Risk assessment method and device, electronic equipment and readable storage medium

Abstract

The invention discloses a risk assessment method and device, electronic equipment and a readable storage medium, and the method comprises the steps: obtaining vulnerability features of host vulnerabilities, the vulnerability features comprise finite discrete features and infinite discrete features, the finite discrete features are features with fixed classification, and the infinite discrete features are features with fixed classification; the infinite discrete features are features without fixed classification; the vulnerability features are input into a target model, a risk assessment result corresponding to the host vulnerability and output by the target model is obtained, and the target model is composed of a decision tree and used for outputting the risk assessment result corresponding to the input vulnerability features.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a risk assessment method, device, electronic device and readable storage medium. Background Art

[0002] Currently, vulnerability security risk assessment solutions include STRIDE threat modeling and FAIR quantitative assessment methods. STRIDE threat modeling is a qualitative analysis that requires technical experts to conduct manual analysis and assessment for each vulnerability, which is time-consuming and labor-intensive, and the assessment efficiency is not high. Some input values ​​of the FAIR quantitative assessment method come from expert judgment. Since each use of the model requires expert manual judgment input, the assessment efficiency is also not high. Summary of the invention

[0003] The present application discloses a risk assessment method, device, electronic device and readable storage medium, which can improve assessment efficiency.

[0004] In order to solve the above problems, this application adopts the following technical solutions: In a first aspect, an embodiment of the present application discloses a risk assessment method, comprising: obtaining vulnerability features of a host vulnerability, wherein the vulnerability features include finite discrete features and infinite discrete features, the finite discrete features are features with fixed classifications, and the infinite discrete features are features without fixed classifications; inputting the vulnerability features into a target model to obtain a risk assessment result corresponding to the host vulnerability output by the target model, wherein the target model is composed of a decision tree, and the target model is used to output a risk assessment result corresponding to the input vulnerability feature.

[0005] In a second aspect, an embodiment of the present application discloses a risk assessment device, comprising: an acquisition module, used to obtain vulnerability features of a host vulnerability, wherein the vulnerability features include finite discrete features and infinite discrete features, the finite discrete features are features with fixed classifications, and the infinite discrete features are features without fixed classifications; an acquisition module, used to input the vulnerability features into a target model, and obtain a risk assessment result corresponding to the host vulnerability output by the target model, wherein the target model is composed of a decision tree, and the target model is used to output a risk assessment result corresponding to the input vulnerability features.

[0006] In a third aspect, an embodiment of the present application provides an electronic device, which includes a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the program or instructions are executed by the processor, the steps of the method described in the first aspect are implemented.

[0007] In a fourth aspect, an embodiment of the present application provides a readable storage medium, on which a program or instruction is stored, and when the program or instruction is executed by a processor, the steps of the method described in the first aspect are implemented.

[0008] In a fifth aspect, an embodiment of the present application provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions, which, when executed by a computer, cause the computer to execute: the steps of the method described in the first aspect.

[0009] The technical solution adopted in this application can achieve the following beneficial effects: The embodiment of the present application provides a risk assessment method, by obtaining the vulnerability features of the host vulnerability, the vulnerability features include finite discrete features and infinite discrete features, the finite discrete features are features with fixed classifications, and the infinite discrete features are features without fixed classifications, and then the vulnerability features are input into a target model to obtain the risk assessment results corresponding to the host vulnerability output by the target model, the target model is composed of a decision tree, and the target model is used to output the risk assessment results corresponding to the input vulnerability features. Due to the use of the risk assessment method of the present application, manual participation is reduced, thereby reducing the assessment workload and improving the assessment efficiency. In addition, since the present application is based on the finite discrete features and infinite discrete features of the host vulnerability, the risk assessment results corresponding to the host vulnerability are determined, which can improve the accuracy of the risk assessment. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1 A schematic diagram of a risk assessment method disclosed in an embodiment of the present application; Figure 2 A training flow chart of a target model disclosed in an embodiment of the present application; Figure 3 A schematic diagram of the structure of a risk assessment device disclosed in an embodiment of the present application; Figure 4 A schematic diagram of the structure of an electronic device disclosed in an embodiment of the present application. DETAILED DESCRIPTION

[0011] The following will be combined with the drawings in the embodiments of the present application to clearly describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the present application belong to the scope of protection of this application.

