Vulnerability early warning method, device and equipment based on low-code platform and storage medium

Abstract

The invention discloses a vulnerability early warning method and device based on a low-code platform, equipment and a storage medium, and the method comprises the steps: querying a target service weight corresponding to a target service based on a first mapping relation; querying a target environment weight corresponding to the access mode of the target service based on the second mapping relationship; querying a target utilization difficulty weight based on the third mapping relationship; querying a target influence range weight corresponding to the influence range of the target vulnerability based on a fourth mapping relationship; on the basis of the fifth mapping relation, the weight of the target vulnerability is inquired; transmitting each weight to a risk value calculation script, wherein the risk value calculation script is used for calculating a risk value of the target vulnerability based on the received weight information; and determining a risk level corresponding to the target vulnerability according to a risk value returned by the risk value calculation script, and sending vulnerability early warning information when the risk level reaches a preset early warning risk level. According to the invention, the accuracy of vulnerability assessment can be improved and vulnerability early warning can be carried out.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to a vulnerability warning method, device, equipment and storage medium based on a low-code platform. Background Art

[0002] In the current information security environment, new high-risk vulnerabilities continue to emerge, and corporate assets may be potentially threatened. For example, for recruitment platforms, some users may exploit the vulnerabilities of the recruitment platform to attack the recruitment platform, such as SQL injection, cross-site scripting attacks, etc., resulting in the theft or tampering of legitimate user information in the recruitment platform, or even causing the recruitment platform to crash.

[0003] When faced with these vulnerabilities, we often face the challenge of how to effectively assess the severity of the vulnerabilities and determine the priority of repair. At present, although the Common Vulnerability Scoring System (CVSS) or the National Information Security Vulnerability Sharing Platform (CNNVD) provide a widely accepted standard to assess the risk of vulnerabilities, these standards are still not comprehensive enough in assessing the severity of vulnerabilities, and the accuracy of assessing the severity of vulnerabilities is low. Summary of the invention

[0004] In view of this, an embodiment of the present application provides a vulnerability warning method, device, electronic device, computer-readable storage medium and computer program product based on a low-code platform to solve at least one of the above-mentioned technical problems.

[0005] An embodiment of the present application provides a vulnerability warning method based on a low-code platform, wherein the low-code platform stores multiple mapping relationships for each of multiple vulnerabilities, and the multiple mapping relationships include: a first mapping relationship between the business involved in the vulnerability and the business weight; a second mapping relationship between the business access method and the environment weight; a third mapping relationship between the vulnerability disclosure, the exploitation cost of the vulnerability, and the exploitation difficulty weight; a fourth mapping relationship between the impact scope of the vulnerability and the impact scope weight; and a fifth mapping relationship between the risk type of the vulnerability, the vulnerability type, the name of the vulnerability, and the weight of the vulnerability itself; the vulnerability warning method based on the low-code platform includes: after the low-code platform receives relevant information of the target vulnerability, based on the first mapping relationship corresponding to the target vulnerability, querying the target business weight corresponding to the target business; based on the second mapping relationship corresponding to the target vulnerability, querying the target business weight corresponding to the access method of the target business Based on the third mapping relationship corresponding to the target vulnerability, query the target exploitation difficulty weight corresponding to the disclosure of the target vulnerability and the exploitation cost of the target vulnerability; based on the fourth mapping relationship corresponding to the target vulnerability, query the target impact range weight corresponding to the impact range of the target vulnerability; based on the fifth mapping relationship corresponding to the target vulnerability, query the target vulnerability own weight corresponding to the risk type of the target vulnerability, the vulnerability type of the target vulnerability and the name of the target vulnerability; transmit the target business weight, target environment weight, target exploitation difficulty weight, target impact range weight and target vulnerability own weight to a preset risk value calculation script, which is used to calculate the risk value of the target vulnerability based on the received weight information; determine the risk level corresponding to the target vulnerability according to the risk value returned by the risk value calculation script, and issue a vulnerability warning information when the risk level reaches a predetermined warning risk level.

[0006] According to some embodiments of the present application, optionally, the risk value calculation script is used to calculate the risk value of the target vulnerability according to the following expression:

[0007] F 风险值 =F2×(F5×((F1×F4) 2 ×a+F1×F3×F4×b)+F5×c)

[0008] Among them, F 风险值 It represents the risk value of the target vulnerability, F1 represents the target business weight, F2 represents the target environment weight, F3 represents the target exploitation difficulty weight, F4 represents the target impact range weight, F5 represents the target vulnerability weight itself, a, b and c represent adjustment coefficients, and a, b and c are all greater than 0.

[0009] According to some embodiments of the present application, optionally, the first mapping relationship includes a first table between the business involved in the vulnerability, the business level and the business weight, the business level is used to characterize the level of the business, and different business levels correspond to different business weights; the vulnerability warning method based on the low-code platform also includes: displaying the interface of the low-code platform, the interface displays a first data selection button and multiple business level selection buttons; in response to the user selecting the first table through the first data selection button, selecting and popping up the first table for the user to view the first table; if the user clicks on the target business level selection button among the multiple business level selection buttons, then based on the target business level corresponding to the target business level selection button and the first table, the first business weight corresponding to the target business level is queried, and the target business weight is changed based on the first business weight.

[0010] According to some embodiments of the present application, optionally, the vulnerability warning information includes a repair deadline for the target vulnerability, and different warning risk levels correspond to different repair deadlines.

[0011] According to some embodiments of the present application, optionally, the disclosure of the vulnerability includes whether it is disclosed by the proof-of-concept POC, the exploitation cost of the vulnerability includes whether a customized attack tool needs to be used, and the third mapping relationship is provided with at least a first exploitation difficulty weight, a second exploitation difficulty weight, and a third exploitation difficulty weight; in the third mapping relationship, the first exploitation difficulty weight corresponds to being disclosed by the POC and not requiring the use of a customized attack tool; the second exploitation difficulty weight corresponds to not being disclosed by the POC and not requiring the use of a customized attack tool; the third exploitation difficulty weight corresponds to not being disclosed by the POC and requiring the use of a customized attack tool; wherein, the first exploitation difficulty weight>the second exploitation difficulty weight>the third exploitation difficulty weight.

[0012] According to some embodiments of the present application, optionally, the risk type of the vulnerability includes application risk and infrastructure risk, application risk characterizes the existence of potential threats in the application, and infrastructure risk characterizes the existence of potential threats in the system infrastructure; the vulnerability type includes at least one of input verification, identity authentication, business logic, configuration baseline and sensitive information leakage; the name of the vulnerability includes remote code execution vulnerability and non-remote code execution vulnerability.

[0013] According to some embodiments of the present application, optionally, the target business weight, target environment weight, target exploitation difficulty weight, target impact range weight and target vulnerability weight are transmitted to a preset risk value calculation script, including: filling in the target business weight, target environment weight, target exploitation difficulty weight, target impact range weight and target vulnerability weight into a form of the low-code platform, and transmitting the target business weight, target environment weight, target exploitation difficulty weight, target impact range weight and target vulnerability weight in the form to the risk value calculation script; after determining the risk level corresponding to the target vulnerability according to the risk value returned by the risk value calculation script, the vulnerability warning method based on the low-code platform also includes: filling in the risk value into a preset position in the form, checking the target risk level in the form, and filling in the repair period corresponding to the target risk level in the form.

