Vulnerability risk assessment method and device, computer equipment and storage medium

Abstract

The invention relates to the technical field of computers, and discloses a vulnerability risk assessment method and device, computer equipment and a storage medium, and the method comprises the steps: obtaining the association degree of a to-be-assessed vulnerability belonging to a first preset number of vulnerability categories according to vulnerability data of the to-be-assessed vulnerability and an association degree judgment mode; according to the association degree, determining a target vulnerability category corresponding to the to-be-evaluated vulnerability, the target vulnerability category including a first preset number of vulnerability categories; according to the correlation degree corresponding to the target vulnerability category and the vulnerability risk value judgment mode, obtaining a vulnerability risk value of the to-be-evaluated vulnerability; and determining a target risk level of the to-be-evaluated vulnerability according to the vulnerability risk value. The problem that the vulnerability category and the vulnerability level of the security vulnerability are not accurate due to the fact that the adopted classification and evaluation mode is simple when the risk evaluation is carried out on the security vulnerability is solved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a vulnerability risk assessment method, device, computer equipment and storage medium. Background Art

[0002] During the development of software projects, security scans will be conducted on the project code to determine whether there are security vulnerabilities such as code defects in the project code. After scanning for security vulnerabilities, risk assessments will be conducted on the vulnerabilities, and the security vulnerabilities will be divided into certain vulnerability categories, and the vulnerability levels of the security vulnerabilities will be determined as high, medium, and low. Subsequent vulnerability repair personnel will handle security vulnerabilities according to vulnerability categories and vulnerability levels.

[0003] The systems and project codes of current software projects are becoming more and more complex. The impact of vulnerabilities may involve multiple levels of multiple modules in the system. A security vulnerability may belong to multiple categories. Depending on the system security defense equipment used, some high-level security vulnerabilities may no longer be a threat, while some low-level security vulnerabilities may be a threat. Therefore, simply classifying and grading vulnerabilities cannot meet the current needs of vulnerability repair and risk assessment for software projects.

[0004] Therefore, the classification and assessment methods used by relevant technologies when conducting risk assessments on security vulnerabilities are relatively simple, resulting in inaccurate vulnerability categories and vulnerability levels of security vulnerabilities. Summary of the invention

[0005] In view of this, the present invention provides a vulnerability risk assessment method, apparatus, computer equipment and storage medium to solve the problem that the classification and assessment method used in risk assessment of security vulnerabilities are relatively simple, resulting in inaccurate vulnerability categories and vulnerability levels of security vulnerabilities.

[0006] In a first aspect, the present invention provides a vulnerability risk assessment method, which is applied to a processor and includes: According to the vulnerability data of the vulnerability to be evaluated and the correlation determination method, the correlation degree of the vulnerability to be evaluated belonging to the first preset number of vulnerability categories is obtained; Determine, according to the correlation degree, a target vulnerability category corresponding to the vulnerability to be evaluated, wherein the target vulnerability category is included in a first preset number of vulnerability categories; According to the correlation degree corresponding to the target vulnerability category and the vulnerability risk value determination method, the vulnerability risk value of the vulnerability to be evaluated is obtained; According to the vulnerability risk value, determine the target risk level of the vulnerability to be assessed.

[0007] The vulnerability risk assessment method provided in this embodiment determines the degree of association of the vulnerability to be assessed belonging to the first preset number of vulnerability categories based on vulnerability data and the degree of association determination method, determines the target vulnerability category based on the degree of association, realizes the diverse classification of vulnerabilities, solves the problem of single classification of vulnerabilities, and is conducive to identifying the potential threat of a single vulnerability in a complex system to multiple modules and multiple business layers. According to the degree of association and the vulnerability risk value determination method, the vulnerability risk value of the vulnerability to be assessed is obtained, and the target risk level of the vulnerability to be assessed is determined. The vulnerability risk level is reclassified, and factors such as the system security defense system are included in the risk level assessment, so that the vulnerability rating is more in line with the actual operation scenario of the project. The technical effect of improving the efficiency of vulnerability repair is solved. The problem that the classification and assessment method used in the risk assessment of security vulnerabilities are relatively simple, resulting in inaccurate vulnerability categories and vulnerability levels of security vulnerabilities is solved.

[0008] In some optional implementations, before obtaining the correlation degree of the vulnerability to be evaluated belonging to the first preset number of vulnerability categories according to the vulnerability data of the vulnerability to be evaluated and the correlation degree determination method, the method further includes: Obtaining initial data and a corpus vocabulary of the vulnerability to be evaluated, wherein the corpus vocabulary includes vocabulary categories corresponding to a first preset number of vulnerability categories, and the vocabulary categories include a second preset number of words; Matching the initial data with the vocabulary in the corpus vocabulary to determine the frequency of the vocabulary in the first preset number of vocabulary categories in the initial data; According to the frequency, vector data of the vulnerability to be evaluated is generated, and the vector data is used as vulnerability data.

[0009] In this embodiment, the initial data of the vulnerability to be evaluated is vectorized to obtain vulnerability data that can be calculated. The membership degree can be calculated based on the vulnerability data, and then the target vulnerability category and target risk level can be determined.

[0010] In some optional implementations, obtaining a corpus vocabulary includes: Obtaining a third preset number of vulnerability information from the vulnerability database; Obtaining a first preset number of vulnerability categories, and generating vocabulary categories corresponding to the vulnerability categories; Match the words in the vulnerability information with the word category to obtain the words under the word category; The vocabulary list of the corpus is generated using vocabulary categories and the words under the vocabulary categories.

[0011] In this embodiment, a corpus vocabulary table including vocabulary categories and vocabulary under the vocabulary categories is generated. Subsequently, the initial data of the vulnerability to be evaluated can be quickly and accurately converted into vulnerability data based on the corpus vocabulary table and the bag-of-words model.

[0012] In some optional implementations, before obtaining a third preset number of vulnerability information from the vulnerability database, the method further includes: Use the preset scanning tool to scan the project code and obtain relevant data about the vulnerabilities in the project code; Utilize relevant data to generate vulnerability information, and utilize the vulnerability information to generate a vulnerability database.

[0013] In some optional implementations, the correlation determination method includes a correlation calculation formula and a cluster center calculation formula, and the correlation of the vulnerability to be evaluated belonging to the first preset number of vulnerability categories is obtained according to the vulnerability data of the vulnerability to be evaluated and the correlation determination method, including: According to the vulnerability data, the preset cluster center and the correlation calculation formula, a first intermediate correlation matrix is ​​obtained; According to the vulnerability data, the first intermediate correlation matrix and the cluster center calculation formula, the intermediate cluster center is obtained; Determine a change value between the intermediate cluster center and the preset cluster center, and determine whether the change value is less than a second preset threshold; When the change value is greater than or equal to the second preset threshold, the preset cluster center is deleted, the intermediate cluster center is used as the preset cluster center, and subsequent steps are performed from obtaining the first intermediate correlation matrix according to the vulnerability data, the preset cluster center and the correlation calculation formula, until the change value is less than the second preset threshold, then the process ends; When the change value is less than the second preset threshold, a first target correlation matrix is ​​obtained according to the vulnerability data, the intermediate cluster center and the correlation calculation formula, wherein the first target correlation matrix includes correlations of a first preset number of vulnerability categories.

[0014] In this embodiment, based on the vulnerability data of the vulnerability to be evaluated and the correlation determination method, the correlation of the vulnerability to be evaluated belonging to each vulnerability category is calculated, and the correlation is used to characterize the degree to which the vulnerability to be evaluated belongs to different vulnerability categories, so as to accurately classify the vulnerability to be evaluated.

