Methods, apparatus, computer equipment and storage media for locating vulnerable files

Abstract

This application relates to a method, apparatus, computer device, and storage medium for locating vulnerability files. The method includes: obtaining supplementary description information corresponding to each first vulnerability entry; enhancing the original description information in the first vulnerability entry based on the supplementary description information to obtain a second vulnerability entry; determining the target repository corresponding to the second vulnerability entry; and further, matching the second vulnerability entry with each vulnerability file in the target repository to determine the vulnerability file matching the second vulnerability entry as the target vulnerability file. This application solves the problem of inaccurately identifying vulnerability files based on low-quality vulnerability entries, thereby improving the quality of vulnerability entries and accurately identifying vulnerability files based on valid vulnerability information within the vulnerability entries.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to methods, apparatus, computer equipment, and storage media for locating vulnerable files. Background Technology

[0002] Open source software (OSS) refers to software whose source code is publicly available, allowing users to freely use, modify, and distribute it. OSS vulnerability management typically utilizes public consultation; for example, the National Vulnerability Database (NVD) records vulnerabilities through Common Vulnerabilities and Exposures (CVE) entries. However, many original vulnerability entries are of low quality, lacking effective vulnerability information in their descriptions, making it impossible to accurately identify vulnerable files based on these low-quality entries.

[0003] There is currently no effective solution to the problem that related technologies cannot accurately identify vulnerable files based on low-quality vulnerability entries. Summary of the Invention

[0004] This embodiment provides a method, apparatus, computer device, and storage medium for locating vulnerability files, in order to solve the problem in related technologies that it is impossible to accurately identify vulnerability files based on low-quality vulnerability entries.

[0005] Firstly, this embodiment provides a method for locating vulnerable files, the method comprising:

[0006] Obtain supplementary description information corresponding to each first vulnerability entry; the supplementary description information includes key elements used to describe the vulnerability corresponding to the first vulnerability entry.

[0007] Based on the supplementary description information, the original description information in the first vulnerability entry is enhanced to obtain the second vulnerability entry.

[0008] Identify the target repository corresponding to the second vulnerability entry;

[0009] The second vulnerability entry is matched with each vulnerability file in the target repository, and the vulnerability file that matches the second vulnerability entry in the matching results is taken as the target vulnerability file.

[0010] In some embodiments, obtaining supplementary descriptive information corresponding to each first vulnerability entry includes:

[0011] Retrieve all reference links appearing in each of the first vulnerability entries;

[0012] Based on preset filtering rules, multiple target reference links are selected from each of the aforementioned reference links;

[0013] For each of the first vulnerability entries, information is collected from the websites pointed to by each of the target reference links to obtain the corresponding supplementary description information.

[0014] In some embodiments, the step of enhancing the original description information in the first vulnerability entry based on the supplementary description information to obtain a second vulnerability entry includes:

[0015] Key elements are extracted from the supplementary descriptive information using a large language model;

[0016] Based on a preset description template, the original description information in the first vulnerability entry is enhanced according to the extraction results to obtain the second vulnerability entry.

[0017] In some embodiments, determining the target repository corresponding to the second vulnerability entry includes:

[0018] Determine the set of repositories corresponding to the second vulnerability entry; the set of repositories includes the same open-source repository under different modified versions;

[0019] Determine the difference between the submission time of each of the modified versions and the publication time of the second vulnerability entry;

[0020] The modified version corresponding to the minimum difference is taken as the target modified version;

[0021] The open-source repository under the target modified version is identified as the target repository corresponding to the second vulnerability entry.

[0022] In some embodiments, the step of matching the second vulnerability entry with each vulnerability file in the target repository, and selecting the vulnerability file that matches the second vulnerability entry in the matching results as the target vulnerability file, includes:

[0023] Key components are extracted from the description information in the second vulnerability entry to obtain multiple corresponding vulnerability components;

[0024] Each vulnerability component is matched with each vulnerability file in the target repository, and the vulnerability file that matches the vulnerability component in the matching results is taken as the first vulnerability file;

[0025] The description information in the second vulnerability entry is matched with the relevant information of each of the first vulnerability files, and the first vulnerability file that matches the second vulnerability entry in the matching result is taken as the target vulnerability file; the relevant information includes the file content and file path of the first vulnerability file.

[0026] In some embodiments, the step of matching the description information in the second vulnerability entry with the relevant information of each first vulnerability file, and using the first vulnerability file that matches the second vulnerability entry in the matching results as the target vulnerability file, includes:

[0027] The description information in the second vulnerability entry and the relevant information of each of the first vulnerability files are input into the large language model to obtain the confidence score corresponding to each of the first vulnerability files; the confidence score is used to indicate the degree of matching between the first vulnerability file and the second vulnerability entry.

[0028] The first vulnerability file with a confidence level greater than a preset threshold is selected as the target vulnerability file.

[0029] In some embodiments, after enhancing the original description information in the first vulnerability entry based on the supplementary description information to obtain the second vulnerability entry, the method further includes:

[0030] If the target repository corresponding to the second vulnerability entry is not obtained, the second vulnerability entry is input into the large language model as context information to obtain the target vulnerability file that matches the second vulnerability entry.

