Vulnerability file positioning method and device, computer equipment and storage medium

Abstract

The invention relates to a vulnerability file positioning method and device, computer equipment and a storage medium, and the vulnerability file positioning method comprises the steps: obtaining supplementary description information corresponding to each first vulnerability entry; based on the supplementary description information, performing enhancement processing on the original description information in the first vulnerability entry to obtain a second vulnerability entry; determining a target storage library corresponding to the second vulnerability entry; and further, matching the second vulnerability entry with each vulnerability file in the target storage library, and determining the vulnerability file matched with the second vulnerability entry as a target vulnerability file. Through the method and the device, the problem that the vulnerability file cannot be accurately identified based on the low-quality vulnerability entry is solved, the quality of the vulnerability entry is improved, and the vulnerability file is accurately identified based on the effective vulnerability information in the vulnerability entry.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a method, device, computer equipment and storage medium for locating vulnerable files. Background Art

[0002] Open Source Software (OSS) refers to software whose source code is open to the public, allowing users to freely use, modify and distribute it. The management of OSS vulnerabilities usually utilizes public consultation. For example, the National Vulnerability Database (NVD) records vulnerabilities through Common Vulnerabilities and Exposures (CVE) entries. However, many original vulnerability entries are of low quality, that is, the entry description lacks effective vulnerability information, and thus it is impossible to accurately identify vulnerable files based on low-quality vulnerability entries.

[0003] With regard to the problem in related technologies that vulnerable files cannot be accurately identified based on low-quality vulnerability entries, no effective solution has been proposed so far. Summary of the invention

[0004] In this embodiment, a method, apparatus, computer device and storage medium for locating a vulnerable file are provided to solve the problem in the related art that vulnerable files cannot be accurately identified based on low-quality vulnerability entries.

[0005] In a first aspect, a method for locating a vulnerable file is provided in this embodiment, and the method includes:

[0006] Obtaining supplementary description information corresponding to each first vulnerability entry; the supplementary description information includes key elements for describing the vulnerability corresponding to the first vulnerability entry;

[0007] Based on the supplementary description information, the original description information in the first vulnerability entry is enhanced to obtain a second vulnerability entry;

[0008] determining a target repository corresponding to the second vulnerability entry;

[0009] The second vulnerability entry is matched with each vulnerability file in the target storage repository, and the vulnerability file that matches the second vulnerability entry in the matching result is used as the target vulnerability file.

[0010] In some embodiments, obtaining the supplementary description information corresponding to each first vulnerability entry includes:

[0011] Obtain all reference links appearing in each of the first vulnerability entries;

[0012] Based on a preset screening rule, selecting a plurality of target reference links from each of the reference links;

[0013] According to each of the first vulnerability entries, information is collected on the website pointed to by each of the target reference links to obtain the corresponding supplementary description information.

[0014] In some embodiments, the enhancing the original description information in the first vulnerability entry based on the supplementary description information to obtain the second vulnerability entry includes:

[0015] Extracting key elements from the supplementary description information using a large language model;

[0016] Based on a preset description template, the original description information in the first vulnerability entry is enhanced according to the extraction result to obtain the second vulnerability entry.

[0017] In some embodiments, determining the target repository corresponding to the second vulnerability entry includes:

[0018] Determine a repository set corresponding to the second vulnerability entry; the repository set includes the same open source repository under different modified versions;

[0019] Determine the difference between the submission time of each of the modified versions and the publication time of the second vulnerability entry;

[0020] Taking the modified version corresponding to the minimum difference as the target modified version;

[0021] Determine the open source repository under the target modified version as the target repository corresponding to the second vulnerability entry.

[0022] In some embodiments, matching the second vulnerability entry with each vulnerability file in the target repository and using the vulnerability file that matches the second vulnerability entry in the matching result as the target vulnerability file includes:

[0023] Extract key components from the description information in the second vulnerability entry to obtain multiple corresponding vulnerability components;

[0024] Matching each of the vulnerability components with each vulnerability file in the target repository, and taking the vulnerability file that matches the vulnerability component in the matching result as the first vulnerability file;

[0025] The description information in the second vulnerability entry is matched with the relevant information of each of the first vulnerability files, and the first vulnerability file that matches the second vulnerability entry in the matching result is used as the target vulnerability file; the relevant information includes the file content and file path of the first vulnerability file.

[0026] In some embodiments, matching the description information in the second vulnerability entry with the relevant information of each of the first vulnerability files, and using the first vulnerability file that matches the second vulnerability entry in the matching result as the target vulnerability file, includes:

[0027] Inputting the description information in the second vulnerability entry and the relevant information of each of the first vulnerability files into the large language model to obtain the confidence level corresponding to each of the first vulnerability files; the confidence level is used to indicate the degree of match between the first vulnerability file and the second vulnerability entry;

[0028] The first vulnerability file whose confidence level is greater than a preset threshold is used as the target vulnerability file.

[0029] In some embodiments, after enhancing the original description information in the first vulnerability entry based on the supplementary description information to obtain the second vulnerability entry, the method further includes:

[0030] When the target repository corresponding to the second vulnerability entry is not obtained, the second vulnerability entry is input into the large language model as context information to obtain a target vulnerability file matching the second vulnerability entry.

