type defined by each library;

[0017] ●Affected vendors, products, and versions: The CPE (Common Platform Enumeration) standard provides a solution for identifying vendors, products (software and hardware), and versions. Affected products also include affected software dependencies and operating systems.

[0018] ●Attack vector: the path or way in which the vulnerability is exploited;

[0019] ●Attack complexity: the technical difficulty required to exploit the vulnerability;

[0020] ● Vulnerability severity: CVSS score, which is the severity rating defined by each library.

[0021] ● Vulnerability exploit information: POC code, which is convenient for users to reproduce the vulnerability;

[0022] ●Reference links: other reference indexes, such as patch links provided by vulnerability-related vendors;

[0023] ●Release time: the date when the vulnerability information was released;

[0024] ●Update time: The time when the vulnerability information was last updated;

[0025] ●Vulnerability Submitter: The person who submits or publishes the vulnerability.

[0026] (12) Design of coroutine asynchronous crawler: Use aiohttp and asyncio to implement asynchronous request operations. The coroutine asynchronous function request method is established using aiohttp, and async with aiohttp.ClientSession() as session is used to send asynchronous requests to the server. The response information is obtained through response = await session.get(url). The main process accesses the target server to receive the server response information and parse the information. The sub-process deduplicates and stores the parsed Web information, and switches back and forth between the main and sub-processes when congestion occurs.

[0027] (13) Use the Beautiful Soup tool to parse the HTML document in the response information and store the data in the database.

[0028] (20) Design a labeled vulnerability description method: After the network and system are scanned by the above vulnerability scanning tools and the network security experts determine the defects in the system, a vulnerability description method is needed to save these vulnerabilities into a list, reflecting the causes and consequences of the exploitation of these vulnerabilities and their various characteristics, so as to facilitate the clustering and combination of vulnerabilities. The specific form is:

[0029] Vulnerability (Atomic Attack) Indicates that exploiting α-type vulnerabilities (atomic attacks) requires Under the condition, implement the λ tactic, use the δ tool, attack σ, and the subsequent results can be obtained as follows: Right now:

[0030]

[0031] Among them, each attribute value has the following characteristics:

[0032] α∈Vuln_type, Vuln_type is the vulnerability type, including but not limited to buffer overflow, code injection authentication issues, etc.

[0033] λ∈Tech, Tech is a collection of network attack techniques and tactics in the ATT&CK framework, and λ represents a technique or tactic in the ATT&CK framework used to launch an attack using the vulnerability;

[0034] δ∈Tool, Tool represents the set of penetration testing tools or network attack arsenal that the attacker may use. The attack means elements in the Tool set mainly include sending data packets, custom scripts, etc. Some hacker organizations use their own attack arsenals when carrying out attacks. The intelligence of these hacker organizations can be found on the ATT&CK official website, and Tool is also these arsenals;

[0035] σ∈Tar, Tar represents the set of targets that can be used as attack targets in the system. It can be a node or device type in the network, a component on a node, or a running service;

[0036] They respectively represent the prerequisites for exploiting the vulnerability (atomic attack) and the consequences caused by exploiting the vulnerability (atomic attack);

[0037] Among them, x∈∑, y∈∑, ∑ represents the set of target system assets, indicating all available resources or permissions of the system, such as user permissions, administrator permissions, system data, etc. These assets are also called attributes. This description method can not only describe vulnerabilities, but also atomic attacks.

[0038] (30) Calculation of specific cyberspace vulnerabilities;

[0039] (31) Cyberspace Data Modeling:

[0040] For a specific cyberspace, a hierarchical cyberspace model is constructed based on the devices existing in the cyberspace, the software installed on the devices, as well as the relationships between devices, between software, and between devices and software, to provide data support for the next step of calculating specific cyberspace vulnerabilities.

[0041] (32) Calculation of cyberspace vulnerabilities:

[0042] Based on the cyberspace data, the manufacturers, products and versions of the devices and software in the current cyberspace are collected, and large-scale database queries are performed based on asset-related attributes to query all vulnerability data that may exist in the cyberspace, and add the association between the vulnerability and network assets.

[0043] (40) Cybersecurity vulnerability data classification, labeling and feature extraction;

[0044] (41) Determine the classification and labeling method:

[0045] Determine the vulnerability type: Use the vulnerability type (CWE) and vulnerability description to determine which common vulnerability type the vulnerability belongs to. Infer the attack method and difficulty based on the attack vector and attack complexity.

