A vulnerability troubleshooting method based on deep neural network model and related products

Abstract

The present invention relates to the field of network security technology, and specifically to a vulnerability troubleshooting method based on a deep neural network model and related products, which include collecting vulnerability information data; performing preprocessing operations to obtain a vulnerability information vector set, constructing a vulnerability knowledge graph based on the preprocessed data and fusing them to obtain enhanced feature representation; training a deep neural network model based on the enhanced feature representation and corresponding target labels, constructing a vulnerability troubleshooting prediction model, acquiring test data of a target system in real time, and inputting the data into the vulnerability troubleshooting prediction model after processing to generate vulnerability detection results; the present invention improves the intelligence and automation level of vulnerability troubleshooting by introducing a deep neural network model, reduces the technical dependence on operators, collects data from a multi-source vulnerability database, and performs deep processing using a feature representation model, so as to more comprehensively capture vulnerability information and improve the ability to identify hidden vulnerabilities.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a vulnerability troubleshooting method based on a deep neural network model and related products. Background Art

[0002] As the digital transformation of the power industry deepens, information systems and network architectures become increasingly large and complex, and the resulting cybersecurity threats are also increasing. In particular, various vulnerabilities hidden in the system have become the focus of attackers. As a key national infrastructure, the cybersecurity of the power system is directly related to the normal operation of the national economy. Therefore, ensuring the cybersecurity of the power system has become a top priority, and vulnerability detection and repair work is even more important.

[0003] At present, vulnerability detection mainly relies on manual detection. Although the investigators have certain professional capabilities, due to the complexity and diversity of power business systems, vulnerabilities are extremely hidden, and it is difficult to fully and efficiently discover problems by manual detection. In addition, the existing open source and commercial vulnerability detection tools are of various types, complex configurations, low levels of automation and intelligence, and require highly professional personnel to operate. The overall efficiency is low and it is difficult to meet the growing security needs of the power grid.

[0004] In order to improve the efficiency and accuracy of vulnerability detection, the industry has conducted a lot of research on vulnerability detection technology in recent years, covering manual testing, fuzzing technology, dynamic analysis technology, and static analysis technology. Although the manual testing method is flexible, it is overly dependent on the professional level of personnel and has low efficiency; fuzzing technology is based on the black box testing concept, which triggers potential vulnerabilities by constructing specific data, and has good reproducibility, but the data construction process is complex and time-consuming; dynamic analysis technology captures vulnerabilities by monitoring the running status of the program, with high accuracy, but the operation is complex and difficult to get started; static analysis technology implements vulnerability detection through source code scanning, which is suitable for the early stage of system development, but it is difficult to cover unknown vulnerabilities in complex business systems. Summary of the invention

[0005] The technical problem to be solved by the present invention is that the existing vulnerability detection technology has high requirements on the professional level of personnel, low efficiency, and strong vulnerability concealment. The limitations of traditional manual testing and tools make it difficult to meet actual needs. The purpose is to provide a vulnerability detection method and related products based on a deep neural network model, which realizes the collection and processing of vulnerability information from multi-source databases through automated deep learning technology, and constructs a neural network model for intelligent vulnerability prediction and identification, thereby reducing the dependence on the technical level of operators and improving the efficiency and accuracy of vulnerability detection.

[0006] The present invention is achieved through the following technical solutions:

[0007] A vulnerability troubleshooting method based on a deep neural network model, comprising:

[0008] Collect vulnerability information data from public vulnerability knowledge bases, industry historical disclosure vulnerability databases, and internal vulnerability databases;

[0009] Construct a preprocessing model, and use the preprocessing model to perform text preprocessing on the data used for model input in the vulnerability information data to obtain preprocessed data;

[0010] Construct a feature representation model, and use the feature representation model to process the preprocessed data into a vulnerability information vector set;

[0011] Build a vulnerability knowledge graph based on preprocessed data, generate a knowledge graph embedding vector, and fuse the knowledge graph embedding vector with the vulnerability information vector set to obtain enhanced feature representation;

[0012] Build a deep neural network model and train it using enhanced feature representation and target labels in vulnerability information data to obtain a vulnerability troubleshooting prediction model;

[0013] Obtain the real-time test data of the target system, process the real-time test data through the preprocessing model and feature representation model, and fuse it with the knowledge graph embedding vector to obtain the enhanced test data vector;

[0014] The enhanced data vector to be tested is input into the vulnerability troubleshooting prediction model to obtain the prediction result.

[0015] Optionally, the preprocessing model includes word segmentation processing, stop word removal processing, and part-of-speech tagging processing;

[0016] The word segmentation process uses a method based on Word2Vec and LSTM bidirectional network. By combining character embedding and forward and backward LSTM hidden states, the hidden state vector of the character is determined, and the score function is calculated to complete the prediction of the character label. Finally, the optimal label sequence is obtained through Viterbi algorithm decoding, and the word segmentation process is completed according to the optimal label sequence.

[0017] The stop word removal process uses a method based on lexical importance measurement and mutual information. By calculating the relevance between words and document topics, the stop word set is dynamically determined, and the stop word set is used to filter the word sequence after word segmentation to complete the stop word removal.

[0018] The part-of-speech tagging process adopts a method based on Gaussian process classifier and conditional random field. By obtaining the feature vector of the word sequence after removing stop words, the Gaussian process classifier is used to make preliminary part-of-speech tag predictions for each word, and the posterior distribution is calculated through Laplace approximation to obtain the preliminary prediction probability; a conditional probability model of the conditional random field is established, and the preliminary prediction probability is used as a feature to train the model parameters, which is then decoded through the Viterbi algorithm to obtain the globally optimal part-of-speech tag sequence, and the part-of-speech tagging result corresponding to the word sequence after removing stop words is output to complete the part-of-speech tagging.

[0019] Optionally, the word segmentation processing method includes:

[0020] Represent the acquired vulnerability information data as a character sequence ,in, is the total number of characters, For the characters;

[0021] Use Word2Vec to convert the characters in the character sequence Mapping to embedding vector ,in, Indicates characters, For characters The embedding vector of

[0022] Determine the hidden state vector , ,in, is the forward LSTM hidden state, is the backward LSTM hidden state, is the hidden layer dimension of LSTM;

[0023] Define a set of character tags and the score function , ,in, is the transposed matrix of label score weights, is the label transfer matrix, For the Character labels, From the label Transfer to label score;

[0024] Determine the log-likelihood function of the correct label sequence, , and decoded by the Viterbi algorithm to obtain the optimal label sequence corresponding to the maximum log-likelihood function , and obtain the word segmentation result according to the optimal label sequence.