[0012] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the terms used in this way are interchangeable where appropriate, so that the embodiments of the present application can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the electrically connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0013] The risk assessment method, device, electronic device and readable storage medium disclosed in the embodiments of the present application are described in detail below with reference to the accompanying drawings through specific embodiments and their application scenarios.

[0014] This application discloses a risk assessment method. Figure 1 FIG. 1 is a flow chart of a risk assessment method disclosed in an embodiment of the present application. Figure 1 As shown, the method comprises the following steps: S120. Obtain vulnerability features of the host vulnerability, wherein the vulnerability features include finite discrete features and infinite discrete features. The finite discrete features are features with fixed classifications, and the infinite discrete features are features without fixed classifications.

[0015] In this application, the vulnerability identifier of the host vulnerability may also be obtained, and the vulnerability identifier may be composed of a service, an IP, a port, a vulnerability name, and a CVE number. The host in this application is a service host.

[0016] S140, inputting the vulnerability feature into a target model, and obtaining a risk assessment result corresponding to the host vulnerability output by the target model, wherein the target model is composed of a decision tree, and the target model is used to output a risk assessment result corresponding to the input vulnerability feature.

[0017] In this application, the risk assessment result corresponding to the host vulnerability is one of high, medium, and low.

[0018] The embodiment of the present application provides a risk assessment method, by obtaining the vulnerability features of the host vulnerability, the vulnerability features include finite discrete features and infinite discrete features, the finite discrete features are features with fixed classifications, and the infinite discrete features are features without fixed classifications, and then the vulnerability features are input into a target model to obtain the risk assessment results corresponding to the host vulnerability output by the target model, the target model is composed of a decision tree, and the target model is used to output the risk assessment results corresponding to the input vulnerability features. Due to the use of the risk assessment method of the present application, manual participation is reduced, thereby reducing the assessment workload and improving the assessment efficiency. In addition, since the present application is based on the finite discrete features and infinite discrete features of the host vulnerability, the risk assessment results corresponding to the host vulnerability are determined, which can improve the accuracy of the risk assessment.

[0019] In one implementation, the infinite discrete features may include at least one of a vulnerability name and vulnerability information. The vulnerability name and vulnerability information are paragraphs and sentences. Since they have too many discrete values ​​and too many optional feature values, they cannot be directly classified and are features without fixed classification. In addition, the infinite discrete features may also include other features in the host vulnerability that meet the requirements of this application.

[0020] In one implementation, the finite discrete features may include at least one of the general level of vulnerability, whether it is an exposed asset, whether there is a public network mapping, service classification, application classification, and threat classification. The general level of vulnerability, whether it is an exposed asset, whether there is a public network mapping, service classification, application classification, and threat classification are discrete features, all of which have fixed classifications, and the number of classifications is limited. There are several discrete values, and they are divided into several classifications. In addition, the finite discrete features may also include other features in the host vulnerability that meet the requirements of this application.

[0021] In one implementation, before inputting the vulnerability feature into a target model to obtain a risk assessment result corresponding to the host vulnerability output by the target model, the process may further include: determining a first sentence vector corresponding to the infinite discrete feature; determining a category corresponding to the infinite discrete feature based on the first sentence vector, a benchmark sentence vector, and a distance interval of each group of classifications corresponding to the infinite discrete feature; inputting the vulnerability feature into a target model to obtain a risk assessment result corresponding to the host vulnerability output by the target model may include: inputting the finite discrete feature and the category corresponding to the infinite discrete feature into a target model to obtain a risk assessment result corresponding to the host vulnerability output by the target model.

[0022] It should be noted that when there is more than one infinite discrete feature, for example, the infinite discrete features include vulnerability names and vulnerability information, the first sentence vectors corresponding to each infinite discrete feature are determined respectively, and then the categories to which each infinite discrete feature belongs are determined respectively. Moreover, the reference sentence vectors and the distance intervals for each group of classifications corresponding to different infinite discrete features may also be different. In this application, infinite discrete features with similar information content and similar semantics are grouped into one category.

[0023] In one implementation manner, the determining the first sentence vector corresponding to the infinite discrete feature may include: determining the word vectors corresponding to each non-stop word in the infinite discrete feature; and determining the first sentence vector corresponding to the infinite discrete feature based on each of the word vectors.