[0014] The embodiment of the present application provides a vulnerability early warning device based on a low-code platform, wherein the low-code platform stores multiple mapping relationships for each of multiple vulnerabilities, wherein the multiple mapping relationships include: a first mapping relationship between the business involved in the vulnerability and the business weight; a second mapping relationship between the business access mode and the environment weight; a third mapping relationship between the vulnerability disclosure, the exploitation cost of the vulnerability and the exploitation difficulty weight; a fourth mapping relationship between the impact scope of the vulnerability and the impact scope weight; and a fifth mapping relationship between the risk type of the vulnerability, the vulnerability type, the name of the vulnerability and the weight of the vulnerability itself; the vulnerability early warning device based on the low-code platform includes:

[0015] A query module is used for querying the target business weight corresponding to the target business based on the first mapping relationship corresponding to the target vulnerability after the low-code platform receives relevant information about the target vulnerability; querying the target environment weight corresponding to the access method of the target business based on the second mapping relationship corresponding to the target vulnerability; querying the target exploitation difficulty weight corresponding to the disclosure of the target vulnerability and the exploitation cost of the target vulnerability based on the third mapping relationship corresponding to the target vulnerability; querying the target impact scope weight corresponding to the impact scope of the target vulnerability based on the fourth mapping relationship corresponding to the target vulnerability; querying the target vulnerability's own weight corresponding to the risk type of the target vulnerability, the vulnerability type of the target vulnerability and the name of the target vulnerability based on the fifth mapping relationship corresponding to the target vulnerability;

[0016] A transmission module is used to transmit the target business weight, target environment weight, target exploitation difficulty weight, target impact range weight and target vulnerability weight to a preset risk value calculation script, and the risk value calculation script is used to calculate the risk value of the target vulnerability based on the received weight information;

[0017] The early warning module is used to determine the risk level corresponding to the target vulnerability according to the risk value returned by the risk value calculation script, and issue a vulnerability early warning message when the risk level reaches a predetermined early warning risk level.

[0018] An embodiment of the present application provides an electronic device, which includes a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, the steps of the vulnerability warning method based on the low-code platform as described above are implemented.

[0019] An embodiment of the present application provides a computer-readable storage medium having computer program instructions stored thereon. When the computer program instructions are executed by a processor, the steps of the vulnerability warning method based on a low-code platform as described above are implemented.

[0020] An embodiment of the present application provides a computer program product, which includes computer program instructions. When the computer program instructions are executed by a processor, the steps of the vulnerability warning method based on the low-code platform as described above are implemented.

[0021] Using the vulnerability early warning method, device, electronic device, computer-readable storage medium and computer program product based on the low-code platform provided by the embodiment of the present application, the low-code platform stores multiple mapping relationships of each vulnerability. Based on the relevant information of the target vulnerability and multiple mapping relationships, the target business weight, target environment weight, target utilization difficulty weight, target impact range weight and target vulnerability weight of the target vulnerability can be obtained. The risk value calculation script calculates the above multiple weights to obtain the risk value of the target vulnerability. Based on the risk value, the risk level corresponding to the target vulnerability can be determined. In this way, the present application fully considers the impact of multiple factors such as the specific environment within the enterprise, the importance of assets, business access methods, the difficulty of exploiting vulnerabilities, the business processes that may be affected, and the risk of the vulnerability itself on the severity of the vulnerability, and can more comprehensively evaluate the severity of the vulnerability and improve the accuracy of evaluating the severity of the vulnerability. When the risk level reaches the predetermined early warning risk level, a vulnerability early warning message is issued, which can better remind the operator to repair the target vulnerability. By establishing a unified vulnerability assessment standard, it will be possible to better identify and classify vulnerabilities, determine repair priorities, and minimize potential security risks to protect the security and integrity of enterprise assets. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following briefly introduces the drawings in the embodiments of the present application.

[0023] Figure 1 A flow chart of a vulnerability warning method based on a low-code platform provided in an embodiment of the present application.

[0024] Figure 2 A schematic diagram of the form interface of the low-code platform.

[0025] Figure 3 A block diagram of a vulnerability warning device based on a low-code platform provided in an embodiment of the present application.

[0026] Figure 4 A schematic diagram of the hardware structure of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0027] The principles and spirit of the present application will be described below with reference to several exemplary embodiments. It should be understood that the purpose of providing these embodiments is to make the principles and spirit of the present application clearer and more thorough, so that those skilled in the art can better understand and implement the principles and spirit of the present application. The exemplary embodiments provided herein are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments herein, all other embodiments obtained by ordinary technicians of the art without creative work are within the scope of protection of this application.

[0028] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0029] It should be understood that the term "and / or" used in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0030] It is obvious to those skilled in the art that various modifications and changes can be made in the present application without departing from the spirit or scope of the present application. Therefore, the present application is intended to cover modifications and changes of the present application that fall within the scope of the corresponding claims (technical solutions for protection) and their equivalents. It should be noted that the implementation methods provided in the embodiments of the present application can be combined with each other without contradiction.

[0031] Before describing the technical solutions provided by the embodiments of the present application, in order to facilitate the understanding of the embodiments of the present application, the present application first specifically describes the problems existing in the related art:

[0032] In the current information security environment, new high-risk vulnerabilities continue to emerge, and corporate assets may be potentially threatened. For example, for recruitment platforms, some users may exploit the vulnerabilities of the recruitment platform to attack the recruitment platform, such as SQL injection, cross-site scripting attacks, etc., resulting in the theft or tampering of legitimate user information in the recruitment platform, or even causing the recruitment platform to crash.

[0033] When faced with these vulnerabilities, we often face the challenge of how to effectively assess the severity of the vulnerabilities and determine the priority of repair. At present, although the Common Vulnerability Scoring System (CVSS) or the National Information Security Vulnerability Sharing Platform (CNNVD) provide a widely accepted standard to assess the risk of vulnerabilities, these standards are still not comprehensive enough in assessing the severity of vulnerabilities, and the accuracy of assessing the severity of vulnerabilities is low.

[0034] The inventor of this application has found that the severity of a vulnerability also needs to be assessed based on the technical details and potential risks of the vulnerability. When deciding whether to fix a vulnerability, the enterprise also needs to consider many other factors. For example, the specific environment within the enterprise, the importance of assets, business access methods, the difficulty of exploiting the vulnerability, the business processes that may be affected, the risks of the vulnerability itself, and many other factors may affect the actual impact of the vulnerability on the enterprise.

[0035] In view of the above research findings of the inventors, the embodiments of the present application provide a vulnerability warning method, device, electronic device, computer-readable storage medium and computer program product based on a low-code platform, which can solve at least one of the above technical problems existing in the related technology.

[0036] The following first introduces the vulnerability warning method based on the low-code platform provided in the embodiment of the present application.