[0031] In a second aspect, a device for locating vulnerable files is provided in this embodiment, the device comprising: an acquisition module, an enhancement module, a search module and a matching module;

[0032] The acquisition module is used to acquire the supplementary description information corresponding to each first vulnerability entry; the supplementary description information includes key elements for describing the vulnerability corresponding to the first vulnerability entry;

[0033] The enhancement module is configured to enhance the original description information in the first vulnerability entry based on the supplementary description information to obtain a second vulnerability entry;

[0034] The search module is used to determine a target repository corresponding to the second vulnerability entry;

[0035] The matching module is used to match the second vulnerability entry with each vulnerability file in the target repository, and use the vulnerability file that matches the second vulnerability entry in the matching result as the target vulnerability file.

[0036] In a third aspect, a computer device is provided in this embodiment, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the vulnerability file locating method described in the first aspect when executing the computer program.

[0037] In a fourth aspect, a storage medium is provided in this embodiment, on which a computer program is stored, and when the program is executed by a processor, the method for locating vulnerable files described in the first aspect is implemented.

[0038] Compared with the related art, the vulnerability file locating method, apparatus, computer equipment and storage medium provided in the present embodiment obtain supplementary description information corresponding to each first vulnerability entry; based on the supplementary description information, enhance the original description information in the first vulnerability entry to obtain a second vulnerability entry; determine the target repository corresponding to the second vulnerability entry; further, match the second vulnerability entry with each vulnerability file in the target repository, and determine the vulnerability file matching the second vulnerability entry as the target vulnerability file, thereby solving the problem of being unable to accurately identify vulnerability files based on low-quality vulnerability entries, improving the quality of vulnerability entries, and accurately identifying vulnerability files based on effective vulnerability information in the vulnerability entries.

[0039] The details of one or more embodiments of the present application are set forth in the following drawings and description to make other features, objects, and advantages of the present application more readily apparent. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0041] Figure 1 It is a hardware structure block diagram of a terminal device of a method for locating a vulnerable file provided in an embodiment of the present application;

[0042] Figure 2 is a flow chart of a method for locating a vulnerable file provided by an embodiment of the present application;

[0043] Figure 3 It is a flowchart of a method for locating a vulnerable file provided by an embodiment of the present application;

[0044] Figure 4 It is a flow chart of a method for locating a vulnerable file provided by a preferred embodiment of the present application;

[0045] Figure 5 It is a structural block diagram of a vulnerability file locating device provided in one embodiment of the present application.

[0046] In the figure: 102, processor; 104, memory; 106, transmission device; 108, input and output device; 10, acquisition module; 20, enhancement module; 30, search module; 40, matching module. DETAILED DESCRIPTION

[0047] In order to more clearly understand the purpose, technical solutions and advantages of the present application, the present application is described and illustrated below in conjunction with the accompanying drawings and embodiments.

[0048] Unless otherwise defined, the technical terms or scientific terms involved in this application shall have the general meaning understood by people with ordinary skills in the technical field to which this application belongs. The words "one", "a", "a", "the", "these" and the like in this application do not represent quantitative restrictions, and they can be singular or plural. The terms "include", "comprise", "have" and any variants thereof involved in this application are intended to cover non-exclusive inclusions; for example, a process, method and system, product or device comprising a series of steps or modules (units) is not limited to the listed steps or modules (units), but may include unlisted steps or modules (units), or may include other steps or modules (units) inherent to these processes, methods, products or devices. The words "connect", "connected", "coupled" and the like involved in this application are not limited to physical or mechanical connections, but may include electrical connections, whether directly or indirectly. The "multiple" involved in this application refers to two or more. "And / or" describes the association relationship of associated objects, indicating that there can be three relationships. For example, "A and / or B" can mean: A exists alone, A and B exist at the same time, and B exists alone. Usually, the character " / " indicates that the objects associated with each other are in an "or" relationship. The terms "first", "second", "third", etc. involved in this application are only used to distinguish similar objects and do not represent a specific ordering of the objects.

[0049] The method embodiment provided in this embodiment can be executed in a terminal, a computer or a similar computing device. For example, running on a terminal, Figure 1 : is a hardware structure diagram of a terminal of the vulnerability file location method of this embodiment. Figure 1 As shown, the terminal may include one or more ( Figure 1 Only one is shown in the figure) processor 102 and memory 104 for storing data, wherein processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA. The above terminal may also include a transmission device 106 and an input and output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1The structure shown is only for illustration and does not limit the structure of the above terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0050] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the vulnerability file location method in this embodiment. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, to implement the above method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0051] The transmission device 106 is used to receive or send data via a network. The above network includes a wireless network provided by the communication provider of the terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (Radio Frequency, referred to as RF) module, which is used to communicate with the Internet wirelessly.