[0024] In this application, all stop words in the infinite discrete feature can be removed first, such as words like "of", "obtained", "please", "this", etc., and then the word vectors corresponding to each non-stop word in the infinite discrete feature are determined, and the word vectors of each non-stop word are superimposed to obtain the first sentence vector corresponding to the infinite discrete feature. Since there are many ready-made corpora currently, a ready-made corpus can be directly selected to calculate the word vectors. Exemplarily, if the infinite discrete feature includes n non-stop words and a k-dimensional corpus is used, the first sentence vector corresponding to the infinite discrete feature is: s(x1,x2,...,x k )=w1(y1,y2,...,y k )+w2(z1,z2,...,z k )+...+w n (v1,v2,...,v k )。

[0025] In one implementation manner, the determining the category to which the infinite discrete feature belongs based on the first sentence vector, the reference sentence vector, and the distance interval for each group of classifications corresponding to the infinite discrete feature may include: determining the target distance between the first sentence vector and the reference sentence vector based on the first sentence vector and the reference sentence vector; and determining the category to which the infinite discrete feature belongs based on the target distance and the distance interval for each group of classifications corresponding to the infinite discrete feature.

[0026] Exemplarily, when the reference sentence vector is a=(x1,x2,...,x n ), the first sentence vector is b=(y1,y2,...,y n ), and the distance interval for each group of classifications corresponding to the infinite discrete feature is a constant D, the target distance between the first sentence vector and the reference sentence vector is determined to be , and then d abDivide by D and round to get j, then the infinite discrete feature belongs to the j+1th classification interval.

[0027] By adopting the solution of the present application, the accuracy of risk assessment can be improved by aggregating infinite discrete features into finite discrete features and then determining the risk assessment results corresponding to the host vulnerability.

[0028] In a possible implementation, the target model may be composed of multiple decision trees, and the target model outputs a target evaluation result as a risk assessment result corresponding to the input vulnerability features, wherein the multiple decision trees output multiple evaluation results, and the target evaluation result is the evaluation result that appears the most times among the multiple evaluation results. Exemplarily, the target model is composed of k decision trees, and the vulnerability features of the host vulnerability are respectively input into the k decision trees of the target model, and the k decision trees output k evaluation results, and among the k evaluation results, there are x evaluation results with high levels, y evaluation results with medium levels, and z evaluation results with low levels. If y and z are both less than x, then the target evaluation result output by the final target model is high. By adopting the solution of this embodiment, the accuracy of the risk assessment result output by the target model can be improved. It should be noted that the k decision trees can be obtained by training based on k training samples, and the k training samples can be obtained by randomly extracting k 70% of the historical data based on the historical data of the same time period.

[0029] In one implementation, before inputting the vulnerability feature into a target model to obtain a risk assessment result corresponding to the host vulnerability output by the target model, the method may also include: obtaining a plurality of training data and a plurality of test data, wherein the training data includes a first vulnerability feature of the host vulnerability and a first risk assessment result corresponding to the first vulnerability feature, the first vulnerability feature includes a finite discrete feature and an infinite discrete feature, and the test data includes a second vulnerability feature of the host vulnerability and a second risk assessment result corresponding to the second vulnerability feature, the second vulnerability feature includes a finite discrete feature and an infinite discrete feature; constructing a target model based on the plurality of training data; adjusting the target model based on the plurality of test data until an error between a target risk assessment result and the second risk assessment result is less than a preset threshold, wherein the target risk assessment result is a risk assessment result corresponding to the second vulnerability feature output by the target model.

[0030] It should be noted that the first vulnerability feature and the second vulnerability feature here are the same vulnerability features. The first and second here are only used to distinguish between training data and test data. The first risk assessment result and the second risk assessment result are both historical technical expert evaluation and analysis results. This application can obtain multiple historical data within a certain period of time, and then use 70% of the multiple historical data as training data and 30% of the multiple historical data as test data. The historical data is as follows:

[0031] Business, IP, port, vulnerability name and CVE number constitute the vulnerability identification of the host vulnerability, and the vulnerability general level, vulnerability name, vulnerability information, whether it is an exposed asset, whether there is a public network mapping, service classification, application classification and threat classification are the vulnerability characteristics of the host vulnerability. The technical expert evaluation and analysis results include high, medium and low categories. The technical expert evaluation and analysis results are used as the classification results of the final output of the training. In addition, after obtaining historical data, the vulnerability characteristics in the historical data can be divided into finite discrete characteristics and infinite discrete characteristics.