[0037] A low-code platform is a software development tool that uses a graphical user interface and pre-built modules to help users quickly build applications and business processes while reducing manual coding. In the embodiment of the present application, users can use the low-code platform to perform related operations for vulnerability assessment, such as inputting relevant information about the vulnerability, selecting or modifying the business level, impact range, and difficulty of exploitation of the vulnerability, which can facilitate user operation, be convenient and concise, and improve user experience.

[0038] In an embodiment of the present application, the low-code platform can store multiple mapping relationships for each of the multiple vulnerabilities, that is, multiple mapping relationships for various vulnerabilities. The multiple mapping relationships may include: a first mapping relationship between the business involved in the vulnerability and the business weight; a second mapping relationship between the business access method and the environment weight; a third mapping relationship between the vulnerability disclosure, the exploitation cost of the vulnerability, and the exploitation difficulty weight; a fourth mapping relationship between the impact scope of the vulnerability and the impact scope weight; and a fifth mapping relationship between the risk type of the vulnerability, the vulnerability type, the name of the vulnerability, and the vulnerability's own weight.

[0039] In the first mapping relationship, different vulnerabilities may involve different levels of business. For example, in some examples, according to the actual situation, it can be divided into business involving core assets of the enterprise, business involving ordinary assets of the enterprise, and business involving non-enterprise assets, etc., and this application does not limit this. Depending on the importance of the business, different levels of business can correspond to different business weights. The business involved in the vulnerability can be understood as the business where the vulnerability is located or the business affected by the vulnerability.

[0040] The business access method can be understood as the method of accessing the business involved in the vulnerability. In the second mapping relationship, there can be multiple ways of accessing the business involved in the vulnerability, such as Internet access, enterprise internal office network access, data center internal access only, and local access only. Accordingly, different business access methods can correspond to different environmental weights.

[0041] Different vulnerabilities have different disclosure situations, such as some vulnerabilities are disclosed by proof of concept (POC) or other means, while other vulnerabilities are not disclosed by proof of concept (POC) or other means. Once a vulnerability is disclosed, it is easier to exploit, that is, the difficulty of exploitation is low. On the contrary, if the vulnerability is not disclosed, it is more difficult to exploit, that is, the difficulty of exploitation is high. The cost of exploiting the vulnerability, that is, some vulnerabilities may require customized attack tools to attack, so the difficulty of exploitation is high; while other vulnerabilities may not require customized attack tools to attack, so the difficulty of exploitation is low. In the third mapping relationship, different vulnerability disclosure situations and / or different vulnerability exploitation costs can correspond to different exploitation difficulty weights.

[0042] In the fourth mapping relationship, the impact scopes of different vulnerabilities may be different, and multiple different impact scopes may be defined according to actual conditions. Different impact scopes may correspond to different impact scope weights.

[0043] Different vulnerabilities may have different risk types. For example, the risk types of vulnerabilities include application risk and infrastructure risk. Application risk represents potential threats in applications, and infrastructure risk represents potential threats in system infrastructure. Different vulnerabilities may also have different vulnerability types, such as input validation, identity authentication, business logic, configuration baseline, and / or sensitive information leakage. Similarly, different vulnerabilities may have different names, such as remote code execution vulnerabilities and non-remote code execution vulnerabilities.

[0044] In the fifth mapping relationship, different vulnerability risk types, different vulnerability types and / or vulnerability names may correspond to different vulnerability weights.

[0045] Figure 1 A flowchart of a vulnerability warning method based on a low-code platform provided in an embodiment of the present application. Figure 1 As shown, the vulnerability warning method based on the low-code platform provided in the embodiment of the present application may include the following steps S101 to S107.

[0046] S101: After receiving relevant information of the target vulnerability, the low-code platform queries the target business weight corresponding to the target business based on the first mapping relationship corresponding to the target vulnerability.

[0047] The relevant information of the target vulnerability may include the business involved in the target vulnerability. For the sake of convenience, the business involved in the target vulnerability is referred to as the target business. In S101, based on the first mapping relationship corresponding to the target vulnerability, the target business weight corresponding to the target business may be queried.

[0048] The weights of each business in the first mapping relationship can be flexibly adjusted according to actual conditions, and this application does not limit this. For example, in some examples, when the target business is a business involving the core assets of the enterprise, the target business weight can be 2. When the target business is a business involving ordinary assets of the enterprise, the target business weight can be 1.5. When the target business is a business involving non-enterprise assets, the target business weight can be 0.5. The above values ​​2, 1.5 and 0.5 are only examples and do not constitute limitations on this application.

[0049] S102: Based on the second mapping relationship corresponding to the target vulnerability, query the target environment weight corresponding to the access mode of the target business.

[0050] The relevant information of the target vulnerability may also include the access mode of the target business, such as Internet access, internal office network access, data center internal access only, or local access only, etc. In S102, based on the second mapping relationship corresponding to the target vulnerability, the target environment weight corresponding to the access mode of the target business may be queried.

[0051] S103: Based on the third mapping relationship corresponding to the target vulnerability, a target exploitation difficulty weight corresponding to the disclosure status of the target vulnerability and the exploitation cost of the target vulnerability is queried.

[0052] The relevant information of the target vulnerability may also include the disclosure of the target vulnerability and the cost of exploiting the target vulnerability, such as whether the target vulnerability is disclosed by POC and whether the target vulnerability uses a customized attack tool. In S103, based on the third mapping relationship corresponding to the target vulnerability, the target exploitation difficulty weight corresponding to the disclosure of the target vulnerability and the cost of exploiting the target vulnerability may be queried.

[0053] S104: Based on the fourth mapping relationship corresponding to the target vulnerability, query the target impact range weight corresponding to the impact range of the target vulnerability.

[0054] The relevant information of the target vulnerability may also include the impact range of the target vulnerability. In S104, based on the fourth mapping relationship corresponding to the target vulnerability, a target impact range weight corresponding to the impact range of the target vulnerability may be queried.

[0055] S105: Based on the fifth mapping relationship corresponding to the target vulnerability, query the target vulnerability's own weight corresponding to the risk type of the target vulnerability, the vulnerability type of the target vulnerability, and the name of the target vulnerability.

[0056] The relevant information of the target vulnerability may also include the risk type of the target vulnerability, the vulnerability type of the target vulnerability and the name of the target vulnerability. In S105, based on the fifth mapping relationship corresponding to the target vulnerability, the target vulnerability weight corresponding to the risk type of the target vulnerability, the vulnerability type of the target vulnerability and the name of the target vulnerability may be queried.

[0057] S106: The target business weight, target environment weight, target exploitation difficulty weight, target impact range weight and target vulnerability weight are transmitted to a preset risk value calculation script. The risk value calculation script can be used to calculate the risk value of the target vulnerability based on the received weight information.

[0058] After obtaining the target business weight, target environment weight, target utilization difficulty weight, target impact range weight and target vulnerability weight, the target business weight, target environment weight, target utilization difficulty weight, target impact range weight and target vulnerability weight can be transmitted to the risk value calculation script in the background. Among them, the risk value calculation script includes but is not limited to Python script. The risk value calculation script can be used to calculate the risk value of the target vulnerability based on the target business weight, target environment weight, target utilization difficulty weight, target impact range weight and target vulnerability weight.

