A CVE vulnerability detection method based on graph matching

Abstract

The present invention belongs to the field of vulnerability detection, and discloses a CVE vulnerability detection method based on graph matching, including extracting multiple signature graphs according to PoC codes used to characterize CVE vulnerabilities; extracting system call event data, and building an origin graph based on the system call event data; calculating the final score of the matching confidence of the signature graph and the origin graph; if at least one final score of the matching confidence exceeds a threshold, it indicates that there is a CVE vulnerability corresponding to the signature graph in the origin graph; otherwise, there is no CVE vulnerability corresponding to the signature graph. The present invention realizes efficient and accurate vulnerability detection.

Description

Technical Field

[0001] The present invention belongs to the field of vulnerability detection, and in particular relates to a CVE vulnerability detection method based on graph matching. Background Art

[0002] Common Vulnerabilities & Exposures (CVE) is a system that provides public names and standardized descriptions for widely recognized information security vulnerabilities or weaknesses that have been exposed, posing an increasingly serious global security threat. CVEs are not just technical flaws, they also allow unauthorized access and data leakage, which not only affects data security, but also causes significant damage to the reputation of the organization and huge financial losses. As corporate business becomes more and more complex, the frequency and complexity of CVEs are also increasing, highlighting the urgent need for advanced mitigation and detection methods.

[0003] Currently, the main methods for solving CVE problems include:

[0004] (1) Software patching: Fix vulnerabilities by adding effective patches. However, the effectiveness of this method is often affected by significant delays, and these delays make enterprises vulnerable to attacks for a long time.

[0005] (2) Active CVE detection: Using the domain knowledge of security experts, manual signature management is performed to collect threat intelligence such as known attacker tools, infrastructure, and behavior patterns to form an intelligence library, and new network activities are matched and analyzed with the intelligence library. This is a time-consuming and error-prone process that is not very scalable.

[0006] (3) Data provenance-based detection: Collect system call logs of the operating system kernel and perform causal analysis to model normal behavior and detect deviations. This method requires frequent retraining to maintain accuracy and minimize false positives, as well as consuming a lot of computing resources, thus delaying vulnerability detection.

[0007] Therefore, existing technologies still have many shortcomings in detecting CVE vulnerabilities, and new, efficient and accurate vulnerability detection technologies are urgently needed to meet the needs of network security protection. Summary of the invention

[0008] The purpose of the present invention is to provide a CVE vulnerability detection method based on graph matching to achieve efficient and accurate vulnerability detection.

[0009] To achieve the above object, the technical solution adopted by the present invention is:

[0010] A CVE vulnerability detection method based on graph matching, the CVE vulnerability detection method based on graph matching comprising:

[0011] Extract multiple signature graphs based on the PoC code used to characterize the CVE vulnerability;

[0012] Extract system call event data and build a provenance graph based on the system call event data;

[0013] Based on the confidence of the nodes, the nodes in the signature graph are divided into different confidence levels, and the nodes and corresponding edges of the same confidence level in the signature graph are taken from high to low according to the confidence level. The nodes and edges taken in the signature graph are matched with the nodes and edges in the origin graph in combination with the maximum number of skipped intermediate nodes until the match is successful and one or more matching sets are output;

[0014] For each matching set, the origin graph alignment score is calculated, and combined with the signature graph quality score to obtain the initial matching confidence score between the signature graph and the origin graph;

[0015] Based on the maximum number of skipped intermediate nodes and the matching confidence scores of the signature graph and the origin graph, the minimum bypass score corresponding to the matching set is calculated;

[0016] Subtract the minimum bypass score from the initial score of the matching confidence of the signature graph and the origin graph to obtain a final score of the matching confidence of the signature graph and the origin graph corresponding to the matching set;

[0017] If at least one matching confidence final score exceeds the threshold, it means that the CVE vulnerability corresponding to the signature graph exists in the origin graph; otherwise, there is no CVE vulnerability corresponding to the signature graph.

[0018] Several optional methods are also provided below, but they are not intended to be additional limitations on the above-mentioned overall solution, but are merely further supplements or preferences. Under the premise that there are no technical or logical contradictions, each optional method can be combined with the above-mentioned overall solution separately, and multiple optional methods can also be combined.

