Vulnerability attack chain updating method and device, equipment and storage medium
By building a new vulnerability entity sequence and finding matching vulnerability data, and updating vulnerability attack chains, the problem of different vulnerabilities in the existing technology needs to be redeveloped, and the efficiency and cost-effectiveness of vulnerability attack chain development are improved.
Patent Information
- Application Number
- CN202310813742.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2023-07-04
- Publication Date
- 2025-01-07
AI Technical Summary
In the prior art, vulnerability attack chains need to be redeveloped for different vulnerabilities, resulting in high cost and low efficiency, and developers need rich experience and time.
By building a new vulnerability entity sequence, finding matching vulnerability data, updating vulnerability attack chains, using new vulnerability intelligence data to build a knowledge graph, finding target vulnerability data based on analysis results, and updating the vulnerability attack chains accordingly.
It reduces the time and cost of vulnerability attack chain development, improves efficiency, and uses a small number of updates to generate vulnerability attack chains corresponding to new vulnerabilities, reducing the requirements for developers' experience.
Smart Images
Figure CN119276516A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network security technology, and in particular to a vulnerability attack chain updating method, device, equipment and storage medium. Background Art
[0002] In the field of network security, in order to verify whether there are corresponding vulnerabilities in the device, it is generally necessary to use a vulnerability attack chain to simulate attack verification. Different vulnerabilities have different attack exploitation methods, which means that for each vulnerability, it is necessary to develop a vulnerability attack program from scratch to form a simulated attack chain. This takes a lot of time and requires the developer of the attack program to have more experience in developing vulnerability exploit programs.
[0003] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention
[0004] The main purpose of the present invention is to provide a vulnerability attack chain updating method, device, equipment and storage medium, aiming to solve the technical problem that the vulnerability attack chain needs to be redeveloped for different vulnerabilities in the prior art, resulting in high costs.
[0005] To achieve the above object, the present invention provides a vulnerability attack chain update method, the method comprising the following steps:
[0006] Construct new vulnerability entity sequences based on new vulnerability intelligence data;
[0007] Searching for vulnerability data matching the new vulnerability entity sequence to obtain target vulnerability data;
[0008] The vulnerability attack chain corresponding to the target vulnerability data is updated according to the new vulnerability intelligence data.
[0009] Optionally, the step of constructing a new vulnerability entity sequence according to the new vulnerability intelligence data includes:
[0010] Determine the sequence entity order and sequence entity index according to the preset sequence construction rules;
[0011] Extract entity sets corresponding to each sequence entity indicator from new vulnerability intelligence data;
[0012] A new vulnerability entity sequence is constructed according to the entity set corresponding to each sequence entity indicator and the sequence entity order.
[0013] Optionally, before the step of constructing a new vulnerability entity sequence according to the new vulnerability intelligence data, the step further includes:
[0014] When vulnerability knowledge update is detected, vulnerability identification information corresponding to the new vulnerability knowledge is obtained;
[0015] Reading vulnerability intelligence data from at least one network security knowledge base according to the vulnerability identification information;
[0016] The vulnerability intelligence data is analyzed, and a vulnerability knowledge graph is constructed based on the analysis results to obtain new vulnerability intelligence data.
[0017] Optionally, the step of searching for vulnerability data matching the new vulnerability entity sequence to obtain target vulnerability data includes:
[0018] Obtaining a sequence structure corresponding to the new vulnerability entity sequence;
[0019] Searching in a preset vulnerability information database according to the sequence structure to determine a vulnerability data set to be matched;
[0020] The vulnerability data in the vulnerability data set to be matched are respectively compared with the new vulnerability intelligence data to determine the target vulnerability data.
[0021] Optionally, the step of comparing the vulnerability data in the vulnerability data set to be matched with the new vulnerability intelligence data to determine the target vulnerability data includes:
[0022] Traversing the vulnerability data set to be matched to obtain current matching vulnerability data;
[0023] Detecting whether the current matching vulnerability data and the new vulnerability intelligence data meet a preset matching condition;
[0024] At the end of the traversal, the vulnerability data that meets the preset matching condition in the vulnerability data set to be matched is used as the target vulnerability data.
[0025] Optionally, the step of detecting whether the current matching vulnerability data and the new vulnerability intelligence data meet a preset matching condition includes:
[0026] Traversing the new vulnerability entity sequence to obtain a current entity index;
[0027] Extracting the entity relationship set corresponding to the current entity indicator from the new vulnerability intelligence data to obtain a first entity relationship set;
[0028] Extracting the entity relationship set corresponding to the current entity indicator from the vulnerability data to be matched to obtain a second entity relationship set;
[0029] Determine a relationship comparison score according to the first entity relationship set and the second entity relationship set;
[0030] If the relationship comparison score is greater than or equal to the preset indicator score threshold, detecting whether the current entity indicator is the last indicator in the new vulnerability entity sequence;
[0031] If it is the last indicator, it is determined that the current matching vulnerability data and the new vulnerability intelligence data meet the preset matching condition.
[0032] Optionally, after the step of detecting whether the current entity indicator is the last indicator in the new vulnerability entity sequence if the relationship comparison score is greater than or equal to a preset indicator score threshold, the step further includes:
[0033] If it is not the last indicator, return to the step of traversing the new vulnerability entity sequence to obtain the current entity indicator.
[0034] Optionally, the step of determining a relationship comparison score according to the first entity relationship set and the second entity relationship set includes:
[0035] Obtaining an intersection of the first entity relationship set and the second entity relationship set to obtain a relationship intersection set;
[0036] A relationship comparison score is determined according to the relationship intersection set.
[0037] Optionally, the step of determining the relationship comparison score according to the relationship intersection set includes:
[0038] Obtaining the relationship type corresponding to each entity relationship in the relationship intersection set;
[0039] Determine the weight score corresponding to each entity relationship in the relationship intersection set according to the relationship type;
[0040] A relationship comparison score is determined according to the weight score.
[0041] Optionally, the step of updating the vulnerability attack chain corresponding to the target vulnerability data according to the new vulnerability intelligence data includes:
[0042] Find the vulnerability attack chain corresponding to the target vulnerability data;
[0043] Extracting a vulnerability exploit corresponding to the target vulnerability data from the vulnerability attack chain;
[0044] The vulnerability exploit program is updated according to the new vulnerability intelligence data to obtain a new vulnerability exploit program;
[0045] The vulnerability attack chain is updated according to the new vulnerability exploit.
[0046] Optionally, the step of searching for a vulnerability attack chain corresponding to the target vulnerability data includes:
[0047] Obtain vulnerability identification information corresponding to the target vulnerability data;
[0048] The vulnerability identification information is matched with a vulnerability exploitation list corresponding to each vulnerability attack chain in a preset attack chain library to determine the vulnerability attack chain corresponding to the target vulnerability data.