[0059] S107: Determine the risk level corresponding to the target vulnerability according to the risk value returned by the risk value calculation script, and issue vulnerability warning information when the risk level reaches a predetermined warning risk level.

[0060] In some embodiments, a sixth mapping relationship between risk levels and risk value ranges may be pre-established. In the sixth mapping relationship, multiple different risk levels may be set, and different risk levels may correspond to different risk value ranges.

[0061] After obtaining the risk value of the target vulnerability returned by the risk value calculation script, the target risk value range into which the risk value of the target vulnerability falls can be queried based on the sixth mapping relationship, and the risk level corresponding to the target risk value range is used as the risk level corresponding to the target vulnerability.

[0062] The warning risk level can be n risk levels among multiple risk levels, where n is a positive integer. For example, if the multiple risk levels in the sixth mapping relationship include serious, high risk, medium risk, low risk, and no risk, the warning risk level can be serious, high risk, and medium risk. The warning risk level can be flexibly adjusted according to actual conditions, and this application does not limit this.

[0063] When the risk level corresponding to the target vulnerability reaches a predetermined warning risk level, such as when the risk level corresponding to the target vulnerability reaches a serious, high risk or medium risk level, a vulnerability warning message may be issued to remind the operator to handle the target vulnerability, such as repairing the target vulnerability in a timely manner.

[0064] The vulnerability early warning method based on the low-code platform provided in the embodiment of the present application, the low-code platform stores multiple mapping relationships of each vulnerability, based on the relevant information of the target vulnerability and multiple mapping relationships, the target business weight, target environment weight, target utilization difficulty weight, target impact range weight and target vulnerability weight of the target vulnerability can be obtained, and the risk value calculation script calculates the above multiple weights to obtain the risk value of the target vulnerability, and the risk level corresponding to the target vulnerability can be determined based on the risk value. In this way, the present application fully considers the impact of various factors such as the specific environment within the enterprise, the importance of assets, business access methods, the difficulty of exploiting vulnerabilities, the business processes that may be affected, and the risks of the vulnerabilities themselves on the severity of the vulnerabilities, and can more comprehensively evaluate the severity of the vulnerabilities and improve the accuracy of evaluating the severity of the vulnerabilities. When the risk level reaches the predetermined warning risk level, a vulnerability early warning message is issued, which can better remind the operator to repair the target vulnerability. By establishing a unified vulnerability assessment standard, it will be possible to better identify and classify vulnerabilities, determine repair priorities, and minimize potential security risks to protect the security and integrity of enterprise assets.

[0065] According to some embodiments of the present application, optionally, the risk value calculation script can be used to calculate the risk value of the target vulnerability according to the following expression:

[0066] F 风险值 =F2×(F5×((F1×F4) 2 ×a+F1×F3×F4×b)+F5×c) (1)

[0067] Among them, F 风险值 It represents the risk value of the target vulnerability, F1 represents the target business weight, F2 represents the target environment weight, F3 represents the target exploitation difficulty weight, F4 represents the target impact range weight, F5 represents the target vulnerability weight itself, a, b and c represent adjustment coefficients, and a, b and c are all greater than 0.

[0068] The values ​​of a, b and c can be adjusted flexibly according to actual conditions, and this application does not limit this. For example, in some examples, a=0.06, b=0.12, and c=1.5.

[0069] The inventors of this application have found through research that the specific environment within the enterprise, business access methods and the risk of the vulnerability itself have a greater impact on the severity of the vulnerability. Therefore, in the above expression (1), setting the target environment weight and the target vulnerability weight itself has a greater impact on the risk value of the target vulnerability, which can further improve the accuracy of assessing the severity of the vulnerability.

[0070] According to some embodiments of the present application, optionally, through the human-computer interaction interface of the low-code platform, the user can select or modify the business level, impact scope, difficulty of exploitation, etc. of the vulnerability, and then select or modify the corresponding weight.

[0071] Specifically, in some embodiments, the first mapping relationship may include a first table between the business involved in the vulnerability, the business level and the business weight. The business level is used to characterize the level of the business, and different business levels correspond to different business weights. For example, see Table 1.

[0072] Table 1

[0073]

[0074] Table 1 schematically shows a first table between the businesses involved in the vulnerability, business levels and business weights. As shown in Table 1, in some examples, four business levels, namely core, general, other and outsourced cooperation, are set in the first table according to the importance of the business, and the four business levels correspond to different business weights. For example, the business weight corresponding to the core business level is 2, the business weight corresponding to the general business level is 1.5, the business weight corresponding to other business levels is 1, and the business weight corresponding to the outsourced cooperation business level is 0.5. The size of each business weight can be flexibly adjusted according to actual conditions, and this application does not limit this.

[0075] Accordingly, the vulnerability warning method based on the low-code platform can also include the following steps one to three.

[0076] Step 1: Display the interface of the low-code platform, which displays a first data selection button and multiple business level selection buttons.

[0077] Figure 2 This is a schematic diagram of the form interface of the low-code platform. Figure 2 As shown, the interface of the low-code platform can display a first data selection button 21 and multiple business level selection buttons 22, such as four business level selection buttons: core, general, other, and outsourcing cooperation.

[0078] Step 2: In response to the user selecting the first table through the first data selection button, the first table is selected and popped up for the user to view.

[0079] In response to the user selecting the first table through the first data selection button, the first table between the business, business level and business weight involved in the vulnerability can be selected and popped up, so that the user can view the mapping relationship between the business, business level and business weight involved in the vulnerability, so as to facilitate the user to select the appropriate business level selection button.

[0080] Step three: If a user clicks on a target business level selection button among multiple business level selection buttons, the first business weight corresponding to the target business level corresponding to the target business level selection button and the first table are queried, and the target business weight is changed based on the first business weight.

[0081] After the user selects the target service level, the first service weight corresponding to the target service level can be queried based on the first table. If the first service weight is consistent with the target service weight obtained in S101, no modification is made. If the first service weight is inconsistent with the target service weight obtained in S101, the target service weight is changed to the first service weight.

[0082] In some embodiments, the second mapping relationship may include a second table between exposure levels, service access modes, and environmental weights, wherein different exposure levels correspond to different environmental weights. For example, see Table 2.

[0083] Table 2

[0084]

[0085] Table 2 schematically shows a second table between exposure level, service access mode and environmental weight. As shown in Table 2, the exposure level can also be referred to as the exposure surface. In some examples, corresponding to different service access modes, for example, four exposure levels such as Internet exposure, office network environment exposure, data center exposure and local only can be set, and the four exposure levels correspond to different environmental weights. The size of each environmental weight can be flexibly adjusted according to the actual situation, and this application does not limit this.

[0086] Accordingly, the vulnerability warning method based on the low-code platform can also include the following steps four to five.

[0087] Step 4: In response to the user selecting the second table through the second data selection button, the second table is selected and popped up for the user to view.