[0015] In some optional implementations, before obtaining the first intermediate correlation matrix according to the vulnerability data, the preset cluster centers and the correlation calculation formula, the method includes: Obtaining an objective function, wherein the objective function is used to determine the total distance from the sample data to the cluster center, the total distance is proportional to the correlation in the objective function, and the total distance is proportional to the cluster center in the objective function; Determine the distance expression from sample data to the cluster center in the objective function; According to the distance expression and the objective function, a first intermediate function is obtained; Constructing a second intermediate function according to a preset strategy and the first intermediate function, wherein the preset strategy is used to determine a minimum value of a function value of the first intermediate function; Taking a partial derivative of the correlation degree in the second intermediate function to obtain a third intermediate function, wherein the third intermediate function is used to determine the correlation degree in the objective function; According to the preset constraint conditions and the third intermediate function, a target parameter expression is obtained; According to the target parameter expression and the third intermediate function, a correlation calculation formula is obtained.

[0016] In this embodiment, an objective function is obtained, a correlation calculation formula is determined based on the objective function, and the correlation calculation formula is used to calculate the vulnerability data to obtain the correlation. The correlation is used to characterize the degree to which the vulnerability to be evaluated belongs to different vulnerability categories, so as to accurately classify the vulnerability to be evaluated.

[0017] In some optional implementations, after constructing the second intermediate function, the method further includes: Taking partial derivative of the cluster center in the second intermediate function to obtain a fourth intermediate function, wherein the fourth intermediate function includes a variable parameter; The cluster center calculation formula is obtained by combining the fourth intermediate function and the first preset range of the variable parameter.

[0018] In some optional implementations, the vulnerability risk value determination method includes a vulnerability risk value calculation formula, and the vulnerability risk value of the vulnerability to be evaluated is obtained according to the correlation degree corresponding to the target vulnerability category and the vulnerability risk value determination method, including: According to the correlations corresponding to the target vulnerability categories, a second target correlation matrix is ​​obtained, wherein the second target correlation matrix includes second target correlations corresponding to the target vulnerability categories, and the sum of the second target correlations in the second target correlation matrix is ​​a preset value; Obtaining a vulnerability classification weight matrix, wherein the vulnerability classification weight matrix is ​​used to determine a target weight corresponding to the second target correlation degree in the second target correlation degree matrix; According to the second target correlation matrix, the vulnerability classification weight matrix and the vulnerability risk value calculation formula, the product of the second target correlation and the corresponding target weight is obtained, and the products are summed to obtain the vulnerability risk value.

[0019] In this embodiment, a vulnerability classification weight matrix is ​​introduced, and the risk level of different vulnerabilities is determined by the weights in the vulnerability classification weight matrix. The product of the second target correlation degree and the corresponding target weight is calculated, and the product is summed to obtain the vulnerability risk value. Through the vulnerability risk value, the risk level of the vulnerability to be evaluated can be accurately determined.

[0020] In some optional implementations, obtaining a vulnerability classification weight matrix includes: Obtain security risk data corresponding to a first preset number of vulnerability categories, and generate weights corresponding to the first preset number of vulnerability categories based on the security risk data and a second preset range, wherein the weights corresponding to the first preset number of vulnerability categories include a target weight; The weights are used to generate a vulnerability classification weight matrix.

[0021] In this embodiment, a vulnerability classification weight matrix including weights corresponding to a first preset number of vulnerability categories is generated, and the risk levels of different vulnerability categories to the software project are determined through these weights.

[0022] In some optional implementations, a second target correlation matrix is ​​obtained according to the correlations corresponding to the target vulnerability categories, including: Sum the correlations corresponding to the target vulnerability categories to obtain the total correlation. Determine the ratio of the correlation degree corresponding to the target vulnerability category to the total correlation degree; According to the ratio and the preset value, a second target correlation degree corresponding to the target vulnerability category is obtained; According to the second target correlation degree, a second target correlation degree matrix is ​​obtained.

[0023] In some optional implementations, determining a target risk level of a vulnerability to be assessed according to the vulnerability risk value includes: Obtain risk value ranges corresponding to a fourth preset number of risk levels; Determine a target risk value range that includes the vulnerability risk value, and use the risk level corresponding to the target risk value range as the target risk level.

[0024] In this embodiment, risk value ranges of different vulnerability risk levels are set, and the vulnerability risk level is determined according to the risk level range in which the vulnerability risk value lies. The method is simple, effective, and easy to implement, ensuring the accuracy of the target risk level.

[0025] In some optional implementations, determining the target vulnerability category corresponding to the vulnerability to be evaluated according to the correlation degree includes: The correlation degree whose value is greater than or equal to the first preset threshold is taken as the first target correlation degree; The vulnerability category corresponding to the first target correlation degree is used as the target vulnerability category.

[0026] In this embodiment, the first preset threshold is used to filter invalid memberships to obtain valid memberships, namely, first target associations, and the vulnerability category corresponding to the first target association is used as the target vulnerability category to improve the accuracy of vulnerability classification.

[0027] In a second aspect, the present invention provides a vulnerability risk assessment device, comprising: A correlation determination module, used to obtain the correlation degree of the vulnerability to be evaluated belonging to a first preset number of vulnerability categories according to the vulnerability data of the vulnerability to be evaluated and the correlation determination method; A vulnerability classification module is used to determine a target vulnerability category corresponding to the vulnerability to be evaluated according to the correlation degree, wherein the target vulnerability category is included in a first preset number of vulnerability categories; A vulnerability risk value determination module is used to obtain the vulnerability risk value of the vulnerability to be evaluated according to the correlation degree corresponding to the target vulnerability category and the vulnerability risk value determination method; The risk level determination module is used to determine the target risk level of the vulnerability to be assessed based on the vulnerability risk value.

[0028] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor are communicatively connected to each other, computer instructions are stored in the memory, and the processor executes the vulnerability risk assessment method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0029] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the vulnerability risk assessment method of the first aspect or any corresponding embodiment thereof.

[0030] In a fifth aspect, the present invention provides a computer program product, comprising computer instructions, wherein the computer instructions are used to enable a computer to execute the vulnerability risk assessment method of the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the related technologies, the drawings required for use in the specific embodiments or the related technical descriptions will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0032] Figure 1 is a flow chart of a vulnerability risk assessment method according to an embodiment of the present invention; Figure 2 is a flowchart of vulnerability data processing according to an embodiment of the present invention; Figure 3 is a flow chart of vulnerability risk calculation model derivation according to an embodiment of the present invention; Figure 4 is a flow chart of hole classification and risk level assessment according to an embodiment of the present invention; Figure 5is a structural block diagram of a vulnerability risk assessment device according to an embodiment of the present invention; Figure 6 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0033] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0034] The embodiment of the present invention provides a vulnerability risk assessment method, which extracts the original data of project code vulnerabilities from the code scanning vulnerability database, and then vectorizes the original data to obtain vulnerability vectorized data that can be calculated; then, based on the fuzzy c-means clustering algorithm, the membership calculation formula of the vulnerability to each vulnerability classification dimension is derived, and the membership calculation formula is combined with the vulnerability classification weight matrix set in advance to derive a vulnerability risk calculation model, where c represents the dimension; then, the vulnerability classification and risk level are calculated according to the vulnerability risk calculation model. This achieves the technical effect of reclassifying and risk rating the code scanning vulnerability and improving the efficiency of vulnerability repair.