[0049] In addition, to achieve the above purpose, the present invention also proposes a vulnerability attack chain update device, which includes the following modules:
[0050] A construction module for constructing a new vulnerability entity sequence based on new vulnerability intelligence data;
[0051] A search module, used to search for vulnerability data matching the new vulnerability entity sequence to obtain target vulnerability data;
[0052] An update module is used to update the vulnerability attack chain corresponding to the target vulnerability data according to the new vulnerability intelligence data.
[0053] Optionally, the construction module is also used to determine the sequence entity order and sequence entity indicators according to preset sequence construction rules; extract the entity set corresponding to each sequence entity indicator from the new vulnerability intelligence data; and construct a new vulnerability entity sequence according to the entity set corresponding to each sequence entity indicator and the sequence entity order.
[0054] Optionally, the construction module is also used to obtain vulnerability identification information corresponding to new vulnerability knowledge when vulnerability knowledge update is detected; read vulnerability intelligence data from at least one network security knowledge base according to the vulnerability identification information; analyze the vulnerability intelligence data, construct a vulnerability knowledge graph based on the analysis results, and obtain new vulnerability intelligence data.
[0055] Optionally, the search module is also used to obtain a sequence structure corresponding to the new vulnerability entity sequence; search in a preset vulnerability information library according to the sequence structure to determine a vulnerability data set to be matched; and compare the vulnerability data in the vulnerability data set to be matched with the new vulnerability intelligence data to determine the target vulnerability data.
[0056] Optionally, the search module is also used to traverse the vulnerability data set to be matched to obtain current matching vulnerability data; detect whether the current matching vulnerability data and the new vulnerability intelligence data meet preset matching conditions; at the end of the traversal, use the vulnerability data in the vulnerability data set to be matched that meets the preset matching conditions as target vulnerability data.
[0057] Optionally, the search module is also used to traverse the new vulnerability entity sequence to obtain a current entity indicator; extract the entity relationship set corresponding to the current entity indicator from the new vulnerability intelligence data to obtain a first entity relationship set; extract the entity relationship set corresponding to the current entity indicator from the vulnerability data to be matched to obtain a second entity relationship set; determine a relationship comparison score based on the first entity relationship set and the second entity relationship set; if the relationship comparison score is greater than or equal to a preset indicator score threshold, detect whether the current entity indicator is the last indicator in the new vulnerability entity sequence; if it is the last indicator, determine that the current matching vulnerability data and the new vulnerability intelligence data meet a preset matching condition.
[0058] Optionally, the search module is further used to return to the step of traversing the new vulnerability entity sequence to obtain the current entity indicator if it is not the last indicator.
[0059] In addition, to achieve the above-mentioned purpose, the present invention also proposes a vulnerability attack chain update device, which includes: a processor, a memory, and a vulnerability attack chain update program stored in the memory and executable on the processor, and the vulnerability attack chain update program implements the steps of the vulnerability attack chain update method described above when executed.
[0060] In addition, to achieve the above-mentioned purpose, the present invention also proposes a computer-readable storage medium, on which a vulnerability attack chain update program is stored, and when the vulnerability attack chain update program is executed, the steps of the vulnerability attack chain update method described above are implemented.
[0061] The present invention constructs a new vulnerability entity sequence according to new vulnerability intelligence data; searches for vulnerability data matching the new vulnerability entity sequence to obtain target vulnerability data; and updates the vulnerability attack chain corresponding to the target vulnerability data according to the new vulnerability intelligence data. Since a new vulnerability entity sequence is constructed according to the new vulnerability intelligence data when the new vulnerability intelligence data is obtained, target vulnerability data highly similar to the new vulnerability is searched according to the new vulnerability entity sequence, and then the vulnerability attack chain corresponding to the target vulnerability data is updated according to the new vulnerability intelligence data. Since the target vulnerability data is highly similar to the new vulnerability, its attack means, attack mode and attack type are also very similar, it is ensured that a vulnerability attack chain corresponding to the new vulnerability can be generated with a small amount of updates. BRIEF DESCRIPTION OF THE DRAWINGS
[0062] Figure 1 It is a schematic diagram of the structure of an electronic device in a hardware operating environment involved in an embodiment of the present invention;
[0063] Figure 2It is a flowchart of the first embodiment of the vulnerability attack chain update method of the present invention;
[0064] Figure 3 A schematic diagram of a knowledge graph structure according to an embodiment of the present invention;
[0065] Figure 4 It is a flowchart of the second embodiment of the vulnerability attack chain updating method of the present invention;
[0066] Figure 5 It is a flowchart of the third embodiment of the vulnerability attack chain update method of the present invention;
[0067] Figure 6 It is a structural block diagram of the first embodiment of the vulnerability attack chain updating device of the present invention.
[0068] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION
[0069] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.
[0070] Reference Figure 1 , Figure 1 The figure is a schematic diagram of the structure of a vulnerability attack chain update device for a hardware operating environment involved in an embodiment of the present invention.
[0071] like Figure 1 As shown, the electronic device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a wireless fidelity (Wireless-Fidelity, WI-FI) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM), or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk storage. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.
[0072] Those skilled in the art will understand that Figure 1The structure shown in the figure does not constitute a limitation on the electronic device, and may include more or less components than shown in the figure, or combine certain components, or arrange the components differently.
[0073] like Figure 1 As shown, the memory 1005 as a storage medium may include an operating system, a network communication module, a user interface module, and a vulnerability attack chain update program.
[0074] exist Figure 1 In the electronic device shown, the network interface 1004 is mainly used for data communication with the network server; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the electronic device of the present invention can be set in a vulnerability attack chain update device, and the electronic device calls the vulnerability attack chain update program stored in the memory 1005 through the processor 1001, and executes the vulnerability attack chain update method provided by the embodiment of the present invention.
[0075] The embodiment of the present invention provides a vulnerability attack chain update method, referring to Figure 2 , Figure 2 The figure is a flow chart of a first embodiment of a vulnerability attack chain updating method of the present invention.
[0076] In this embodiment, the vulnerability attack chain update method includes the following steps:
[0077] Step S10: Construct a new vulnerability entity sequence based on the new vulnerability intelligence data.
[0078] It should be noted that the executor of this embodiment may be the vulnerability attack chain update device, and the vulnerability attack chain update device may be an electronic device such as a personal computer, a smart terminal or a server, or other devices that can achieve the same or similar functions. This embodiment is not limited to this. In this embodiment and the following embodiments, the vulnerability attack chain update method of the present invention is described by taking the vulnerability attack chain update device as an example.
[0079] It should be noted that the new vulnerability entity sequence can be a sequence composed of entity sets corresponding to multiple preset entity indicators in order. New vulnerability intelligence data can be data used to represent the attack information of newly emerged vulnerabilities, which may include real network attack implementation process (), vulnerability attack verification code (Proof of Concept, abbreviated as S), vulnerability intelligence information (Vulnerability, abbreviated as V), software vulnerability (Weakness, abbreviated as W), software attack characteristics (Attack Pattern, abbreviated as C), software attack characteristics (Technique, abbreviated as T) and other information.