[0031] Secondly, this embodiment provides a vulnerability file location device, which includes: an acquisition module, an enhancement module, a search module, and a matching module;

[0032] The acquisition module is used to acquire supplementary description information corresponding to each first vulnerability entry; the supplementary description information includes key elements for describing the vulnerability corresponding to the first vulnerability entry.

[0033] The enhancement module is used to enhance the original description information in the first vulnerability entry based on the supplementary description information to obtain a second vulnerability entry.

[0034] The search module is used to determine the target repository corresponding to the second vulnerability entry;

[0035] The matching module is used to match the second vulnerability entry with each vulnerability file in the target repository, and to take the vulnerability file that matches the second vulnerability entry in the matching results as the target vulnerability file.

[0036] Thirdly, this embodiment provides a computer device including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the vulnerability file location method described in the first aspect above.

[0037] Fourthly, this embodiment provides a storage medium storing a computer program that, when executed by a processor, implements the vulnerability file location method described in the first aspect above.

[0038] Compared with related technologies, the vulnerability file location method, apparatus, computer device, and storage medium provided in this embodiment obtain supplementary description information corresponding to each first vulnerability entry; enhance the original description information in the first vulnerability entry based on the supplementary description information to obtain a second vulnerability entry; determine the target repository corresponding to the second vulnerability entry; and further, match the second vulnerability entry with each vulnerability file in the target repository to determine the vulnerability file that matches the second vulnerability entry as the target vulnerability file. This solves the problem of not being able to accurately identify vulnerability files based on low-quality vulnerability entries, improves the quality of vulnerability entries, and accurately identifies vulnerability files based on the effective vulnerability information in the vulnerability entries.

[0039] Details of one or more embodiments of this application are set forth in the following drawings and description to make other features, objects and advantages of this application more readily apparent. Attached Figure Description

[0040] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0041] Figure 1 This is a hardware structure block diagram of a terminal device for a vulnerability file location method provided in an embodiment of this application;

[0042] Figure 2 This is a flowchart of a vulnerability file location method provided in an embodiment of this application;

[0043] Figure 3 This is a flowchart illustrating a vulnerability file location method provided in an embodiment of this application;

[0044] Figure 4 This is a flowchart of a preferred embodiment of the vulnerability file location method provided in this application;

[0045] Figure 5 This is a structural block diagram of a vulnerability file location device provided in an embodiment of this application.

[0046] In the diagram: 102, processor; 104, memory; 106, transmission device; 108, input / output device; 10, acquisition module; 20, enhancement module; 30, search module; 40, matching module. Detailed Implementation

[0047] To better understand the purpose, technical solution, and advantages of this application, the application is described and illustrated below in conjunction with the accompanying drawings and embodiments.

[0048] Unless otherwise defined, the technical or scientific terms used in this application shall have the general meaning as understood by one of ordinary skill in the art to which this application pertains. Words such as “a,” “an,” “an,” “the,” “the,” and “these,” used in this application, do not indicate quantitative limitation and may be singular or plural. The terms “comprising,” “including,” “having,” and any variations thereof used in this application are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device that comprises a series of steps or modules (units) is not limited to the listed steps or modules (units) but may include steps or modules (units) not listed, or may include other steps or modules (units) inherent to such processes, methods, products, or devices. The terms “connected,” “linked,” and “coupled,” used in this application, are not limited to physical or mechanical connections but may include electrical connections, whether direct or indirect. The term “multiple” used in this application refers to two or more. The "and / or" operator describes the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: A alone, A and B simultaneously, and B alone. Typically, the character " / " indicates that the objects before and after it are in an "or" relationship. The terms "first," "second," and "third," etc., used in this application are merely for distinguishing similar objects and do not represent a specific ordering of the objects.

[0049] The method embodiments provided in this example can be executed on a terminal, computer, or similar computing device. For example, it can run on a terminal. Figure 1 This is a hardware structure block diagram of the terminal for the vulnerability file location method in this embodiment. For example... Figure 1 As shown, a terminal may include one or more ( Figure 1 Only one is shown in the diagram. A processor 102 and a memory 104 for storing data are also included. The processor 102 may be, but is not limited to, a microprocessor (MCU) or a programmable logic device (FPGA). The terminal may also include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that… Figure 1The structure shown is for illustrative purposes only and does not limit the structure of the terminal described above. For example, the terminal may also include components that are larger than... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown are illustrated.

[0050] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the vulnerability file location method in this embodiment. The processor 102 executes various functional applications and data processing by running the computer programs stored in the memory 104, thereby implementing the above-described method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0051] The transmission device 106 is used to receive or send data via a network. This network includes a wireless network provided by the terminal's communication provider. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 can be a Radio Frequency (RF) module used for wireless communication with the Internet.