[0032] In one implementation, constructing a target model based on the multiple training data may include: determining a second sentence vector corresponding to each infinite discrete feature in the first vulnerability feature; determining the category corresponding to the infinite discrete feature based on the second sentence vector, a benchmark sentence vector, and a distance interval of each group of classifications corresponding to the infinite discrete feature, wherein the benchmark sentence vector is any one of the multiple second sentence vectors; and recursively generating a decision tree based on the multiple training data and the classification categories of each feature in the first vulnerability feature.

[0033] By adopting the solution of the present application, infinite discrete features are aggregated into finite discrete features, which can better perform classification training.

[0034] It should be noted that the specific implementation of determining the second sentence vector corresponding to the infinite discrete feature here is consistent with the specific implementation of determining the first sentence vector above, and the specific implementation of determining the category corresponding to the infinite discrete feature here is consistent with the specific implementation of determining the category corresponding to the infinite discrete feature above, and this application will not repeat them here. The maximum distance between the second sentence vector and the reference sentence vector is d max In the case of , the number of categories of this infinite discrete feature is d max / D, for example, when the infinite discrete feature is a vulnerability name, the number of categories of the vulnerability name is d max / D, the benchmark sentence vector corresponding to the vulnerability name is the second sentence vector corresponding to any one of the vulnerability names in the multiple training data.

[0035] In this application, a decision tree is recursively generated by calculating the Gini coefficient of each feature in multiple training data. Starting from the root node, the Gini coefficient is calculated for all features of all training data it contains, and the feature with the smallest Gini coefficient is selected as the node feature, and a child node is established. The above operation is then recursively performed on the child node until there are no more features that can be classified, and the tree construction stops.

[0036] Assume that multiple training data E include n training data, and there are V classification results of E, and the number of classification results is d1, d2, ..., d v For example, if the classification results of E include high risk assessment results and medium risk assessment results, then V is 2. For feature A, A has m values, namely a1, a2, ..., a m , the number of these m values ​​in E is an1, an2, ..., an m . a1 has i classification results in E, and their numbers are dn1, dn2, ..., dn i The Gini coefficient Gini(D,A) of feature A is calculated as follows: Gini(D,A)= Gini(D,a1)+ Gini(D,a2)+...+ Gini(D,a m ); Among them, Gini(D,a1)=1-( ) 2 -( ) 2 -...-( ) 2 .

[0037] It should be noted that feature A is any one of the eight vulnerability features mentioned above, and the m values ​​of A are a1, a2, ..., a m That is the classification category of feature A.

[0038] When the Gini coefficient of feature A is calculated to be the smallest, a subnode is established based on feature A, and E is divided into m data sets using the m values ​​of feature A, namely A-a1, A-a2, ..., Aa m Take one of the branches A-a1 as an example, calculate the Gini coefficients of the remaining features in A-a1, get the feature with the smallest Gini coefficient, such as B, and then use it to establish the next child node until there are no more features that can be classified. m It is also calculated in the same way. It should be noted that only one feature is selected each time the data set is divided.

[0039] It should be noted that the Gini coefficient represents the impurity of the model. The smaller the Gini coefficient, the higher the order of the set, the better the features and the better the classification effect.

[0040] The solution of this embodiment selects features based on the Gini coefficient to generate a decision tree. Compared with the traditional ID3 algorithm and C4.5 algorithm, which both select features based on the entropy model to calculate information gain or information gain ratio, it can reduce calculations and improve model training efficiency.

[0041] In one implementation, adjusting the target model based on the multiple test data until the error between the target risk assessment result and the second risk assessment result is less than a preset threshold may include: when the error between the target risk assessment result and the second risk assessment result is greater than or equal to the preset threshold, pruning the decision tree from bottom to top until the error between the target risk assessment result and the second risk assessment result is less than the preset threshold. Exemplarily, the preset threshold may be 5%. When the error between the target risk assessment result and the second risk assessment result is less than the preset threshold, it indicates that the decision tree performs well.