[0052] In this embodiment, a method for locating a vulnerable file is provided. Figure 2 is a flow chart of the vulnerability file locating method of this embodiment. Figure 2 As shown, the process includes the following steps:

[0053] Step S210, obtaining supplementary description information corresponding to each first vulnerability entry; the supplementary description information includes key elements for describing the vulnerability corresponding to the first vulnerability entry;

[0054] Step S220, based on the supplementary description information, the original description information in the first vulnerability entry is enhanced to obtain a second vulnerability entry;

[0055] Step S230, determining a target storage repository corresponding to the second vulnerability entry;

[0056] Step S240, matching the second vulnerability entry with each vulnerability file in the target repository, and taking the vulnerability file that matches the second vulnerability entry in the matching result as the target vulnerability file.

[0057] Specifically, each first vulnerability entry contains information such as original description information, reference link, release time and entry identifier, and the vulnerability entries include but are not limited to CVE vulnerability entries and Common Weakness Enumeration (CWE) vulnerability entries. The original description information is used to describe the source, attack method and impact of the vulnerability; the reference link is a link to the relevant reference information of the vulnerability, including the vendor's vulnerability announcement, emergency response recommendations and vulnerability details page; and the entry identifier refers to the unique number assigned to each first vulnerability entry.

[0058] When collecting supplementary description information corresponding to the first vulnerability entry, all reference links appearing in each first vulnerability entry are counted in advance, and multiple target reference links are selected from each reference link based on a preset screening rule, for example, multiple reference links with the highest frequency of appearance are selected as target reference links, and related reference links with high-quality content and wide industry applications are selected as target reference links, etc. According to each first vulnerability entry, information is collected on the website pointed to by each target reference link to obtain corresponding supplementary description information, which contains key elements for describing the vulnerability corresponding to the first vulnerability entry.

[0059] Furthermore, key elements are extracted from the supplementary description information, and the extracted key elements include but are not limited to related products, vulnerability components, vulnerability types, attack vectors, and vulnerability impacts. According to the preset description template, the original description information in the first vulnerability entry is enhanced according to the extraction result to obtain a second vulnerability entry.

[0060] A repository set corresponding to each second vulnerability entry is collected, the repository set includes the same open source repository under different modification versions, and each modification version corresponds to a code submission record used to modify the repository. According to the submission time corresponding to each code submission record, a modification version closest to the release time of the second vulnerability entry is selected as the target modification version, and the open source repository under the target modification version is used as the target repository corresponding to the second vulnerability entry.

[0061] Before using the second vulnerability entry to accurately identify the vulnerable file, the vulnerable files in the target repository are initially filtered. In this process, the description information in the second vulnerability entry is preliminarily extracted for key components to obtain multiple corresponding vulnerable components, and each vulnerable component is matched with each vulnerable file in the target repository. The vulnerable file that matches the vulnerable component in the matching result is used as the first vulnerable file, thereby implementing the vulnerability file screening based on the vulnerability component, reducing the number of candidate files, and thus improving the screening efficiency.

[0062] Afterwards, the description information in the second vulnerability entry is matched with the relevant information of each first vulnerability file, the relevant information of the first vulnerability file including the file content and file path of the first vulnerability file, and then the first vulnerability file that matches the second vulnerability entry in the matching result is used as the target vulnerability file.

[0063] At present, the quality of many original vulnerability entries in the vulnerability database is relatively low, that is, there is a lack of effective vulnerability information in the entry description, and it is impossible to accurately identify vulnerable files based on low-quality vulnerability entries. Compared with the prior art, the present application obtains supplementary description information corresponding to each first vulnerability entry; based on the supplementary description information, the original description information in the first vulnerability entry is enhanced to obtain a second vulnerability entry; the target repository corresponding to the second vulnerability entry is determined; further, the second vulnerability entry is matched with each vulnerability file in the target repository, and the vulnerability file matching the second vulnerability entry is determined as the target vulnerability file. Based on this, by collecting the supplementary description information corresponding to the vulnerability entry, the original description information in the vulnerability entry is enhanced using the vulnerability key elements in the supplementary description information, so that the vulnerability entry contains effective vulnerability information, thereby solving the problem of being unable to accurately identify vulnerable files based on low-quality vulnerability entries, improving the quality of the vulnerability entries, and accurately identifying vulnerable files based on the effective vulnerability information in the vulnerability entries.

[0064] In some embodiments, obtaining the supplementary description information corresponding to each first vulnerability entry in step S210 includes the following steps:

[0065] Step S211, obtaining all reference links appearing in each first vulnerability entry;

[0066] Step S212, selecting a plurality of target reference links from the reference links based on a preset screening rule;

[0067] Step S213: According to each first vulnerability entry, information is collected on the website pointed to by each target reference link to obtain corresponding supplementary description information.

[0068] Specifically, all reference links appearing in each first vulnerability entry are counted, and based on the preset screening rules, multiple target reference links are selected from each reference link. According to the website pointed to by each target reference link, a corresponding information collection program is written, and according to each first vulnerability entry, the website pointed to by each target reference link is accessed using the information collection program to collect information and obtain supplementary description information, for example, a corresponding crawler program is written according to the specific structure of each website, and the Python Selenium library is used to automatically access the website and collect information, etc. Among them, the preset screening rules include selecting multiple reference links with the highest frequency of occurrence as target reference links, selecting relevant reference links with high-quality content and wide industry applications as target reference links, or selecting according to the timeliness of each reference link, etc.