[0019] Preferably, the step of extracting multiple signature graphs according to the PoC code for characterizing the CVE vulnerability includes:

[0020] Simulate the execution of the PoC code and obtain the abstract syntax tree generated during the simulation execution;

[0021] Extract the path of each function in the abstract syntax tree, compress the extracted path, and create a control flow node based on the key code block or key statement in the compressed path;

[0022] Extract Import statements and function call nodes from the PoC code, and filter and retain the function call nodes that are system calls;

[0023] Add function edges to control flow nodes, and perform data flow propagation based on the control flow nodes after adding function edges to obtain the transmission and dependency relationship between data;

[0024] Based on the extracted Import statements, the retained function call nodes, the control flow nodes after adding function edges, and the transfer and dependency relationships between data, multiple signature graphs are generated using execution tracing technology.

[0025] Preferably, the nodes in the signature graph are divided into different confidence levels based on the confidence of the nodes, including:

[0026] Confidence division of nodes: set the confidence of nodes that exist in more than half of the CVE vulnerabilities to high confidence; set the confidence of nodes that exist in every detectable PoC code to medium confidence; and set the remaining nodes to low confidence;

[0027] Confidence level division of nodes in the signature graph: nodes in the signature graph that show consistent patterns in different PoC codes of the same CVE vulnerability and have high confidence are divided into high confidence levels; nodes in the signature graph that are identified by unique but variable identifiers and have medium confidence are divided into medium confidence levels; nodes in the signature graph other than high confidence levels and medium confidence levels are divided into low confidence levels.

[0028] Preferably, the step of matching the nodes and edges taken from the signature graph with the nodes and edges in the origin graph in combination with the maximum number of skipped intermediate nodes comprises:

[0029] Take the first node and the corresponding edge in the signature graph and match them with the nodes and edges in the origin graph. If the match is successful, mark the successfully matched node in the origin graph as the first matching node; otherwise, the match fails and ends;

[0030] Based on the first matching node, the second node in the signature graph and the corresponding edge are matched with the one-hop neighbor node, two-hop neighbor node, ..., the maximum number of skipped intermediate nodes plus the one-hop neighbor node of the first matching node in the origin graph. If the match is successful, the successfully matched node in the origin graph is marked as the second matching node; otherwise, the match fails and ends;

[0031] Based on the second matching node, the third node in the signature graph and the corresponding edge are matched with the one-hop neighbor node, two-hop neighbor node, ..., the maximum number of skipped intermediate nodes plus the one-hop neighbor node of the second matching node in the origin graph. If the match is successful, the node in the origin graph that is successfully matched is marked as the third matching node; otherwise, the match fails and ends;

[0032] Continue to match the nodes and corresponding edges in the signature graph with the origin graph until all nodes in the signature graph are matched, and output each successfully matched path as a matching set.

[0033] Preferably, for each matching set, the origin graph alignment score is calculated, and the initial matching confidence score of the signature graph and the origin graph is obtained in combination with the signature graph quality score, including:

[0034] Calculate the quality score of the signature graph:

[0035] ;

[0036] ;

[0037] in, represents the quality score of the signature graph, Indicates the number of nodes with high confidence level in the signature graph, represents the weight of nodes with high confidence level, Indicates the number of nodes with medium confidence level in the signature graph, represents the weight of nodes with medium confidence level, Indicates the number of nodes with low confidence level in the signature graph, represents the weight of nodes with low confidence level, represents the quality score of the normalized signature graph, is the total number of nodes in the signature graph;

[0038] Compute provenance graph alignment scores:

[0039] ;

[0040] ;

[0041] ;

[0042] in, Indicates that based on The node matching score obtained by the matching set is Indicates The number of nodes in the matching set, Indicates that based on The edge matching score obtained by the matching set is Indicates The number of edges in the matching set, is the total number of edges in the signature graph, Indicates that based on Provenance graph alignment scores obtained from the matching set;

[0043] Calculate the matching confidence initial score:

[0044] ;

[0045] in, Indicates that based on The initial score of the matching confidence between the signature graph and the origin graph obtained from the matching set, is the quality score weight of the signature graph, is the provenance graph alignment score weight, .