[0042] It should be noted that the second vulnerability feature of the test data is input into the target model to obtain the target risk assessment result corresponding to the second vulnerability feature output by the target model. When the error between the target risk assessment result and the second risk assessment result is greater than or equal to the preset threshold, it means that the depth of the tree is too large during the training process and overfitting has occurred. At this time, the decision tree needs to be pruned to reduce its depth. Specifically, pruning needs to be performed from the bottom to the top. A group of nodes with the same parent node at the bottom are checked to calculate whether the error between the output result of the test data set and the second risk assessment result before and after the merger is smaller. If the error becomes smaller after the merger, this group of nodes is merged and pruned, and pruned upward layer by layer according to this rule until the error between the target risk assessment result and the second risk assessment result is less than the preset threshold.

[0043] The target model training process of this application is as follows Figure 2 shown.

[0044] S1. Collect historical data.

[0045] The historical data on security vulnerabilities of business hosts discovered through scanning in the past three years can be collected. The historical data may include vulnerability identification, vulnerability characteristics, and corresponding technical expert evaluation and analysis results.

[0046] S2. Prepare data.

[0047] Use 70% of the historical data as training data and 30% of the historical data as test data.

[0048] S3. Feature classification.

[0049] Determine the finite discrete features and infinite discrete features in vulnerability features.

[0050] S4. Determine the category to which the infinite discrete features correspond.

[0051] It should be noted that the specific implementation here is consistent with the above, and this application will not repeat it here.

[0052] S5. Feature selection, recursively generate decision trees.

[0053] Feature selection is to determine which feature to use to divide the feature space. It mainly focuses on selecting features that have the ability to classify training data. Only one feature can be selected each time for division.

[0054] It should be noted that the specific implementation here is consistent with the above, and this application will not repeat it here.

[0055] S6. Decision tree testing and adjustment.

[0056] It should be noted that the specific implementation here is consistent with the above, and this application will not repeat it here.

[0057] By adopting the solution of this application, the workload of risk assessment is greatly reduced, and the overall efficiency of vulnerability repair and risk prevention is improved.

[0058] The risk assessment method provided in the embodiment of the present application can be executed by a risk assessment device. In the embodiment of the present application, the risk assessment device provided in the embodiment of the present application is described by taking the risk assessment method executed by the risk assessment device as an example.

[0059] Figure 3 FIG. 1 is a schematic diagram of the structure of a risk assessment device disclosed in an embodiment of the present application. Figure 3 As shown, the risk assessment device 300 includes: an acquisition module 310 and an obtaining module 320 .

[0060] In the present application, an acquisition module 310 is used to obtain vulnerability features of a host vulnerability, wherein the vulnerability features include finite discrete features and infinite discrete features, wherein the finite discrete features are features with fixed classifications, and the infinite discrete features are features without fixed classifications; an acquisition module 320 is used to input the vulnerability features into a target model to obtain a risk assessment result corresponding to the host vulnerability output by the target model, wherein the target model is composed of a decision tree, and the target model is used to output a risk assessment result corresponding to the input vulnerability features.

[0061] In one implementation, the device further includes: a determination module, which is used to determine a first sentence vector corresponding to the infinite discrete feature before inputting the vulnerability feature into a target model to obtain a risk assessment result corresponding to the host vulnerability output by the target model; the determination module is also used to determine the category corresponding to the infinite discrete feature based on the first sentence vector, the benchmark sentence vector and the distance interval of each group of classifications corresponding to the infinite discrete feature; the obtaining module 320 inputs the vulnerability feature into the target model to obtain the risk assessment result corresponding to the host vulnerability output by the target model, including: inputting the finite discrete feature and the category corresponding to the infinite discrete feature into the target model to obtain the risk assessment result corresponding to the host vulnerability output by the target model.

[0062] In one implementation, the determination module determines the first sentence vector corresponding to the infinite discrete feature, including: determining a word vector corresponding to each non-stop word in the infinite discrete feature; and determining the first sentence vector corresponding to the infinite discrete feature based on each of the word vectors.

[0063] In one implementation, the determination module determines the category corresponding to the infinite discrete feature based on the first sentence vector, the benchmark sentence vector, and the distance interval of each group of classifications corresponding to the infinite discrete feature, including: determining the target distance between the first sentence vector and the benchmark sentence vector based on the first sentence vector and the benchmark sentence vector; determining the category corresponding to the infinite discrete feature based on the target distance and the distance interval of each group of classifications corresponding to the infinite discrete feature.