[0088] like Figure 2 As shown, the interface of the low-code platform may display a second data selection button 23 and an exposure level input box 24. In response to the user selecting the second table through the second data selection button 23, the second table displaying the exposure level, business access method and environmental weight may be selected and popped up for the user to view the mapping relationship between the exposure level, business access method and environmental weight, so that the user can enter a suitable target exposure level in the exposure level input box 24.

[0089] Step 5: If the target exposure level input by the user in the exposure level input box is received, the first environmental weight corresponding to the target exposure level is queried based on the second table, and the target environmental weight is changed based on the first environmental weight.

[0090] After the user inputs the target exposure level, the first environment weight corresponding to the target exposure level can be queried based on the second table. If the first environment weight is consistent with the target environment weight obtained in S102, no modification is made. If the first environment weight is inconsistent with the target environment weight obtained in S102, the target environment weight is changed to the first environment weight.

[0091] According to some embodiments of the present application, optionally, the disclosure status of the vulnerability may include whether it is disclosed by a proof-of-concept POC, the exploitation cost of the vulnerability may include whether a customized attack tool is required, and the third mapping relationship is provided with at least a first exploitation difficulty weight, a second exploitation difficulty weight, and a third exploitation difficulty weight.

[0092] In the third mapping relationship, the first utilization difficulty weight corresponds to being disclosed by POC and does not require the use of customized attack tools; the second utilization difficulty weight corresponds to not being disclosed by POC and does not require the use of customized attack tools; the third utilization difficulty weight corresponds to not being disclosed by POC and requires the use of customized attack tools.

[0093] Once a vulnerability is disclosed by POC, it is easier to exploit, that is, the difficulty of exploitation is low. On the contrary, if the vulnerability is not disclosed by POC, it is difficult to exploit, that is, the difficulty of exploitation is high. If the vulnerability requires the use of customized attack tools to attack, the difficulty of exploitation is high. If the vulnerability does not require the use of customized attack tools to attack, the difficulty of exploitation is low.

[0094] Therefore, the first utilization difficulty weight>the second utilization difficulty weight>the third utilization difficulty weight.

[0095] In some specific embodiments, the third mapping relationship may include a third table between the exploit difficulty level, vulnerability disclosure, exploit cost of the vulnerability and exploit difficulty weight. Among them, different vulnerability disclosures and / or different exploit costs of the vulnerability correspond to different exploit difficulty levels, and different exploit difficulty levels correspond to different exploit difficulty weights. For example, please refer to Table 3.

[0096] Table 3

[0097]

[0098]

[0099] Table 3 schematically shows a third table between the difficulty level of exploitation, vulnerability disclosure, exploitation cost of the vulnerability and the exploitation difficulty weight. As shown in Table 3, in some examples, corresponding to different vulnerability disclosures and / or different exploitation costs of the vulnerability, for example, five difficulty levels of exploitation, such as very low, low, medium, high and very high, can be set, and the five difficulty levels of exploitation correspond to different difficulty weights of exploitation. The size of each difficulty weight can be flexibly adjusted according to the actual situation, and this application does not limit this.

[0100] Accordingly, the vulnerability warning method based on the low-code platform may also include steps six to seven below.

[0101] Step 6: In response to the user selecting the third table through the third data selection button, the third table is selected and popped up for the user to view.

[0102] In response to the user selecting the third table through the third data selection button, the third table between the exploit difficulty level, vulnerability disclosure, vulnerability exploitation cost and exploit difficulty weight can be selected and popped up for the user to view the mapping relationship between the exploit difficulty level, vulnerability disclosure, vulnerability exploitation cost and exploit difficulty weight, so as to facilitate the user to select the appropriate exploit difficulty level selection button.

[0103] Step 7: If a user clicks on a target utilization difficulty level selection button among multiple utilization difficulty level selection buttons, a first utilization difficulty weight corresponding to the target utilization difficulty level is queried based on the target utilization difficulty level corresponding to the target utilization difficulty level selection button and the third table, and the target utilization difficulty weight is changed based on the first utilization difficulty weight.

[0104] After the user selects the target utilization difficulty level, the first utilization difficulty weight corresponding to the target utilization difficulty level can be queried based on the third table. If the first utilization difficulty weight is consistent with the target utilization difficulty weight obtained in S103, no modification is made. If the first utilization difficulty weight is inconsistent with the target utilization difficulty weight obtained in S103, the target utilization difficulty weight is changed to the first utilization difficulty weight.

[0105] According to some embodiments of the present application, optionally, the impact scope of the vulnerability may include the affected object, impact degree, affected scope and recovery cost of the vulnerability.

[0106] In some specific embodiments, the fourth mapping relationship may include a fourth table between the impact scope of the vulnerability, the impact scope level, and the impact scope weight. Among them, the impact scope of different vulnerabilities corresponds to different impact scope levels, and different impact scope levels correspond to different impact scope weights. For example, please refer to Table 4.

[0107] Table 4

[0108]

[0109]

[0110] Table 4 schematically shows a fourth table between the impact scope of the vulnerability, the impact scope level and the impact scope weight. As shown in Table 4, in some examples, corresponding to the impact scope of different vulnerabilities, for example, five impact scope levels such as severe, high, medium, low and none can be set, and the five impact scope levels correspond to different impact scope weights. The size of each impact scope weight can be flexibly adjusted according to actual conditions, and this application does not limit this.

[0111] Accordingly, the vulnerability warning method based on the low-code platform may also include steps eight to nine below.

[0112] Step 8: In response to the user selecting the fourth table through the fourth data selection button, the fourth table is selected and popped up for the user to view.

[0113] In response to the user selecting the fourth table through the fourth data selection button, the fourth table between the impact scope of the vulnerability, the impact scope level and the impact scope weight can be selected and popped up, so that the user can view the mapping relationship between the impact scope of the vulnerability, the impact scope level and the impact scope weight, so that the user can select the appropriate impact scope level selection button.

[0114] Step nine: If a user clicks on a target influence range level selection button among multiple influence range level selection buttons, the first influence range weight corresponding to the target influence range level corresponding to the target influence range level selection button and the fourth table is queried, and the target influence range weight is changed based on the first influence range weight.

[0115] After the user selects the target influence range level, the first influence range weight corresponding to the target influence range level can be queried based on the fourth table. If the first influence range weight is consistent with the target influence range weight obtained in S104, no modification is made. If the first influence range weight is inconsistent with the target influence range weight obtained in S104, the target influence range weight is changed to the first influence range weight.

[0116] According to some embodiments of the present application, optionally, the risk type of a vulnerability may include application risk and infrastructure risk, where application risk characterizes potential threats in the application, and infrastructure risk characterizes potential threats in the system infrastructure. Vulnerability types may include at least one of input validation, identity authentication, business logic, configuration baseline, and sensitive information leakage. The names of vulnerabilities may include remote code execution vulnerabilities and non-remote code execution vulnerabilities. Remote code execution vulnerabilities and non-remote code execution vulnerabilities can be further subdivided into code injection, remote file inclusion, arbitrary command execution, and local file inclusion.