[0080] In the specific implementation, in order to facilitate subsequent processing and analysis, when constructing new vulnerability intelligence data, the information therein can be encapsulated and represented as entities. At this time, the entities involved can mainly include: Procedure, abbreviated as P, representing the attack implementation process; Proof of Concept (PoC), abbreviated as S, indicating the existence of vulnerability verification code; Vulnerability, abbreviated as V, representing vulnerability intelligence information; Weakness, abbreviated as W, representing software defects; AttackPattern, abbreviated as C, representing software attack characteristics; Technique, abbreviated as T, representing the attacker's attack technology.
[0081] At this time, the new vulnerability intelligence data may include a real network attack implementation process entity set, a vulnerability attack verification code entity set, a vulnerability intelligence entity set, a software vulnerability point entity set, a software attack feature entity set, and a software attack feature entity set.
[0082] In order to facilitate subsequent comparison, when constructing new vulnerability intelligence data, the relationship between entities can also be represented. At this time, a knowledge graph of the new vulnerability can be constructed and the constructed knowledge graph can be used as new vulnerability intelligence data.
[0083] For example: through G<P,S,V,W,C,T,E> The seven-tuple represents the knowledge graph;
[0084] Among them, P = {P1, P2, ... Pn} is a set of entities for the real network attack implementation process, which is composed of an attack kill chain through an ordered sequence;
[0085] S = {S1, S2, ... Sn} is a set of vulnerability attack proof of concept (PoC) entities;
[0086] V = {V1, V2, ... Vn} is a specific set of vulnerability intelligence entities, and the CVE vulnerability intelligence dataset can be used;
[0087] W = {W1, W2, ... Wn} is a set of software vulnerability entities, which can use the CWE dataset;
[0088] C = {C1, C2, ... Cn} is a set of software attack feature entities, which can use the CAPEC data set;
[0089] T = {T1, T2, ... Tn} is a set of software attack feature entities, which can use the ATT&CK dataset;
[0090] E=E PS ∪E SV ∪E VW ∪E WW ∪E CW ∪E CC ∪ECT It is the set of relationships between all entities in the knowledge graph.
[0091] For ease of understanding, now combined Figure 3 This is for illustration only, but not for limitation. Figure 3 is a schematic diagram of the knowledge graph structure of this embodiment, such as Figure 3 As shown in the figure, the entities in the constructed knowledge graph can be divided into seven categories according to their types: P, S, V, W, C, T, and E. The relationships between entities can be divided into many different types according to their relationship types, such as Use, PoCOf, ExampleOf, CanPrecede, ChildOf, Requires, StartWith, AttackOf, CanFollow, Map, etc.
[0092] Furthermore, in order to reasonably construct a new vulnerability entity sequence, step S10 in this embodiment may include:
[0093] Determine the sequence entity order and sequence entity index according to the preset sequence construction rules;
[0094] Extract entity sets corresponding to each sequence entity indicator from new vulnerability intelligence data;
[0095] A new vulnerability entity sequence is constructed according to the entity set corresponding to each sequence entity indicator and the sequence entity order.
[0096] It should be noted that when exploiting vulnerabilities to launch attacks, similar vulnerability intelligence, similar vulnerabilities, and similar attack characteristics are generally required. Therefore, when searching for similar vulnerabilities, it is not necessary to match all entities in the new vulnerability intelligence data. At this time, the administrator of the vulnerability attack chain update device can specify the entity indicators required for matching and the order of each entity indicator in the sequence by pre-setting preset sequence construction rules.
[0097] In actual use, the sequence entity indicator can be the entity indicator required to be used when constructing a new vulnerability entity sequence, for example: V, W, C, T are used as sequence entity indicators, and the sequence entity order can be the order of the sequence entity indicators in the sequence when constructing a new vulnerability entity sequence, for example: the sequence entity order is set to "VWCT".
[0098] In a specific implementation, the entity set corresponding to each sequence entity indicator can be extracted from the new vulnerability intelligence data, and then the entity set corresponding to the extracted sequence entity indicator can be assembled according to the sequence order of the sets specified in the sequence entity order in the sequence, thereby obtaining a new vulnerability entity sequence.
[0099] Furthermore, in order to ensure that the vulnerability intelligence included in the constructed new vulnerability intelligence data is as comprehensive as possible, before step S10 in this embodiment, the following may also be included:
[0100] When vulnerability knowledge update is detected, vulnerability identification information corresponding to the new vulnerability knowledge is obtained;
[0101] Reading vulnerability intelligence data from at least one network security knowledge base according to the vulnerability identification information;
[0102] The vulnerability intelligence data is analyzed, and a vulnerability knowledge graph is constructed based on the analysis results to obtain new vulnerability intelligence data.
[0103] It should be noted that when it is detected that the relevant knowledge of a new vulnerability is updated in any network security knowledge base, or when it is determined that new vulnerability knowledge is released from a vulnerability release forum, etc., it can be determined that the vulnerability knowledge is updated. The vulnerability identification information can be the unique identification information assigned to the vulnerability according to the rules in the network security field, and obtaining the vulnerability identification information corresponding to the new vulnerability knowledge can be parsing the new vulnerability knowledge to extract the vulnerability identification information therefrom.
[0104] In a specific implementation, the network security knowledge base can be pre-set by the administrator of the vulnerability attack chain update device, for example: setting four network security knowledge bases including CVE, CWE, CAPEC, and ATT&CK.
[0105] Among them, CVE stands for Common Vulnerability and Exposure, which is a list of publicly disclosed network security vulnerabilities. CWE stands for Common Weakness Enumeration, which is a universal online dictionary of computer software defects. CAPEC stands for Common Attack Pattern Enumeration and Classification, which is an attack type enumeration and classification data set. ATT&CK stands for Adversarial Tactics, Techniques, and Common Knowledge, which is a globally accessible knowledge base of network attack tactics and techniques based on real-world observations.
[0106] At this time, vulnerability intelligence data can be read from at least one network security knowledge base based on the vulnerability identification information, which can be data corresponding to the vulnerability identification information in four network security knowledge bases such as CVE, CWE, CAPEC, and ATT&CK to obtain vulnerability intelligence data.
[0107] In the specific implementation, the vulnerability intelligence data is analyzed, and a vulnerability knowledge graph is constructed based on the analysis results. New vulnerability intelligence data can be obtained by analyzing the vulnerability intelligence data using a machine learning clustering algorithm model, etc., to determine the various entities corresponding to the vulnerability intelligence data and the entity relationships between the entities, thereby constructing a vulnerability knowledge graph, and using the constructed vulnerability knowledge graph data as vulnerability intelligence data.