[0052] This embodiment provides a method for locating vulnerability files. Figure 2 This is a flowchart of the vulnerability file location method in this embodiment, such as... Figure 2 As shown, the process includes the following steps:

[0053] Step S210: Obtain supplementary description information corresponding to each first vulnerability entry; the supplementary description information includes key elements used to describe the vulnerability corresponding to the first vulnerability entry;

[0054] Step S220: Based on the supplementary description information, the original description information in the first vulnerability entry is enhanced to obtain the second vulnerability entry;

[0055] Step S230: Determine the target repository corresponding to the second vulnerability entry;

[0056] Step S240: Match the second vulnerability entry with each vulnerability file in the target repository, and take the vulnerability file that matches the second vulnerability entry in the matching results as the target vulnerability file.

[0057] Specifically, each first vulnerability entry includes original description information, reference links, release date, and entry identifier. Vulnerability entries include, but are not limited to, CVE vulnerability entries and Common Weakness Enumeration (CWE) vulnerability entries. The original description information describes the vulnerability's source, attack method, and impact; the reference links are links to relevant information, including vendor vulnerability announcements, emergency response recommendations, and vulnerability details pages; and the entry identifier is a unique number assigned to each first vulnerability entry.

[0058] When collecting supplementary descriptive information corresponding to the first vulnerability entries, all reference links appearing in each first vulnerability entry are pre-compiled. Based on preset filtering rules, multiple target reference links are selected from each reference link. For example, the most frequently occurring reference links are selected as target reference links, or relevant reference links with high-quality content and wide industry applications are selected as target reference links. Information is collected from the websites pointed to by each target reference link for each first vulnerability entry to obtain corresponding supplementary descriptive information. This supplementary descriptive information contains key elements used to describe the vulnerability corresponding to the first vulnerability entry.

[0059] Furthermore, key elements are extracted from the supplementary description information. These key elements include, but are not limited to, related products, vulnerable components, vulnerability types, attack vectors, and vulnerability impacts. Following a pre-defined description template, the original description information in the first vulnerability entry is enhanced based on the extraction results to obtain the second vulnerability entry.

[0060] Collect a set of repositories corresponding to each second vulnerability entry. This set includes the same open-source repository under different modified versions, with each modified version corresponding to a code commit record used to modify the repository. Based on the commit time corresponding to each code commit record, select the modified version closest to the release time of the second vulnerability entry as the target modified version, and use the open-source repository under the target modified version as the target repository corresponding to the second vulnerability entry.

[0061] Before accurately identifying vulnerable files using the second vulnerability entry, a preliminary filtering of vulnerable files in the target repository is performed. Specifically, key components are extracted from the description information in the second vulnerability entry to obtain multiple corresponding vulnerability components. Each vulnerability component is then matched against vulnerable files in the target repository. Vulnerable files matching the vulnerability components are selected as the first vulnerable files. This component-based vulnerability file filtering reduces the number of candidate files, thereby improving filtering efficiency.

[0062] Next, the description information in the second vulnerability entry is matched with the relevant information of each first vulnerability file. The relevant information of the first vulnerability file includes the file content and file path of the first vulnerability file. Then, the first vulnerability file that matches the second vulnerability entry in the matching results is taken as the target vulnerability file.

[0063] Currently, many original vulnerability entries in vulnerability databases are of low quality, meaning their descriptions lack effective vulnerability information, making it impossible to accurately identify vulnerable files based on these low-quality entries. This application, compared to existing technologies, obtains supplementary description information corresponding to each first vulnerability entry; based on this supplementary description information, it enhances the original description information in the first vulnerability entry to obtain a second vulnerability entry; it determines the target repository corresponding to the second vulnerability entry; further, it matches the second vulnerability entry with each vulnerability file in the target repository, identifying the vulnerability file that matches the second vulnerability entry as the target vulnerability file. Based on this, by collecting supplementary description information corresponding to vulnerability entries and using the key vulnerability elements in the supplementary description information to enhance the original description information in the vulnerability entries, the vulnerability entries contain effective vulnerability information. This solves the problem of not being able to accurately identify vulnerable files based on low-quality vulnerability entries, improving the quality of vulnerability entries and enabling accurate identification of vulnerable files based on the effective vulnerability information within the vulnerability entries.

[0064] In some embodiments, obtaining supplementary description information corresponding to each first vulnerability entry in step S210 includes the following steps:

[0065] Step S211: Obtain all reference links appearing in each first vulnerability entry;

[0066] Step S212: Based on preset filtering rules, select multiple target reference links from each reference link;

[0067] Step S213: Based on each first vulnerability entry, collect information on the websites pointed to by each target reference link to obtain corresponding supplementary description information.

[0068] Specifically, all reference links appearing in each primary vulnerability entry are analyzed. Based on preset filtering rules, multiple target reference links are selected from these links. For each target reference link pointing to a website, a corresponding information gathering program is written. For each primary vulnerability entry, the information gathering program is used to access the websites pointed to by the target reference links to collect supplementary descriptive information. For example, a corresponding web crawler program is written based on the specific structure of each website, and the Selenium library in Python is used to automate website access and information collection. The preset filtering rules include selecting the most frequently occurring reference links as target reference links, selecting relevant reference links with high-quality content and broad industry applications, or selecting based on the timeliness of each reference link.