[0046] Identify attack strategies and techniques: Using the vulnerability description and attack vector, refer to the MITRE ATT&CK framework to find the corresponding TTPs (tactics, techniques, and procedures). Based on the complexity of the attack, assess the level of preparation and resources required by the attacker.

[0047] Identify tools used by attackers: Look for POC code and tools in vulnerability exploit information, identify commonly used attack tools, and information in reference links.

[0048] Identify attack target types: Determine which systems or software are potential targets based on the affected vendors, products, and versions. Use CPE information to identify specific hardware, software, or operating system versions.

[0049] (42) Use TF-IDF to convert text labels into feature vectors. TF-IDF can measure the relative importance of labels and thus extract features from vulnerability data:

[0050]

[0051] Where: f(t,d) is the number of times term t appears in document d; N d is the total number of all data in document d.

[0052]

[0053] Where: N is the total number of documents in the corpus; DF(t) is the number of documents containing term t; the smoothing by adding 1 prevents the denominator from being zero when the term does not appear in any document.

[0054] TF-IDF(t,d,D)=TF(t,d)×IDF(t,D)

[0055] By multiplying TF and IDF, we can get the importance of a term in a specific document relative to the entire corpus.

[0056] (50) Network security vulnerability clustering based on features and clustering algorithms;

[0057] (51) Determine the number of clusters K for σ∈Tar in the vulnerability description method;

[0058] The classic K-Means clustering algorithm is used to divide the dataset into K clusters, so that the data points in each cluster are similar but different from the data points in other clusters, and the intra-cluster variance is minimized by assigning data points to the nearest centroids.

[0059] (52) Randomly select a data point (K in total) from each class σ in the data set as the initial centroid;

[0060] (53) Cluster assignment: For each data point, calculate the distance between it and each centroid, and assign the data point to the cluster corresponding to the centroid closest to it. This method uses Euclidean distance for calculation:

[0061]

[0062] Where: x is the data point, c is the centroid, and n is the number of features.

[0063] (54) Update the centroid: Recalculate the centroid of each cluster, that is, calculate the average value of all data points in the cluster as the new centroid:

[0064] Let C k is the kth cluster, then the formula for updating the centroid is:

[0065]

[0066] Where: c k is the new centroid of the kth cluster, x i is the data point in the cluster, |C k | is the number of data points in the cluster.

[0067] (55) Repeat steps (53) and (54) until the centroid change is less than a threshold or the maximum number of iterations is reached.

[0068] (60) Visual display of clustered cyberspace vulnerability categories.

[0069] The present invention realizes efficient analysis and management of large-scale network vulnerabilities through a clustering method based on feature value similarity calculation. It automates the classification and labeling of vulnerabilities, greatly reduces the workload of manual analysis, and improves the efficiency of vulnerability management. The clustering algorithm ensures the consistency and accuracy of the analysis results, avoiding the deviations and errors that may be caused by manual analysis. The method visualizes the clustering results, allowing security personnel to intuitively understand the distribution of vulnerabilities and risk situations, thereby formulating more accurate protection strategies and significantly improving the security protection capabilities of cyberspace. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] Figure 1 Flow chart of the method of the present invention.

[0071] Figure 2 The feature extraction algorithm flow chart of the method of the present invention.

[0072] Figure 3 The clustering algorithm flow chart of the method of the present invention.

[0073] Figure 4 The experimental flow chart of the method of the present invention is DETAILED DESCRIPTION

[0074] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments.

[0075] The present invention provides a network space vulnerability clustering method based on feature value similarity calculation, and the specific steps are as follows:

[0076] (10) Vulnerability data acquisition and standardized storage;

[0077] (11) Define the data fields that need to be crawled and stored for network security vulnerability data, including:

[0078] Title: A brief summary of the vulnerability, including the software name and vulnerability type.

[0079] ●Identification number: includes CVE-ID and different identification numbers assigned by different vulnerability libraries;

[0080] ●Vulnerability description: description of the vulnerability principle, triggering method, vulnerability type, etc.;

[0081] ●Vulnerability type: CWE (Common Weakness Enumeration) type, or vulnerability type defined by each library;

[0082] ●Affected vendors, products, and versions: The CPE (Common Platform Enumeration) standard provides a solution for identifying vendors, products (software and hardware), and versions. Affected products also include affected software dependencies and operating systems.