[0069] Exemplarily, based on the statistical results of the occurrence frequency of each reference link, the 40 reference links with the highest frequency of occurrence in each first vulnerability entry are pre-selected as target reference links. At the same time, related reference links with high-quality content are also used as target reference links, such as reference links pointing to the Computer Emergency Response Team (CERT) vulnerability annotation database, the Exploit Database vulnerability submission platform, etc.

[0070] Furthermore, based on each first vulnerability entry, information is collected from the websites pointed to by each target reference link to obtain corresponding supplementary description information, which contains key elements for describing the vulnerability corresponding to the first vulnerability entry. The key elements include but are not limited to related products, vulnerability components, vulnerability types, attack vectors and vulnerability impacts.

[0071] It should be noted that in addition to collecting information by using the reference links in the vulnerability entries, you can search based on the vulnerability information contained in the vulnerability entries to find vulnerability databases and resources related to the vulnerability entries, so as to facilitate the collection of supplementary descriptive information, or directly obtain supplementary descriptive information related to the vulnerability entries.

[0072] Through this embodiment, all reference links appearing in each first vulnerability entry are obtained, and based on preset screening rules, multiple target reference links are selected from each reference link. According to each first vulnerability entry, information is collected on the website pointed to by each target reference link to obtain corresponding supplementary description information, thereby obtaining supplementary information related to each vulnerability entry to facilitate subsequent description enhancement.

[0073] In some embodiments, the step S220 of enhancing the original description information in the first vulnerability entry based on the supplementary description information to obtain the second vulnerability entry includes the following steps:

[0074] Step S221, extracting key elements from the supplementary description information using a large language model;

[0075] Step S222: Based on a preset description template, the original description information in the first vulnerability entry is enhanced according to the extraction result to obtain a second vulnerability entry.

[0076] Specifically, key elements are extracted from the collected supplementary description information. The extracted key elements include but are not limited to related products, vulnerability components, vulnerability types, attack vectors and vulnerability impacts. Models used to extract key elements include the deep bidirectional language representation model BERT (Bidirectional Encoder Representations from Transformers), the autoregressive language model GPT (Generative Pre-trained Transformer), etc.

[0077] Further, according to the preset description template, the original description information in the first vulnerability entry is enhanced according to the extracted key elements to obtain a second vulnerability entry, which contains valid vulnerability information. The original description information can be enhanced by a large language model, or other information fusion methods can be used to achieve enhanced description information.

[0078] It should be noted that the above-mentioned preset description template is usually set according to the description information format in the vulnerability entry, so that the key elements in the enhancement processing process are adapted to the original description information, thereby improving the enhancement processing effect of the description information.

[0079] Through this embodiment, key elements of the supplementary description information are extracted through a large language model, and based on a preset description template, the original description information in the first vulnerability entry is enhanced according to the extraction result to obtain a second vulnerability entry, thereby achieving enhanced processing of the vulnerability entry and significantly improving the quality of the vulnerability entry.

[0080] In some embodiments, determining the target repository corresponding to the second vulnerability entry in step S230 includes the following steps:

[0081] Step S231, determining a repository set corresponding to the second vulnerability entry; the repository set includes the same open source repository under different modified versions;

[0082] Step S232, determining the difference between the submission time of each modified version and the release time of the second vulnerability entry;

[0083] Step S233, taking the modified version corresponding to the minimum difference as the target modified version;

[0084] Step S234: determine that the open source repository under the target modified version is the target repository corresponding to the second vulnerability entry.

[0085] Specifically, a repository set corresponding to each second vulnerability entry is searched, and the repository set includes the same open source repository under different modified versions, and each modified version corresponds to a code submission record used to modify the repository. The repository search method includes extracting from relevant links of the vulnerability entry, using a large language model for querying, or searching for relevant repositories of the vulnerability entry on the GitHub platform, and the searched repository sets can be multiple, and each repository set corresponds to a certain category of open source repository.

[0086] Furthermore, for each repository set, the submission time corresponding to each code submission record is obtained, the difference between each submission time and the release time of the second vulnerability entry is calculated, and the modified version corresponding to the minimum difference is used as the target modified version, that is, the modified version closest to the release time of the second vulnerability entry is selected as the target modified version, and the open source repository under the target modified version is used as the target repository corresponding to the second vulnerability entry.

[0087] Through this embodiment, a repository set corresponding to the second vulnerability entry is determined, the repository set includes the same open source repository under different modification versions, and the difference between the submission time of each modification version and the release time of the second vulnerability entry is determined, and the modification version corresponding to the minimum difference is used as the target modification version, and then the open source repository under the target modification version is determined as the target repository corresponding to the second vulnerability entry, so as to accurately collect the repositories related to the vulnerability entry and improve the accuracy of subsequent positioning of vulnerability files.