[0046] Preferably, the calculation of the minimum bypass score corresponding to the matching set based on the maximum number of skipped intermediate nodes and the matching confidence scores of the signature graph and the origin graph includes:

[0047] ;

[0048] ;

[0049] in, Indicates that based on The bypass score obtained by the matching set is is the scaling factor, Indicates the maximum number of intermediate nodes to be skipped. Indicates that the match is obtained The bypass frequency of the matching set, Indicates that based on The minimum bypass score obtained by matching sets, Indicates that based on The initial score of the matching confidence between the signature graph and the origin graph obtained from the matching set, Indicates the initial score of the matching confidence corresponding to the matching set obtained by skipping the number of intermediate nodes.

[0050] The CVE vulnerability detection method based on graph matching provided by the present invention has the following beneficial effects compared with the prior art:

[0051] 1. High detection accuracy: By converting the proof of concept (PoC) code into a signature graph and using program analysis and execution tracking methods, a reliable representation of vulnerability exploitation behavior is ensured. This approach avoids the incomplete CVE vulnerability description, poor portability of open source signatures, and time-consuming normalization process in traditional signature-based detection methods, thereby significantly improving detection accuracy.

[0052] 2. Efficient resource utilization and rapid response: Through automated signature graph generation and graph matching methods, the reliance on manual updates and maintenance is reduced, and the adaptability to new vulnerabilities is improved.

[0053] 3. Strong explainability: It provides explanations for alerts, enhances the understanding of detection results through matching signature graphs, and helps to respond to threats quickly. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 The present invention is a flowchart of a CVE vulnerability detection method based on graph matching. DETAILED DESCRIPTION

[0055] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0056] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used in the specification of the present invention herein are only for the purpose of describing specific embodiments and are not intended to limit the present invention.

[0057] like Figure 1 As shown, this embodiment provides a CVE vulnerability detection method based on graph matching, comprising the following steps:

[0058] (1) Generate signature graph :Extract multiple signature graphs according to the PoC code used to characterize the CVE vulnerability. Perform the following steps for each PoC code that characterizes the CVE vulnerability to generate one or more signature graphs, that is, one CVE vulnerability corresponds to one or more signature graphs.

[0059] (1-1) Enhance PoC code structure: Adopt AST-based strategies to enhance coverage of complex structures such as asynchronous operations, error handling, and nested function calls.

[0060] (1-1-1) Perform control flow analysis on the generated Abstract Syntax Tree (AST): simulate the execution of the PoC code and obtain the AST generated in the simulation execution; extract the path of each function in the AST, analyze the system calls on each path, eliminate redundant paths (referring to multiple repeated or no substantial differences in execution paths), that is, merge nodes and edges with similar or identical functions. At the same time, identify branches that are impossible to execute (will not be triggered or will not involve a useful system call series) and eliminate them, that is, complete the compression of the extracted path. Then create a control flow node based on the key code blocks or key statements in the compressed path, where the standards for key code blocks or key statements can be defined by yourself, such as setting the most important ones as key, or randomly taking a certain proportion of objects as key, etc. At the same time, the creation operation is specifically merged, that is, merging the key code blocks or key statements into a control flow node (Control FlowNode, CFN).

[0061] When extracting and compressing the path, it is all done based on existing tools, such as the ready-made tool PyCFG tool.

[0062] (1-1-2) Extract system calls: Extract Import statements and function call nodes (ast.Call nodes) from the PoC code. For function call nodes, extract the function name and parameters, determine whether it is a system call, and retain the function call nodes that are system calls.

[0063] (1-1-3) Add function edges to the control flow nodes obtained in step (1-1-1) (specifically, for each ast.Call node, find the control flow node where the call point is located. Find the definition location of the called function corresponding to the ast.Call node, and determine the entry node of the called function. Connect the control flow node of the call point and the entry node of the called function with a function edge), and perform data flow propagation, mainly forward propagation and backward propagation. Data flow propagation obtains the transmission and dependency relationship between data.

[0064] (1-2) Constructing a signature graph :Based on the combined propagation of control flow and data flow, namely the extracted Import statements, the retained function call nodes, the control flow nodes after adding function edges, and the transmission and dependency between data, the execution tracing technology (such as the trace module in the Python standard library, dynamic analysis tools, debuggers, code coverage tools, tracing and monitoring frameworks, etc.) is used to map the relevant suspicious code paths to system calls, thereby simulating the dynamic PoC code execution path and interaction, and generating multiple signature graphs according to the possible execution path branches of the PoC code .

[0065] (2) Generate origin graph :Extract system call event data and build a provenance graph based on the system call event data. Extract system call event data from the kernel audit logs of Linux, FreeBSD and Windows operating systems, and build a provenance graph reflecting the execution order and mutual correlation of events based on the causal relationship contained in the extracted system call event data.