[0035] According to an embodiment of the present invention, a vulnerability risk assessment embodiment is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer device with data processing capabilities, such as a computer, a server, etc., and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0036] In this embodiment, a vulnerability risk assessment method is provided, which is applied to a processor in a computer device. Figure 1 is a flow chart of a vulnerability risk assessment method according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps: Step S101 : obtaining the degree of association of the vulnerability to be evaluated belonging to a first preset number of vulnerability categories according to the vulnerability data of the vulnerability to be evaluated and the method of determining the degree of association.

[0037] Specifically, during the development of a software project, the project code will be tested. If a security vulnerability is found in the project code during the test, the vulnerability risk assessment method of this embodiment needs to be used to conduct a risk assessment of the vulnerability. A software testing platform is created based on the device to which the software project is applied. For example, if the software project is developed for a server and the software project is applied to the server, a server is used as a software testing platform for the software project, and the processor in the server executes the vulnerability risk assessment method of this embodiment, such as a CPU (Central Processing Unit) or a GPU (Graphics Processing Unit). If the software project is applied to a PC (Personal Computer), a PC is used as a software testing platform for the software project. Similarly, the processor in the PC executes the vulnerability risk assessment method of this embodiment.

[0038] The association degree in this application includes the membership degree, and the following description takes the association degree as the membership degree as an example. The membership degree calculation formula of the vulnerability to each vulnerability classification dimension is derived based on the fuzzy c-means clustering algorithm, and the vulnerability risk calculation model is derived in combination with the vulnerability classification weight matrix set by security experts based on experience.

[0039] In the case where there are code vulnerabilities in the code scanning vulnerability database, the project code vulnerabilities are extracted from the code scanning vulnerability database as the vulnerabilities to be evaluated, and the original data of the vulnerabilities to be evaluated are extracted. Then, the original data is vectorized to obtain vectorized data, i.e., vulnerability data of the vulnerabilities to be evaluated, for example, the original data is vectorized in c-dimension using a bag-of-words model to obtain vulnerability data.

[0040] The first preset number is, for example: 5, 6, 7... The specific value is set according to actual needs, and the first preset number of vulnerability categories is, for example: network security, database security, operating system security, privacy data security, etc.

[0041] The vulnerability data is input into the vulnerability risk calculation model. The vulnerability risk calculation model will process the vulnerability data according to the correlation determination method, determine the correlation between the vulnerability to be evaluated and each vulnerability category according to the vulnerability data, and output it. For example, the correlation between the vulnerability to be evaluated and network security is 0.5, the correlation with operating system security is 0.03, the correlation with database security is 0.4, and the correlation with operating system security is 0.07.

[0042] Step S102: determining a target vulnerability category corresponding to the vulnerability to be evaluated according to the correlation degree, wherein the target vulnerability category is included in a first preset number of vulnerability categories.

[0043] Specifically, the target vulnerability category is determined according to the correlation degree, for example: a threshold is set, correlation degrees less than the threshold are eliminated, and the vulnerability categories corresponding to the remaining correlation degrees are used as the target vulnerability categories. The correlation degrees are sorted according to their magnitude, such as 0.5, 0.4, 0.07, and 0.03, and two correlation degrees are selected from large to small, and the vulnerability categories corresponding to the selected correlation degrees are used as the target vulnerability categories.

[0044] Step S103, obtaining the vulnerability risk value of the vulnerability to be assessed according to the correlation degree corresponding to the target vulnerability category and the vulnerability risk value determination method.

[0045] Specifically, the correlations corresponding to the target vulnerability categories are screened, and the correlations with too small values ​​are removed, for example, the correlations with values ​​less than 0.1 are removed. The remaining correlations are adjusted and the effective membership is recalculated. For example, the remaining correlations are 0.5 and 0.4, corresponding to network security and database security respectively. The calculation process of the effective membership is [0.5 / (0.5+0.4), 0.4 / (0,5+0.4)]=[0.5556,0.4444].

[0046] Multiply the effective membership by the corresponding weight, sum them up, and use the result as the vulnerability risk value of the vulnerability to be assessed. For example, the weight corresponding to network security is 40, and the weight corresponding to the target vulnerability category is 100. The vulnerability risk value = 40×0.5556+100×0.4444=66.66.

[0047] Step S104: determining the target risk level of the vulnerability to be assessed according to the vulnerability risk value.

[0048] Specifically, the vulnerability risk level is, for example, high, medium, and low. The risk value ranges corresponding to different vulnerability risk levels are set. For example, the risk value range corresponding to the high vulnerability risk level is 85-100, the risk value range corresponding to the medium vulnerability risk level is 45-84.99, and the risk value range corresponding to the low vulnerability risk level is 0-44.99. According to the range of the vulnerability risk value, the target risk level of the vulnerability to be evaluated is determined. For example, if the vulnerability risk value is 66.66, the target risk level of the vulnerability to be evaluated is medium, and if the vulnerability risk value is 30, the target risk level of the vulnerability to be evaluated is low.

[0049] The vulnerability risk assessment method provided in this embodiment determines the degree of association of the vulnerability to be assessed belonging to the first preset number of vulnerability categories based on vulnerability data and the degree of association determination method, determines the target vulnerability category based on the degree of association, realizes the diverse classification of vulnerabilities, solves the problem of single classification of vulnerabilities, and is conducive to identifying the potential threat of a single vulnerability in a complex system to multiple modules and multiple business layers. According to the degree of association and the vulnerability risk value determination method, the vulnerability risk value of the vulnerability to be assessed is obtained, and the target risk level of the vulnerability to be assessed is determined. The vulnerability risk level is reclassified, and factors such as the system security defense system are included in the risk level assessment, so that the vulnerability rating is more in line with the actual operation scenario of the project. The technical effect of improving the efficiency of vulnerability repair is solved. The problem that the classification and assessment method used in the risk assessment of security vulnerabilities are relatively simple, resulting in inaccurate vulnerability categories and vulnerability levels of security vulnerabilities is solved.

[0050] In some optional implementations, before obtaining the correlation degree of the vulnerability to be evaluated belonging to the first preset number of vulnerability categories according to the vulnerability data of the vulnerability to be evaluated and the correlation degree determination method, the method further includes: Obtaining initial data and a corpus vocabulary of the vulnerability to be evaluated, wherein the corpus vocabulary includes vocabulary categories corresponding to a first preset number of vulnerability categories, and the vocabulary categories include a second preset number of words; Matching the initial data with the vocabulary in the corpus vocabulary to determine the frequency of the vocabulary in the first preset number of vocabulary categories in the initial data; According to the frequency, vector data of the vulnerability to be evaluated is generated, and the vector data is used as vulnerability data.

[0051] Specifically, the vulnerabilities to be assessed include: insecure SSL (Secure Socket Layer), Telnet service vulnerabilities, unencrypted communications, etc.

[0052] Take the insecure SSL vulnerability to be evaluated as an example for explanation. Obtain initial data of the insecure SSL, for example, as shown in Table 1.

[0053] Table 1 Initial data of vulnerabilities to be assessed

[0054] Get a corpus vocabulary, for example: the corpus vocabulary is shown in Table 2. The corpus vocabulary includes vocabulary categories corresponding to a first preset number of vulnerability categories, the first preset number is for example: 5, 6, 7... The specific value is set according to actual needs, the first preset number of vulnerability categories are for example: network security, database security, operating system security, privacy data security, etc. The vocabulary category includes a second preset number of words, the second preset number is for example: 4, 5, 6... The specific value is set according to actual needs, and the second preset number of words included in network security are for example: network, http, SSL, etc.