[0069] For example, based on the frequency statistics of each reference link, the 40 reference links that appear most frequently in each first vulnerability entry are pre-selected as target reference links. At the same time, relevant reference links with high-quality content are also used as target reference links, such as reference links pointing to the Computer Emergency Response Team (CERT) vulnerability annotation database, the Exploit Database vulnerability submission platform, etc.

[0070] Furthermore, based on each first vulnerability entry, information is collected from the websites pointed to by each target reference link to obtain corresponding supplementary description information. This supplementary description information includes key elements for describing the vulnerability corresponding to the first vulnerability entry. Key elements include, but are not limited to, related products, vulnerable components, vulnerability types, attack vectors, and vulnerability impacts.

[0071] It should be noted that, in addition to using the reference links in the vulnerability entries for information gathering, you can also search based on the vulnerability information contained in the vulnerability entries to find vulnerability databases and resources related to the vulnerability entries, which will facilitate the collection of supplementary descriptive information or directly obtain supplementary descriptive information related to the vulnerability entries.

[0072] In this embodiment, all reference links appearing in each first vulnerability entry are obtained. Based on preset filtering rules, multiple target reference links are selected from each reference link. For each first vulnerability entry, information is collected on the websites pointed to by each target reference link to obtain corresponding supplementary description information. This process obtains supplementary information related to each vulnerability entry, which facilitates subsequent description enhancement.

[0073] In some embodiments, step S220, which enhances the original description information in the first vulnerability entry based on supplementary description information to obtain the second vulnerability entry, includes the following steps:

[0074] Step S221: Extract key elements from supplementary descriptive information using a large language model;

[0075] Step S222: Based on the preset description template, the original description information in the first vulnerability entry is enhanced according to the extraction results to obtain the second vulnerability entry.

[0076] Specifically, key elements are extracted from the collected supplementary descriptive information. These key elements include, but are not limited to, related products, vulnerable components, vulnerability types, attack vectors, and vulnerability impacts. Models used to extract these key elements include the deep bidirectional language representation model BERT (Bidirectional Encoder Representations from Transformers) and the autoregressive language model GPT (Generative Pre-trained Transformer).

[0077] Furthermore, following a preset description template, the original description information in the first vulnerability entry is enhanced based on the extracted key elements to obtain a second vulnerability entry containing valid vulnerability information. This enhancement can be achieved through a large language model or other information fusion methods.

[0078] It should be noted that the above-mentioned preset description templates are usually set according to the description information format in the vulnerability entry, so that the key elements in the enhancement process are adapted to the original description information, thereby improving the enhancement effect of the description information.

[0079] In this embodiment, key elements are extracted from supplementary description information using a large language model. Based on a preset description template, the original description information in the first vulnerability entry is enhanced according to the extraction results to obtain the second vulnerability entry. This enhances the vulnerability entry and significantly improves its quality.

[0080] In some embodiments, determining the target repository corresponding to the second vulnerability entry in step S230 includes the following steps:

[0081] Step S231: Determine the set of repositories corresponding to the second vulnerability entry; the set of repositories includes the same open-source repository under different modified versions;

[0082] Step S232: Determine the difference between the submission time of each modified version and the release time of the second vulnerability entry;

[0083] Step S233: Take the modified version corresponding to the minimum difference as the target modified version;

[0084] Step S234: Determine the open-source repository under the target modified version as the target repository corresponding to the second vulnerability entry.

[0085] Specifically, the system searches for a set of repositories corresponding to each second vulnerability entry. This set includes the same open-source repository under different modified versions, with each modified version corresponding to the code commit record used to modify the repository. The repository search methods include extracting from relevant links of the vulnerability entry, querying using a large language model, or searching for relevant repositories of the vulnerability entry on the GitHub platform. Multiple sets of repositories can be found, each corresponding to a specific category of open-source repositories.

[0086] Furthermore, for each repository set, the commit time corresponding to each code commit record is obtained, the difference between each commit time and the release time of the second vulnerability entry is calculated, and the modified version corresponding to the smallest difference is taken as the target modified version. That is, the modified version closest to the release time of the second vulnerability entry is selected as the target modified version, and the open source repository under the target modified version is taken as the target repository corresponding to the second vulnerability entry.

[0087] This embodiment determines the set of repositories corresponding to the second vulnerability entry. The set of repositories includes the same open-source repository under different modified versions. It also determines the difference between the submission time of each modified version and the release time of the second vulnerability entry. The modified version corresponding to the smallest difference is taken as the target modified version. Then, the open-source repository under the target modified version is determined as the target repository corresponding to the second vulnerability entry. This accurately collects repositories related to the vulnerability entry and improves the accuracy of subsequent vulnerability file location.

[0088] In some embodiments, step S240, which involves matching the second vulnerability entry with each vulnerability file in the target repository and selecting the vulnerability file that matches the second vulnerability entry as the target vulnerability file, includes the following steps:

[0089] Step S241: Extract key components from the description information in the second vulnerability entry to obtain multiple corresponding vulnerability components;

[0090] Step S242: Match each vulnerable component with each vulnerable file in the target repository, and take the vulnerable file that matches the vulnerable component in the matching results as the first vulnerable file.