[0066] (2-1) System call event data collection: Extract the original system call event data from the kernel audit log of the operating system. The system call event data includes: event occurrence time, process ID, thread ID, operation type, operation object and other information.

[0067] (2-2) Modeling Origin Diagram : Construct the identified entities, events and their causal relationships into a directed acyclic graph in the chronological order of the events ,in: is a collection of subject nodes, where a subject refers to an entity in the system that performs an operation on another entity; It is a set of object nodes, where the object represents the entity object being operated; An event is an operation between entities in the system. Both the subject and the object are represented as nodes, while the event is represented as an edge.

[0068] (3) Vulnerability detection: Use an unsupervised graph matching algorithm and focus on nodes with higher confidence, focusing on signature graphs of multiple CVE vulnerabilities. vertices appearing in , as preliminary indicators of potential CVE patterns. These signature graphs are matched against the data provenance graph, and this is enhanced by using an iterative deepening strategy in graph matching to extend the initial matching to thoroughly explore the signature graph. and Origin Diagram The relationship between nodes and edges in the graph. This exploration is performed by aligning nodes and edges, and iteratively reveals more related nodes and their interconnections, revealing the complete CVE vulnerability footprint along the flow path of the graph, while allowing inaccurate matching results, and obtaining all CVE vulnerabilities contained in the origin graph by matching all signature graphs.

[0069] (3-1) Based on the confidence of the nodes, the nodes in the signature graph are divided into different confidence levels, and the nodes and corresponding edges of the signature graph belonging to the same confidence level are selected from high to low according to the confidence level. The nodes and edges taken in the signature graph are matched with the nodes and edges in the origin graph in combination with the maximum number of skipped intermediate nodes until the match is successful and one or more matching sets of the signature graph are output.

[0070] (3-1-1) Confidence division of nodes: The confidence of nodes that exist in more than half of the CVE vulnerabilities is set to high confidence; the confidence of nodes that exist in every detectable PoC code is set to medium confidence; the remaining nodes (i.e., nodes with lower reliability used as wildcards) are set to low confidence.

[0071] (3-1-2) Confidence level division of nodes in the signature graph:

[0072] Nodes in the signature graph that show consistent patterns in different PoC codes of the same CVE vulnerability and have high confidence are classified as high confidence level and recorded as category 3 (C3) nodes. For example, system call patterns os.system("whoami"), subprocess.run("ls"), etc.; common library imports: import os, etc.; specific vulnerability function calls: requests.get, etc.

[0073] Nodes in the signature graph that are identified by unique but variable identifiers and have medium confidence are classified as medium confidence level and recorded as category 2 (C2) nodes. For example, unique identifiers or names: user = "admin", etc.; URL paths, file paths.

[0074] Nodes other than high confidence and medium confidence in the signature graph (nodes that depend on user input, have different performances in different PoC codes, and have low confidence) are classified as low confidence nodes and recorded as category 1 (C1) nodes. For example, user input: input("Enter username: "); dynamically generated data: timestamp = time.time().

[0075] (3-1-3) From the signature graph Take all C3 nodes, match the nodes and edges taken in the signature graph with the nodes and edges in the origin graph in combination with the maximum number of skipped intermediate nodes, and execute the next step.

[0076] (3-1-4) If step (3-1-3) matches successfully, the output corresponds to a signature graph One or more matching sets of , and end; otherwise, from the signature graph Take all C2 nodes, match the nodes and edges taken in the signature graph with the nodes and edges in the origin graph in combination with the maximum number of skipped intermediate nodes, and execute the next step;

[0077] (3-1-5) If step (3-1-4) matches successfully, the output corresponds to a signature graph One or more matching sets of , and end; otherwise, from the signature graph Take all C1 nodes, and match the nodes and edges taken in the signature graph with the nodes and edges in the origin graph in combination with the maximum number of skipped intermediate nodes;

[0078] (3-1-6) If step (3-1-5) matches successfully, the output corresponds to a signature graph One or more matching sets of , and end; otherwise, it means that the signature image does not exist in the original image The corresponding CVE vulnerability ends the signature graph The subsequent calculation steps.