[0055] Table 2 Corpus vocabulary

[0056] Among them, the corpus vocabulary shown in Table 2 includes four vocabulary categories: network security, database security, operating system security, and privacy data security. The network security includes the vocabulary of network, http, SSL, TLS, etc. The database security includes the vocabulary of database, sql, mysql, injection, etc. For other vocabulary, please refer to Table 2 and will not be repeated here.

[0057] Based on the corpus vocabulary, the bag-of-words model is used to process the vulnerability data to obtain vectorized data, including: matching the initial data shown in Table 1 with the vocabulary in the corpus vocabulary shown in Table 2, and determining the frequency of the vocabulary in the first preset number of vocabulary categories in the initial data, for example: the frequency is shown in Table 3. It should be noted that the bag-of-words model (BOW) is a model that converts text data into a numerical vector structure.

[0058] Table 3 Frequency of vocabulary occurrence

[0059] Among them, after comparison, it can be seen that there are 3 SSLs and 2 TLSs in the initial data shown in Table 1. SSL and TLS are words in network security. Therefore, the frequency of words in network security in Table 3 is 5. The frequency acquisition process corresponding to other vocabulary categories in Table 3 is the same, which will not be repeated here.

[0060] According to the frequency, vector data of the vulnerability to be evaluated is generated, and the vector data is used as vulnerability data. For example, the vocabulary in Table 3 is used to form 4-dimensional vector data [5, 0, 0, 2], and the 4-dimensional vector data is used as vulnerability data of the vulnerability to be evaluated.

[0061] The above process is as follows Figure 2As shown: Step S201, extracting project code vulnerability data from the code scanning software database; Step S202, defining the vulnerability classification dimension c; Step S203, designing the expected vocabulary for each dimension; Step S204, using the bag-of-words model to process the vulnerability data to obtain vectorized data.

[0062] In this embodiment, the initial data of the vulnerability to be evaluated is vectorized to obtain vulnerability data that can be calculated. The membership degree can be calculated based on the vulnerability data, and then the target vulnerability category and target risk level can be determined.

[0063] In some optional implementations, obtaining a corpus vocabulary includes: Obtaining a third preset number of vulnerability information from the vulnerability database; Obtaining a first preset number of vulnerability categories, and generating vocabulary categories corresponding to the vulnerability categories; Match the words in the vulnerability information with the word category to obtain the words under the word category; The vocabulary list of the corpus is generated using vocabulary categories and the words under the vocabulary categories.

[0064] Specifically, the third preset number is, for example, 1000, 2000, etc. The specific value is set according to actual needs. The third preset number of vulnerability information is obtained from the vulnerability database.

[0065] The vulnerability classification dimension c is defined according to the computer security protection category. For example, the vulnerability classification is defined as the four dimensions according to network security, database security, operating system security, and privacy data security. Therefore, the first preset number of vulnerability categories include: network security, database security, operating system security, and privacy data security.

[0066] Generate vocabulary categories corresponding to vulnerability categories, for example: directly use the vulnerability categories as vocabulary categories, and obtain a first preset number of vocabulary categories including: network security, database security, operating system security, and privacy data security; or, regenerate vocabulary categories that correspond one-to-one to the vulnerability categories, and save the corresponding relationship.

[0067] Design a corpus vocabulary for each dimension, match the vocabulary in the vulnerability information with the vocabulary category, obtain the vocabulary under the vocabulary category, and make a vocabulary list based on the vocabulary in the vulnerability information that matches the vocabulary category dimension. For example, network security includes vocabulary such as network, http, SSL, TLS, etc., and database security includes vocabulary such as database, sql, mysql, injection, etc. Summarize the above vocabulary categories and vocabulary under the vocabulary categories, and fill the above vocabulary categories and vocabulary into the blank table to generate a corpus vocabulary list. The corpus vocabulary list is, for example, the corpus vocabulary list shown in Table 2 above.

[0068] In this embodiment, a corpus vocabulary table including vocabulary categories and vocabulary under the vocabulary categories is generated. Subsequently, the initial data of the vulnerability to be evaluated can be quickly and accurately converted into vulnerability data based on the corpus vocabulary table and the bag-of-words model.

[0069] In some optional implementations, before obtaining a third preset number of vulnerability information from the vulnerability database, the method further includes: Use the preset scanning tool to scan the project code and obtain relevant data about the vulnerabilities in the project code; Utilize relevant data to generate vulnerability information, and utilize the vulnerability information to generate a vulnerability database.

[0070] Specifically, the preset scanning tools include: Trivy tool, OpenVAS tool, Nessus tool, etc. The vulnerability data scanned by different scanning tools are not exactly the same, but most of them include information such as vulnerability name, vulnerability type, vulnerability description, vulnerability impact, and processing suggestions.

[0071] In order to facilitate the management of the vulnerability database, the vulnerability information scanned by different preset scanning tools can be stored in the vulnerability database. Therefore, the same information of the vulnerability data scanned by different scanning tools is used as vulnerability information, such as vulnerability name, vulnerability type, vulnerability description, vulnerability impact, processing suggestions and other information.

[0072] Use one or more preset scanning tools to scan the project code, obtain relevant data that the project code contains vulnerabilities, and extract the above vulnerability information from the relevant data. Use the vulnerability information to generate a vulnerability database, for example: if there is an existing vulnerability database, directly write the extracted vulnerability information into the existing vulnerability database; if there is no vulnerability database, first create an empty database, write the extracted vulnerability information into the empty database, and use the empty database as the vulnerability database.

[0073] In some optional implementations, the correlation determination method includes a correlation calculation formula and a cluster center calculation formula, and the correlation of the vulnerability to be evaluated belonging to the first preset number of vulnerability categories is obtained according to the vulnerability data of the vulnerability to be evaluated and the correlation determination method, including: According to the vulnerability data, the preset cluster center and the correlation calculation formula, a first intermediate correlation matrix is ​​obtained; According to the vulnerability data, the first intermediate correlation matrix and the cluster center calculation formula, the intermediate cluster center is obtained; Determine a change value between the intermediate cluster center and the preset cluster center, and determine whether the change value is less than a second preset threshold; When the change value is greater than or equal to the second preset threshold, the preset cluster center is deleted, the intermediate cluster center is used as the preset cluster center, and subsequent steps are performed from obtaining the first intermediate correlation matrix according to the vulnerability data, the preset cluster center and the correlation calculation formula, until the change value is less than the second preset threshold, then the process ends; When the change value is less than the second preset threshold, a first target correlation matrix is ​​obtained according to the vulnerability data, the intermediate cluster center and the correlation calculation formula, wherein the first target correlation matrix includes correlations of a first preset number of vulnerability categories.

[0074] Specifically, c cluster centers are randomly selected as preset cluster centers, where the value of c is equal to a first preset value. The preset cluster centers are, for example, the cluster centers shown in formula (1).

[0075] (1) in, is the first preset cluster center, is the cth preset cluster center.

[0076] The correlation calculation formula is as follows: Formula (2). Substitute the above vulnerability data and the preset cluster center into the correlation calculation formula to calculate the first intermediate correlation matrix, which is shown in Formula (3).

[0077] (2) (3) The cluster center calculation formula is, for example, formula (4). Substitute the above vulnerability data and the first intermediate correlation matrix into the cluster center calculation formula to calculate the intermediate cluster center. The intermediate cluster center is, for example, the cluster center shown in formula (5).