[0091] Step S243: Match the description information in the second vulnerability entry with the relevant information of each first vulnerability file, and take the first vulnerability file that matches the second vulnerability entry in the matching result as the target vulnerability file; the relevant information includes the file content and file path of the first vulnerability file.

[0092] Specifically, using large language models such as BERT and GPT, key components are extracted from the descriptive information in the second vulnerability entry, resulting in multiple vulnerability components, including file components, function components, and module components. Different module components typically correspond to the internal structure of the relevant repository; for example, each module component corresponds to a file directory within the repository.

[0093] Furthermore, each vulnerable component is matched against each vulnerable file in the target repository, and the vulnerable file that matches the vulnerable component in the matching results is taken as the first vulnerable file. In the file-based component matching process, the names of each file in the target repository are traversed, and files whose names are the component name or contain the component name are selected. Simultaneously, files whose file names have a similarity greater than a preset threshold with the component name are also selected, and these selected files are taken as the first vulnerable files. The name similarity can be calculated using standard Levenstein distance or other algorithms used to measure the similarity between strings. In the function-based component matching process, all code content in the target repository is traversed, and files containing function components are selected as the first vulnerable files. In the module-based component matching process, component matching is performed according to the internal structure of the relevant repository. For example, if each module component corresponds to a file directory within the repository, all file directories in the target repository are traversed, and directories whose directory names match the module components are selected, and all files contained in that directory are taken as the first vulnerable files.

[0094] It should be noted that if the number of first vulnerability files obtained based on each vulnerability component is too large, the first vulnerability files can be filtered again using a large language model to obtain a preset number of first vulnerability files, thereby reducing the number of candidate files and improving the filtering efficiency.

[0095] Next, the description information in the second vulnerability entry is matched with the relevant information of each first vulnerability file, wherein the relevant information includes at least the file content and file path of the first vulnerability file, and the first vulnerability file that matches the second vulnerability entry in the matching results is taken as the target vulnerability file.

[0096] In this embodiment, key components are extracted from the descriptive information of the second vulnerability entry to obtain multiple corresponding vulnerability components. Each vulnerability component is matched with each vulnerability file in the target repository, and the vulnerability file that matches the vulnerability component in the matching results is taken as the first vulnerability file. This achieves vulnerability file screening based on vulnerability components, reducing the number of candidate files and improving screening efficiency. Furthermore, the descriptive information in the second vulnerability entry is matched with the file content and file path of each first vulnerability file. The first vulnerability file that matches the second vulnerability entry in the matching results is taken as the target vulnerability file. Thus, based on the initial filtering of vulnerability files, the vulnerability file is located by combining the file content and file path of each vulnerability file, achieving accurate identification of files containing vulnerabilities.

[0097] In some embodiments, step S243, which involves matching the description information in the second vulnerability entry with the relevant information of each first vulnerability file, and selecting the first vulnerability file that matches the second vulnerability entry in the matching results as the target vulnerability file, includes the following steps:

[0098] The description information in the second vulnerability entry and the relevant information of each first vulnerability file are input into the large language model to obtain the confidence score corresponding to each first vulnerability file; the confidence score is used to indicate the degree of matching between the first vulnerability file and the second vulnerability entry;

[0099] The first vulnerability file with a confidence level greater than a preset threshold is selected as the target vulnerability file.

[0100] Specifically, the descriptive information from the second vulnerability entry and the relevant information from each first vulnerability file are input into a large language model. The relevant information includes at least the file content and file path of the first vulnerability file. The large language model analyzes and processes the data to obtain the confidence score for each first vulnerability file. The first vulnerability files are then sorted according to their confidence scores, and the sorting results are output. First vulnerability files with a confidence score greater than a preset threshold are designated as target vulnerability files. The confidence score indicates the degree of matching between the first vulnerability file and the second vulnerability entry, that is, the degree of matching between the descriptive information in the second vulnerability entry and the relevant information in the second vulnerability entry.

[0101] It should be noted that if a unique first vulnerability file is obtained based on the filtering of each vulnerability component, then that first vulnerability file will be used as the target vulnerability file.

[0102] In this embodiment, the description information in the second vulnerability entry and the relevant information of each first vulnerability file are input into the large language model to obtain the confidence level corresponding to each first vulnerability file. The confidence level is used to indicate the degree of matching between the first vulnerability file and the second vulnerability entry. The first vulnerability file with a confidence level greater than a preset threshold is used as the target vulnerability file. Thus, after screening and obtaining candidate first vulnerability files, the file containing the vulnerability is accurately identified by comparing and analyzing the relevant information of the first vulnerability files.

[0103] In some embodiments, after enhancing the original description information in the first vulnerability entry based on supplementary description information to obtain the second vulnerability entry, the vulnerability file location method further includes the following steps:

[0104] If the target repository corresponding to the second vulnerability entry is not obtained, the second vulnerability entry is input as context information into the large language model to obtain the target vulnerability file that matches the second vulnerability entry.