[0079] Relying only on the initial matching of high-confidence vertices may overlook some vulnerabilities, and the system needs to explore all potential vulnerabilities in the graph. Therefore, in this embodiment, the path is used to start from the initial matching and gradually expand the exploration in the signature graph. and Origin Diagram Among them, the nodes and edges taken from the signature graph are matched with the nodes and edges in the origin graph in combination with the maximum number of skipped intermediate nodes, including:

[0080] Take the first node and the corresponding edge in the signature graph and match them with the nodes and edges in the origin graph. If the match is successful, mark the successfully matched node in the origin graph as the first matching node; otherwise, the match fails and ends;

[0081] Based on the first matching node, the second node in the signature graph and the corresponding edge are matched with the one-hop neighbor node, two-hop neighbor node, ..., the maximum number of skipped intermediate nodes plus the one-hop neighbor node of the first matching node in the origin graph. If the match is successful, the successfully matched node in the origin graph is marked as the second matching node; otherwise, the match fails and ends;

[0082] Based on the second matching node, the third node in the signature graph and the corresponding edge are matched with the one-hop neighbor node, two-hop neighbor node, ..., the maximum number of skipped intermediate nodes plus the one-hop neighbor node of the second matching node in the origin graph. If the match is successful, the node in the origin graph that is successfully matched is marked as the third matching node; otherwise, the match fails and ends;

[0083] Continue to match the nodes and corresponding edges in the signature graph with the origin graph until all nodes in the signature graph are matched, and output each successfully matched path as a matching set, which contains all matching nodes and all edges from the first matching node to the last matching node.

[0084] For example, a path that matches successfully is , then the nodes and edges recorded in its matching set include ,in represent the first matching node, the second matching node, the third matching node and the fourth matching node respectively, Represent the first to sixth sides respectively, Indicates intermediate nodes that are skipped during graph matching.

[0085] Attackers may use obfuscation strategies to complicate the detection process. In order to enhance the robustness of the system, this embodiment introduces the maximum number of skipped intermediate nodes. , allowing to intelligently bypass most The maximum number of intermediate nodes to be skipped It can be dynamically adjusted in different scenarios to adapt to the attacker's strategy.

[0086] (3-2) For each matching set, the origin graph alignment score is calculated, and combined with the signature graph quality score to obtain the initial matching confidence score between the signature graph and the origin graph.

[0087] (3-2-1) In the signature diagram Assign weights to nodes of different confidence levels: In order to emphasize the importance of each vertex category, different graphs are analyzed with different degrees of accuracy, and different weights are assigned to nodes of different categories. : High confidence level (C3); : Medium confidence level (C2); : Low confidence level (C1). Among them, .

[0088] (3-2-2) Calculate the signature graph Quality Score:

[0089] ;

[0090] in, represents the quality score of the signature graph, Indicates the number of nodes with high confidence level in the signature graph, represents the weight of nodes with high confidence level, Indicates the number of nodes with medium confidence level in the signature graph, represents the weight of nodes with medium confidence level, Indicates the number of nodes with low confidence level in the signature graph, Represents the weight of nodes with low confidence level.

[0091] At the same time Normalization is performed so that images of different sizes can be compared fairly. The formula is as follows:

[0092] ;

[0093] in, represents the quality score of the normalized signature graph, is the total number of nodes in the signature graph.

[0094] (3-2-3) Calculate the origin graph alignment score:

[0095] ;

[0096] in, Indicates that based on The node matching score obtained by the matching set reflects the completeness of the node matching. Indicates The number of nodes in the matching set, that is, , Indicates node matching, signature graph node With the origin graph node match, For matching sets.

[0097] ;

[0098] in, Indicates that based on The edge matching score obtained by the matching set reflects the completeness of the edge matching. Since the edges on the entire path in the origin graph are recorded, the edge matching scores of different paths are different. Indicates The number of edges in the matching set, that is, , Represents edge matching, signature graph edge Edge with origin graph Matching, it should be noted that since the edges related to the skipped intermediate nodes are also recorded in the matching set, the signature graph edges Edge with origin graph It is a one-to-many or one-to-one relationship. When there is no skipped intermediate node, it is a one-to-one relationship. When there is a skipped intermediate node, it is a one-to-many relationship.

[0099] ;

[0100] Last passed and , considering the matching degree of structure and behavior, we get , that is, based on The provenance graph alignment score obtained from the set of matches.