[0078] (4) (5) In the process of calculating the first target association matrix, there is a cutoff condition, which is shown in formula (6). According to the cutoff condition, it is judged whether to stop iterating the cluster center and the association matrix. The judgment process includes: determining the intermediate cluster center With preset cluster centers and determines whether the change value is less than a second preset threshold value. The second preset threshold value is , The specific value is set according to actual needs.

[0079] (6) When the change value is greater than or equal to the second preset threshold, the preset cluster center is deleted, the intermediate cluster center is used as the preset cluster center, and subsequent steps are performed starting from the first intermediate correlation matrix obtained according to the vulnerability data, the preset cluster center and the correlation calculation formula, until the change value is less than the second preset threshold, then the process ends.

[0080] When the change value is less than the second preset threshold, the first target correlation matrix is ​​obtained according to the vulnerability data, the intermediate cluster center and the correlation calculation formula, for example, the correlation matrix shown in formula (7).

[0081] (7) The first target correlation matrix includes correlations of a first preset number of vulnerability categories. is the relevance of the first vulnerability category, is the correlation degree of the cth vulnerability category.

[0082] In this embodiment, based on the vulnerability data of the vulnerability to be evaluated and the correlation determination method, the correlation of the vulnerability to be evaluated belonging to each vulnerability category is calculated, and the correlation is used to characterize the degree to which the vulnerability to be evaluated belongs to different vulnerability categories, so as to accurately classify the vulnerability to be evaluated.

[0083] In some optional implementations, before obtaining the first intermediate correlation matrix according to the vulnerability data, the preset cluster centers and the correlation calculation formula, the method includes: Obtaining an objective function, wherein the objective function is used to determine the total distance from the sample data to the cluster center, the total distance is proportional to the correlation in the objective function, and the total distance is proportional to the cluster center in the objective function; Determine the distance expression from sample data to the cluster center in the objective function; According to the distance expression and the objective function, a first intermediate function is obtained; Constructing a second intermediate function according to a preset strategy and the first intermediate function, wherein the preset strategy is used to determine a minimum value of a function value of the first intermediate function; Taking a partial derivative of the correlation degree in the second intermediate function to obtain a third intermediate function, wherein the third intermediate function is used to determine the correlation degree in the objective function; According to the preset constraint conditions and the third intermediate function, a target parameter expression is obtained; According to the target parameter expression and the third intermediate function, a correlation calculation formula is obtained.

[0084] Specifically, obtain the objective function, such as the membership matrix It is obtained by iterative calculation based on a large number of extracted vulnerability sample data by the fuzzy c-means model, where the objective function of the fuzzy c-means model is: (8) Among them, J is the sum of the weighted distances from all sample data to all cluster centers; is the fuzzy coefficient, usually taken =2, is the number of vulnerability samples, is the number of cluster centers, which is represented by the number of vulnerability classification dimensions in this embodiment, that is, c=4. For the samples, For the Cluster centers, For vulnerability samples Cluster Center The membership degree of Representation sample To cluster center distance.

[0085] In this embodiment, the Euclidean distance is used to calculate the sample To cluster center Therefore, the distance expression from the sample data to the cluster center in the objective function is as shown in formula (9).

[0086] (9) Among them, the sample For the loophole Vector data, cluster center is the cluster center obtained by iterative calculation Vector data, here we use Representation sample To cluster center The Euclidean distance.

[0087] Substitute the distance expression into the objective function and calculate the first intermediate function, as shown in formula (10).

[0088] (10) The membership degree when the distance between the vulnerability sample and each cluster center is the smallest is the optimal classification membership, that is, solving the minimum value of J in the above formula. Therefore, the preset strategy is used to determine the minimum value of the function value of the first intermediate function. The preset strategy is, for example, the Lagrange multiplier method.

[0089] According to a preset strategy (such as the Lagrange multiplier method) and the first intermediate function, a Lagrange function is constructed as the second intermediate function. The second intermediate function is shown in formula (11).

[0090] (11) in, is the Lagrange multiplier.

[0091] In the second intermediate function, the correlation Take the partial derivative and get the third intermediate function, through which the correlation degree in the objective function can be determined , for example: The third intermediate function is shown in formula (12), which can be calculated The value of .

[0092] (12) The preset constraint condition is, for example, that the sum of the membership degrees is 1, as shown in formula (13).

[0093] (13) Expanding the constraints shown in formula (13) yields formula (14).

[0094] (14) Target parameters such as Lagrange multipliers Substitute the preset constraint condition, i.e., formula (14), into the third intermediate function, and calculate the target parameter expression. The Lagrange multiplier expression is shown in formula (15).

[0095] (15) Substitute the target parameter expression into the third intermediate function and calculate the correlation degree calculation formula, as shown in formula (16).

[0096] (16) In this embodiment, an objective function is obtained, a correlation calculation formula is determined based on the objective function, and the correlation calculation formula is used to calculate the vulnerability data to obtain the correlation. The correlation is used to characterize the degree to which the vulnerability to be evaluated belongs to different vulnerability categories, so as to accurately classify the vulnerability to be evaluated.

[0097] In some optional implementations, after constructing the second intermediate function, the method further includes: Taking partial derivative of the cluster center in the second intermediate function to obtain a fourth intermediate function, wherein the fourth intermediate function includes a variable parameter; The cluster center calculation formula is obtained by combining the fourth intermediate function and the first preset range of the variable parameter.

[0098] Specifically, in the second intermediate function, the cluster center By taking partial derivatives, we get the fourth intermediate function, as shown in formula (17). The fourth intermediate function contains variable parameters , For example: number of vulnerability classification dimensions.

[0099] (17) The first preset range of the variable parameter, for example: [1,c].

[0100] Combining the fourth intermediate function and the first preset range of the variable parameter, a cluster center calculation formula is obtained, as shown in formula (18).

[0101] (18) In some optional implementations, the vulnerability risk value determination method includes a vulnerability risk value calculation formula, and the vulnerability risk value of the vulnerability to be evaluated is obtained according to the correlation degree corresponding to the target vulnerability category and the vulnerability risk value determination method, including: According to the correlations corresponding to the target vulnerability categories, a second target correlation matrix is ​​obtained, wherein the second target correlation matrix includes second target correlations corresponding to the target vulnerability categories, and the sum of the second target correlations in the second target correlation matrix is ​​a preset value; Obtaining a vulnerability classification weight matrix, wherein the vulnerability classification weight matrix is ​​used to determine a target weight corresponding to the second target correlation degree in the second target correlation degree matrix; According to the second target correlation matrix, the vulnerability classification weight matrix and the vulnerability risk value calculation formula, the product of the second target correlation and the corresponding target weight is obtained, and the products are summed to obtain the vulnerability risk value.

[0102] Specifically, the target vulnerability categories are, for example, network security and database security, the corresponding correlation degree for network security is 0.6, and the corresponding correlation degree for database security is 0.3. According to the correlation degree corresponding to the target vulnerability category, the preset values ​​are, for example, 1, 2, etc. The specific values ​​are set according to actual needs.

[0103] Take the preset value equal to 1 as an example. The sum of the second target correlations in the second target correlation matrix is ​​the preset value. The membership validity filter is introduced to eliminate the influence of interference items on the calculation model and improve the accuracy of the vulnerability risk calculation model. It is necessary to adjust the correlation corresponding to the target vulnerability category, calculate the effective membership, and summarize the effective membership to obtain the second target correlation matrix, for example: [0.6667, 0.3333]. The second target correlation matrix contains the second target correlations corresponding to the target vulnerability category, for example: 0.6667 and 0.3333. The sum of the second target correlations in the second target correlation matrix is ​​the preset value, that is, the sum is 1. The process of building a vulnerability risk calculation model is as follows: Figure 3As shown: Step S301, the fuzzy c-means clustering algorithm calculates the membership matrix of vulnerabilities to vulnerability classification centers; Step S302, security experts set the vulnerability classification weight matrix based on experience; Step S303, the vulnerability risk calculation model is obtained from the membership matrix and the weight matrix.