[0105] Specifically, if no target repository corresponding to the second vulnerability entry is found, the second vulnerability entry is input as context information into the large language model. After analysis and retrieval by the large language model, the target vulnerability file that matches the second vulnerability entry is output.

[0106] In addition, if the first vulnerability file is not found based on the filtering of each vulnerability component, the second vulnerability entry can be used as context information to input into the large language model for file retrieval, so as to ensure the stable acquisition of vulnerability file location results.

[0107] In this embodiment, when no vulnerability file matching the second vulnerability entry is obtained, the second vulnerability entry is input as context information into the large language model to obtain the target vulnerability file matching the second vulnerability entry. This ensures the completeness of the output vulnerability file location results and avoids situations where no vulnerability-related files can be matched.

[0108] Figure 3 This is a flowchart illustrating the vulnerability file location method of this embodiment, as shown below. Figure 3 As shown, the specific process of this vulnerability file location method includes the following steps:

[0109] All reference links appearing in each first vulnerability entry are retrieved. Based on preset filtering rules, multiple target reference links are selected from each reference link. Information is collected on the websites pointed to by each target reference link according to each first vulnerability entry to obtain corresponding supplementary description information S310. Next, the original description information in each first vulnerability entry is retrieved. Key elements are extracted from the supplementary description information using a large language model. Based on a preset description template, the original description information in the first vulnerability entry is enhanced according to the extraction results to obtain the second vulnerability entry S320.

[0110] Further, it is determined whether the target repository corresponding to the second vulnerability entry can be found (S330). If the target repository corresponding to the second vulnerability entry is not found, the second vulnerability entry is input as context information into the large language model for processing to obtain the target vulnerability file S340 that matches the second vulnerability entry. If the target repository corresponding to the second vulnerability entry is found, key components are extracted from the description information in the second vulnerability entry to obtain multiple corresponding vulnerability components (S350). Each vulnerability component is matched with each vulnerability file in the target repository, and the vulnerability file that matches the vulnerability component in the matching result is taken as the first vulnerability file (S360).

[0111] Next, it is determined whether a unique first vulnerable file S370 has been found through screening. If multiple first vulnerable files are found, the description information in the second vulnerability entry is matched with the relevant information of each first vulnerable file. The first vulnerable file that matches the second vulnerability entry in the matching results is taken as the target vulnerable file, thus achieving accurate identification of the vulnerable file S390. If a unique first vulnerable file is found, that first vulnerable file is taken as the target vulnerable file S380.

[0112] The present embodiment will now be described and illustrated through preferred embodiments.

[0113] Figure 4 This is a flowchart of the vulnerability file location method of this preferred embodiment, such as... Figure 4 As shown, the method for locating the vulnerable file includes the following steps:

[0114] Step S410: Obtain all reference links appearing in each first vulnerability entry;

[0115] Step S420: Select multiple target reference links from each reference link based on preset filtering rules;

[0116] Step S430: Based on each first vulnerability entry, collect information on the websites pointed to by each target reference link to obtain corresponding supplementary description information;

[0117] Step S440: Extract key elements from the supplementary descriptive information using a large language model;

[0118] Step S450: Based on the preset description template, the original description information in the first vulnerability entry is enhanced according to the extraction results to obtain the second vulnerability entry.

[0119] Step S460: Determine the target repository corresponding to the second vulnerability entry;

[0120] Step S470: Match the second vulnerability entry with each vulnerability file in the target repository, and take the vulnerability file that matches the second vulnerability entry in the matching results as the target vulnerability file.

[0121] This embodiment obtains all reference links appearing in each first vulnerability entry. Based on preset filtering rules, multiple target reference links are selected from these links. For each first vulnerability entry, information is collected about the websites pointed to by each target reference link to obtain corresponding supplementary description information. Key elements are extracted from the supplementary description information using a large language model. Based on a preset description template, the original description information in the first vulnerability entry is enhanced according to the extraction results to obtain a second vulnerability entry. This enhances the vulnerability entries and improves their quality.

[0122] Furthermore, the target repository corresponding to the second vulnerability entry is determined, and the second vulnerability entry is matched with each vulnerability file in the target repository. The vulnerability file that matches the second vulnerability entry in the matching results is taken as the target vulnerability file. This solves the problem of not being able to accurately identify vulnerability files based on low-quality vulnerability entries, improves the quality of vulnerability entries, and accurately identifies vulnerability files based on the valid vulnerability information in the vulnerability entries.

[0123] It should be noted that the steps shown in the above process or in the flowchart of the accompanying figures can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0124] This embodiment also provides a vulnerability file location device, which is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. The terms "module," "unit," "subunit," etc., used below refer to combinations of software and / or hardware that perform a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0125] Figure 5 This is a structural block diagram of the vulnerability file location device in this embodiment, as shown below. Figure 5 As shown, the device includes: an acquisition module 10, an enhancement module 20, a search module 30, and a matching module 40;

[0126] The acquisition module 10 is used to acquire supplementary description information corresponding to each first vulnerability entry; the supplementary description information includes key elements used to describe the vulnerability corresponding to the first vulnerability entry.