[0117] In some specific embodiments, the fifth mapping relationship may include a fifth table between the risk type of the vulnerability, the vulnerability type, the name of the vulnerability and the vulnerability weight. Different risk types of vulnerabilities, different vulnerability types and / or names of vulnerabilities may correspond to different vulnerability weights. For example, see Table 5.

[0118] Table 5

[0119]

[0120]

[0121]

[0122] Table 5 schematically shows a fifth table between the risk type of vulnerability, vulnerability type, vulnerability name and vulnerability weight. As shown in Table 5, in some examples, different vulnerability risk types, different vulnerability types and / or vulnerability names may correspond to different vulnerability weights, for example, different vulnerability weights may be set. The size of each vulnerability weight can be flexibly adjusted according to actual conditions, and this application does not limit this.

[0123] Accordingly, the interface of the low-code platform can display buttons or input boxes with the risk type, vulnerability type, and vulnerability name of the vulnerability. Through the buttons or input boxes with the risk type, vulnerability type, and vulnerability name of the vulnerability, the user can modify the weight of the target vulnerability itself. The specific process is similar to the modification method of the target impact range weight mentioned above, and will not be repeated here.

[0124] According to some embodiments of the present application, the vulnerability warning information may optionally include a repair deadline for the target vulnerability, and different warning risk levels correspond to different repair deadlines.

[0125] In some embodiments, a sixth mapping relationship between risk level, repair time limit and risk value range can be pre-established, such as a sixth table between risk level, repair time limit and risk value range. In the sixth mapping relationship, multiple different risk levels can be set, different risk levels can correspond to different risk value ranges, and different risk levels can correspond to different repair time limits. For example, see Table 6.

[0126] Table 6

[0127]

[0128] Table 6 schematically shows a sixth table between risk levels, repair deadlines and risk value ranges. As shown in Table 6, in some examples, corresponding to different risk value ranges, five risk levels such as severe, high risk, medium risk, low risk and non-vulnerability can be set, and the five risk levels can correspond to different repair deadlines. For example, when the risk level is severe, the repair deadline is 1 day, and developers are required to quickly repair the vulnerability. The size of each repair deadline can be flexibly adjusted according to actual conditions, and this application does not limit this.

[0129] In this way, identifying and classifying different vulnerabilities and determining repair priorities can greatly reduce potential security risks and protect the security and integrity of corporate assets.

[0130] According to some embodiments of the present application, optionally, S106: transmitting the target business weight, the target environment weight, the target utilization difficulty weight, the target impact range weight, and the target vulnerability weight to a preset risk value calculation script may include the following steps:

[0131] Fill in the target business weight, target environment weight, target exploitation difficulty weight, target impact range weight and target vulnerability weight into the form of the low-code platform, and transfer the target business weight, target environment weight, target exploitation difficulty weight, target impact range weight and target vulnerability weight in the form to the risk value calculation script.

[0132] Accordingly, in S107: after determining the risk level corresponding to the target vulnerability according to the risk value returned by the risk value calculation script, the vulnerability warning method based on the low-code platform may further include the following steps:

[0133] Fill in the risk value into the preset position in the form, check the target risk level in the form, and fill in the repair period corresponding to the target risk level in the form.

[0134] like Figure 2As shown in the figure, in the form of the low-code platform, the risk value of the target vulnerability, the target risk level of the target vulnerability and the repair period corresponding to the target risk level can be displayed. In this way, it is convenient for developers to deal with different vulnerabilities in different time periods and reduce the risk of vulnerabilities with higher risk values ​​not being repaired in time.

[0135] The vulnerability warning method based on the low-code platform of the embodiment of the present application is verified below in combination with a variety of different types of vulnerabilities.

[0136] Vulnerability 1: The core business that provides external services has an Apache Log4j remote code execution vulnerability (CVE-2021-44228, CVE-2021-45046).

[0137] The values ​​of each vulnerability assessment factor in the form of the low-code platform:

[0138] Business weight: 2, Vulnerability weight: 10, Environmental weight: 2, Impact level: High, Exploitation difficulty level: Very low.

[0139] The detection result obtained by the vulnerability warning method based on the low-code platform is a risk value of 202.8, the risk level is serious, and the repair period is 1 day, which is in line with expectations.

[0140] Vulnerability 2: Apache Log4j remote code execution vulnerability (CVE-2021-44228, CVE-2021-45046) exists in the ES application used only in the intranet. Application path (example): / usr / share / elasticsearch / lib / log4j-core-2.11.1.jar.

[0141] The values ​​of each vulnerability assessment factor in the form of the low-code platform:

[0142] Business weight: 2, vulnerability weight: 10, environment weight: 1 (combined with the actual scenario, only the data center can access it, and the office network cannot access the online ES), impact scope level: high, exploit difficulty level: extremely low.

[0143] The detection result obtained by the vulnerability warning method based on the low-code platform is a risk value of 101.4, the risk level is medium, and the repair period is 7 days, which is in line with expectations.

[0144] Vulnerability 3: The payload of a stored XSS vulnerability in the core business is stored in public resources or shared data and can be triggered by multiple users.

[0145] The values ​​of each vulnerability assessment factor in the form of the low-code platform:

[0146] Business weight: 2, Vulnerability weight: 5, Environmental weight: 2, Impact level: High, Exploitation difficulty level: Very low.

[0147] The detection result obtained by the vulnerability warning method based on the low-code platform is a risk value of 101.4, the risk level is medium, and the repair period is 7 days, which is in line with expectations.

[0148] Vulnerability 4: The payload of a stored XSS vulnerability in the core business is only effective when triggered by the attacker himself and cannot be accessed or executed by other users.

[0149] The values ​​of each vulnerability assessment factor in the form of the low-code platform:

[0150] Business weight: 2, Vulnerability weight: 5, Environmental weight: 2, Impact level: low, Exploitation difficulty level: very low.

[0151] The detection result obtained by the vulnerability warning method based on the low-code platform is a risk value of 48.6, the risk level is low, and the repair period is 14 days, which is in line with expectations.

[0152] Vulnerability 5: ES unauthorized access vulnerability (sensitive data of core business, but bound to local access only).

[0153] The values ​​of each vulnerability assessment factor in the form of the low-code platform:

[0154] Business weight: 2, vulnerability weight: 9, environmental weight: 0.8, impact level: high, exploit difficulty level: very low.

[0155] The detection result obtained by the vulnerability warning method based on the low-code platform is a risk value of 73.01, the risk level is medium, and the repair period is 7 days, which is in line with expectations.

[0156] Corresponding to the method embodiment of the present application, the present application also provides a vulnerability early warning device based on a low-code platform. The low-code platform stores multiple mapping relationships for each of the multiple vulnerabilities, and the multiple mapping relationships include: a first mapping relationship between the business involved in the vulnerability and the business weight; a second mapping relationship between the business access method and the environment weight; a third mapping relationship between the vulnerability disclosure, the exploitation cost of the vulnerability, and the exploitation difficulty weight; a fourth mapping relationship between the impact scope of the vulnerability and the impact scope weight; and a fifth mapping relationship between the risk type of the vulnerability, the vulnerability type, the name of the vulnerability, and the vulnerability's own weight.