[0104] The formulas for calculating vulnerability risk values ​​are shown in formula (19) and formula (20).

[0105] (19) Among them, s is the risk value; d is the number of valid membership degrees; Vulnerability category The risk weight of is the effective membership degree. Expanding formula (19) yields formula (20).

[0106] (20) Among them, s is the vulnerability risk value, ranging from [0,100]. The larger the value, the higher the risk level. Dimensions for vulnerability classification The membership degree is in [0,1], indicating that the vulnerability belongs to the vulnerability classification dimension The degree of membership of each vulnerability to all vulnerability classification dimensions is 1, that is, =1; Dimensions for classifying vulnerabilities risk weight.

[0107] Get the vulnerability classification weight matrix. The weights in the vulnerability classification weight matrix are set by security experts based on comprehensive factors such as project type, security defense system, security defense equipment, and project experience accumulated by security experts. For example, the vulnerability classification weight matrix is: [40, 100, 60, 80].

[0108] According to the above formula (19) or formula (20), the second target correlation matrix [0.6667, 0.3333], and the vulnerability classification weight matrix [40, 100, 60, 80], the product of the second target correlation and the corresponding target weight is obtained, and the product is summed to obtain the vulnerability risk value, for example: vulnerability risk value s = 40 × 0.6667 + 100 × 0.3333 = 60.

[0109] In this embodiment, a vulnerability classification weight matrix is ​​introduced, and the risk level of different vulnerability categories to the software project is determined by the weights in the vulnerability classification weight matrix. The product of the second target correlation degree and the corresponding target weight is calculated, and the product is summed to obtain the vulnerability risk value. Through the vulnerability risk value, the risk level of the vulnerability to be evaluated can be accurately determined.

[0110] In some optional implementations, obtaining a vulnerability classification weight matrix includes: Obtain security risk data corresponding to a first preset number of vulnerability categories, and generate weights corresponding to the first preset number of vulnerability categories based on the security risk data and a second preset range, wherein the weights corresponding to the first preset number of vulnerability categories include a target weight; The weights are used to generate a vulnerability classification weight matrix.

[0111] Specifically, the vulnerability classification weight matrix is ​​as shown in formula (21).

[0112] (twenty one) in, is the cluster center The risk weight is between [0,100], which indicates the security risk level of vulnerability classification dimension k. The larger the value, the higher the risk level. The risk weight is set by security experts based on comprehensive factors such as project type, security defense system, security defense equipment, and project experience accumulated by security experts.

[0113] The first preset number of vulnerability categories are, for example, network security, database security, operating system security, privacy data security, etc. The security risk data corresponding to the first preset number of vulnerability categories are obtained, and the security risk data can be set in combination with the impact of different vulnerability categories on project types, security defense systems, security defense equipment, etc. The security risk data can also be set by security experts based on comprehensive factors such as project types, security defense systems, security defense equipment, and project experience accumulated by security experts.

[0114] The second preset range is, for example, [0,100]. The weight corresponding to the vulnerability category should be within the second preset range, and the weights corresponding to the first preset number of vulnerability categories are generated. For example, the weight corresponding to network security is 40, the weight corresponding to database security is 100, the weight corresponding to operating system security is 60, and the weight corresponding to privacy data security is 80.

[0115] The weights are used to generate a vulnerability classification weight matrix, for example: [40, 100, 60, 80].

[0116] In this embodiment, a vulnerability classification weight matrix including weights corresponding to a first preset number of vulnerability categories is generated, and the risk levels of different vulnerability categories to the software project are determined through these weights.

[0117] In some optional implementations, a second target correlation matrix is ​​obtained according to the correlations corresponding to the target vulnerability categories, including: Sum the correlations corresponding to the target vulnerability categories to obtain the total correlation. Determine the ratio of the correlation degree corresponding to the target vulnerability category to the total correlation degree; According to the ratio and the preset value, a second target correlation degree corresponding to the target vulnerability category is obtained; According to the second target correlation degree, a second target correlation degree matrix is ​​obtained.

[0118] Specifically, the effective membership is calculated according to formula (22).

[0119] (twenty two) in, Indicates A correlation, Indicates association degrees, d is the number of valid membership degrees, represents the sum of effective memberships, is the degree of belonging of the vulnerability to vulnerability category k (expressed as a percentage).

[0120] For example, the target vulnerability categories are network security and database security, where the correlation degree corresponding to network security is 0.6 and the correlation degree corresponding to database security is 0.3. Sum the correlation degrees corresponding to the target vulnerability categories to obtain the total correlation degree, for example, total correlation degree = 0.6 + 0.3 = 0.9.

[0121] Determine the ratio of the correlation degree corresponding to the target vulnerability category to the total correlation degree, for example: 0.6 / 0.9=0.6667, 0.3 / 0.9=0.3333. Preset values ​​are for example: 1=100%, 2=200%... The specific value is set according to actual needs. Take the preset value equal to 100 as an example. According to the ratio and the preset value, the second target correlation degree corresponding to the target vulnerability category is obtained, for example: 0.6667×100%=66.67%, 0.3333×100%=33.33%, that is, the degree to which the vulnerability to be evaluated belongs to the network security classification is 66.67%, and the degree to which the vulnerability to be evaluated belongs to the database security classification is 33.33%.

[0122] According to the second target correlation degree, a second target correlation degree matrix is ​​obtained, for example: [0.6667, 0.3333].

[0123] In some optional implementations, determining a target risk level of a vulnerability to be assessed according to the vulnerability risk value includes: Obtain risk value ranges corresponding to a fourth preset number of risk levels; Determine a target risk value range that includes the vulnerability risk value, and use the risk level corresponding to the target risk value range as the target risk level.

[0124] Specifically, the fourth preset number is, for example, 3, 4, 5, etc. The specific value is set according to actual needs, and the fourth preset number of risk levels is, for example, high, medium, and low. The risk value range corresponding to the fourth preset number of risk levels is obtained, for example, the risk value range is shown in Table 4.

[0125] Table 4 Risk value range corresponding to risk level

[0126] Among them, the risk value range for high risk level is [80,100], that is, greater than or equal to 80 and less than or equal to 100, the risk value range for medium risk level is [50,80), that is, greater than or equal to 50 and less than 80, and the risk value range for low risk level is [0,50), that is, greater than or equal to 0 and less than 50.

[0127] Determine the target risk value range that includes the vulnerability risk value, and use the risk level corresponding to the target risk value range as the target risk level. For example, if the vulnerability risk value is 60, the target risk value range is [50,80), and the target risk level is medium, the vulnerability to be assessed is a medium-risk vulnerability; if the vulnerability risk value is 40, the target risk value range is [0,50), and the target risk level is low, the vulnerability to be assessed is a low-risk vulnerability.

[0128] In this embodiment, risk value ranges of different vulnerability risk levels are set, and the vulnerability risk level is determined according to the risk level range in which the vulnerability risk value lies. The method is simple, effective, and easy to implement, ensuring the accuracy of the target risk level.

[0129] In some optional implementations, determining the target vulnerability category corresponding to the vulnerability to be evaluated according to the correlation degree includes: The correlation degree whose value is greater than or equal to the first preset threshold is taken as the first target correlation degree; The vulnerability category corresponding to the first target correlation degree is used as the target vulnerability category.