[0064] In one implementation, the infinite discrete features include at least one of a vulnerability name and vulnerability information.

[0065] In one implementation, the finite discrete features include at least one of a general vulnerability level, whether it is an exposed surface asset, whether there is a public network mapping, a service classification, an application classification, and a threat classification.

[0066] In one implementation, the target model is composed of multiple decision trees, and the target model outputs a target evaluation result as a risk assessment result corresponding to the input vulnerability feature, wherein the multiple decision trees output multiple evaluation results, and the target evaluation result is the evaluation result that appears the most times among the multiple evaluation results.

[0067] In one implementation, the above-mentioned device also includes: the acquisition module 310, which is also used to acquire multiple training data and multiple test data before inputting the vulnerability feature into the target model to obtain the risk assessment result corresponding to the host vulnerability output by the target model, wherein the training data includes a first vulnerability feature of the host vulnerability and a first risk assessment result corresponding to the first vulnerability feature, the first vulnerability feature includes a finite discrete feature and an infinite discrete feature, and the test data includes a second vulnerability feature of the host vulnerability and a second risk assessment result corresponding to the second vulnerability feature, the second vulnerability feature includes a finite discrete feature and an infinite discrete feature; a construction module, which is used to construct a target model based on the multiple training data; an adjustment module, which is used to adjust the target model based on the multiple test data until the error between the target risk assessment result and the second risk assessment result is less than a preset threshold, wherein the target risk assessment result is the risk assessment result corresponding to the second vulnerability feature output by the target model.

[0068] In one implementation, the construction module constructs a target model based on the multiple training data, including: determining a second sentence vector corresponding to each infinite discrete feature in the first vulnerability feature; determining a category corresponding to the infinite discrete feature based on the second sentence vector, a benchmark sentence vector, and a distance interval of each group of classifications corresponding to the infinite discrete feature, wherein the benchmark sentence vector is any one of multiple second sentence vectors; and recursively generating a decision tree based on the multiple training data and the classification categories of each feature in the first vulnerability feature.

[0069] In one implementation, the adjustment module adjusts the target model based on the multiple test data until the error between the target risk assessment result and the second risk assessment result is less than a preset threshold, including: when the error between the target risk assessment result and the second risk assessment result is greater than or equal to a preset threshold, pruning the decision tree from bottom to top until the error between the target risk assessment result and the second risk assessment result is less than the preset threshold.

[0070] The risk assessment device provided in the embodiment of the present application can implement each process implemented in the risk assessment method embodiment, and will not be described again here to avoid repetition.

[0071] Alternatively, if Figure 4As shown, an embodiment of the present application also provides an electronic device 400, including a processor 401 and a memory 402, wherein the memory 402 stores programs or instructions that can be executed on the processor 401, and when the program or instructions are executed by the processor 401, the various steps of the above-mentioned risk assessment method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, they are not described here.

[0072] It should be noted that the electronic devices in the embodiments of the present application include mobile electronic devices and non-mobile electronic devices.

[0073] An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the various processes of the above-mentioned risk assessment method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0074] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory ROM, a random access memory RAM, a magnetic disk or an optical disk.

[0075] An embodiment of the present application also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer executes: the steps of the risk assessment method as described above.

[0076] The above embodiments of the present application focus on describing the differences between the various embodiments. As long as the different optimization features between the various embodiments are not contradictory, they can be combined to form a better embodiment. Considering the simplicity of the text, they will not be repeated here.

[0077] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A risk assessment method, characterized in that: include: Obtain vulnerability features of the host vulnerability, wherein the vulnerability features include finite discrete features and infinite discrete features, the finite discrete features are features with fixed classifications, and the infinite discrete features are features without fixed classifications; The vulnerability feature is input into a target model to obtain a risk assessment result corresponding to the host vulnerability output by the target model, wherein the target model is composed of a decision tree, and the target model is used to output a risk assessment result corresponding to the input vulnerability feature.

2. The method according to claim 1, characterized in that Before inputting the vulnerability feature into a target model to obtain a risk assessment result output by the target model corresponding to the host vulnerability, the method further includes: Determine a first sentence vector corresponding to the infinite discrete feature; Determine the category corresponding to the infinite discrete feature based on the first sentence vector, the reference sentence vector, and the distance interval of each group of classifications corresponding to the infinite discrete feature; The step of inputting the vulnerability feature into a target model to obtain a risk assessment result output by the target model and corresponding to the host vulnerability includes: The finite discrete features and the categories corresponding to the infinite discrete features are input into a target model to obtain a risk assessment result corresponding to the host vulnerability output by the target model.