[0088] In some embodiments, the step S240 of matching the second vulnerability entry with each vulnerability file in the target repository and using the vulnerability file that matches the second vulnerability entry in the matching result as the target vulnerability file includes the following steps:

[0089] Step S241, extracting key components from the description information in the second vulnerability entry to obtain a plurality of corresponding vulnerability components;

[0090] Step S242, matching each vulnerability component with each vulnerability file in the target repository, and taking the vulnerability file that matches the vulnerability component in the matching result as the first vulnerability file;

[0091] Step S243, matching the description information in the second vulnerability entry with the relevant information of each first vulnerability file, and taking the first vulnerability file that matches the second vulnerability entry in the matching result as the target vulnerability file; the relevant information includes the file content and file path of the first vulnerability file.

[0092] Specifically, a large language model such as a BERT model and a GPT model is used to extract key components from the description information in the second vulnerability entry to obtain multiple vulnerability components, including file components, function components, and module components. Among them, different module components usually correspond to the internal structure divisions of the relevant repository, for example, each module component corresponds to a file directory inside the repository.

[0093] Furthermore, each vulnerability component is matched with each vulnerability file in the target repository, and the vulnerability file that matches the vulnerability component in the matching result is used as the first vulnerability file. In the matching process based on file components, the names of each file in the target repository are traversed, and files whose file names are component names or file names contain component names are screened out. At the same time, files whose file names have a similarity with component names greater than a preset threshold are screened out, and the screening result is used as the first vulnerability file, wherein the name similarity can be calculated using the standard Levenshtein distance or any other algorithm used to measure the similarity between strings; in the matching process based on function components, all code contents in the target repository are traversed, and files containing function components are screened out as the first vulnerability files; in the matching process based on module components, component matching is performed according to the internal structure division of the relevant repository. For example, when each module component corresponds to a file directory inside the repository, all file directories in the target repository are traversed, directories whose directory names match the module components are screened out, and all files contained in the directory are used as the first vulnerability files.

[0094] It should be noted that if the number of first vulnerability files obtained by screening based on each vulnerability component is too large, the first vulnerability files can be screened again through a large language model to obtain a preset number of first vulnerability files, thereby reducing the number of candidate files and improving screening efficiency.

[0095] Afterwards, the description information in the second vulnerability entry is matched with the relevant information of each first vulnerability file, wherein the relevant information includes at least the file content and file path of the first vulnerability file, and the first vulnerability file that matches the second vulnerability entry in the matching result is used as the target vulnerability file.

[0096] Through this embodiment, the description information in the second vulnerability entry is extracted for key components to obtain multiple corresponding vulnerability components, each vulnerability component is matched with each vulnerability file in the target repository, and the vulnerability file that matches the vulnerability component in the matching result is used as the first vulnerability file, thereby implementing vulnerability file screening based on vulnerability components, reducing the number of candidate files, and improving screening efficiency. In addition, the description information in the second vulnerability entry is matched with the file content and file path of each first vulnerability file, and the first vulnerability file that matches the second vulnerability entry in the matching result is used as the target vulnerability file, so that on the basis of preliminary filtering of vulnerability files, the vulnerability file is located in combination with the file content and file path of each vulnerability file, so as to accurately identify files containing vulnerabilities.

[0097] In some embodiments, step S243 of matching the description information in the second vulnerability entry with the relevant information of each first vulnerability file, and taking the first vulnerability file that matches the second vulnerability entry in the matching result as the target vulnerability file, includes the following steps:

[0098] Inputting the description information in the second vulnerability entry and the relevant information of each first vulnerability file into the large language model to obtain the confidence corresponding to each first vulnerability file; the confidence is used to indicate the matching degree between the first vulnerability file and the second vulnerability entry;

[0099] The first vulnerability file whose confidence level is greater than a preset threshold is used as the target vulnerability file.

[0100] Specifically, the description information in the second vulnerability entry and the related information of each first vulnerability file are input into the large language model, and the related information at least includes the file content and file path of the first vulnerability file. The confidence corresponding to each first vulnerability file is obtained through analysis and processing by the large language model, and the first vulnerability files are sorted according to the confidence, and the sorting result is output, and the first vulnerability file with a confidence greater than a preset threshold is used as the target vulnerability file. Among them, the confidence is used to indicate the matching degree between the first vulnerability file and the second vulnerability entry, that is, the matching degree between the description information in the second vulnerability entry and the related information of the second vulnerability entry.

[0101] It should be noted that if a unique first vulnerability file is obtained based on the screening of each vulnerability component, the first vulnerability file is used as the target vulnerability file.

[0102] Through this embodiment, the description information in the second vulnerability entry and the relevant information of each first vulnerability file are input into the large language model to obtain the confidence corresponding to each first vulnerability file. The confidence is used to indicate the degree of matching between the first vulnerability file and the second vulnerability entry, and the first vulnerability file with a confidence greater than a preset threshold is used as the target vulnerability file. After screening and obtaining the candidate first vulnerability file, the file containing the vulnerability can be accurately identified by comparing and analyzing the relevant information of the first vulnerability file.