[0130] Specifically, the first preset threshold is, for example, 0.1, 0.2, etc. The specific value is set according to actual needs. Take the first preset threshold equal to 0.1 as an example for explanation. Through the first preset threshold, the validity judgment condition is set, for example, when the membership degree is <0.1, the membership degree is determined to be invalid, that is, the vulnerability is irrelevant to the vulnerability type pointed to by the membership degree.

[0131] For example, the correlation matrix is ​​[0.6, 0.3, 0.06, 0.04], which corresponds to the vulnerability categories [network security, database security, operating system security, privacy data security]. The correlation matrix includes 4 correlations, 0.6, 0.3, 0.06, and 0.04, respectively. The correlation with a value greater than or equal to 0.1 is used as the first target correlation, and the first target correlation includes 0.6 and 0.3. The vulnerability category corresponding to the first target correlation is used as the target vulnerability category. For example, the first target correlation includes 0.6 and 0.3, and the target vulnerability categories are network security and database security, that is, the vulnerability to be evaluated involves 2 vulnerability categories.

[0132] In this embodiment, the first preset threshold is used to filter invalid memberships to obtain valid memberships, namely, first target associations, and the vulnerability category corresponding to the first target association is used as the target vulnerability category to improve the accuracy of vulnerability classification.

[0133] In some optional implementations, after determining the target vulnerability category and target risk level of the vulnerability to be assessed, the vulnerability to be assessed needs to be repaired, and the specific process of repairing may include steps A1 to A10.

[0134] Step A1: call the code security detection tool to perform security detection on the vulnerability to be assessed, and export the detection result file.

[0135] Specifically, the BlackDuck tool is a commonly used code security detection tool that supports parameterized configuration and can perform security detection on the code in a specific directory. Jenkins is a continuous integration tool developed based on the Java language and is used to monitor continuous and repetitive work. This embodiment uses the Jenkins platform to configure the code scanning and analysis work of BlackDuck as a task for conditional triggering execution, thereby realizing automated code security detection and automatic export of scanning results.

[0136] Step A2: from the detection result file, screen out the vulnerabilities that meet the risk level or operation level of the vulnerabilities to be repaired, record them as the vulnerabilities to be repaired, and output the component information of the vulnerabilities to be repaired.

[0137] Specifically, the output component information for fixing the vulnerability includes: component name, vulnerability level, current version of the component, and new version of the component that can be upgraded.

[0138] Step A3: Repair the vulnerability according to the component information of the vulnerability to be repaired.

[0139] Specifically, the programming language of the software code is detected; based on the programming language of the software code, a code adaptation method is used to update the vulnerable component to a new version to which the component can be upgraded.

[0140] First, the programming language of the software code is detected, and then the appropriate repair method is selected to update the current version of the vulnerable component to a new version that can be upgraded to achieve vulnerability repair.

[0141] Step A4: After each vulnerability is fixed, the test case is executed to verify the functionality of the software.

[0142] Step A5: If the verification is successful, proceed directly to fix the next vulnerability.

[0143] Step A6: If the verification fails, the component version of the current vulnerability is rolled back to the current version, and then the next vulnerability is repaired. At the same time, the verification failure information and the rolled back component version information are recorded.

[0144] Step A7, after all the vulnerabilities to be repaired have been repaired once, it is determined whether there are no more vulnerabilities and whether the number of detection and repair attempts has reached the maximum number of detection and repair attempts.

[0145] Step A8: If there is no leakage or the number of detection and repair attempts has reached the maximum number of detection and repair attempts, then exit the detection and repair program.

[0146] Step A9: Otherwise, a new round of detection and repair process is performed again.

[0147] Specifically, a new round of detection and repair process refers to returning to step S3 to re-perform code security detection, followed by vulnerability screening, vulnerability repair, and software function verification.

[0148] Step A10, after exiting the detection and repair program, all recorded verification failure information and rolled-back component version information are sent to the personnel in the summary notification personnel list.

[0149] Specifically, all software function verification failure information and rolled-back component version information are sent to relevant personnel so that they can locate the vulnerabilities and handle them.

[0150] In this embodiment, the detection and repair parameters are configured, and the code security detection is automatically implemented through the code security detection tool. Then, the vulnerabilities to be repaired are screened according to the detection and repair parameters, and the vulnerabilities are automatically repaired. The present invention realizes the high automation of the entire code security detection and vulnerability repair through parameter configuration and code security detection tools, greatly improving work efficiency and reducing manpower investment.

[0151] In some optional embodiments, a process for hole classification and risk level assessment is provided. Figure 4 is a flow chart of hole classification and risk level assessment according to an embodiment of the present invention. Figure 4 As shown, the process includes the following steps: Step S401, quantize the vulnerability data; Step S402, bring the processed vulnerability vector data into the vulnerability classification membership α calculation formula to obtain the membership matrix; Step S403, determine the effectiveness; Step S404, if effective, perform vulnerability diversity classification; Step S405, bring it into the vulnerability risk calculation model to obtain the vulnerability risk value; Step S406, set the risk value range for different vulnerability risk levels; Step S407, determine the vulnerability risk level according to the risk level range of the vulnerability risk value.

[0152] In this implementation, a diverse classification of vulnerabilities is achieved, which solves the problem of single classification of vulnerabilities and is conducive to identifying the potential threats of a single vulnerability in a complex system to multiple modules and multiple business layers. The vulnerability risk level is reclassified, and factors such as the system security defense system are included in the risk level assessment, so that the vulnerability rating is more closely matched with the actual operation scenario of the project. The introduction of membership validity filtering eliminates the influence of interference items on the calculation model and improves the accuracy of the vulnerability risk calculation model.

[0153] In this embodiment, a vulnerability risk assessment device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0154] This embodiment provides a vulnerability risk assessment device, such as Figure 5 As shown, including: The correlation determination module 501 is used to obtain the correlation degree of the vulnerability to be evaluated belonging to the first preset number of vulnerability categories according to the vulnerability data of the vulnerability to be evaluated and the correlation determination method; A vulnerability classification module 502 is used to determine a target vulnerability category corresponding to the vulnerability to be evaluated according to the correlation degree, wherein the target vulnerability category is included in a first preset number of vulnerability categories; The vulnerability risk value determination module 503 is used to obtain the vulnerability risk value of the vulnerability to be evaluated according to the correlation degree corresponding to the target vulnerability category and the vulnerability risk value determination method; The risk level determination module 504 is used to determine the target risk level of the vulnerability to be assessed according to the vulnerability risk value.

[0155] In some optional embodiments, the device further comprises: A first acquisition module is used to acquire initial data and a corpus vocabulary of the vulnerability to be evaluated, wherein the corpus vocabulary includes vocabulary categories corresponding to a first preset number of vulnerability categories, and the vocabulary categories include a second preset number of words; A first determination module is used to match the initial data with the vocabulary in the corpus vocabulary table to determine the frequency of the vocabulary in the first preset number of vocabulary categories in the initial data; The first generating module is used to generate vector data of the vulnerability to be evaluated according to the frequency, and use the vector data as vulnerability data.

[0156] In some optional implementations, the first acquisition module includes: A first acquisition unit is used to acquire a third preset number of vulnerability information from a vulnerability database; A second acquisition unit, used to acquire a first preset number of vulnerability categories and generate vocabulary categories corresponding to the vulnerability categories; A matching unit, used for matching the words in the vulnerability information with the word category to obtain the words under the word category; The first generating unit is used to generate a corpus vocabulary list by using vocabulary categories and words under the vocabulary categories.