[0083] ●Attack vector: the path or way in which the vulnerability is exploited;

[0084] ●Attack complexity: the technical difficulty required to exploit the vulnerability;

[0085] ● Vulnerability severity: CVSS score, which is the severity rating defined by each library.

[0086] ● Vulnerability exploit information: POC code, which is convenient for users to reproduce the vulnerability;

[0087] ●Reference links: other reference indexes, such as patch links provided by vulnerability-related vendors;

[0088] ●Release time: the date when the vulnerability information was released;

[0089] ●Update time: The time when the vulnerability information was last updated;

[0090] ●Vulnerability Submitter: The person who submits or publishes the vulnerability.

[0091] (12) Design of coroutine asynchronous crawler: Use aiohttp and asyncio to implement asynchronous request operations. The coroutine asynchronous function request method is established using aiohttp, and async with aiohttp.ClientSession() as session is used to send asynchronous requests to the server. The response information is obtained through response = await session.get(url). The main process accesses the target server to receive the server response information and parse the information. The sub-process deduplicates and stores the parsed Web information, and switches back and forth between the main and sub-processes when congestion occurs.

[0092] (13) Use the Beautiful Soup tool to parse the HTML document in the response information and store the data in the database.

[0093] (20) Design a labeled vulnerability description method: After the network and system are scanned by the above vulnerability scanning tools and the network security experts determine the defects in the system, a vulnerability description method is needed to save these vulnerabilities into a list, reflecting the causes and consequences of the exploitation of these vulnerabilities and their various characteristics, so as to facilitate the clustering and combination of vulnerabilities. The specific form is:

[0094] Vulnerability (Atomic Attack) Indicates that exploiting α-type vulnerabilities (atomic attacks) requires Under the condition, implement the λ tactic, use the δ tool, attack σ, and the subsequent results can be obtained as follows: Right now:

[0095]

[0096] Among them, each attribute value has the following characteristics:

[0097] α∈Vuln_type, Vuln_type is the vulnerability type, including but not limited to buffer overflow, code injection authentication issues, etc.

[0098] λ∈Tech, Tech is a collection of network attack techniques and tactics in the ATT&CK framework, and λ represents a technique or tactic in the ATT&CK framework used to launch an attack using the vulnerability;

[0099] δ∈Tool, Tool represents the set of penetration testing tools or network attack arsenal that the attacker may use. The attack means elements in the Tool set mainly include sending data packets, custom scripts, etc. Some hacker organizations use their own attack arsenals when carrying out attacks. The intelligence of these hacker organizations can be found on the ATT&CK official website, and Tool is also these arsenals;

[0100] σ∈Tar, Tar represents the set of targets that can be used as attack targets in the system. It can be a node or device type in the network, a component on a node, or a running service;

[0101] They respectively represent the prerequisites for exploiting the vulnerability (atomic attack) and the consequences caused by exploiting the vulnerability (atomic attack);

[0102] Among them, x∈∑, y∈∑, ∑ represents the set of target system assets, indicating all available resources or permissions of the system, such as user permissions, administrator permissions, system data, etc. These assets are also called attributes. This description method can not only describe vulnerabilities, but also atomic attacks.

[0103] (30) Calculation of specific cyberspace vulnerabilities;

[0104] (31) Cyberspace Data Modeling:

[0105] For a specific cyberspace, a hierarchical cyberspace model is constructed based on the devices existing in the cyberspace, the software installed on the devices, as well as the relationships between devices, between software, and between devices and software, to provide data support for the next step of calculating specific cyberspace vulnerabilities.

[0106] (32) Calculation of cyberspace vulnerabilities:

[0107] Based on the cyberspace data, the manufacturers, products and versions of the devices and software in the current cyberspace are collected, and large-scale database queries are performed based on asset-related attributes to query all vulnerability data that may exist in the cyberspace, and add the association between the vulnerability and network assets.

[0108] (40) Cybersecurity vulnerability data classification, labeling and feature extraction;

[0109] (41) Determine the classification and labeling method:

[0110] Determine the vulnerability type: Use the vulnerability type (CWE) and vulnerability description to determine which common vulnerability type the vulnerability belongs to. Infer the attack method and difficulty based on the attack vector and attack complexity.