[0157] Figure 3 A block diagram of a vulnerability warning device based on a low-code platform provided in an embodiment of the present application. Figure 3 As shown, the vulnerability early warning device 30 based on the low-code platform may include:

[0158] The query module 301 is used for querying the target business weight corresponding to the target business based on the first mapping relationship corresponding to the target vulnerability after the low-code platform receives the relevant information of the target vulnerability; querying the target environment weight corresponding to the access method of the target business based on the second mapping relationship corresponding to the target vulnerability; querying the target exploitation difficulty weight corresponding to the disclosure of the target vulnerability and the exploitation cost of the target vulnerability based on the third mapping relationship corresponding to the target vulnerability; querying the target impact scope weight corresponding to the impact scope of the target vulnerability based on the fourth mapping relationship corresponding to the target vulnerability; querying the target vulnerability own weight corresponding to the risk type of the target vulnerability, the vulnerability type of the target vulnerability and the name of the target vulnerability based on the fifth mapping relationship corresponding to the target vulnerability;

[0159] A transmission module 302 is used to transmit the target business weight, the target environment weight, the target exploitation difficulty weight, the target impact range weight and the target vulnerability weight to a preset risk value calculation script, and the risk value calculation script is used to calculate the risk value of the target vulnerability based on the received weight information;

[0160] The warning module 303 is used to determine the risk level corresponding to the target vulnerability according to the risk value returned by the risk value calculation script, and issue a vulnerability warning message when the risk level reaches a predetermined warning risk level.

[0161] The vulnerability early warning device based on the low-code platform provided in the embodiment of the present application, the low-code platform stores multiple mapping relationships of each vulnerability, based on the relevant information of the target vulnerability and multiple mapping relationships, the target business weight, target environment weight, target utilization difficulty weight, target impact range weight and target vulnerability weight of the target vulnerability can be obtained, and the risk value calculation script calculates the above multiple weights to obtain the risk value of the target vulnerability, and the risk level corresponding to the target vulnerability can be determined based on the risk value. In this way, the present application fully considers the impact of various factors such as the specific environment within the enterprise, the importance of assets, business access methods, the difficulty of exploiting vulnerabilities, the business processes that may be affected, and the risks of the vulnerabilities themselves on the severity of the vulnerabilities, and can more comprehensively evaluate the severity of the vulnerabilities and improve the accuracy of evaluating the severity of the vulnerabilities. When the risk level reaches the predetermined warning risk level, a vulnerability warning message is issued, which can better remind the operator to repair the target vulnerability. By establishing a unified vulnerability assessment standard, it will be possible to better identify and classify vulnerabilities, determine repair priorities, and minimize potential security risks to protect the security and integrity of enterprise assets.

[0162] Figure 3Each module / unit in the shown device has the function of implementing each step in the vulnerability warning method based on the low-code platform provided by the above-mentioned method embodiment. The two have the same or corresponding technical characteristics and can achieve their corresponding technical effects. For the sake of concise description, they will not be repeated here.

[0163] The electronic device in the embodiment of the present application may be a user terminal device, a server, other computing devices, or a cloud server. Figure 4 This is a hardware structure diagram of an electronic device of an embodiment of the present application. The electronic device may include a processor 401 and a memory 402 storing computer program instructions. When the processor 401 executes the computer program instructions, it implements the process or function of any of the above-mentioned embodiment methods.

[0164] Specifically, the processor 401 may include a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application. The memory 402 may include a large-capacity memory for data or instructions. For example, the memory 402 may be at least one of the following: a hard disk drive (HDD), a read-only memory (ROM), a random access memory (RAM), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a tape, a universal serial bus (USB) drive or other physical / tangible memory storage device. For another example, the memory 402 may include a removable or non-removable (or fixed) medium. For another example, the memory 402 may be inside or outside the integrated gateway disaster recovery device. The memory 402 may be a non-volatile solid-state memory. In other words, the memory 402 generally includes a tangible (non-transitory) computer-readable storage medium (such as a memory device) encoded with computer-executable instructions, and when the software is executed (such as executed by one or more processors), the operations described in the method of the embodiments of the present application may be performed. The processor 401 implements the process or function of any method in the above embodiments by reading and executing the computer program instructions stored in the memory 402 .

[0165] In one example, Figure 4The electronic device shown may also include a communication interface 403 and a bus 410. Among them, the processor 401, the memory 402, and the communication interface 403 are connected through the bus 410 and complete the communication between each other. The communication interface 403 is mainly used to realize the communication between each module, device, unit and / or device in the embodiment of the present application. The bus 410 includes hardware, software or both, and can couple the components of the online data traffic billing device to each other. For example, the bus may include at least one of the following: an accelerated graphics port (AGP) or other graphics bus, an enhanced industrial standard architecture (EISA) bus, a front-end bus (FSB), a hypertransport (HT) interconnect, an industrial standard architecture (ISA) bus, an infinite bandwidth interconnect, a low pin count (LPC) bus, a memory bus, a micro channel architecture (MCA) bus, a peripheral component interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a serial advanced technology attachment (SATA) bus, a video electronics standard association local (VLB) bus or other suitable buses. The bus 410 may include one or more buses. Although the embodiments of the present application describe or illustrate a specific bus, the embodiments of the present application may consider any suitable bus or interconnection method.

[0166] In combination with the method in the above embodiments, an embodiment of the present application also provides a computer-readable storage medium, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the process or function of any method in the above embodiments is implemented.

[0167] In addition, an embodiment of the present application further provides a computer program product, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the process or function of any one of the methods in the above embodiments is implemented.

[0168] The above exemplarily describes the flowcharts and / or block diagrams of the methods, devices, systems and computer program products of the embodiments of the present application, and describes the relevant various aspects. It should be understood that each box or combination thereof in the flowchart and / or block diagram can be implemented by computer program instructions, or by dedicated hardware that performs a specified function or action, or by a combination of dedicated hardware and computer instructions. For example, these computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer or other programmable data processing device to form a machine that enables these instructions executed by such a processor to enable the implementation of the functions / actions specified in each box or combination thereof in the flowchart and / or block diagram. Such a processor can be a general-purpose processor, a special-purpose processor, a special application processor or a field programmable logic circuit.

[0169] The functional blocks shown in the structured block diagram of the embodiment of the present application can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application-specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc.; when implemented in software, it is a program or code segment used to perform the required task. The program or code segment can be stored in a memory, or transmitted on a transmission medium or a communication link via a data signal carried in a carrier. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0170] It should be noted that the present application is not limited to the specific configurations and processes described above or shown in the figures. The above is only a specific implementation mode of the present application. Those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working process of the described system, device, module or unit can refer to the corresponding process in the method embodiment without further description. It should be understood that the scope of protection of the present application is not limited to this. Any technician familiar with the technical field can think of various equivalent modifications or substitutions within the technical scope disclosed in the present application, and these modifications or substitutions should be included in the scope of protection of the present application.