[0108] Step S20: searching for vulnerability data matching the new vulnerability entity sequence to obtain target vulnerability data.
[0109] It should be noted that searching for vulnerability data that matches the new vulnerability entity sequence and obtaining the target vulnerability data can be performed by searching in a preset vulnerability information library for vulnerability data whose entity relationships between corresponding entities are similar to the entity relationships between entities in the new vulnerability entity sequence, and using the found vulnerability data as the target vulnerability data.
[0110] Step S30: updating the vulnerability attack chain corresponding to the target vulnerability data according to the new vulnerability intelligence data.
[0111] It can be understood that the target vulnerability data is similar to the entity relationship between the entities of the new vulnerability intelligence data. At this time, the attack methods between the two vulnerabilities are relatively similar. Only a small amount of modification is required to the vulnerability attack program corresponding to the target vulnerability data to form a vulnerability attack program corresponding to the new vulnerability intelligence data. At this time, you can try to reuse the vulnerability attack chain corresponding to the target vulnerability data to avoid the need to write a vulnerability attack program from scratch.
[0112] In a specific implementation, updating the vulnerability attack chain corresponding to the target vulnerability data according to the new vulnerability intelligence data may be to update the code, parameters, etc. of the part of the vulnerability attack chain related to the target vulnerability data based on the attack code in the new vulnerability intelligence data.
[0113] This embodiment constructs a new vulnerability entity sequence according to the new vulnerability intelligence data; searches for vulnerability data that matches the new vulnerability entity sequence to obtain target vulnerability data; and updates the vulnerability attack chain corresponding to the target vulnerability data according to the new vulnerability intelligence data. Since a new vulnerability entity sequence is constructed according to the new vulnerability intelligence data when the new vulnerability intelligence data is obtained, target vulnerability data that is highly similar to the new vulnerability is searched according to the new vulnerability entity sequence, and then the vulnerability attack chain corresponding to the target vulnerability data is updated according to the new vulnerability intelligence data. Since the target vulnerability data is highly similar to the new vulnerability, its attack means, attack method and attack type are also very similar, it is ensured that the vulnerability attack chain corresponding to the new vulnerability can be generated with a small amount of updates.
[0114] refer to Figure 4 , Figure 4The figure is a flow chart of a second embodiment of a vulnerability attack chain updating method of the present invention.
[0115] Based on the first embodiment, step S20 of the vulnerability attack chain update method of this embodiment includes:
[0116] Step S201: Obtain a sequence structure corresponding to the new vulnerability entity sequence.
[0117] It should be noted that the sequence structure may include structural information such as entity type, entity quantity, and sequence of each entity in the new vulnerability entity sequence.
[0118] Step S202: searching in a preset vulnerability information database according to the sequence structure to determine a vulnerability data set to be matched.
[0119] It should be noted that searching in a preset vulnerability information library according to the sequence structure to determine the vulnerability data set to be matched can be to search in the preset vulnerability information library for vulnerability information whose sequence structure of the corresponding vulnerability entity sequence is the same as the sequence structure of the new vulnerability entity sequence, and aggregate the found vulnerability information to obtain the vulnerability data set to be matched.
[0120] Step S203: performing relationship comparison between the vulnerability data in the vulnerability data set to be matched and the new vulnerability intelligence data respectively to determine the target vulnerability data.
[0121] It should be noted that the vulnerability data in the vulnerability data set to be matched are respectively compared with the new vulnerability intelligence data, and the target vulnerability data can be determined by comparing the entity relationships between the entities corresponding to the vulnerability data in the vulnerability data set to be matched with the entity relationships between the entities contained in the new vulnerability intelligence data, and determining the target vulnerability data according to the comparison results.
[0122] In a specific implementation, a traversal method may be used when comparing the relationship between the vulnerability data in the vulnerability data set to be matched and the new vulnerability intelligence data. In this case, step S203 of this embodiment may include:
[0123] Traversing the vulnerability data set to be matched to obtain current matching vulnerability data;
[0124] Detecting whether the current matching vulnerability data and the new vulnerability intelligence data meet a preset matching condition;
[0125] At the end of the traversal, the vulnerability data that meets the preset matching condition in the vulnerability data set to be matched is used as the target vulnerability data.
[0126] It should be noted that traversing the to-be-matched vulnerability data set to obtain the current matching vulnerability data may be traversing the to-be-matched vulnerability data set and using the traversed vulnerability data as the current matching vulnerability data.
[0127] In actual use, the preset matching conditions can be set in advance by the administrator of the vulnerability attack chain update device. If the vulnerability data and the new vulnerability intelligence data meet the preset matching conditions, it means that the difference between the vulnerability data and the new vulnerability intelligence data is small. When building a vulnerability attack program, the structure of the constructed vulnerability attack program is also similar. Therefore, the vulnerability data that meets the preset matching conditions can be used as the target vulnerability data to try to reuse the vulnerability attack chain.
[0128] In a specific implementation, the step of detecting whether the current matching vulnerability data and the new vulnerability intelligence data meet a preset matching condition in this embodiment may include:
[0129] Traversing the new vulnerability entity sequence to obtain a current entity index;
[0130] Extracting the entity relationship set corresponding to the current entity indicator from the new vulnerability intelligence data to obtain a first entity relationship set;
[0131] Extracting the entity relationship set corresponding to the current entity indicator from the vulnerability data to be matched to obtain a second entity relationship set;
[0132] Determine a relationship comparison score according to the first entity relationship set and the second entity relationship set;
[0133] If the relationship comparison score is greater than or equal to the preset indicator score threshold, detecting whether the current entity indicator is the last indicator in the new vulnerability entity sequence;
[0134] If it is the last indicator, it is determined that the current matching vulnerability data and the new vulnerability intelligence data meet the preset matching condition.
[0135] It should be noted that traversing the new vulnerability entity sequence and obtaining the current entity index can be to obtain the sequence entity order and sequence entity index corresponding to the new vulnerability entity sequence, traverse the sequence entity index according to the sequence view order, and use the traversed sequence entity index as the current entity index.
[0136] In a specific implementation, the entity relationship set corresponding to the current entity indicator is extracted from the new vulnerability intelligence data, and the first entity relationship set is obtained by extracting the relationship set of entities related to the current entity indicator from the new vulnerability intelligence data, thereby obtaining the first entity set. For example, assuming that the current entity indicator is W, the entity relationship set contained in the new vulnerability intelligence data is E=E PS∪E SV ∪E VW ∪E WW ∪E CW ∪E CC ∪E CT , then the first entity set = E VW ∪E WW ∪E CW Similarly, the method for obtaining the second entity relationship set is the same as the method for obtaining the first entity set, which will not be described in detail here.