[0111] Identify attack strategies and techniques: Using vulnerability descriptions and attack vectors, refer to the MITRE ATT&CK framework to find the corresponding TTPs (tactics, techniques, and procedures). Based on the complexity of the attack, assess the level of preparation and resources required by the attacker.

[0112] Identify the tools used by attackers: Find POC codes and tools in vulnerability exploit information and identify common attack tools. Refer to the information in the link.

[0113] Identify attack target types: Determine which systems or software are potential targets based on the affected vendors, products, and versions. Use CPE information to identify specific hardware, software, or operating system versions.

[0114] (42) Use TF-IDF to convert text labels into feature vectors. TF-IDF can measure the relative importance of labels and thus extract features from vulnerability data:

[0115]

[0116] Where: f(t, d) is the number of times term t appears in document d; N d is the total number of all data in document d.

[0117]

[0118] Where: N is the total number of documents in the corpus; DF(t) is the number of documents containing term t; the smoothing by adding 1 prevents the denominator from being zero when the term does not appear in any document.

[0119] TF-IDF(t,d,D)=TF(t,d)×IDF(t,D)

[0120] By multiplying TF and IDF, we can get the importance of a term in a specific document relative to the entire corpus.

[0121] (50) Network security vulnerability clustering based on features and clustering algorithms;

[0122] (51) Determine the number of clusters K for σ∈Tar in the vulnerability description method;

[0123] The classic K-Means clustering algorithm is used to divide the dataset into K clusters, so that the data points in each cluster are similar but different from the data points in other clusters, and the intra-cluster variance is minimized by assigning data points to the nearest centroids.

[0124] (52) Randomly select a data point (K in total) from each class σ in the data set as the initial centroid;

[0125] (53) Cluster assignment: For each data point, calculate the distance between it and each centroid, and assign the data point to the cluster corresponding to the centroid closest to it. This method uses Euclidean distance for calculation:

[0126]

[0127] Where: x is the data point, c is the centroid, and n is the number of features.

[0128] (54) Update the centroid: Recalculate the centroid of each cluster, that is, calculate the average value of all data points in the cluster as the new centroid:

[0129] Let C k is the kth cluster, then the formula for updating the centroid is:

[0130]

[0131] Where: c k is the new centroid of the kth cluster, x i is the data point in the cluster, |Ck| is the number of data points in the cluster.

[0132] (55) Repeat steps (53) and (54) until the centroid change is less than a threshold or the maximum number of iterations is reached.

[0133] (60) Visual display of clustered cyberspace vulnerability categories.

[0134] Example analysis:

[0135] Use crawlers to obtain the latest vulnerability data from multiple public vulnerability databases (such as NVD, CVE, ExploitDB, etc.). These data are stored in the database according to the structure described in the above steps:

[0136] For each vulnerability, a vulnerability label is generated according to the following format: For example, for CVE-202144228 (Log4j):

[0137] Status characteristics before the vulnerability: Log4j 2.0-beta9 to 2.14.1 were in operation.

[0138] α: Conditions or prerequisites before exploiting the vulnerability: JNDI component is not enabled.

[0139] λ: Attack carrier (such as attack vector, attack method): remote attack through LDAP protocol.

[0140] δ: The immediate effect or result after exploitation: remote code execution.

[0141] σ: Scope or objects of vulnerability impact: affected servers and applications.

[0142] Status characteristics after vulnerability exploitation: The server is controlled or malicious code is implanted.

[0143] In this embodiment, there is a list of devices in the network space, including operating system versions, application software and their version information. Based on this information, all vulnerabilities related to these devices are found by querying the vulnerability database. For example, if a system is running Windows 10 and a specific version of Apache HTTP Server is installed, the query results may include all known vulnerabilities related to this system and software.

[0144] The acquired vulnerability data is classified and labeled according to the vulnerability type, impact scope and other characteristics. For example, all vulnerabilities involving remote code execution are classified into one category, and vulnerabilities involving privilege escalation are classified into another category. Then, a corresponding feature label V is generated for each vulnerability. t .

[0145] Use the TF-IDF algorithm to convert the vulnerability label V in text form into t Convert to feature vector. This process represents the text label of each vulnerability as a multi-dimensional vector, where each dimension represents a unique feature value, and the value represents the weight of the feature in the vulnerability data.