[0127] Enhancement module 20 is used to enhance the original description information in the first vulnerability entry based on supplementary description information to obtain the second vulnerability entry;

[0128] Search module 30 is used to determine the target repository corresponding to the second vulnerability entry;

[0129] The matching module 40 is used to match the second vulnerability entry with each vulnerability file in the target repository, and to take the vulnerability file that matches the second vulnerability entry in the matching results as the target vulnerability file.

[0130] The apparatus provided in this embodiment obtains supplementary description information corresponding to each first vulnerability entry; based on the supplementary description information, the original description information in the first vulnerability entry is enhanced to obtain a second vulnerability entry; the target repository corresponding to the second vulnerability entry is determined; further, the second vulnerability entry is matched with each vulnerability file in the target repository to determine the vulnerability file that matches the second vulnerability entry as the target vulnerability file. This solves the problem of not being able to accurately identify vulnerability files based on low-quality vulnerability entries, thereby improving the quality of vulnerability entries and accurately identifying vulnerability files based on the effective vulnerability information in the vulnerability entries.

[0131] In some embodiments, the acquisition module 10 is further configured to acquire all reference links appearing in each first vulnerability entry; select multiple target reference links from each reference link based on preset filtering rules; and collect information on the websites pointed to by each target reference link according to each first vulnerability entry to obtain corresponding supplementary description information.

[0132] In some embodiments, the enhancement module 20 is further configured to extract key elements from the supplementary description information using a large language model; and based on a preset description template, enhance the original description information in the first vulnerability entry according to the extraction results to obtain the second vulnerability entry.

[0133] In some embodiments, the search module 30 is further configured to determine the set of repositories corresponding to the second vulnerability entry; the set of repositories includes the same open-source repository under different modified versions; determine the difference between the commit time of each modified version and the release time of the second vulnerability entry; take the modified version corresponding to the smallest difference as the target modified version; and determine the open-source repository under the target modified version as the target repository corresponding to the second vulnerability entry.

[0134] In some embodiments, the matching module 40 is further configured to extract key components from the description information in the second vulnerability entry to obtain multiple corresponding vulnerability components; match each vulnerability component with each vulnerability file in the target repository, and take the vulnerability file that matches the vulnerability component in the matching result as the first vulnerability file; match the description information in the second vulnerability entry with the relevant information of each first vulnerability file, and take the first vulnerability file that matches the second vulnerability entry in the matching result as the target vulnerability file; the relevant information includes the file content and file path of the first vulnerability file.

[0135] In some embodiments, the matching module 40 is further configured to input the description information in the second vulnerability entry and the relevant information of each first vulnerability file into the large language model to obtain the confidence level corresponding to each first vulnerability file; the confidence level is used to indicate the degree of matching between the first vulnerability file and the second vulnerability entry; and the first vulnerability file with a confidence level greater than a preset threshold is used as the target vulnerability file.

[0136] In some embodiments, the matching module 40 is further configured to input the second vulnerability entry as context information into the large language model to obtain a target vulnerability file that matches the second vulnerability entry when no target repository corresponding to the second vulnerability entry is obtained.

[0137] It should be noted that the above modules can be functional modules or program modules, and can be implemented through software or hardware. For modules implemented through hardware, the above modules can reside in the same processor; or the above modules can be located in different processors in any combination.

[0138] This embodiment also provides a computer device, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above method embodiments.

[0139] Optionally, the computer device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor and the input / output device is connected to the processor.

[0140] Optionally, in this embodiment, the processor can be configured to perform the following steps via a computer program:

[0141] S1, Obtain supplementary description information corresponding to each first vulnerability entry; the supplementary description information contains key elements used to describe the vulnerability corresponding to the first vulnerability entry;

[0142] S2, based on the supplementary description information, the original description information in the first vulnerability entry is enhanced to obtain the second vulnerability entry;

[0143] S3, determine the target repository corresponding to the second vulnerability entry;

[0144] S4, match the second vulnerability entry with each vulnerability file in the target repository, and take the vulnerability file that matches the second vulnerability entry in the matching results as the target vulnerability file.

[0145] It should be noted that the specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementations, and will not be repeated in this embodiment.

[0146] Furthermore, in conjunction with the vulnerability file location method provided in the above embodiments, this embodiment can also provide a storage medium for implementation. This storage medium stores a computer program; when executed by a processor, the computer program implements any of the vulnerability file location methods in the above embodiments.

[0147] It should be understood that the specific embodiments described herein are merely illustrative of the application and not intended to limit it. All other embodiments derived by those skilled in the art based on the embodiments provided in this application without inventive effort are within the scope of protection of this application.

[0148] Obviously, the accompanying drawings are merely some examples or embodiments of this application. Those skilled in the art can apply this application to other similar situations based on these drawings without any creative effort. Furthermore, it is understood that although the work done in this development process may be complex and lengthy, for those skilled in the art, certain design, manufacturing, or production modifications made based on the technical content disclosed in this application are merely conventional technical means and should not be considered as insufficient disclosure of this application.