[0103] In some of the embodiments, after the original description information in the first vulnerability entry is enhanced based on the supplementary description information to obtain the second vulnerability entry, the vulnerability file location method further includes the following steps:

[0104] When the target repository corresponding to the second vulnerability entry is not obtained, the second vulnerability entry is input into the large language model as context information to obtain a target vulnerability file matching the second vulnerability entry.

[0105] Specifically, if the target repository corresponding to the second vulnerability entry is not found, the second vulnerability entry is input into the large language model as context information, and after analysis and retrieval by the large language model, a target vulnerability file matching the second vulnerability entry is output.

[0106] In addition, when the first vulnerability file is obtained without screening based on each vulnerability component, the second vulnerability entry can also be input into the large language model as context information for file retrieval to ensure stable acquisition of vulnerability file location results.

[0107] Through this embodiment, when a vulnerability file matching the second vulnerability entry is not obtained, the second vulnerability entry is input into the large language model as context information to obtain a target vulnerability file matching the second vulnerability entry, thereby ensuring the completeness of the output vulnerability file location result and avoiding the situation where vulnerability-related files cannot be matched.

[0108] Figure 3 : is a flow chart of the vulnerability file location method of this embodiment. Figure 3 As shown in the figure, the specific process of the vulnerability file location method includes the following steps:

[0109] All reference links appearing in each first vulnerability entry are obtained, and based on a preset screening rule, multiple target reference links are selected from each reference link, and information is collected on the website pointed to by each target reference link according to each first vulnerability entry to obtain corresponding supplementary description information S310. After that, the original description information in each first vulnerability entry is obtained, key elements of the supplementary description information are extracted through a large language model, and based on a preset description template, the original description information in the first vulnerability entry is enhanced according to the extraction result to obtain a second vulnerability entry S320.

[0110] Further, it is determined whether the target repository corresponding to the second vulnerability entry can be searched at present S330. If the target repository corresponding to the second vulnerability entry is not searched, the second vulnerability entry is input into the large language model as context information for processing to obtain a target vulnerability file matching the second vulnerability entry S340; if the target repository corresponding to the second vulnerability entry is searched, the description information in the second vulnerability entry is extracted for key components to obtain multiple corresponding vulnerability components S350, each vulnerability component is matched with each vulnerability file in the target repository, and the vulnerability file matching the vulnerability component in the matching result is used as the first vulnerability file S360.

[0111] Afterwards, it is determined whether a unique first vulnerability file is obtained by screening S370. In the case where multiple first vulnerability files are obtained by screening, the description information in the second vulnerability entry is matched with the relevant information of each first vulnerability file, and the first vulnerability file that matches the second vulnerability entry in the matching result is used as the target vulnerability file to achieve accurate identification of the vulnerability file S390; in the case where a unique first vulnerability file is obtained by screening, the first vulnerability file is used as the target vulnerability file S380.

[0112] The present embodiment is described and illustrated below through preferred embodiments.

[0113] Figure 4 is a flow chart of the vulnerability file locating method of the preferred embodiment. Figure 4 As shown, the vulnerability file location method includes the following steps:

[0114] Step S410, obtaining all reference links appearing in each first vulnerability entry;

[0115] Step S420, selecting a plurality of target reference links from the reference links based on a preset screening rule;

[0116] Step S430, according to each first vulnerability entry, collect information about the website pointed to by each target reference link to obtain corresponding supplementary description information;

[0117] Step S440, extracting key elements from the supplementary description information using a large language model;

[0118] Step S450, based on a preset description template, the original description information in the first vulnerability entry is enhanced according to the extraction result to obtain a second vulnerability entry;

[0119] Step S460, determining a target storage repository corresponding to the second vulnerability entry;

[0120] Step S470: Match the second vulnerability entry with each vulnerability file in the target repository, and use the vulnerability file that matches the second vulnerability entry in the matching result as the target vulnerability file.

[0121] Through this embodiment, all reference links appearing in each first vulnerability entry are obtained, and multiple target reference links are selected from each reference link based on a preset screening rule, and information is collected on the website pointed to by each target reference link according to each first vulnerability entry to obtain corresponding supplementary description information. The key elements of the supplementary description information are extracted through a large language model, and based on a preset description template, the original description information in the first vulnerability entry is enhanced according to the extraction result to obtain a second vulnerability entry, thereby achieving enhanced processing of the vulnerability entry and improving the quality of the vulnerability entry.

[0122] Furthermore, the target repository corresponding to the second vulnerability entry is determined, the second vulnerability entry is matched with each vulnerability file in the target repository, and the vulnerability file that matches the second vulnerability entry in the matching result is used as the target vulnerability file, thereby solving the problem of being unable to accurately identify vulnerability files based on low-quality vulnerability entries, improving the quality of vulnerability entries, and accurately identifying vulnerability files based on valid vulnerability information in the vulnerability entries.