Claims

1. A vulnerability early warning method based on a low-code platform, characterized in that: The low-code platform stores multiple mapping relationships for each of the multiple vulnerabilities, and the multiple mapping relationships include: A first mapping relationship between the business involved in the vulnerability and the business weight; A second mapping relationship between the service access mode and the environment weight; The third mapping relationship between vulnerability disclosure, vulnerability exploitation cost and exploitation difficulty weight; a fourth mapping relationship between the impact scope of the vulnerability and the impact scope weight; and, The fifth mapping relationship between the risk type of the vulnerability, the vulnerability type, the name of the vulnerability and the vulnerability's own weight; The method comprises: After receiving the relevant information of the target vulnerability, the low-code platform queries the target business weight corresponding to the target business based on the first mapping relationship corresponding to the target vulnerability; Based on the second mapping relationship corresponding to the target vulnerability, query the target environment weight corresponding to the access method of the target business; Based on the third mapping relationship corresponding to the target vulnerability, query the target exploitation difficulty weight corresponding to the disclosure status of the target vulnerability and the exploitation cost of the target vulnerability; Based on the fourth mapping relationship corresponding to the target vulnerability, query the target impact range weight corresponding to the impact range of the target vulnerability; Based on the fifth mapping relationship corresponding to the target vulnerability, the target vulnerability weight corresponding to the risk type of the target vulnerability, the vulnerability type of the target vulnerability, and the name of the target vulnerability is queried; The target business weight, target environment weight, target exploitation difficulty weight, target impact range weight, and target vulnerability weight are transmitted to a preset risk value calculation script, where the risk value calculation script is used to calculate the risk value of the target vulnerability based on the received weight information; According to the risk value returned by the risk value calculation script, the risk level corresponding to the target vulnerability is determined, and a vulnerability warning message is issued when the risk level reaches the predetermined warning risk level.

2. The method according to claim 1, characterized in that The risk value calculation script is used to calculate the risk value of the target vulnerability according to the following expression: F 风险值 =F2×(F5×((F1×F4) 2 ×a+F1×F3×F4×b)+F5×c) Among them, F 风险值 It represents the risk value of the target vulnerability, F1 represents the target business weight, F2 represents the target environment weight, F3 represents the target exploitation difficulty weight, F4 represents the target impact range weight, F5 represents the target vulnerability weight itself, a, b and c represent adjustment coefficients, and a, b and c are all greater than 0.

3. The method according to claim 1, characterized in that The first mapping relationship includes a first table between the business involved in the vulnerability, the business level and the business weight, the business level is used to characterize the level of the business, and different business levels correspond to different business weights; The method further comprises: Displaying an interface of a low-code platform, wherein the interface displays a first data selection button and a plurality of business level selection buttons; In response to the user selecting the first table through the first data selection button, the first table is selected and popped up for display so that the user can view the first table; If a user clicks a target business level selection button among multiple business level selection buttons, the first business weight corresponding to the target business level is queried based on the target business level corresponding to the target business level selection button and the first table, and the target business weight is changed based on the first business weight.

4. The method according to claim 1, characterized in that: The vulnerability warning information includes a repair time limit for the target vulnerability, and different warning risk levels correspond to different repair time limits.

5. The method according to claim 1, characterized in that: The disclosure of the vulnerability includes whether it is disclosed by the proof-of-concept POC, the exploitation cost of the vulnerability includes whether a customized attack tool is required, and the third mapping relationship is at least provided with a first exploitation difficulty weight, a second exploitation difficulty weight, and a third exploitation difficulty weight; In the third mapping relationship, the first utilization difficulty weight corresponds to being disclosed by POC and does not require the use of customized attack tools; the second utilization difficulty weight corresponds to not being disclosed by POC and does not require the use of customized attack tools; the third utilization difficulty weight corresponds to not being disclosed by POC and requires the use of customized attack tools; Among them, the first utilization difficulty weight>the second utilization difficulty weight>the third utilization difficulty weight.

6. The method according to claim 1, characterized in that The risk types of vulnerabilities include application risk and infrastructure risk. Application risk represents potential threats in applications, while infrastructure risk represents potential threats in system infrastructure. Vulnerability types include at least one of input validation, identity authentication, business logic, configuration baseline and sensitive information leakage; vulnerability names include remote code execution vulnerabilities and non-remote code execution vulnerabilities.

7. The method according to claim 1, characterized in that The target business weight, target environment weight, target exploit difficulty weight, target impact range weight, and target vulnerability weight are transferred to the preset risk value calculation script, including: Fill in the target business weight, target environment weight, target exploitation difficulty weight, target impact range weight, and target vulnerability weight in the form of the low-code platform, and transfer the target business weight, target environment weight, target exploitation difficulty weight, target impact range weight, and target vulnerability weight in the form to the risk value calculation script; After determining the risk level corresponding to the target vulnerability according to the risk value returned by the risk value calculation script, the method further includes: Fill in the risk value into the preset position in the form, check the target risk level in the form, and fill in the repair period corresponding to the target risk level in the form.

8. A vulnerability early warning device based on a low-code platform, characterized in that: The low-code platform stores multiple mapping relationships for each of the multiple vulnerabilities, and the multiple mapping relationships include: A first mapping relationship between the business involved in the vulnerability and the business weight; A second mapping relationship between the service access mode and the environment weight; The third mapping relationship between vulnerability disclosure, vulnerability exploitation cost and exploitation difficulty weight; a fourth mapping relationship between the impact scope of the vulnerability and the impact scope weight; and, The fifth mapping relationship between the risk type of the vulnerability, the vulnerability type, the name of the vulnerability and the vulnerability's own weight; The device comprises: A query module, which is used for querying the target business weight corresponding to the target business based on the first mapping relationship corresponding to the target vulnerability after the low-code platform receives relevant information about the target vulnerability; querying the target environment weight corresponding to the access method of the target business based on the second mapping relationship corresponding to the target vulnerability; querying the target exploitation difficulty weight corresponding to the disclosure status of the target vulnerability and the exploitation cost of the target vulnerability based on the third mapping relationship corresponding to the target vulnerability; querying the target impact scope weight corresponding to the impact scope of the target vulnerability based on the fourth mapping relationship corresponding to the target vulnerability; querying the target vulnerability own weight corresponding to the risk type of the target vulnerability, the vulnerability type of the target vulnerability and the name of the target vulnerability based on the fifth mapping relationship corresponding to the target vulnerability; A transmission module, used to transmit the target business weight, the target environment weight, the target exploitation difficulty weight, the target impact range weight and the target vulnerability weight to a preset risk value calculation script, wherein the risk value calculation script is used to calculate the risk value of the target vulnerability based on the received weight information; The early warning module is used to determine the risk level corresponding to the target vulnerability according to the risk value returned by the risk value calculation script, and issue a vulnerability early warning message when the risk level reaches a predetermined early warning risk level.

9. An electronic device, characterized in that: The electronic device includes: a processor and a memory storing computer program instructions; when the electronic device executes the computer program instructions, it implements the vulnerability warning method based on the low-code platform as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement a vulnerability warning method based on a low-code platform as described in any one of claims 1-7.

Images