[0149] The term "embodiment" in this application refers to a specific feature, structure, or characteristic described in connection with an embodiment that may be included in at least one embodiment of this application. The appearance of this phrase in various places in the specification does not necessarily imply the same embodiment, nor does it imply that it is mutually exclusive with or independent of other embodiments. It will be clearly or implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments without conflict.

[0150] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of patent protection. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the appended claims.

Claims

1. A vulnerability file positioning method characterized by, The method comprises: obtaining supplementary description information corresponding to each first vulnerability entry; the supplementary description information contains key elements for describing the vulnerability corresponding to the first vulnerability entry; based on the supplementary description information, the original description information in the first vulnerability entry is enhanced to obtain a second vulnerability entry; determining the target repository corresponding to the second vulnerability entry; matching the second vulnerability entry with each vulnerability file in the target repository, and taking the vulnerability file matched with the second vulnerability entry in the matching result as the target vulnerability file, comprising: extracting the description information in the second vulnerability entry to obtain a plurality of vulnerability components corresponding thereto; matching each vulnerability component with each vulnerability file in the target repository, and taking the vulnerability file matched with the vulnerability component in the matching result as a first vulnerability file; matching the description information in the second vulnerability entry with the related information of each first vulnerability file, and taking the first vulnerability file matched with the second vulnerability entry in the matching result as the target vulnerability file; the related information includes the file content and file path of the first vulnerability file.

2. The vulnerability file positioning method of claim 1, wherein, The acquisition of the supplementary description information corresponding to each first vulnerability entry comprises: obtaining all reference links appearing in each first vulnerability entry; based on a preset filtering rule, select a plurality of target reference links from each reference link; According to each first vulnerability entry, collect information from each target reference link website to obtain corresponding supplementary description information.

3. The vulnerability file positioning method of claim 1, wherein, The second vulnerability entry is obtained by enhancing the original description information in the first vulnerability entry based on the supplementary description information, comprising: extracting key elements from the supplementary description information through a large language model; based on a preset description template, the original description information in the first vulnerability entry is enhanced according to the extraction result to obtain the second vulnerability entry.

4. The vulnerability file locating method of claim 1, wherein, The determination of the target repository corresponding to the second vulnerability entry comprises: determining a repository set corresponding to the second vulnerability entry; the repository set includes the same open source repository under different modified versions; determining the difference between the submission time of each modified version and the publication time of the second vulnerability entry; the modified version corresponding to the minimum difference is taken as the target modified version; determining the open source repository under the target modified version as the target repository corresponding to the second vulnerability entry.

5. The method of claim 1, wherein, The matching of the description information in the second vulnerability entry with the related information of each first vulnerability file, and taking the first vulnerability file matched with the second vulnerability entry in the matching result as the target vulnerability file, comprises: input the description information in the second vulnerability entry and the related information of each first vulnerability file into a large language model to obtain the confidence degree corresponding to each first vulnerability file; the confidence degree is used to indicate the matching degree between the first vulnerability file and the second vulnerability entry; The first vulnerability file with the confidence greater than the preset threshold is taken as the target vulnerability file.

6. The vulnerability file locating method of claim 1, wherein, After the original description information in the first vulnerability entry is enhanced based on the supplementary description information to obtain a second vulnerability entry, the method further includes: When the target repository corresponding to the second vulnerability entry is not acquired, the second vulnerability entry is input to a large language model as context information to obtain a target vulnerability file matched with the second vulnerability entry.

7. A vulnerability file locating apparatus characterized by comprising: The device includes an acquisition module, an enhancement module, a search module, and a matching module. The acquisition module is configured to acquire supplementary description information corresponding to each first vulnerability entry, wherein the supplementary description information contains key elements for describing a vulnerability corresponding to the first vulnerability entry. The enhancement module is configured to enhance original description information in the first vulnerability entry based on the supplementary description information to obtain a second vulnerability entry. The search module is configured to determine a target repository corresponding to the second vulnerability entry. The matching module is configured to match the second vulnerability entry with each vulnerability file in the target repository, and take the vulnerability file matched with the second vulnerability entry in the matching result as a target vulnerability file. The matching module is further configured to extract key components from the description information in the second vulnerability entry to obtain a plurality of vulnerability components, match each vulnerability component with each vulnerability file in the target repository, take the vulnerability file matched with the vulnerability component in the matching result as a first vulnerability file, and match the description information in the second vulnerability entry with related information of each first vulnerability file, take the first vulnerability file matched with the second vulnerability entry in the matching result as the target vulnerability file, wherein the related information includes file content and a file path of the first vulnerability file. 8.A computer device, comprising a memory and a processor, and characterized in that, The memory stores a computer program, and the processor is configured to run the computer program to execute the steps of the vulnerability file positioning method in any one of claims 1 to 6.

9. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the vulnerability file positioning method in any one of claims 1 to 6.

Images