[0025] Optionally, the method for removing stop words includes:

[0026] Identify a corpus containing multiple documents; Identify a vocabulary containing all the words that have appeared ;

[0027] Calculate the mutual information between words and document topics in the corpus ,in, is the topic variable obtained through the topic model LDA, For words Does it appear with the theme The joint probability of is a binary variable;

[0028] Determine the set of stop words ,in, is the importance threshold set;

[0029] Determine the word sequence after word segmentation ,in, is the total number of words, For the words;

[0030] Filter the word sequence after segmentation through the stop word set to obtain the word sequence after removing the stop words ,in, For the words;

[0031] When the corpus or topic model LDA is updated, the stop word set is re-determined.

[0032] Optionally, the method for part-of-speech tagging includes:

[0033] Extract word sequence after removing stop words The character n-gram features, word length features, and letter composition features of each subword in the word, and all features are encoded into feature vectors ;

[0034] Use the Gaussian process classifier to make a preliminary prediction of the part-of-speech tag for each word, and use the Laplace approximation to calculate the posterior distribution of the Gaussian process classifier to obtain the first Words The initial predicted probability distribution of ;

[0035] Building a conditional probability model ,in, is the normalization factor, , , , are model parameters, is the number of words in the word sequence after removing stop words, is the state characteristic function, is the transfer characteristic function, For the The part-of-speech tag of each word, For the The part-of-speech tag of each word, is the part-of-speech tag sequence, is the indicator function, , , are possible part-of-speech tags;

[0036] The model parameters of the conditional probability model are trained based on the initial predicted probability distribution;

[0037] The Viterbi algorithm is used to decode the trained conditional probability model to obtain the globally optimal part-of-speech tag sequence. ;

[0038] The optimal part-of-speech tag sequence and word sequence after removing stop words Correspondingly, obtain the part-of-speech tagging result of each time, and output the part-of-speech tagged word sequence after the part-of-speech tagging.

[0039] Optionally, a method for constructing a feature representation maps each word in a word sequence after stop words are removed into a word embedding vector, converts each part-of-speech tag in a part-of-speech tag sequence after part-of-speech tagging into a one-hot vector, concatenates and generates a feature vector for each word, performs average pooling on the feature vectors of all words, obtains a final feature representation, and constructs a vulnerability information vector set.

[0040] Specifically, the method for constructing feature representation maps each word in the word sequence after removing stop words into a word embedding vector, converts each part-of-speech tag in the part-of-speech tag sequence after part-of-speech tagging into a one-hot vector, concatenates the feature vectors of each word, performs average pooling on the feature vectors of all words, obtains the final feature representation, and constructs a vulnerability information vector set.

[0041] Specifically, the method of constructing the feature representation model includes:

[0042] Determine the word sequence after the stop words are removed ; And map each word into a word embedding vector through Word2Vec;

[0043] Determine the word sequence after part-of-speech tagging ,in, is the number of words in the word sequence after removing stop words; and each part-of-speech tag is converted into a one-hot vector through one-hot encoding;

[0044] Perform feature concatenation on the word embedding vector and the one-hot vector to obtain the word feature vector ,in, For the The word feature vector of the word, For the The word embedding vector of words, For the One-hot vector of each word;

[0045] All word feature vectors are average pooled to obtain the final feature representation and construct a vulnerability information vector set.

[0046] The method for constructing a vulnerability knowledge graph based on preprocessed data includes:

[0047] Extract vulnerability-related entities and relations from preprocessed data;

[0048] Build a knowledge graph using the extracted entities and relationships to form a structured representation containing nodes and edges;

[0049] The knowledge graph embedding algorithm is used to train the knowledge graph and generate embedding vectors for each node and edge;

[0050] The knowledge graph embedding vector is fused with the vulnerability information vector set, and enhanced feature representation is obtained by using vector concatenation, weighted summation or attention mechanism.

[0051] Optionally, the method for obtaining the vulnerability troubleshooting prediction model includes:

[0052] Establish a deep neural network model including an input layer, at least one hidden layer and an output layer, wherein the number of nodes in the input layer corresponds to the dimension of the final feature representation in the enhanced feature representation, and the number of nodes in the output layer corresponds to the number of vulnerability categories;

[0053] The enhanced feature representation is used as input data, the corresponding vulnerability category or risk level is used as the target output, and the cross entropy loss function and optimization algorithm are used to train the deep neural network model and adjust the model parameters;

[0054] The trained deep neural network model and its parameters are saved to obtain a vulnerability troubleshooting prediction model.

[0055] A computer program product includes a computer program / instruction, which, when executed by a processor, implements a vulnerability troubleshooting method based on a deep neural network model as described above.

[0056] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0057] The present invention first collects vulnerability information data from a public vulnerability knowledge base, an industry historical disclosure vulnerability database, and an internal vulnerability database; and performs preprocessing operations such as word segmentation, stop word removal, and part-of-speech tagging on the data by constructing a preprocessing model to form a feature vector set that can be used to input a deep neural network model. Then, the preprocessed data is converted into a vulnerability information vector set using a feature representation model. Next, a deep neural network model is trained based on the vulnerability information vector set and the corresponding target labels to construct a vulnerability troubleshooting prediction model. Finally, the data to be tested of the target system is obtained in real time, and a data vector to be tested is generated through preprocessing and feature representation models, and is input into the vulnerability troubleshooting prediction model to generate vulnerability detection results.

[0058] The present invention improves the intelligence and automation level of vulnerability troubleshooting by introducing a deep neural network model, reduces the technical dependence on operators, and significantly improves the accuracy and efficiency of vulnerability detection. By collecting data from a multi-source vulnerability database and performing deep processing using a feature representation model, it can capture vulnerability information more comprehensively and improve the ability to identify hidden vulnerabilities.

[0059] Deep neural networks have powerful feature learning capabilities and can automatically extract semantic features from a large amount of vulnerability data and make intelligent predictions and judgments. By combining multi-source vulnerability databases and building deep neural network models, the automation of vulnerability detection can be effectively improved and the reliance on the technical level of operators can be reduced. The application of this method is expected to safeguard the network security of key infrastructure fields such as the power industry. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] The accompanying drawings illustrate exemplary embodiments of the present invention and, together with the description thereof, are used to explain the principles of the present invention. These drawings are included to provide a further understanding of the present invention, and the accompanying drawings are included in and constitute a part of this specification and do not constitute a limitation of the embodiments of the present invention.