[0123] It should be noted that the steps shown in the above process or the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0124] In this embodiment, a device for locating vulnerable files is also provided, which is used to implement the above embodiments and preferred implementations, and will not be repeated here. The terms "module", "unit", "subunit", etc. used below can implement a combination of software and / or hardware for a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0125] Figure 5 is a structural block diagram of the vulnerability file locating device of this embodiment, such as Figure 5 As shown, the device includes: an acquisition module 10, an enhancement module 20, a search module 30 and a matching module 40;

[0126] The acquisition module 10 is used to acquire the supplementary description information corresponding to each first vulnerability entry; the supplementary description information includes key elements for describing the vulnerability corresponding to the first vulnerability entry;

[0127] An enhancement module 20, configured to enhance the original description information in the first vulnerability entry based on the supplementary description information to obtain a second vulnerability entry;

[0128] A search module 30, configured to determine a target repository corresponding to the second vulnerability entry;

[0129] The matching module 40 is used to match the second vulnerability entry with each vulnerability file in the target storage repository, and use the vulnerability file that matches the second vulnerability entry in the matching result as the target vulnerability file.

[0130] Through the device provided by this embodiment, supplementary description information corresponding to each first vulnerability entry is obtained; based on the supplementary description information, the original description information in the first vulnerability entry is enhanced to obtain a second vulnerability entry; the target repository corresponding to the second vulnerability entry is determined; further, the second vulnerability entry is matched with each vulnerability file in the target repository, and the vulnerability file matching the second vulnerability entry is determined as the target vulnerability file, which solves the problem of being unable to accurately identify vulnerability files based on low-quality vulnerability entries, improves the quality of vulnerability entries, and accurately identifies vulnerability files based on valid vulnerability information in the vulnerability entries.

[0131] In some of the embodiments, the acquisition module 10 is further used to obtain all reference links appearing in each first vulnerability entry; based on a preset screening rule, multiple target reference links are selected from each reference link; according to each first vulnerability entry, information is collected on the website pointed to by each target reference link to obtain corresponding supplementary description information.

[0132] In some of the embodiments, the enhancement module 20 is further used to extract key elements from the supplementary description information through a large language model; based on a preset description template, the original description information in the first vulnerability entry is enhanced according to the extraction result to obtain a second vulnerability entry.

[0133] In some of the embodiments, the search module 30 is further used to determine a repository set corresponding to the second vulnerability entry; the repository set includes the same open source repository under different modification versions; determine the difference between the submission time of each modification version and the release time of the second vulnerability entry; use the modification version corresponding to the minimum difference as the target modification version; and determine the open source repository under the target modification version as the target repository corresponding to the second vulnerability entry.

[0134] In some of the embodiments, the matching module 40 is further used to extract key components from the description information in the second vulnerability entry to obtain corresponding multiple vulnerability components; match each vulnerability component with each vulnerability file in the target repository, and use the vulnerability file that matches the vulnerability component in the matching result as the first vulnerability file; match the description information in the second vulnerability entry with the relevant information of each first vulnerability file, and use the first vulnerability file that matches the second vulnerability entry in the matching result as the target vulnerability file; the relevant information includes the file content and file path of the first vulnerability file.

[0135] In some of the embodiments, the matching module 40 is further used to input the description information in the second vulnerability entry and the relevant information of each first vulnerability file into the large language model to obtain the confidence corresponding to each first vulnerability file; the confidence is used to indicate the degree of matching between the first vulnerability file and the second vulnerability entry; and the first vulnerability file with a confidence greater than a preset threshold is used as the target vulnerability file.

[0136] In some of the embodiments, the matching module 40 is further configured to input the second vulnerability entry as context information into the large language model when the target repository corresponding to the second vulnerability entry is not obtained, so as to obtain a target vulnerability file matching the second vulnerability entry.

[0137] It should be noted that the above modules can be functional modules or program modules, and can be implemented by software or hardware. For modules implemented by hardware, the above modules can be located in the same processor; or the above modules can be located in different processors in any combination.

[0138] In this embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0139] Optionally, the computer device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0140] Optionally, in this embodiment, the processor may be configured to perform the following steps through a computer program:

[0141] S1, obtaining supplementary description information corresponding to each first vulnerability entry; the supplementary description information includes key elements for describing the vulnerability corresponding to the first vulnerability entry;

[0142] S2, based on the supplementary description information, enhancing the original description information in the first vulnerability entry to obtain a second vulnerability entry;

[0143] S3, determining a target repository corresponding to the second vulnerability entry;

[0144] S4, matching the second vulnerability entry with each vulnerability file in the target repository, and taking the vulnerability file that matches the second vulnerability entry in the matching result as the target vulnerability file.

[0145] It should be noted that the specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementation modes, and will not be repeated in this embodiment.

[0146] In addition, in combination with the vulnerability file location method provided in the above embodiments, a storage medium can also be provided in this embodiment to implement the vulnerability file location method. The storage medium stores a computer program; when the computer program is executed by a processor, any of the vulnerability file location methods in the above embodiments is implemented.

[0147] It should be understood that the specific embodiments described herein are only used to explain the application, rather than to limit it. Based on the embodiments provided in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the protection scope of this application.