[0137] It should be noted that the relationship comparison score can be a quantitative score used to represent the similarity between the entity relationships in the first entity relationship set and the second entity relationship set. The larger the relationship comparison score, the higher the similarity between the entity relationships in the first entity relationship set and the second entity relationship set. The preset indicator score threshold can be pre-set by the administrator of the vulnerability attack chain update device according to actual needs, and different preset indicator score thresholds can be set for different sequence entity indicators.
[0138] In actual use, if the relationship comparison score is less than the preset indicator score threshold, it means that at this time, for the current entity indicator, the entity relationship similarity between the new vulnerability intelligence data and the vulnerability data to be matched is low. At this time, it can be directly determined that the current matching vulnerability data and the new vulnerability intelligence data do not meet the preset matching conditions to reduce unnecessary matching actions and save device resources. At this time, it is possible to directly return to the step of traversing the vulnerability data set to be matched to obtain the current matching vulnerability data.
[0139] If the relationship comparison score is greater than or equal to the preset indicator score threshold, it means that at this time, for the current entity indicator, the entity relationship similarity between the new vulnerability intelligence data and the vulnerability data to be matched exceeds the preset threshold, then it can be detected whether the current entity indicator is the last indicator in the new vulnerability entity sequence. If it is not the last indicator, it can return to the step of traversing the new vulnerability entity sequence to obtain the current entity indicator, and continue to compare the entity relationship corresponding to the next entity indicator;
[0140] If it is the last indicator, it means that for all sequence entity indicators in the new vulnerability entity sequence, the similarity of the entity relationship contained in the new vulnerability intelligence data and the vulnerability data to be matched exceeds the preset threshold, and the difference between the new vulnerability intelligence data and the vulnerability data to be matched is small, and the two are relatively close. Therefore, it can be determined that the current matching vulnerability data and the new vulnerability intelligence data meet the preset matching conditions.
[0141] In a specific implementation, since the relationship between entities involves the type and connection relationship of the entities, it is too complicated to directly determine whether they are similar, and the calculation time is long. In order to quickly and reasonably calculate the relationship comparison score, the step of determining the relationship comparison score according to the first entity relationship set and the second entity relationship set in this embodiment may include:
[0142] Obtaining an intersection of the first entity relationship set and the second entity relationship set to obtain a relationship intersection set;
[0143] A relationship comparison score is determined according to the relationship intersection set.
[0144] It should be noted that obtaining the intersection of the first entity relationship set and the second entity relationship set to obtain the relationship intersection set may be to obtain entity relationships that exist in both the first entity relationship set and the second entity relationship set, and aggregate the obtained entities into a set to obtain the relationship intersection set.
[0145] In actual use, determining the relationship comparison score according to the relationship intersection set may be to count the number of entity relationships included in the relationship intersection set, thereby obtaining the relationship comparison score.
[0146] Furthermore, since the importance of different types of entity relationships is also different, in order to reasonably set the relationship comparison score, the step of determining the relationship comparison score according to the relationship intersection set in this embodiment may include:
[0147] Obtaining the relationship type corresponding to each entity relationship in the relationship intersection set;
[0148] Determine the weight score corresponding to each entity relationship in the relationship intersection set according to the relationship type;
[0149] A relationship comparison score is determined according to the weight score.
[0150] It should be noted that relationship types can be divided into many different types according to the relationship between two entities, such as Use, PoCOf, ExampleOf, CanPrecede, ChildOf, Requires, StartWith, AttackOf, CanFollow, Map, etc.
[0151] In actual use, determining the corresponding weight score according to the relationship type may be to search for the weight score corresponding to the relationship type in a preset type score mapping table.
[0152] Among them, the preset type score mapping table may include a mapping relationship between each relationship type and a weight score, which may be pre-set by the administrator of the vulnerability attack chain update device, for example: setting the weight score corresponding to the Use relationship type to 10, setting the weight score corresponding to the ChildOf relationship type to 3, and so on.
[0153] In actual use, determining the relationship comparison score according to the weight score may be to sum the weight scores corresponding to the entity relationships in the relationship intersection set, and use the sum as the relationship comparison score.
[0154] This embodiment obtains the sequence structure corresponding to the new vulnerability entity sequence; searches in the preset vulnerability information library according to the sequence structure to determine the vulnerability data set to be matched; and compares the vulnerability data in the vulnerability data set to be matched with the new vulnerability intelligence data to determine the target vulnerability data. Since the search is first performed according to the sequence structure to determine the vulnerability data set to be matched, and then the found vulnerability data is compared with the new vulnerability intelligence data, the number of vulnerabilities that need to be compared can be greatly reduced, reducing unnecessary performance consumption.
[0155] refer to Figure 5 , Figure 5 The figure is a flow chart of a third embodiment of a vulnerability attack chain updating method of the present invention.
[0156] Based on the first embodiment, step S30 of the vulnerability attack chain update method of this embodiment includes:
[0157] Step S301: searching for a vulnerability attack chain corresponding to the target vulnerability data.
[0158] It should be noted that searching for the vulnerability attack chain corresponding to the target vulnerability data may be searching for the vulnerability attack chain that exploits the target vulnerability data when attacking in a preset attack chain library. The preset attack chain library may be a database for storing vulnerability attack chains, which may be pre-set by an administrator of a vulnerability attack chain update device.
[0159] Further, in order to quickly find the vulnerability attack chain corresponding to the target vulnerability data, step S301 in this embodiment may include:
[0160] Obtain vulnerability identification information corresponding to the target vulnerability data;
[0161] The vulnerability identification information is matched with a vulnerability exploitation list corresponding to each vulnerability attack chain in a preset attack chain library to determine the vulnerability attack chain corresponding to the target vulnerability data.
[0162] It should be noted that, in order to facilitate searching, when building a vulnerability attack chain, the administrator of the vulnerability attack chain update device can set a corresponding vulnerability exploitation list for the vulnerability attack chain, and store the vulnerability exploitation list in association with the vulnerability attack chain, where the vulnerability exploitation list can include vulnerability identification information of the vulnerability exploited by the vulnerability attack chain when launching an attack.
[0163] In actual use, the vulnerability identification information is matched with the exploit list corresponding to each vulnerability attack chain in the preset attack chain library to determine the vulnerability attack chain corresponding to the target vulnerability data. The vulnerability identification information is matched with the exploit list corresponding to each vulnerability attack chain in the preset attack chain library, and the vulnerability attack chain in the exploit list in the preset attack chain library that contains the vulnerability identification information corresponding to the target vulnerability data is used as the vulnerability attack chain corresponding to the target vulnerability data.
[0164] Step S302: extracting a vulnerability exploit corresponding to the target vulnerability data from the vulnerability attack chain.
[0165] It should be noted that extracting the vulnerability exploit corresponding to the target vulnerability data from the vulnerability attack chain may be extracting a portion of the attack program related to the target vulnerability data from the vulnerability attack chain, thereby obtaining the vulnerability exploit corresponding to the target vulnerability data.