[0061] Figure 1 It is a flowchart of a vulnerability troubleshooting method based on a deep neural network model according to the present invention. DETAILED DESCRIPTION

[0062] To make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and implementation methods. It is understood that the specific implementation methods described herein are only used to explain the relevant content, rather than to limit the present invention.

[0063] It should also be noted that, for the convenience of description, only the parts related to the present invention are shown in the drawings.

[0064] In the absence of conflict, the embodiments and features of the embodiments of the present invention may be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0065] The present invention requires the use of big data to train the deep neural network model. The overall idea of ​​the method is explained below.

[0066] Vulnerability information databases usually contain a variety of detailed information about vulnerabilities. When building a deep neural network model for vulnerability detection and prediction, this information needs to be processed to distinguish which ones are used as input data for the model and which ones are used as output data for the model (i.e., target labels). The following details which vulnerability information in the database is used for input and which ones are used for output after being processed.

[0067] 1. Common vulnerability information in the database

[0068] A typical vulnerability information database (such as CVE, CNNVD) usually contains the following:

[0069] 1. Vulnerability Identifier:

[0070] CVE number: a globally used vulnerability number, such as "CVE202134527".

[0071] Other numbers: country or industry vulnerability numbers, such as "CNNVD2021071234".

[0072] 2. Vulnerability description:

[0073] Text description: A detailed text description of the vulnerability, including the cause, impact, and exploitation methods of the vulnerability.

[0074] Technical details: Technical information about the vulnerability, such as code snippets, attack steps, etc.

[0075] 3. Vulnerability Type / Category:

[0076] Classification tags: such as "SQL injection", "buffer overflow", "cross-site scripting (XSS)", etc.

[0077] 4. Risk level / severity:

[0078] Qualitative rating: such as "high", "medium", "low".

[0079] Quantitative scores: such as CVSS (Common Vulnerability Scoring System) scores.

[0080] 5. Affected products and versions:

[0081] Software name: such as "Microsoft Windows", "Apache Tomcat".

[0082] Version information: Specific affected version number.

[0083] 6. Solution / Patch Information:

[0084] Remediation: Recommendations on how to fix or mitigate the vulnerability.

[0085] Patch link: Patch download address or update information.

[0086] 7. References:

[0087] Links and Documents: Links to relevant technical documents, bulletins or research reports.

[0088] 2. Part of the processed data as input

[0089] The data mainly used for model input are:

[0090] 1. Vulnerability description (text information)

[0091] Reason: Vulnerability description contains rich semantic information and can reflect the characteristics and nature of the vulnerability.

[0092] Processing method:

[0093] Text preprocessing: segment the vulnerability description, remove stop words, and perform part-of-speech tagging.

[0094] Feature extraction: Convert the preprocessed text into numerical feature vectors, such as word embeddings.

[0095] 2. Technical Details

[0096] Why: Technical details provide in-depth vulnerability information, which helps the model understand the nature of the vulnerability more accurately.

[0097] Processing method: Text preprocessing and feature extraction are also performed, and the vulnerability description is used as input features.

[0098] 3. Affected Products and Versions

[0099] Reason: Affected product information can serve as an additional feature to help the model associate the vulnerability with specific software or systems.

[0100] Processing method:

[0101] Named Entity Recognition: Extract software names and version numbers from text.

[0102] Encoding method: Convert the extracted entities into feature vectors (such as one-hot encoding or embedding representation).

[0103] 4. Contents of reference materials

[0104] Reason: If the reference material contains useful information, it can also be used as input features.

[0105] Processing method:

[0106] Text preprocessing: Process the abstract or key content of reference materials.

[0107] 3. The part of the processed data as output

[0108] The data mainly used for model output (target label) are:

[0109] 1. Vulnerability Type / Category

[0110] Function: As the classification target of the model, the model is trained to identify different types of vulnerabilities.

[0111] Processing method:

[0112] Label encoding: Convert vulnerability types into numeric labels, such as using integer encoding or one-hot encoding.

[0113] 2. Risk level / severity

[0114] Function: As the prediction target of the model, it evaluates the risk level of the vulnerability.

[0115] Processing method:

[0116] Qualitative ratings: such as "high", "medium", and "low", converted to numerical labels.

[0117] Quantitative scoring: If CVSS scores are used, they can be used directly as regression targets or graded according to the scores.

[0118] 4. Correspondence between input data and output data

[0119] 1. Input data (features)

[0120] Main content:

[0121] Feature vector of vulnerability description text.

[0122] A feature vector of technical details.

[0123] Coding characteristics of the affected products.

[0124] Processing flow:

[0125] Text preprocessing: word segmentation, stop word removal, and part-of-speech tagging.

[0126] Feature representation: word embedding, feature concatenation, text representation (such as average pooling, LSTM, attention mechanism).

[0127] Form feature vector: The feature vector used as input to the model.

[0128] 2. Output data (target label)

[0129] Main contents: vulnerability type label, risk level label.

[0130] Directions:

[0131] Classification task: Vulnerability type and risk level are used as target labels for classification tasks, and the model outputs the corresponding category prediction.

[0132] Multi-task learning (optional): predict vulnerability type and risk level simultaneously to improve the comprehensive ability of the model.

[0133] 5. Example

[0134] Assume that the database contains the following vulnerability information:

[0135] Vulnerability description: "This vulnerability exists in the input validation module of a certain software. Attackers can exploit this vulnerability to perform SQL injection attacks, resulting in database information leakage."

[0136] Vulnerability type: "SQL injection"

[0137] Risk level: "High"

[0138] Affected products and versions: "certain software versions 1.0 to 2.0"

[0139] Processing process:

[0140] 1. Extraction and processing of input data:

[0141] Text preprocessing: segment the vulnerability description, remove stop words, and perform part-of-speech tagging.

[0142] Feature representation: Convert the processed word sequence into a feature vector.

[0143] Affected products: Extract "certain software" and its version information and encode them as features.

[0144] 2. Extraction and processing of output data:

[0145] Vulnerability type label: Convert "SQL injection" to the corresponding numeric label.