[0146] The K-Means clustering algorithm is used to analyze the above feature vectors and classify the vulnerabilities with high similarity into the same cluster. Each cluster represents a group of vulnerabilities with similar characteristics. For example, all vulnerabilities involving SQL injection may be clustered into one group, and all vulnerabilities involving buffer overflow may be clustered into another group.

[0147] After clustering is completed, the clustering results are displayed in the network space.

[0148] The invention is not limited to the above-mentioned embodiments, and anyone should know that any technical solution identical or similar to the present invention made under the inspiration of the present invention shall fall within the protection scope of the present invention.

Claims

1. A network space vulnerability clustering method based on feature value similarity calculation, characterized in that: The steps of the method are as follows: (10) Vulnerability data acquisition and standardized storage; (20) Design a labeled vulnerability description method; (30) Calculation of specific cyberspace vulnerabilities; (40) Cybersecurity vulnerability data classification, labeling and feature extraction; (50) Network security vulnerability clustering based on features and clustering algorithms; (60) Visual display of clustered cyberspace vulnerability categories.

2. According to claim 1, a network space vulnerability clustering method based on feature value similarity calculation is characterized in that: The specific aspects of (10) include the following: (11) Define the data fields that need to be crawled and stored for network security vulnerability data, including: Title: A brief summary of the vulnerability, including the software name and vulnerability type. ●Identification number: includes CVE-ID and different identification numbers assigned by different vulnerability libraries; ●Vulnerability description: description of the vulnerability principle, triggering method, vulnerability type, etc.; ●Vulnerability type: CWE (Common Weakness Enumeration) type, or vulnerability type defined by each library; ●Affected vendors, products, and versions: The CPE (Common Platform Enumeration) standard provides a solution for identifying vendors, products (software and hardware), and versions. Affected products also include affected software dependencies and operating systems. ●Attack vector: the path or way in which the vulnerability is exploited; ●Attack complexity: the technical difficulty required to exploit the vulnerability; ● Vulnerability severity: CVSS score, which is the severity rating defined by each library. ● Vulnerability exploit information: POC code, which is convenient for users to reproduce the vulnerability; ●Reference links: other reference indexes, such as patch links provided by vulnerability-related vendors; ●Release time: the date when the vulnerability information was released; ●Update time: The time when the vulnerability information was last updated; ●Vulnerability Submitter: The person who submits or publishes the vulnerability. (12) Design of coroutine asynchronous crawler: Use aiohttp and asyncio to implement asynchronous request operations. The coroutine asynchronous function request method is established using aiohttp, and async with aiohttp.ClientSession() as session is used to send asynchronous requests to the server. The response information is obtained through response = await session.get(url). The main process accesses the target server to receive the server response information and parse the information. The sub-process deduplicates and stores the parsed Web information, and switches back and forth between the main and sub-processes when congestion occurs. (13) Use the Beautiful Soup tool to parse the HTML document in the response information and store the data in the database.

3. According to claim 1, a network space vulnerability clustering method based on feature value similarity calculation is characterized by: (20) Design a labeled vulnerability description method: After the network and system are scanned by the above vulnerability scanning tools and the network security experts determine the defects in the system, a vulnerability description method is needed to save these vulnerabilities into a list, reflecting the causes and consequences of the exploitation of these vulnerabilities and their various characteristics, so as to facilitate the clustering and combination of vulnerabilities. The specific form is: Vulnerability (Atomic Attack) Indicates that exploiting α-type vulnerabilities (atomic attacks) requires Under the condition, implement the λ tactic, use the δ tool, attack σ, and the subsequent results can be obtained as follows: Right now: Among them, each attribute value has the following characteristics: α∈Vuln_type, Vuln_type is the vulnerability type, including but not limited to buffer overflow, code injection authentication issues, etc. λ∈Tech, Tech is a collection of network attack techniques and tactics in the ATT&CK framework, and λ represents a technique or tactic in the ATT&CK framework used to launch an attack using the vulnerability; δ∈Tool, Tool represents the set of penetration testing tools or network attack arsenal that the attacker may use. The attack means elements in the Tool set mainly include sending data packets, custom scripts, etc. Some hacker organizations use their own attack arsenals when carrying out attacks. The intelligence of these hacker organizations can be found on the ATT&CK official website, and Tool is also these arsenals; σ∈Tar, Tar represents the set of targets in the system that can be used as attack targets. It can be a node or device type in the network, a component on a node, or a running service; They respectively represent the prerequisites for exploiting the vulnerability (atomic attack) and the consequences caused by exploiting the vulnerability (atomic attack); Among them, x∈∑, y∈∑, ∑ represents the set of target system assets, indicating all available resources or permissions of the system, such as user permissions, administrator permissions, system data, etc. These assets are also called attributes. This description method can not only describe vulnerabilities, but also atomic attacks.