[0166] Step S303: updating the vulnerability exploit program according to the new vulnerability intelligence data to obtain a new vulnerability exploit program.
[0167] In actual use, the vulnerability exploit program is updated according to the new vulnerability intelligence data. The new vulnerability exploit program can be obtained by modifying the code and / or parameters in the vulnerability exploit program according to the attack method, attack means, attack code, etc. recorded in the new vulnerability intelligence data, so as to obtain the new vulnerability exploit program.
[0168] Step S304: updating the vulnerability attack chain according to the new vulnerability exploit program.
[0169] It should be noted that updating the vulnerability attack chain according to the new vulnerability exploit may be to replace the vulnerability exploit corresponding to the target vulnerability data included in the vulnerability attack chain with the new vulnerability exploit.
[0170] This embodiment searches for the vulnerability attack chain corresponding to the target vulnerability data; extracts the vulnerability exploit corresponding to the target vulnerability data from the vulnerability attack chain; updates the vulnerability exploit according to the new vulnerability intelligence data to obtain a new vulnerability exploit; and updates the vulnerability attack chain according to the new vulnerability exploit. After obtaining the vulnerability attack chain corresponding to the target vulnerability data, the vulnerability exploit is first obtained from the part of the program related to the target vulnerability data in the vulnerability attack chain, and then the vulnerability exploit is updated according to the new vulnerability intelligence data, and the new vulnerability exploit obtained after the update is replaced in the vulnerability attack chain, ensuring that the vulnerability attack chain corresponding to the new vulnerability can be constructed with a small amount of updates, ensuring that the latest vulnerability intelligence can be quickly converted into a usable vulnerability attack program, and replacing the outdated vulnerability attack program in the replaceable simulated attack chain conditions.
[0171] In addition, an embodiment of the present invention further proposes a storage medium, on which a vulnerability attack chain update program is stored. When the vulnerability attack chain update program is executed by a processor, the steps of the vulnerability attack chain update method described above are implemented.
[0172] Reference Figure 6 , Figure 6 It is a structural block diagram of the first embodiment of the vulnerability attack chain updating device of the present invention.
[0173] like Figure 6 As shown, the vulnerability attack chain updating device proposed in the embodiment of the present invention includes:
[0174] A construction module 10 is used to construct a new vulnerability entity sequence according to the new vulnerability intelligence data;
[0175] A search module 20 is used to search for vulnerability data matching the new vulnerability entity sequence to obtain target vulnerability data;
[0176] The updating module 30 is used to update the vulnerability attack chain corresponding to the target vulnerability data according to the new vulnerability intelligence data.
[0177] This embodiment constructs a new vulnerability entity sequence according to the new vulnerability intelligence data; searches for vulnerability data that matches the new vulnerability entity sequence to obtain target vulnerability data; and updates the vulnerability attack chain corresponding to the target vulnerability data according to the new vulnerability intelligence data. Since a new vulnerability entity sequence is constructed according to the new vulnerability intelligence data when the new vulnerability intelligence data is obtained, target vulnerability data that is highly similar to the new vulnerability is searched according to the new vulnerability entity sequence, and then the vulnerability attack chain corresponding to the target vulnerability data is updated according to the new vulnerability intelligence data. Since the target vulnerability data is highly similar to the new vulnerability, its attack means, attack method and attack type are also very similar, it is ensured that the vulnerability attack chain corresponding to the new vulnerability can be generated with a small amount of updates.
[0178] Furthermore, the construction module 10 is also used to determine the sequence entity order and sequence entity indicators according to preset sequence construction rules; extract the entity set corresponding to each sequence entity indicator from the new vulnerability intelligence data; and construct a new vulnerability entity sequence according to the entity set corresponding to each sequence entity indicator and the sequence entity order.
[0179] Furthermore, the construction module 10 is also used to obtain vulnerability identification information corresponding to new vulnerability knowledge when vulnerability knowledge update is detected; read vulnerability intelligence data from at least one network security knowledge base according to the vulnerability identification information; analyze the vulnerability intelligence data, construct a vulnerability knowledge graph based on the analysis results, and obtain new vulnerability intelligence data.
[0180] Furthermore, the search module 20 is also used to obtain the sequence structure corresponding to the new vulnerability entity sequence; search in a preset vulnerability information library according to the sequence structure to determine the vulnerability data set to be matched; compare the vulnerability data in the vulnerability data set to be matched with the new vulnerability intelligence data respectively to determine the target vulnerability data.
[0181] Furthermore, the search module 20 is also used to traverse the vulnerability data set to be matched to obtain current matching vulnerability data; detect whether the current matching vulnerability data and the new vulnerability intelligence data meet the preset matching conditions; at the end of the traversal, the vulnerability data in the vulnerability data set to be matched that meets the preset matching conditions is used as the target vulnerability data.
[0182] Furthermore, the search module 20 is also used to traverse the new vulnerability entity sequence to obtain a current entity indicator; extract the entity relationship set corresponding to the current entity indicator from the new vulnerability intelligence data to obtain a first entity relationship set; extract the entity relationship set corresponding to the current entity indicator from the vulnerability data to be matched to obtain a second entity relationship set; determine a relationship comparison score based on the first entity relationship set and the second entity relationship set; if the relationship comparison score is greater than or equal to a preset indicator score threshold, detect whether the current entity indicator is the last indicator in the new vulnerability entity sequence; if it is the last indicator, determine that the current matching vulnerability data and the new vulnerability intelligence data meet the preset matching conditions.
[0183] Furthermore, the search module 20 is also used to return to the step of traversing the new vulnerability entity sequence to obtain the current entity indicator if it is not the last indicator.
[0184] Furthermore, the search module 20 is further configured to obtain an intersection of the first entity relationship set and the second entity relationship set to obtain a relationship intersection set; and determine a relationship comparison score according to the relationship intersection set.
[0185] Furthermore, the search module 20 is also used to obtain the relationship type corresponding to each entity relationship in the relationship intersection set; determine the weight score corresponding to each entity relationship in the relationship intersection set according to the relationship type; and determine the relationship comparison score according to the weight score.
[0186] Furthermore, the update module 30 is also used to find the vulnerability attack chain corresponding to the target vulnerability data; extract the vulnerability exploitation program corresponding to the target vulnerability data from the vulnerability attack chain; update the vulnerability exploitation program according to the new vulnerability intelligence data to obtain a new vulnerability exploitation program; and update the vulnerability attack chain according to the new vulnerability exploitation program.
[0187] Furthermore, the update module 30 is also used to obtain vulnerability identification information corresponding to the target vulnerability data; match the vulnerability identification information with the exploitation vulnerability list corresponding to each vulnerability attack chain in the preset attack chain library to determine the vulnerability attack chain corresponding to the target vulnerability data.
[0188] It should be understood that the above is only an example and does not constitute any limitation on the technical solution of the present invention. In specific applications, technicians in this field can make settings as needed, and the present invention does not limit this.