[0146] Risk level label: Convert "High" to the corresponding numeric label.

[0147] 3. Model training:

[0148] Input: feature vector.

[0149] Target output: vulnerability type label and risk level label.

[0150] Training process: The model learns the mapping relationship between input features and target labels.

[0151] VI. Conclusion

[0152] Input data: Processed vulnerability description and related text information, including technical details and affected product information.

[0153] Processing method: text preprocessing and feature extraction to form the input feature vector of the model.

[0154] Output data: vulnerability type and risk level, which serve as the target label of the model.

[0155] Processing method: label encoding for model training.

[0156] 7. Summarize the overall process:

[0157] 1. Data preprocessing: segment the vulnerability text information, remove stop words, and tag parts of speech to obtain feature representation.

[0158] 2. Feature and label preparation: The feature representation is used as the model input, and the vulnerability type and risk level are used as the target label.

[0159] 3. Model training: Train the deep neural network model using input features and target labels.

[0160] 4. Model prediction: For new data, after the same preprocessing, input the model and output the prediction of vulnerability type and risk level.

[0161] 8. Notes:

[0162] Maintain independence between input and output: Input features and output labels should be independent to avoid including target label information in the features.

[0163] Consistent preprocessing process: During the training and prediction phases, the data preprocessing method must be consistent to ensure that the feature format of the model input is the same.

[0164] Data quality and diversity: The training data should contain a variety of vulnerability types and risk levels to ensure that the model has good generalization capabilities.

[0165] Embodiment 1

[0166] like Figure 1 As shown, this embodiment provides a vulnerability troubleshooting method based on a deep neural network model, including:

[0167] Vulnerability information data is collected from the public vulnerability knowledge base, the industry historical disclosure vulnerability database and the internal vulnerability database; the database contains extensive information related to network security vulnerabilities. The public vulnerability knowledge base is a collection of vulnerability information disclosed worldwide, the industry historical disclosure vulnerability database records the vulnerabilities that have been disclosed in a specific industry, and the internal vulnerability database is proprietary vulnerability data within an enterprise or organization.

[0168] Construct a preprocessing model and use it to perform text preprocessing on the data used as model input in the vulnerability information data to obtain preprocessed data; the main purpose of text preprocessing is to convert the original vulnerability information into a form suitable for deep neural network processing. Common preprocessing operations include word segmentation, stop word removal, part-of-speech tagging, etc., in order to extract key text features. After the preprocessing is completed, the cleaned and standardized preprocessed data is obtained.

[0169] Construct a feature representation model and use it to process the preprocessed data into a set of vulnerability information vectors; feature representation is an important step in deep neural network input, converting the original text data into numerical representations (i.e., vectors). These vectors can represent different dimensions and features of vulnerability information and are used for subsequent model training. Common feature representation methods include word embedding, such as Word2Vec or TF-IDF.

[0170] Based on the preprocessed data, a vulnerability knowledge graph is constructed to generate a knowledge graph embedding vector, and the knowledge graph embedding vector is fused with the vulnerability information vector set to obtain an enhanced feature representation; the vector concatenation in the fusion method directly concatenates the knowledge graph embedding vector and the vulnerability information vector together to form a higher-dimensional feature vector. The two vectors are weighted and summed, and the weights can be adjusted according to the needs of the model to balance the importance of text features and knowledge graph features. At the same time, the attention mechanism is introduced to dynamically adjust the fusion method according to the importance of each feature in a specific task, so that the model can better focus on key features.

[0171] A deep neural network model is constructed and trained using enhanced feature representation and target labels in vulnerability information data to obtain a vulnerability troubleshooting prediction model; a deep neural network performs feature learning through a multi-layer neuron structure, with the goal of learning features from complex vulnerability data that help distinguish and predict vulnerabilities. The training process matches this information with the target label of the vulnerability (e.g., vulnerability category, risk level) to generate a vulnerability troubleshooting prediction model.

[0172] Obtain the real-time test data of the target system, process the real-time test data through the preprocessing model and feature representation model, and fuse it with the knowledge graph embedding vector to obtain the enhanced test data vector; ensure that the new real-time data is consistent with the data format of the training model.

[0173] The data vector to be tested is input into the vulnerability troubleshooting prediction model to obtain the prediction results. The prediction results include the possibility, category, severity, etc. of the vulnerability. This information can help system administrators or security teams identify and fix potential security issues in a timely manner.

[0174] This embodiment introduces the feature learning capability of deep neural networks to automatically extract deep semantic and feature information from a large amount of vulnerability data, and uses this information to build an efficient vulnerability troubleshooting prediction model. The model can effectively identify potential vulnerabilities in new data through training, improving the accuracy and real-time performance of vulnerability detection.

[0175] Embodiment 2

[0176] This embodiment describes the preprocessing in the first embodiment in detail.

[0177] The preprocessing model includes word segmentation, stop word removal, and part-of-speech tagging;

[0178] 1. Word segmentation processing adopts a method based on Word2Vec and LSTM bidirectional network. By combining character embedding and forward and backward LSTM hidden states, the hidden state vector of the character is determined, and the score function is calculated to complete the prediction of the character label; finally, the optimal label sequence is obtained through Viterbi algorithm decoding, and the word segmentation processing is completed according to the optimal label sequence; the specific methods include:

[0179] Represent the acquired vulnerability information data as a character sequence ,in, is the total number of characters, For the characters; the vulnerability information data is represented as a character sequence, that is, each character in the text information is regarded as an independent element.

[0180] Use Word2Vec to convert the characters in the character sequence Mapping to embedding vector ,in, Indicates characters, For characters Word2Vec is a method for mapping discrete characters or words into a continuous vector space. Through this technology, each character in a character sequence can be converted into a numerical vector for subsequent neural network processing.

[0181] Determine the hidden state vector , , where is the forward LSTM hidden state, is the backward LSTM hidden state, is the hidden layer dimension of the LSTM; Use bidirectional LSTM (Long Short-Term Memory) to process the embedded vector. LSTM is a special type of recurrent neural network (RNN) that can capture long-term dependencies in sequential data. The forward LSTM calculates the state of the current character based on the previous context, and the backward LSTM considers the subsequent context. The hidden state vector of the current character is formed by concatenating the states of the forward and backward LSTMs.