[0148] Obviously, the drawings are only some examples or embodiments of the present application. For ordinary technicians in the field, the present application can also be applied to other similar situations based on these drawings without creative work. In addition, it is understandable that although the work done in this development process may be complicated and lengthy, for ordinary technicians in the field, certain changes in design, manufacturing or production based on the technical content disclosed in this application are only conventional technical means and should not be regarded as insufficient content disclosed in this application.

[0149] The term "embodiment" in this application refers to a specific feature, structure or characteristic described in conjunction with the embodiment that can be included in at least one embodiment of the present application. The appearance of this phrase in various locations in the specification does not necessarily mean the same embodiment, nor does it mean that it is mutually exclusive with other embodiments and is independent or optional. It is clearly or implicitly understood by those of ordinary skill in the art that the embodiments described in this application can be combined with other embodiments without conflict.

[0150] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of patent protection. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the scope of protection of the present application. Therefore, the scope of protection of the present application shall be subject to the attached claims.

Claims

1. A method for locating a vulnerable file, characterized in that: The method comprises: Obtaining supplementary description information corresponding to each first vulnerability entry; the supplementary description information includes key elements for describing the vulnerability corresponding to the first vulnerability entry; Based on the supplementary description information, the original description information in the first vulnerability entry is enhanced to obtain a second vulnerability entry; determining a target repository corresponding to the second vulnerability entry; The second vulnerability entry is matched with each vulnerability file in the target storage repository, and the vulnerability file that matches the second vulnerability entry in the matching result is used as the target vulnerability file.

2. The method for locating a vulnerable file according to claim 1, characterized in that: The obtaining of the supplementary description information corresponding to each first vulnerability entry includes: Obtain all reference links appearing in each of the first vulnerability entries; Based on a preset screening rule, selecting a plurality of target reference links from each of the reference links; According to each of the first vulnerability entries, information is collected on the website pointed to by each of the target reference links to obtain the corresponding supplementary description information.

3. The method for locating a vulnerable file according to claim 1, characterized in that: The step of enhancing the original description information in the first vulnerability entry based on the supplementary description information to obtain a second vulnerability entry includes: Extracting key elements from the supplementary description information using a large language model; Based on a preset description template, the original description information in the first vulnerability entry is enhanced according to the extraction result to obtain the second vulnerability entry.

4. The method for locating a vulnerable file according to claim 1, characterized in that: The determining a target repository corresponding to the second vulnerability entry includes: Determine a repository set corresponding to the second vulnerability entry; the repository set includes the same open source repository under different modified versions; Determine the difference between the submission time of each of the modified versions and the publication time of the second vulnerability entry; Taking the modified version corresponding to the minimum difference as the target modified version; Determine the open source repository under the target modified version as the target repository corresponding to the second vulnerability entry.

5. The method for locating a vulnerable file according to claim 1, characterized in that: The step of matching the second vulnerability entry with each vulnerability file in the target repository and taking the vulnerability file that matches the second vulnerability entry in the matching result as the target vulnerability file includes: Extract key components from the description information in the second vulnerability entry to obtain multiple corresponding vulnerability components; Matching each of the vulnerability components with each vulnerability file in the target repository, and taking the vulnerability file that matches the vulnerability component in the matching result as the first vulnerability file; The description information in the second vulnerability entry is matched with the relevant information of each of the first vulnerability files, and the first vulnerability file that matches the second vulnerability entry in the matching result is used as the target vulnerability file; the relevant information includes the file content and file path of the first vulnerability file.

6. The method for locating a vulnerable file according to claim 5, characterized in that: The step of matching the description information in the second vulnerability entry with the relevant information of each of the first vulnerability files, and taking the first vulnerability file that matches the second vulnerability entry in the matching result as the target vulnerability file, includes: Inputting the description information in the second vulnerability entry and the relevant information of each of the first vulnerability files into the large language model to obtain the confidence level corresponding to each of the first vulnerability files; the confidence level is used to indicate the degree of match between the first vulnerability file and the second vulnerability entry; The first vulnerability file whose confidence level is greater than a preset threshold is used as the target vulnerability file.

7. The method for locating a vulnerable file according to claim 1, characterized in that: After the original description information in the first vulnerability entry is enhanced based on the supplementary description information to obtain the second vulnerability entry, the method further includes: When the target repository corresponding to the second vulnerability entry is not obtained, the second vulnerability entry is input into the large language model as context information to obtain a target vulnerability file matching the second vulnerability entry.

8. A device for locating vulnerable files, characterized in that: The device comprises: an acquisition module, an enhancement module, a search module and a matching module; The acquisition module is used to acquire the supplementary description information corresponding to each first vulnerability entry; the supplementary description information includes key elements for describing the vulnerability corresponding to the first vulnerability entry; The enhancement module is configured to enhance the original description information in the first vulnerability entry based on the supplementary description information to obtain a second vulnerability entry; The search module is used to determine a target repository corresponding to the second vulnerability entry; The matching module is used to match the second vulnerability entry with each vulnerability file in the target repository, and use the vulnerability file that matches the second vulnerability entry in the matching result as the target vulnerability file.

9. A computer device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps of the vulnerability file locating method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method for locating vulnerable files according to any one of claims 1 to 7 are implemented.

Images