[0189] It should be noted that the workflow described above is merely illustrative and does not limit the scope of protection of the present invention. In practical applications, technicians in this field can select part or all of them according to actual needs to achieve the purpose of the present embodiment, and no limitation is made here.
[0190] In addition, for technical details not fully described in this embodiment, reference can be made to the vulnerability attack chain updating method provided in any embodiment of the present invention, and will not be repeated here.
[0191] In addition, it should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.
[0192] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.
[0193] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory (ROM) / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.
[0194] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.
[0195] The present invention discloses A1, a vulnerability attack chain updating method, the vulnerability attack chain updating method comprising the following steps:
[0196] Construct new vulnerability entity sequences based on new vulnerability intelligence data;
[0197] Searching for vulnerability data matching the new vulnerability entity sequence to obtain target vulnerability data;
[0198] The vulnerability attack chain corresponding to the target vulnerability data is updated according to the new vulnerability intelligence data.
[0199] A2. In the vulnerability attack chain updating method described in A1, the step of constructing a new vulnerability entity sequence according to the new vulnerability intelligence data comprises:
[0200] Determine the sequence entity order and sequence entity index according to the preset sequence construction rules;
[0201] Extract entity sets corresponding to each sequence entity indicator from new vulnerability intelligence data;
[0202] A new vulnerability entity sequence is constructed according to the entity set corresponding to each sequence entity indicator and the sequence entity order.
[0203] A3. The vulnerability attack chain updating method as described in A2, before the step of constructing a new vulnerability entity sequence according to the new vulnerability intelligence data, further includes:
[0204] When vulnerability knowledge update is detected, vulnerability identification information corresponding to the new vulnerability knowledge is obtained;
[0205] Reading vulnerability intelligence data from at least one network security knowledge base according to the vulnerability identification information;
[0206] The vulnerability intelligence data is analyzed, and a vulnerability knowledge graph is constructed based on the analysis results to obtain new vulnerability intelligence data.
[0207] A4. In the vulnerability attack chain updating method described in A1, the step of searching for vulnerability data matching the new vulnerability entity sequence to obtain target vulnerability data comprises:
[0208] Obtaining a sequence structure corresponding to the new vulnerability entity sequence;
[0209] Searching in a preset vulnerability information database according to the sequence structure to determine a vulnerability data set to be matched;
[0210] The vulnerability data in the vulnerability data set to be matched are respectively compared with the new vulnerability intelligence data to determine the target vulnerability data.
[0211] A5. The vulnerability attack chain updating method as described in A4, wherein the step of comparing the vulnerability data in the vulnerability data set to be matched with the new vulnerability intelligence data to determine the target vulnerability data comprises:
[0212] Traversing the vulnerability data set to be matched to obtain current matching vulnerability data;
[0213] Detecting whether the current matching vulnerability data and the new vulnerability intelligence data meet a preset matching condition;
[0214] At the end of the traversal, the vulnerability data that meets the preset matching condition in the vulnerability data set to be matched is used as the target vulnerability data.
[0215] A6. In the vulnerability attack chain updating method described in A5, the step of detecting whether the current matching vulnerability data and the new vulnerability intelligence data meet a preset matching condition comprises:
[0216] Traversing the new vulnerability entity sequence to obtain a current entity index;
[0217] Extracting the entity relationship set corresponding to the current entity indicator from the new vulnerability intelligence data to obtain a first entity relationship set;
[0218] Extracting the entity relationship set corresponding to the current entity indicator from the vulnerability data to be matched to obtain a second entity relationship set;
[0219] Determine a relationship comparison score according to the first entity relationship set and the second entity relationship set;
[0220] If the relationship comparison score is greater than or equal to the preset indicator score threshold, detecting whether the current entity indicator is the last indicator in the new vulnerability entity sequence;
[0221] If it is the last indicator, it is determined that the current matching vulnerability data and the new vulnerability intelligence data meet the preset matching condition.
[0222] A7. The vulnerability attack chain updating method as described in A6, after the step of detecting whether the current entity indicator is the last indicator in the new vulnerability entity sequence if the relationship comparison score is greater than or equal to the preset indicator score threshold, further includes:
[0223] If it is not the last indicator, return to the step of traversing the new vulnerability entity sequence to obtain the current entity indicator.
[0224] A8. The vulnerability attack chain updating method as described in A6, wherein the step of determining the relationship comparison score according to the first entity relationship set and the second entity relationship set comprises:
[0225] Obtaining an intersection of the first entity relationship set and the second entity relationship set to obtain a relationship intersection set;
[0226] A relationship comparison score is determined according to the relationship intersection set.
[0227] A9. In the vulnerability attack chain updating method described in A8, the step of determining the relationship comparison score according to the relationship intersection set comprises:
[0228] Obtaining the relationship type corresponding to each entity relationship in the relationship intersection set;
[0229] Determine the weight score corresponding to each entity relationship in the relationship intersection set according to the relationship type;
[0230] A relationship comparison score is determined according to the weight score.
[0231] A10. In the vulnerability attack chain updating method as described in any one of A1 to A9, the step of updating the vulnerability attack chain corresponding to the target vulnerability data according to the new vulnerability intelligence data comprises:
[0232] Find the vulnerability attack chain corresponding to the target vulnerability data;
[0233] Extracting a vulnerability exploit corresponding to the target vulnerability data from the vulnerability attack chain;
[0234] The vulnerability exploit program is updated according to the new vulnerability intelligence data to obtain a new vulnerability exploit program;
[0235] The vulnerability attack chain is updated according to the new vulnerability exploit.
[0236] A11. In the vulnerability attack chain updating method described in A10, the step of searching for the vulnerability attack chain corresponding to the target vulnerability data comprises:
[0237] Obtain vulnerability identification information corresponding to the target vulnerability data;
[0238] The vulnerability identification information is matched with a vulnerability exploitation list corresponding to each vulnerability attack chain in a preset attack chain library to determine the vulnerability attack chain corresponding to the target vulnerability data.
[0239] The present invention also discloses B12, a vulnerability attack chain update device, the vulnerability attack chain update device comprising the following modules:
[0240] A construction module for constructing a new vulnerability entity sequence based on new vulnerability intelligence data;
[0241] A search module, used to search for vulnerability data matching the new vulnerability entity sequence to obtain target vulnerability data;
[0242] An update module is used to update the vulnerability attack chain corresponding to the target vulnerability data according to the new vulnerability intelligence data.
[0243] B13. In the vulnerability attack chain updating device as described in B12, the construction module is also used to determine the sequence entity order and sequence entity indicators according to a preset sequence construction rule; extract the entity set corresponding to each sequence entity indicator from the new vulnerability intelligence data; and construct a new vulnerability entity sequence according to the entity set corresponding to each sequence entity indicator and the sequence entity order.