[0182] Define the character label set and the scoring function , , where is the transposed matrix of the label score weights, is the label transition matrix, is the label of the th character, is the score for transitioning from label to label ; The character label set represents possible character labels. For example, in a word segmentation task, a character may be labeled as "start of word" or "middle of word", etc.

[0183] Determine the log-likelihood function of the correct label sequence , where the first term is the score of the target label sequence and the second term is the log sum of all possible label sequences.

[0184] And decode through the Viterbi algorithm to obtain the optimal label sequence corresponding to the maximized log-likelihood function , and obtain the word segmentation result according to the optimal label sequence.

[0185] List a specific example.

[0186] Suppose we have a text: "Vulnerability detection system". First, represent this text as a character sequence: C = [leak, hole, detect, system]. Use the Word2Vec model to map each character to an embedded vector, and then input these embedded vectors into a bidirectional LSTM model to calculate the hidden states of the forward LSTM and the backward LSTM respectively. Then, concatenate the hidden states of the forward and backward LSTMs to obtain the final hidden state vector of each character.

[0187] Assume that there is a set of character labels to mark whether each character is the beginning (B), middle (I) or end (E) of a word, for example: "leak"->B(begin), "hole"->B(begin), "detection"->B(begin), "test"->E(end), "system"->B(begin), "system"->E(end), and calculate the score of each label through the score function. Then decode it through the Viterbi algorithm to obtain the optimal label sequence: "leak"->B+E, "detection"->B+E, "system"->B+E (indicating that "system" is the beginning of the new word and "system" is the end of the word).

[0188] According to the optimal label sequence, the final word segmentation result is determined as: vulnerability | detection | system. After word segmentation, the original character sequence is successfully divided into three words.

[0189] Second, the stop word removal process uses a method based on vocabulary importance measurement and mutual information. By calculating the relevance between words and document topics, the stop word set is dynamically determined, and the stop word set is used to filter the word sequence after word segmentation to complete the stop word removal. The specific methods include:

[0190] Identify a corpus containing multiple documents; Identify a vocabulary containing all the words that have appeared ; A corpus refers to a large collection of texts. A vocabulary is built based on the corpus, that is, the vocabulary contains all the words that have appeared in the corpus.

[0191] Calculate the mutual information between words and document topics in the corpus ,in, is the topic variable obtained through the topic model LDA, For words Does it appear with the theme The joint probability of is a binary variable; the topic model (LDA) is used to analyze the documents in the corpus and determine different topics. LDA (Latent Dirichlet Allocation) is a commonly used topic model that can identify the topic structure hidden behind the document based on the word distribution in the document. Each document can be composed of a mixture of multiple topics, and each word will be associated with different topics. On this basis, the mutual information value between each word and the topic is calculated, that is, whether the word has a strong correlation with a specific topic. The higher the mutual information value, the closer the relationship between the word and the topic, and the words with a low mutual information value may be irrelevant content.

[0192] Determine the set of stop words ,in, is the importance threshold set; according to the preset importance threshold, determine which words have mutual information values ​​lower than the threshold, and put these words into the stop word set. Stop words usually include some common words that do not have practical meaning, such as, is, in, etc. These words do not contribute significantly to the topic of the text, so they need to be filtered out.

[0193] Determine the word sequence after word segmentation ,in, is the total number of words, For the words; filter the word sequence after word segmentation through the stop word set to obtain the word sequence after removing the stop words ,in, For the words; once the stop word set is determined, it is applied to the text data that has completed the word segmentation process. By comparing each word in the word sequence after word segmentation with the stop word set, all words in the stop word set will be removed, thus obtaining a word sequence after the stop words are removed, that is, only those meaningful words are retained and irrelevant words are removed.

[0194] When the corpus or topic model LDA is updated, the stop word set is re-determined, ensuring the dynamic adjustment of the stop word set to adapt to the new document and word distribution and maintain the accuracy of the analysis.

[0195] Give a specific example.

[0196] Suppose we have a corpus containing multiple documents, one of which is: "We are working on automated processing of vulnerability detection systems." First, we need to build a vocabulary and use a topic model to identify the main topics in this text.

[0197] By analyzing all the documents in the corpus, we built a vocabulary containing all the words that appeared, such as: {we, are, researching, vulnerability, detection, systems, and,automating, the process}.

[0198] The topic analysis of the entire corpus is performed through the topic model (LDA). Assume that the main topics obtained by the analysis are "cybersecurity" and "system automation". Then, for each word, calculate its mutual information value with these topics. For example, the words "we" and "are" have a low correlation with any topic. They are common words and are not specific to a certain topic. The words "vulnerability", "detection", and "system" have a high correlation with the "cybersecurity" topic. "Automation" and "processing" have a high correlation with the "system automation" topic.

[0199] Based on the calculated mutual information value and the determined importance threshold, if the mutual information value of a word is lower than the threshold, we consider it as an unimportant stop word. In this example, words like "we" and "being" have low mutual information values ​​and are therefore classified as stop words.

[0200] After word segmentation, we get the word sequence: [We are studying vulnerability detection system automation processing]. We filter this word sequence through the stop word set, remove the stop words, and retain other useful words. The word sequence after removing the stop words is: [research, vulnerability detection, system automation, processing].

[0201] 3. Part-of-speech tagging is processed by using a method based on Gaussian process classifier and conditional random field. By obtaining the feature vector of the word sequence after removing stop words, the Gaussian process classifier is used to make a preliminary prediction of the part-of-speech tag for each word, and the posterior distribution is calculated by Laplace approximation to obtain the preliminary prediction probability; a conditional probability model of the conditional random field is established, and the model parameters are trained using the preliminary prediction probability as a feature, and then decoded by the Viterbi algorithm to obtain the globally optimal part-of-speech tag sequence, and the part-of-speech tagging result corresponding to the word sequence after removing stop words is output to complete the part-of-speech tagging. The specific method includes:

[0202] Extract word sequence after removing stop words The character ngram features, word length features, and letter composition features of each subword in , and all features are encoded into feature vectors ; The n-gram feature captures the contextual information of a word sequence by considering a word and the n words before and after it. The word length feature is the length of each word in characters. The letter composition feature is used to describe the composition of a word, such as whether the word contains numbers, special symbols, or uppercase letters.