3. The method according to claim 2, characterized in that The determining of the first sentence vector corresponding to the infinite discrete feature includes: Determine a word vector corresponding to each non-stop word in the infinite discrete features; Based on each of the word vectors, a first sentence vector corresponding to the infinite discrete feature is determined.

4. The method according to claim 2, characterized in that: The determining the category corresponding to the infinite discrete feature based on the first sentence vector, the reference sentence vector, and the distance interval of each group of classifications corresponding to the infinite discrete feature includes: Determining a target distance between the first sentence vector and the benchmark sentence vector based on the first sentence vector and the benchmark sentence vector; Based on the target distance and the distance interval of each group of classifications corresponding to the infinite discrete features, the category corresponding to the infinite discrete features is determined.

5. The method according to claim 1, characterized in that The infinite discrete features include at least one of a vulnerability name and vulnerability information.

6. The method according to claim 1, characterized in that The finite discrete features include at least one of a general vulnerability level, whether it is an exposed surface asset, whether there is a public network mapping, a service classification, an application classification, and a threat classification.

7. The method according to claim 1, characterized in that The target model is composed of multiple decision trees, and the target model outputs a target evaluation result as a risk assessment result corresponding to the input vulnerability feature, wherein the multiple decision trees output multiple evaluation results, and the target evaluation result is the evaluation result that appears the most times among the multiple evaluation results.

8. The method according to claim 1, characterized in that Before inputting the vulnerability feature into a target model to obtain a risk assessment result output by the target model corresponding to the host vulnerability, the method further includes: Acquire a plurality of training data and a plurality of test data, wherein the training data includes a first vulnerability feature of a host vulnerability and a first risk assessment result corresponding to the first vulnerability feature, the first vulnerability feature includes a finite discrete feature and an infinite discrete feature, and the test data includes a second vulnerability feature of the host vulnerability and a second risk assessment result corresponding to the second vulnerability feature, the second vulnerability feature includes a finite discrete feature and an infinite discrete feature; Based on the multiple training data, construct a target model; The target model is adjusted based on the multiple test data until an error between a target risk assessment result and the second risk assessment result is less than a preset threshold, wherein the target risk assessment result is a risk assessment result output by the target model corresponding to the second vulnerability feature.

9. The method according to claim 8, characterized in that Based on the plurality of training data, a target model is constructed, comprising: For each infinite discrete feature in the first vulnerability feature, determine a second sentence vector corresponding to the infinite discrete feature; Determine the category corresponding to the infinite discrete feature based on the second sentence vector, the reference sentence vector, and the distance interval of each group of classifications corresponding to the infinite discrete feature, wherein the reference sentence vector is any one of the plurality of the second sentence vectors; A decision tree is recursively generated based on the multiple training data and the classification category of each feature in the first vulnerability feature.

10. The method according to claim 9, characterized in that Adjusting the target model based on the plurality of test data until an error between the target risk assessment result and the second risk assessment result is less than a preset threshold comprises: When the error between the target risk assessment result and the second risk assessment result is greater than or equal to a preset threshold, the decision tree is pruned from bottom to top until the error between the target risk assessment result and the second risk assessment result is less than the preset threshold.

11. A risk assessment device, characterized in that: include: An acquisition module, used to acquire vulnerability features of host vulnerabilities, wherein the vulnerability features include finite discrete features and infinite discrete features, wherein the finite discrete features are features with fixed classifications, and the infinite discrete features are features without fixed classifications; A module is obtained, which is used to input the vulnerability characteristics into a target model to obtain a risk assessment result corresponding to the host vulnerability output by the target model, wherein the target model is composed of a decision tree, and the target model is used to output a risk assessment result corresponding to the input vulnerability characteristics.

12. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a program or instruction that can be run on the processor, and when the program or instruction is executed by the processor, the steps of the risk assessment method according to any one of claims 1 to 10 are implemented.

13. A readable storage medium, characterized in that: The readable storage medium stores a program or instruction, and when the program or instruction is executed by the processor, the steps of the risk assessment method according to any one of claims 1 to 10 are implemented.

Images