[0244] B14. In the vulnerability attack chain updating device as described in B13, the construction module is further used to obtain vulnerability identification information corresponding to new vulnerability knowledge when vulnerability knowledge update is detected; read vulnerability intelligence data from at least one network security knowledge base according to the vulnerability identification information; analyze the vulnerability intelligence data, construct a vulnerability knowledge graph based on the analysis results, and obtain new vulnerability intelligence data.
[0245] B15. In the vulnerability attack chain updating device as described in B12, the search module is further used to obtain a sequence structure corresponding to the new vulnerability entity sequence; search in a preset vulnerability information library according to the sequence structure to determine a vulnerability data set to be matched; and compare the vulnerability data in the vulnerability data set to be matched with the new vulnerability intelligence data to determine the target vulnerability data.
[0246] B16. In the vulnerability attack chain updating device as described in B15, the search module is further used to traverse the vulnerability data set to be matched to obtain current matching vulnerability data; detect whether the current matching vulnerability data and the new vulnerability intelligence data meet the preset matching conditions; at the end of the traversal, use the vulnerability data in the vulnerability data set to be matched that meets the preset matching conditions as the target vulnerability data.
[0247] B17. In the vulnerability attack chain updating device as described in B16, the search module is further used to traverse the new vulnerability entity sequence to obtain a current entity indicator; extract the entity relationship set corresponding to the current entity indicator from the new vulnerability intelligence data to obtain a first entity relationship set; extract the entity relationship set corresponding to the current entity indicator from the vulnerability data to be matched to obtain a second entity relationship set; determine a relationship comparison score based on the first entity relationship set and the second entity relationship set; if the relationship comparison score is greater than or equal to a preset indicator score threshold, detect whether the current entity indicator is the last indicator in the new vulnerability entity sequence; if it is the last indicator, determine that the current matching vulnerability data and the new vulnerability intelligence data meet the preset matching conditions.
[0248] B18. In the vulnerability attack chain updating device as described in B17, the search module is further used to return to the step of traversing the new vulnerability entity sequence to obtain the current entity indicator if it is not the last indicator.
[0249] The present invention also discloses C19, a vulnerability attack chain update device, which includes: a processor, a memory, and a vulnerability attack chain update program stored in the memory and executable on the processor, and the vulnerability attack chain update program implements the steps of the vulnerability attack chain update method described above when executed.
[0250] The present invention also discloses D20, a computer-readable storage medium, on which a vulnerability attack chain update program is stored, and when the vulnerability attack chain update program is executed, the steps of the vulnerability attack chain update method as described above are implemented.
Claims
1. A vulnerability attack chain update method, characterized in that: The vulnerability attack chain update method comprises the following steps: Construct new vulnerability entity sequences based on new vulnerability intelligence data; Searching for vulnerability data matching the new vulnerability entity sequence to obtain target vulnerability data; The vulnerability attack chain corresponding to the target vulnerability data is updated according to the new vulnerability intelligence data.
2. The vulnerability attack chain updating method according to claim 1, characterized in that: The step of constructing a new vulnerability entity sequence according to the new vulnerability intelligence data includes: Determine the sequence entity order and sequence entity index according to the preset sequence construction rules; Extract entity sets corresponding to each sequence entity indicator from new vulnerability intelligence data; A new vulnerability entity sequence is constructed according to the entity set corresponding to each sequence entity indicator and the sequence entity order.
3. The vulnerability attack chain updating method according to claim 2, characterized in that: Before the step of constructing a new vulnerability entity sequence according to the new vulnerability intelligence data, the method further includes: When vulnerability knowledge update is detected, vulnerability identification information corresponding to the new vulnerability knowledge is obtained; Reading vulnerability intelligence data from at least one network security knowledge base according to the vulnerability identification information; The vulnerability intelligence data is analyzed, and a vulnerability knowledge graph is constructed based on the analysis results to obtain new vulnerability intelligence data.
4. The vulnerability attack chain updating method according to claim 1, characterized in that: The step of searching for vulnerability data matching the new vulnerability entity sequence to obtain target vulnerability data includes: Obtaining a sequence structure corresponding to the new vulnerability entity sequence; Searching in a preset vulnerability information database according to the sequence structure to determine a vulnerability data set to be matched; The vulnerability data in the vulnerability data set to be matched are respectively compared with the new vulnerability intelligence data to determine the target vulnerability data.
5. The vulnerability attack chain updating method according to claim 4, characterized in that: The step of comparing the vulnerability data in the vulnerability data set to be matched with the new vulnerability intelligence data to determine the target vulnerability data includes: Traversing the vulnerability data set to be matched to obtain current matching vulnerability data; Detecting whether the current matching vulnerability data and the new vulnerability intelligence data meet a preset matching condition; At the end of the traversal, the vulnerability data that meets the preset matching condition in the vulnerability data set to be matched is used as the target vulnerability data.
6. The vulnerability attack chain updating method according to claim 5, characterized in that: The step of detecting whether the current matching vulnerability data and the new vulnerability intelligence data meet a preset matching condition includes: Traversing the new vulnerability entity sequence to obtain a current entity index; Extracting the entity relationship set corresponding to the current entity indicator from the new vulnerability intelligence data to obtain a first entity relationship set; Extracting the entity relationship set corresponding to the current entity indicator from the vulnerability data to be matched to obtain a second entity relationship set; Determine a relationship comparison score according to the first entity relationship set and the second entity relationship set; If the relationship comparison score is greater than or equal to the preset indicator score threshold, detecting whether the current entity indicator is the last indicator in the new vulnerability entity sequence; If it is the last indicator, it is determined that the current matching vulnerability data and the new vulnerability intelligence data meet the preset matching condition.
7. The vulnerability attack chain updating method according to claim 6, characterized in that: After the step of detecting whether the current entity indicator is the last indicator in the new vulnerability entity sequence if the relationship comparison score is greater than or equal to the preset indicator score threshold, the method further includes: If it is not the last indicator, return to the step of traversing the new vulnerability entity sequence to obtain the current entity indicator.
8. A vulnerability attack chain update device, characterized in that: The vulnerability attack chain update device includes the following modules: A construction module for constructing a new vulnerability entity sequence based on new vulnerability intelligence data; A search module, used to search for vulnerability data matching the new vulnerability entity sequence to obtain target vulnerability data; An update module is used to update the vulnerability attack chain corresponding to the target vulnerability data according to the new vulnerability intelligence data.
9. A vulnerability attack chain update device, characterized in that: The vulnerability attack chain update device includes: a processor, a memory, and a vulnerability attack chain update program stored in the memory and executable on the processor. When the vulnerability attack chain update program is executed, the steps of the vulnerability attack chain update method according to any one of claims 1 to 7 are implemented.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a vulnerability attack chain update program, which, when executed, implements the steps of the vulnerability attack chain update method according to any one of claims 1 to 7.