[0203] Use the Gaussian process classifier to make a preliminary prediction of the part-of-speech tag for each word, and use the Laplace approximation to calculate the posterior distribution of the Gaussian process classifier to obtain the first Words The initial predicted probability distribution of ; Use Gaussian process classifier (GPC) to make preliminary part-of-speech tag predictions for each word. Gaussian process is a non-parametric Bayesian model that can make probability predictions based on features. Through Laplace approximation, we can calculate the posterior probability distribution of each word, that is, the probability that the word belongs to a certain part-of-speech tag.

[0204] Building a conditional probability model ,in, is the normalization factor, , , , are model parameters, is the number of words in the word sequence after removing stop words, is the state characteristic function, is the transfer characteristic function, For the The part-of-speech tag of each word, For the The part-of-speech tag of each word, is the part-of-speech tag sequence, is the indicator function, , , are possible part-of-speech tags;

[0205] A conditional random field model (CRF) is constructed, where the probability distribution of the part-of-speech tag sequence given a word sequence is determined by the state feature function and the transition feature function. The state feature function is used to describe whether the part-of-speech state of the current word is equal to a specific tag. This is achieved through an indicator function, the output of which is "1" or "0", indicating whether the current word meets a certain tag. The transfer feature function is used to describe the transfer relationship between the part-of-speech tag of the previous word and the part-of-speech tag of the current word, capturing the sequence dependency of the part-of-speech tags. The normalization factor ensures that the probability distribution of the entire model is legal, and the sum of the probabilities of all possible tag sequences is 1.

[0206] The model parameters of the conditional probability model are trained using the preliminary predicted probability distribution as a feature; the parameters of the conditional random field model are trained using the preliminary predicted probability distribution generated by the previous Gaussian process classifier as a feature.

[0207] The Viterbi algorithm is used to decode the trained conditional probability model to obtain the globally optimal part-of-speech tag sequence. ; After the model is trained, the conditional random field model is decoded using the Viterbi algorithm. The Viterbi algorithm is a dynamic programming algorithm that can find the global optimal solution for the part-of-speech tag sequence in a limited time. The final output part-of-speech tag sequence is the tag sequence that maximizes the conditional probability of the model.

[0208] The optimal part-of-speech tag sequence and word sequence after removing stop words Correspondingly, the part-of-speech tagging results of each time are obtained, and the part-of-speech tagged word sequence is output. The part-of-speech tag of each word in the word sequence, such as noun, verb, adjective, etc. Then the part-of-speech tagging results of the entire word sequence are output as the word sequence after part-of-speech tagging.

[0209] Embodiment 3

[0210] The method for constructing feature representation is to map each word in the word sequence after the stop words are removed into a word embedding vector, convert each part-of-speech tag in the part-of-speech tag sequence after the part-of-speech tagging process into a one-hot vector, concatenate to generate the feature vector of each word, perform average pooling on the feature vectors of all words, obtain the final feature representation, and construct the vulnerability information vector set. The specific method includes:

[0211] Determine the word sequence after the stop words are removed ; and map each word to a word embedding vector through Word2Vec; Word2Vec is a method of embedding words into a high-dimensional vector space so that the semantic relationship between words can be represented by the distance or direction in the vector space. For example, words with similar semantics will be closer in the vector space.

[0212] Determine the word sequence after part-of-speech tagging ,in, is the number of words in the word sequence after removing stop words; and each part-of-speech tag is converted into a one-hot vector through one-hot encoding; one-hot encoding is a way to convert category labels into vectors. For example, if there are three part-of-speech tags {noun, verb, adjective}, then "noun" may be encoded as [1,0,0], "verb" as [0,1,0], and so on.

[0213] Perform feature concatenation on the word embedding vector and the one-hot vector to obtain the word feature vector ,in, For the The word feature vector of the word, For the The word embedding vector of words, For the One-hot vector of each word;

[0214] All word feature vectors are averaged and pooled to obtain the final feature representation and construct a vulnerability information vector set. Average pooling generates an overall vector representation by averaging all components of the word feature vector.

[0215] Give specific examples.

[0216] Suppose we have the following text sequence [vulnerability, detection, system] after removing stop words.

[0217] Using the Word2Vec model, we map each word to a corresponding word embedding vector. The word embedding vector of the vulnerability is [0.2, 0.4, 0.1], the word embedding vector of the detection is [0.6, 0.3, 0.8], and the word embedding vector of the system is [0.5, 0.7, 0.4].

[0218] Perform one-hot encoding on the part-of-speech tag of each word. Assuming we have the following part-of-speech tag set: {noun, verb, adjective}, vulnerability is labeled as a noun, and the one-hot vector is [1,0,0]. Detection is labeled as a verb, and the one-hot vector is [0,1,0]. System is labeled as a noun, and the one-hot vector is [1,0,0].

[0219] The word embedding vector of each word is concatenated with the one-hot vector of its corresponding part-of-speech tag to obtain the word feature vector. The feature vector of the vulnerability is [0.2, 0.4, 0.1; 1, 0, 0], the feature vector of the detection is [0.6, 0.3, 0.8; 0, 1, 0], and the feature vector of the system is [0.5, 0.7, 0.4; 1, 0, 0].

[0220] By performing average pooling on these feature vectors, we obtain a unified feature vector [0.43, 0.47, 0.43, 0.67, 0.33, 0] that integrates the word embedding vector (semantic information) and the part-of-speech tag unique-hot vector (part-of-speech information).

[0221] Embodiment 4

[0222] The method for constructing a vulnerability knowledge graph based on preprocessed data includes:

[0223] Extract vulnerability-related entities and relationships from preprocessed data, including but not limited to vulnerability identification, affected system components, attack paths, repair measures, etc.;

[0224] Build a knowledge graph using the extracted entities and relationships to form a structured representation containing nodes and edges;

[0225] The knowledge graph is trained using a knowledge graph embedding algorithm to generate an embedding vector for each node and edge; the embedding algorithm includes but is not limited to TransE, TransH, GraphSAGE or GAT;

[0226] The knowledge graph embedding vector is fused with the vulnerability information vector set, and enhanced feature representation is obtained by using vector concatenation, weighted summation or attention mechanism.

[0227] Extract vulnerability-related entities (such as vulnerability number, vulnerability name, affected system components, attack methods, repair measures, etc.) and relations (such as "impact", "cause", "repair", "exploitation", etc.) from the preprocessed data. Use named entity recognition and relationship extraction technology to automatically identify and extract this information from the text.