[0101] (3-2-4) Initial matching confidence score: Combines the image quality and matching degree to give a preliminary overall matching confidence, providing a comprehensive matching quality indicator.

[0102] ;

[0103] in, Indicates that based on The initial score of the matching confidence between the signature graph and the origin graph obtained from the matching set, is the quality score weight of the signature graph, is the provenance graph alignment score weight, , balancing the importance of graph quality and graph alignment.

[0104] (3-3) Based on the maximum number of skipped intermediate nodes and the matching confidence scores of the signature graph and the origin graph, the minimum bypass score corresponding to the matching set is calculated.

[0105] Considering the complexity of the attack, adjust the maximum number of intermediate nodes to be skipped according to environmental requirements. In order to make the system adaptable to more complex attack patterns while not overly punishing benign complexity, a bypass score KAD is designed, which is calculated as follows:

[0106] ;

[0107] in, Indicates that based on The bypass score obtained by the matching set is is a scaling factor that adjusts the impact of benign vertex bypasses on the final matching confidence. Indicates the maximum number of intermediate nodes to be skipped. Indicates that the match is obtained The bypass frequency of the matching set. It is easy to know that only when the maximum number of skipped intermediate nodes is When it is greater than 0, the bypass score calculation is meaningful, otherwise the bypass score is always 0.

[0108] The bypass frequency is the total number of bypassed nodes when generating a path (matching set) divided by the total number of bypasses. Take this as an example to illustrate, where the node and nodes If the match between skips the intermediate node, the number of bypasses is 1, and if two intermediate nodes are skipped, the number of bypassed nodes is 2; and nodes If the match between skips the intermediate node, the bypass count is 1, and if one intermediate node is skipped, the number of bypassed nodes is 1; and nodes If the match between them does not skip the intermediate node, the bypass times and the bypass nodes are both recorded as 0. When the path is generated, the total number of bypassed nodes is 3, the total bypass times is 2, and the bypass frequency is 1.5.

[0109] At the same time, in order to ensure that the bypass score does not excessively reduce the matching confidence, maintain the sensitivity of the system, and control the false alarm rate, a minimum bypass is designed to obtain KADcapped:

[0110] ;

[0111] in, Indicates that based on The minimum bypass score obtained by matching sets, Indicates that based on The initial score of the matching confidence between the signature graph and the origin graph obtained from the matching set, Indicates the initial score of the matching confidence corresponding to the matching set obtained by skipping the number of intermediate nodes.

[0112] (3-4) Subtract the minimum bypass score from the initial match confidence score of the signature graph and the origin graph to obtain a final match confidence score of the signature graph and the origin graph corresponding to the matching set.

[0113] This embodiment takes into account the graph quality, matching degree and attack complexity, and provides a final, adjusted matching confidence score as follows:

[0114] ;

[0115] in, Indicates that based on The final score of the matching confidence between the signature graph and the origin graph obtained from the matching set.

[0116] (4) Vulnerability Alert: Due to a signature graph One or more matching sets will be matched, and a matching confidence final score will be calculated for each matching set. Then one signature graph will get one or more matching confidence final scores. If the matching confidence final score of at least one signature graph and the origin graph exceeds the threshold, it means that the CVE vulnerability corresponding to the signature graph exists in the origin graph; otherwise, there is no CVE vulnerability corresponding to the signature graph. Matches a corresponding signature graph An alert will be triggered when a potential CVE vulnerability exists in the system.

[0117] (4-1) Setting the threshold: Taking into account the different tolerance levels for attacks in different environments, the threshold here can be set by security analysts based on the conditions in different environments.

[0118] (4-2) Alarm: If If the threshold is exceeded, the alarm graphic (i.e., the corresponding signature graphic, the corresponding matching set may also be output) is output. This embodiment can output the alarm graphic, which is highly explanatory.

[0119] In order to illustrate the effectiveness of the present application, the following is based on experimental description.

[0120] The experiment was conducted based on the Theia dataset containing CVE vulnerability attacks in Linux systems collected by the Darpa organization, and the existing graph matching-based vulnerability detection system POIROT was used as a comparison. The measurement criteria used are as follows:

[0121] FP: The number of samples predicted to be positive but actually negative.

[0122] FN: refers to the number of samples that are actually positive and are incorrectly classified as negative by the model.

[0123] TN (True Negative): The number of samples that are predicted to be negative and are actually negative.