4. According to claim 1, a network space vulnerability clustering method based on feature value similarity calculation is characterized in that: The specific steps of (30) are as follows: (31) Cyberspace Data Modeling: For a specific cyberspace, a hierarchical cyberspace model is constructed based on the devices existing in the cyberspace, the software installed on the devices, as well as the relationships between devices, between software, and between devices and software, to provide data support for the next step of calculating specific cyberspace vulnerabilities. (32) Calculation of cyberspace vulnerabilities: Based on the cyberspace data, the manufacturers, products and versions of the devices and software in the current cyberspace are collected, and large-scale database queries are performed based on asset-related attributes to query all vulnerability data that may exist in the cyberspace, and add the association between the vulnerability and network assets.

5. The network space vulnerability clustering method based on feature value similarity calculation according to claim 1 is characterized in that: The specific steps of (40) are as follows: According to the vulnerability data obtained in step (30), classification and feature extraction can be performed based on one or more data fields therein. (41) Determine the classification and labeling method: Determine the vulnerability type: Use the vulnerability type (CWE) and vulnerability description to determine which common vulnerability type the vulnerability belongs to. Infer the attack method and difficulty based on the attack vector and attack complexity. Identify attack strategies and techniques: Using the vulnerability description and attack vector, refer to the MITRE ATT&CK framework to find the corresponding TTPs (tactics, techniques, and procedures). Based on the complexity of the attack, assess the level of preparation and resources required by the attacker. Identify the tools used by attackers: Find POC codes and tools in vulnerability exploit information and identify common attack tools. Refer to the information in the link. Identify attack target types: Determine which systems or software are potential targets based on the affected vendors, products, and versions. Use CPE information to identify specific hardware, software, or operating system versions. (42) Use TF-IDF to convert text labels into feature vectors. TF-IDF can measure the relative importance of labels and thus extract features from vulnerability data: Where: f(t,d) is the number of times term t appears in document d; N d is the total number of all data in document d. Where: N is the total number of documents in the corpus; DF(t) is the number of documents containing term t; the smoothing by adding 1 prevents the denominator from being zero when the term does not appear in any document. TF-IDF(t,d,D)=TF(t,d)×IDF(t,D) By multiplying TF and IDF, we can get the importance of a term in a specific document relative to the entire corpus.

6. After converting the text data into a TF-IDF feature matrix according to claim 5, vulnerability clustering is performed using a K-Means algorithm, characterized in that: The specific steps of (50) are as follows: (51) Determine the number of clusters K for σ∈Tar in the vulnerability description method; The classic K-Means clustering algorithm is used to divide the dataset into K clusters, so that the data points in each cluster are similar but different from the data points in other clusters, and the intra-cluster variance is minimized by assigning data points to the nearest centroids. (52) Randomly select a data point (K in total) from each class σ in the data set as the initial centroid; (53) Cluster assignment: For each data point, calculate the distance between it and each centroid, and assign the data point to the cluster corresponding to the centroid closest to it. This method uses Euclidean distance for calculation: Where: x is the data point, c is the centroid, and n is the number of features. (54) Update the centroid: Recalculate the centroid of each cluster, that is, calculate the average value of all data points in the cluster as the new centroid: Let C k is the kth cluster, then the formula for updating the centroid is: Where: c k is the new centroid of the kth cluster, x i is the data point in the cluster, |C k | is the number of data points in the cluster. (55) Repeat steps (53) and (54) until the centroid change is less than a threshold or the maximum number of iterations is reached.

7. The network space vulnerability clustering method based on feature value similarity calculation according to claim 1 is characterized in that: (60) Visual display of clustered cyberspace vulnerability categories.

Images