[0228] The extracted entities are used as nodes and relationships as edges to construct a vulnerability knowledge graph. The knowledge graph is a directed graph that represents the relationships and associations between vulnerability entities, providing structured semantic information for subsequent feature representation.

[0229] The constructed knowledge graph is trained using a knowledge graph embedding algorithm (such as TransE, TransH, GraphSAGE, or GAT) to generate a low-dimensional embedding vector for each entity and relationship. The embedding vector can capture the semantic features of nodes and edges in the knowledge graph, making similar or related entities closer in the vector space.

[0230] Embodiment 5

[0231] Methods for obtaining vulnerability troubleshooting prediction models include:

[0232] Establish a deep neural network model including an input layer, at least one hidden layer and an output layer, wherein the number of nodes in the input layer corresponds to the dimension of the final feature representation in the enhanced feature representation, and the number of nodes in the output layer corresponds to the number of vulnerability categories;

[0233] Input layer: The number of nodes in the input layer corresponds to the dimension of the final feature representation of the enhanced feature representation. For example, if the dimension of the vulnerability information vector obtained by feature processing is 100, then the input layer will have 100 nodes, each node receiving a feature input.

[0234] Hidden layer: The hidden layer is the core part of a deep neural network. It can contain one or more layers. The nodes of each layer are connected to the previous layer through weights and processed by activation functions. The role of the hidden layer is to extract higher-level features from the input data. The learning ability of the model mainly depends on the nonlinear feature extraction ability of these hidden layers.

[0235] Output layer: The number of nodes in the output layer corresponds to the number of vulnerability categories that need to be predicted. If we want to predict the category or risk level of the vulnerability, for example, there are 5 vulnerability categories, then the output layer will have 5 nodes, each node outputting the probability of a category.

[0236] The enhanced feature representation is used as input data, the corresponding vulnerability category or risk level is used as the target output, and the deep neural network model is trained using the cross entropy loss function and optimization algorithm to adjust the model parameters.

[0237] The cross entropy loss function is a commonly used loss function for classification problems, which is used to measure the gap between the category probability distribution predicted by the model and the actual category label. Specifically, the cross entropy loss calculates the deviation between the probability predicted by the model and the true label. The smaller the deviation, the lower the loss value. The calculation result of the loss function will be used to guide the parameter update of the model.

[0238] When training the model, an optimization algorithm is used to adjust the parameters of the neural network (i.e., weights and biases). Common optimization algorithms include gradient descent and its improved versions (such as the Adam optimizer). The role of these algorithms is to update the parameters of the model by calculating the gradient of the loss function, so that the model's prediction results are closer and closer to the actual vulnerability category or risk level.

[0239] The trained deep neural network model and its parameters are saved to obtain a vulnerability troubleshooting prediction model. Through continuous iteration, the optimization algorithm will gradually reduce the value of the cross entropy loss function. When the value of the loss function converges to a smaller range, the training is completed, and the trained deep neural network model and its parameters (weights and biases) are saved to obtain a vulnerability troubleshooting prediction model.

[0240] Embodiment 6

[0241] A vulnerability troubleshooting terminal based on a deep neural network model comprises a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, a vulnerability troubleshooting method based on a deep neural network model as described above is implemented.

[0242] The memory can be used to store software programs and modules. The processor executes various functional applications and data processing of the terminal by running the software programs and modules stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an execution program required for at least one function, etc.

[0243] The data storage area can store data created according to the use of the terminal, etc. In addition, the memory may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0244] A computer program product includes a computer program / instruction, which, when executed by a processor, implements a vulnerability troubleshooting method based on a deep neural network model as described above.

[0245] A computer program product includes a computer program or set of instructions for performing specific tasks or implementing specific functions. These programs or instructions are designed to be executed by a processor to implement a series of predefined steps or operations. The program product may be stored in various forms of computer storage media, such as memory, hard disk, solid-state drive, optical disk or other forms of digital storage devices. It may exist in the form of compiled binary code or in the form of scripts or bytecodes that can be executed by an interpreter. The program product uses carefully designed algorithms and logical instructions to enable the processor to process data in a specific order and manner to complete various functions such as data analysis, user interaction, device control, etc.

[0246] In the description of this specification, the description with reference to the terms "one embodiment / method", "some embodiments / methods", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment / method or example are included in at least one embodiment / method or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment / method or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments / methods or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments / methods or examples described in this specification and the features of the different embodiments / methods or examples, unless they are contradictory.

[0247] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0248] It should be understood by those skilled in the art that the above embodiments are only for the purpose of clearly illustrating the present invention, and are not intended to limit the scope of the present invention. For those skilled in the art, other changes or modifications may be made based on the above invention, and these changes or modifications are still within the scope of the present invention.