[0124] TP (True Positive): The number of samples that are predicted to be positive and are actually positive.

[0125] Acc. (Accuracy): Accuracy measures the overall prediction correctness of the model. Accuracy = (TP+TN) / (FP+FN+TP+TN).

[0126] Prec. (Precision): The proportion of samples that are actually positive among all samples predicted to be positive. It measures the accuracy of the model in predicting positive samples. Precision = TP / (TP+FN).

[0127] Rec. (Recall): The proportion of samples that the model can correctly identify among all samples that are actually positive. It measures the model's ability in positive identification. Recall = TP / (TP+FN).

[0128] F1: The harmonic mean of precision and recall, used to weigh the relationship between the two. The F1 score is a comprehensive indicator that is suitable for situations where precision and recall are equally important. F1 = 2×(Precision×Recall) / (Precision+Recall).

[0129] The experimental results are shown in Table 1.

[0130] Table 1 Experimental results

[0131] Dataset method FP FN Acc. Prec. Rec. F1 Theia Method of the present invention 6 0 0.99 0.98 1.0 0.99 Theia POIROT 20 7 0.97 0.96 0.99 0.97

[0132] According to the experimental results in Table 1, it can be seen that the method of the present invention is superior to the existing vulnerability detection system POIROT based on graph matching in all aspects. The present application can achieve efficient and accurate vulnerability detection.

[0133] The present invention provides a CVE vulnerability detection method based on graph matching: (1) High accuracy. By constructing a provenance graph that reflects the real system behavior, the PoC code with known metadata information is constructed as a signature graph for graph alignment. The matching degree of the two is analyzed by matching the initial confidence score, so that the CVE vulnerability execution process can be detected with high accuracy, avoiding the high underreporting and high false positive problems of traditional vulnerability detection methods. (2) Reliable signature graph generation. The method adopts an abstract syntax tree-based method to enhance the PoC code structure, and uses data flow analysis (DFA) technology to generate multiple control flow graphs (CFGs) for different environments, and introduces the path triggered by specific variable states in the signature graph. (3) Strong scalability. By matching multiple signature graphs and retaining matching information in the provenance graph, most vulnerabilities can be detected at the same time, and new signature graphs can be added at any time to support the detection of new vulnerabilities, which has good scalability. (4) High efficiency. The signature graph can be automatically generated, which reduces the time of data preprocessing. At the same time, the rich information contained in the signature graph can not only fully describe the attack behavior, but also closely simulate the structure of the data provenance graph, thereby achieving highly effective matching.

[0134] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0135] The above-mentioned embodiments only express several implementation modes of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the invention. It should be pointed out that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the attached claims.

Claims

1. A CVE vulnerability detection method based on graph matching, characterized in that: The CVE vulnerability detection method based on graph matching includes: Extract multiple signature graphs based on the PoC code used to characterize the CVE vulnerability; Extract system call event data and build a provenance graph based on the system call event data; Based on the confidence of the nodes, the nodes in the signature graph are divided into different confidence levels, and the nodes and corresponding edges of the same confidence level in the signature graph are taken from high to low according to the confidence level. The nodes and edges taken in the signature graph are matched with the nodes and edges in the origin graph in combination with the maximum number of skipped intermediate nodes until the match is successful and one or more matching sets are output; For each matching set, the origin graph alignment score is calculated, and combined with the signature graph quality score to obtain the initial matching confidence score between the signature graph and the origin graph; Based on the maximum number of skipped intermediate nodes and the matching confidence scores of the signature graph and the origin graph, the minimum bypass score corresponding to the matching set is calculated; Subtract the minimum bypass score from the initial score of the matching confidence of the signature graph and the origin graph to obtain a final score of the matching confidence of the signature graph and the origin graph corresponding to the matching set; If the final score of the matching confidence between at least one signature graph and the origin graph exceeds the threshold, it means that the CVE vulnerability corresponding to the signature graph exists in the origin graph; otherwise, there is no CVE vulnerability corresponding to the signature graph; The step of extracting multiple signature graphs according to the PoC code for characterizing the CVE vulnerability includes: Simulate the execution of the PoC code and obtain the abstract syntax tree generated during the simulation execution; Extract the path of each function in the abstract syntax tree, compress the extracted path, and create a control flow node based on the key code block or key statement in the compressed path; Extract Import statements and function call nodes from the PoC code, and filter and retain the function call nodes that are system calls; Add function edges to control flow nodes, and perform data flow propagation based on the control flow nodes after adding function edges to obtain the transmission and dependency relationship between data; Based on the extracted Import statements, the retained function call nodes, the control flow nodes after adding function edges, and the transfer and dependency relationships between data, multiple signature graphs are generated using execution tracing technology.