Claims

1. A vulnerability troubleshooting method based on a deep neural network model, characterized in that: include: Collect vulnerability information data from public vulnerability knowledge bases, industry historical disclosure vulnerability databases, and internal vulnerability databases; Construct a preprocessing model, and use the preprocessing model to perform text preprocessing on the data used for model input in the vulnerability information data to obtain preprocessed data; Construct a feature representation model, and use the feature representation model to process the preprocessed data into a vulnerability information vector set; Build a vulnerability knowledge graph based on preprocessed data, generate a knowledge graph embedding vector, and fuse the knowledge graph embedding vector with the vulnerability information vector set to obtain enhanced feature representation; Build a deep neural network model and train it using enhanced feature representation and target labels in vulnerability information data to obtain a vulnerability troubleshooting prediction model; Obtain the real-time test data of the target system, process the real-time test data through the preprocessing model and feature representation model, and fuse it with the knowledge graph embedding vector to obtain the enhanced test data vector; Input the enhanced data vector to be tested into the vulnerability troubleshooting prediction model to obtain the prediction result; Among them, the preprocessing model includes word segmentation, stop word removal, and part-of-speech tagging; The word segmentation process uses a method based on Word2Vec and LSTM bidirectional network. By combining character embedding and forward and backward LSTM hidden states, the hidden state vector of the character is determined, and the score function is calculated to complete the prediction of the character label. Finally, the optimal label sequence is obtained through Viterbi algorithm decoding, and the word segmentation process is completed according to the optimal label sequence. The stop word removal process uses a method based on lexical importance measurement and mutual information. By calculating the relevance between words and document topics, the stop word set is dynamically determined, and the stop word set is used to filter the word sequence after word segmentation to complete the stop word removal. The part-of-speech tagging process adopts a method based on Gaussian process classifier and conditional random field. By obtaining the feature vector of the word sequence after removing stop words, the Gaussian process classifier is used to make a preliminary part-of-speech tag prediction for each word, and the posterior distribution is calculated by Laplace approximation to obtain the preliminary prediction probability; a conditional probability model of the conditional random field is established, and the model parameters are trained using the preliminary prediction probability as a feature, and then decoded by the Viterbi algorithm to obtain the globally optimal part-of-speech tag sequence, and the part-of-speech tagging result corresponding to the word sequence after removing stop words is output to complete the part-of-speech tagging; Among them, the method of removing stop words includes: Determine a corpus containing multiple documents; determine a vocabulary W″ containing all the words that have appeared; Calculate the mutual information between words and document topics in the corpus Where T is the topic variable obtained by the topic model LDA, P(w=c, T=t) is the joint probability of whether word w appears with topic t, and c is a binary variable; Determine the stop word set S = {w∈W″|I(w;T)<τ}, where τ is the set importance threshold; Determine the word sequence after word segmentation processing W = [w1, w2, ..., w M ], where M is the total number of words, w M is the Mth word; Filter the word sequence after word segmentation through the stop word set to obtain the word sequence after removing the stop words Among them, w j is the jth word; When the corpus or topic model LDA is updated, the stop word set is re-determined; Part-of-speech tagging methods include: Extract the character n-gram features, word length features, and letter composition features of each sub-word in the word sequence W′ after removing stop words, and encode all features into feature vector a i ; Use the Gaussian process classifier to make a preliminary prediction of the part-of-speech tag for each word, and use the Laplace approximation to calculate the posterior distribution of the Gaussian process classifier to obtain the i-th word w i The initial prediction probability distribution P GPC (b i |a i ); Building a conditional probability model , where Z(W′) is the normalization factor, λ k , μ l , k, l are model parameters, M′ is the number of words in the word sequence after removing stop words, and f k (b i ,W′,i)=δ(b i =s k ) is the state characteristic function, t l (b i-1 ,y i ,W′,i)=δ(b i-1 =s l1 )·δ(b i =s l2 ) is the transfer characteristic function, b i is the part-of-speech tag of the i-th word, b i-1 is the part-of-speech tag of the i-1th word, b is the part-of-speech tag sequence, δ is the indicator function, s k 、s l1 、s l2 are possible part-of-speech tags; The model parameters of the conditional probability model are trained based on the initial predicted probability distribution; The Viterbi algorithm is used to decode the trained conditional probability model to obtain the globally optimal part-of-speech tag sequence. The optimal part-of-speech tag sequence Corresponding to the word sequence W′ after removing stop words, obtain the part-of-speech tagging result of each time, and output the word sequence after part-of-speech tagging.

2. According to claim 1, a vulnerability troubleshooting method based on a deep neural network model is characterized in that: The methods of word segmentation include: The acquired vulnerability information data is represented as a character sequence C = [c1, c2, ..., c N ], where N is the total number of characters, c N is the Nth character; Use Word2Vec to convert the character c in the character sequence i Mapped to embedding vector x i , where c i represents the i-th character, x i For character c i The embedding vector of Determine the hidden state vector h i , in, is the forward LSTM hidden state, is the backward LSTM hidden state, h is the hidden layer dimension of LSTM; Define a set of character tags and the score function s(C,y), in, is the transposed matrix of the label score weight, A is the label transfer matrix, is the label of the i-th character, From label y i Move to label y i+1 score; Determine the log-likelihood function of the correct label sequence, The optimal label sequence corresponding to the maximum log-likelihood function is obtained by decoding with the Viterbi algorithm. And obtain the word segmentation results based on the optimal label sequence.

3. According to claim 1, a vulnerability troubleshooting method based on a deep neural network model is characterized in that: The method for constructing feature representation is to map each word in the word sequence after removing stop words into a word embedding vector, convert each part-of-speech tag in the part-of-speech tag sequence after part-of-speech tagging, concatenate and generate the feature vector of each word, perform average pooling on the feature vectors of all words, obtain the final feature representation, and construct a vulnerability information vector set.

4. According to claim 3, a vulnerability troubleshooting method based on a deep neural network model is characterized in that: Methods for building feature representation models include: Determine the word sequence after the stop word removal process W′=[w1, w2, ..., w M′ ]; and map each word into a word embedding vector through Word2Vec; Determine the word sequence after part-of-speech tagging T = [t1, t2, ..., t M′ ], where M′ is the number of words in the word sequence after removing stop words; and each part-of-speech tag is converted into a one-hot vector by one-hot encoding; Perform feature concatenation on the word embedding vector and the one-hot vector to obtain the word feature vector f i =[v i ;p i ], where f i is the word feature vector of the i-th word, v i is the word embedding vector of the i-th word, p i is the one-hot vector of the i-th word; All word feature vectors are average pooled to obtain the final feature representation and construct a vulnerability information vector set.

5. The vulnerability troubleshooting method based on a deep neural network model according to claim 1 is characterized in that: The method for constructing a vulnerability knowledge graph based on preprocessed data includes: Extract vulnerability-related entities and relations from preprocessed data; Build a knowledge graph using the extracted entities and relationships to form a structured representation containing nodes and edges; The knowledge graph embedding algorithm is used to train the knowledge graph and generate embedding vectors for each node and edge; The knowledge graph embedding vector is fused with the vulnerability information vector set, and enhanced feature representation is obtained by using vector concatenation, weighted summation or attention mechanism.

6. The vulnerability troubleshooting method based on a deep neural network model according to claim 1 is characterized in that: Methods for obtaining vulnerability troubleshooting prediction models include: Establish a deep neural network model including an input layer, at least one hidden layer and an output layer, wherein the number of nodes in the input layer corresponds to the dimension of the final feature representation in the enhanced feature representation, and the number of nodes in the output layer corresponds to the number of vulnerability categories; The enhanced feature representation is used as input data, the corresponding vulnerability category or risk level is used as the target output, and the cross entropy loss function and optimization algorithm are used to train the deep neural network model and adjust the model parameters; The trained deep neural network model and its parameters are saved to obtain a vulnerability troubleshooting prediction model.

7. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by the processor, a vulnerability troubleshooting method based on a deep neural network model as described in any one of claims 1 to 6 is implemented.

Images