2. The CVE vulnerability detection method based on graph matching according to claim 1, characterized in that: The nodes in the signature graph are divided into different confidence levels based on the confidence of the nodes, including: Confidence division of nodes: set the confidence of nodes that exist in more than half of the CVE vulnerabilities to high confidence; set the confidence of nodes that exist in every detectable PoC code to medium confidence; and set the remaining nodes to low confidence; Confidence level division of nodes in the signature graph: nodes in the signature graph that show consistent patterns in different PoC codes of the same CVE vulnerability and have high confidence are divided into high confidence levels; nodes in the signature graph that are identified by unique but variable identifiers and have medium confidence are divided into medium confidence levels; nodes in the signature graph other than high confidence levels and medium confidence levels are divided into low confidence levels.

3. The CVE vulnerability detection method based on graph matching according to claim 1 is characterized in that: The step of matching the nodes and edges taken from the signature graph with the nodes and edges in the origin graph in combination with the maximum number of skipped intermediate nodes includes: Take the first node and the corresponding edge in the signature graph and match them with the nodes and edges in the origin graph. If the match is successful, mark the successfully matched node in the origin graph as the first matching node; otherwise, the match fails and ends; Based on the first matching node, the second node in the signature graph and the corresponding edge are matched with the one-hop neighbor node, two-hop neighbor node, ..., the maximum number of skipped intermediate nodes plus the one-hop neighbor node of the first matching node in the origin graph. If the match is successful, the successfully matched node in the origin graph is marked as the second matching node; otherwise, the match fails and ends; Based on the second matching node, the third node in the signature graph and the corresponding edge are matched with the one-hop neighbor node, two-hop neighbor node, ..., the maximum number of skipped intermediate nodes plus the one-hop neighbor node of the second matching node in the origin graph. If the match is successful, the node in the origin graph that is successfully matched is marked as the third matching node; otherwise, the match fails and ends; Continue to match the nodes and corresponding edges in the signature graph with the origin graph until all nodes in the signature graph are matched, and output each successfully matched path as a matching set.

4. The CVE vulnerability detection method based on graph matching according to claim 1 is characterized in that: For each matching set, the origin graph alignment score is calculated, and the initial matching confidence score of the signature graph and the origin graph is obtained by combining the signature graph quality score, including: Calculate the quality score of the signature graph: ； ； in, represents the quality score of the signature graph, Indicates the number of nodes with high confidence level in the signature graph, represents the weight of nodes with high confidence level, Indicates the number of nodes with medium confidence level in the signature graph, represents the weight of nodes with medium confidence level, Indicates the number of nodes with low confidence level in the signature graph, represents the weight of nodes with low confidence level, represents the quality score of the normalized signature graph, is the total number of nodes in the signature graph; Compute provenance graph alignment scores: ； ； ； in, Indicates that based on The node matching score obtained by the matching set is Indicates The number of nodes in the matching set, Indicates that based on The edge matching score obtained by the matching set is Indicates The number of edges in the matching set, is the total number of edges in the signature graph, Indicates that based on Provenance graph alignment scores obtained from the matching set; Calculate the matching confidence initial score: ； in, Indicates that based on The initial score of the matching confidence between the signature graph and the origin graph obtained from the matching set, is the quality score weight of the signature graph, is the provenance graph alignment score weight, .

5. The CVE vulnerability detection method based on graph matching according to claim 1 is characterized in that: The step of calculating the minimum bypass score corresponding to the matching set based on the maximum number of skipped intermediate nodes and the matching confidence scores of the signature graph and the origin graph includes: ； ； in, Indicates that based on The bypass score obtained by the matching set is is the scaling factor, Indicates the maximum number of intermediate nodes to be skipped. Indicates that the match is obtained The bypass frequency of the matching set, Indicates that based on The minimum bypass score obtained by matching sets, Indicates that based on The initial score of the matching confidence between the signature graph and the origin graph obtained from the matching set, Indicates the initial score of the matching confidence corresponding to the matching set obtained by skipping the number of intermediate nodes.

Images