[0157] In some optional embodiments, the device further comprises: The scanning module is used to scan the project code using a preset scanning tool to obtain relevant data about vulnerabilities in the project code; The second generating module is used to generate vulnerability information using relevant data, and to generate a vulnerability database using the vulnerability information.

[0158] In some optional implementations, the association degree determination module 501 includes: A first calculation unit, used to obtain a first intermediate correlation matrix according to the vulnerability data, a preset cluster center and a correlation calculation formula; A second calculation unit, used to obtain an intermediate cluster center according to the vulnerability data, the first intermediate correlation matrix and the cluster center calculation formula; A judging unit, used to determine a change value between the intermediate cluster center and the preset cluster center, and to judge whether the change value is less than a second preset threshold value; A third calculation unit is used to delete the preset cluster center when the change value is greater than or equal to the second preset threshold value, use the intermediate cluster center as the preset cluster center, and start executing subsequent steps from obtaining the first intermediate correlation matrix according to the vulnerability data, the preset cluster center and the correlation calculation formula, until the change value is less than the second preset threshold value, then the process ends; The fourth calculation unit is used to obtain a first target correlation matrix based on the vulnerability data, the intermediate cluster center and the correlation calculation formula when the change value is less than the second preset threshold, wherein the first target correlation matrix includes the correlations of a first preset number of vulnerability categories.

[0159] In some optional embodiments, the device further comprises: The second acquisition module is used to acquire the target function, wherein the target function is used to determine the total distance from the sample data to the cluster center, the total distance is proportional to the correlation in the target function, and the total distance is proportional to the cluster center in the target function; The second determination module is used to determine the distance expression from the sample data to the cluster center in the objective function; A first obtaining module is used to obtain a first intermediate function according to the distance expression and the target function; A construction module, configured to construct a second intermediate function according to a preset strategy and the first intermediate function, wherein the preset strategy is used to determine a minimum value of a function value of the first intermediate function; A second obtaining module is used to obtain a partial derivative of the correlation degree in the second intermediate function to obtain a third intermediate function, wherein the third intermediate function is used to determine the correlation degree in the objective function; A third obtaining module is used to obtain a target parameter expression according to a preset constraint condition and a third intermediate function; The fourth obtaining module is used to obtain a correlation calculation formula according to the target parameter expression and the third intermediate function.

[0160] In some optional embodiments, the device further comprises: A fifth obtaining module is used to obtain a partial derivative of the cluster center in the second intermediate function to obtain a fourth intermediate function, wherein the fourth intermediate function includes a variable parameter; The sixth obtaining module is used to obtain a cluster center calculation formula by combining the fourth intermediate function and the first preset range of the variable parameter.

[0161] In some optional implementations, the vulnerability risk value determination module 503 includes: A first obtaining unit is used to obtain a second target correlation matrix according to the correlation corresponding to the target vulnerability category, wherein the second target correlation matrix includes second target correlations corresponding to the target vulnerability category, and the sum of the second target correlations in the second target correlation matrix is ​​a preset value; A third acquisition unit is used to acquire a vulnerability classification weight matrix, wherein the vulnerability classification weight matrix is ​​used to determine the target weight corresponding to the second target correlation degree in the second target correlation degree matrix; The second obtaining unit is used to obtain the product of the second target correlation and the corresponding target weight according to the second target correlation matrix, the vulnerability classification weight matrix and the vulnerability risk value calculation formula, and sum the products to obtain the vulnerability risk value.

[0162] In some optional implementations, the vulnerability risk value determination module 503 includes: a fourth acquisition unit, configured to acquire security risk data corresponding to a first preset number of vulnerability categories, and generate weights corresponding to the first preset number of vulnerability categories according to the security risk data and a second preset range, wherein the weights corresponding to the first preset number of vulnerability categories include a target weight; The second generating unit is used to generate a vulnerability classification weight matrix using the weights.

[0163] In some optional implementations, the vulnerability risk value determination module 503 includes: A fifth calculation unit, configured to sum the correlation degrees corresponding to the target vulnerability categories to obtain a total correlation degree; A first determination unit, used to determine a ratio of a correlation degree corresponding to a target vulnerability category to a total correlation degree; A third obtaining unit is used to obtain a second target correlation degree corresponding to the target vulnerability category according to the ratio and a preset value; The fourth obtaining unit is used to obtain a second target correlation matrix according to the second target correlation.

[0164] In some optional implementations, the risk level determination module 504 includes: A fifth obtaining unit, used to obtain risk value ranges corresponding to a fourth preset number of risk levels; The second determining unit is used to determine a target risk value range including the vulnerability risk value, and to use the risk level corresponding to the target risk value range as the target risk level.

[0165] In some optional implementations, the vulnerability classification module 502 includes: A first setting unit, configured to use a correlation degree whose value is greater than or equal to a first preset threshold as a first target correlation degree; The second setting unit is configured to use the vulnerability category corresponding to the first target correlation degree as the target vulnerability category.

[0166] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0167] The vulnerability risk assessment device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0168] The embodiment of the present invention also provides a computer device having the above Figure 5 Vulnerability risk assessment device shown.

[0169] See also Figure 6 , Figure 6 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 6 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 6 A processor 10 is taken as an example.

[0170] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include an integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0171] The memory 20 stores instructions executable by at least one processor 10, so that at least one processor 10 executes the method shown in the above embodiment.

[0172] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0173] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0174] The computer device further comprises a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0175] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0176] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0177] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined in this application.

Claims

1. A vulnerability risk assessment method, characterized in that: The method is applied to a processor, and the method comprises: According to the vulnerability data of the vulnerability to be evaluated and the correlation determination method, the correlation degree of the vulnerability to be evaluated belonging to a first preset number of vulnerability categories is obtained; Determine, according to the correlation degree, a target vulnerability category corresponding to the vulnerability to be evaluated, wherein the target vulnerability category is included in the first preset number of vulnerability categories; Obtaining the vulnerability risk value of the vulnerability to be assessed according to the correlation degree corresponding to the target vulnerability category and the vulnerability risk value determination method; According to the vulnerability risk value, a target risk level of the vulnerability to be assessed is determined.

2. The method according to claim 1, characterized in that Before obtaining the degree of association of the vulnerability to be evaluated belonging to a first preset number of vulnerability categories according to the vulnerability data of the vulnerability to be evaluated and the method of determining the degree of association, the method further includes: Acquire initial data and a corpus vocabulary of the vulnerability to be evaluated, wherein the corpus vocabulary includes vocabulary categories corresponding to the first preset number of vulnerability categories, and the vocabulary categories include a second preset number of words; Matching the initial data with the words in the corpus vocabulary to determine the frequencies of the words in the first preset number of the word categories in the initial data; According to the frequency, vector data of the vulnerability to be evaluated is generated, and the vector data is used as the vulnerability data.

3. The method according to claim 2, characterized in that Obtaining the corpus vocabulary, including: Obtaining a third preset number of vulnerability information from the vulnerability database; Obtaining the first preset number of vulnerability categories, and generating vocabulary categories corresponding to the vulnerability categories; Matching the vocabulary in the vulnerability information with the vocabulary category to obtain the vocabulary under the vocabulary category; The corpus vocabulary is generated by using the vocabulary categories and the vocabulary under the vocabulary categories.

4. The method according to claim 3, characterized in that Before acquiring a third preset number of vulnerability information from the vulnerability database, the method further includes: Scan the project code using a preset scanning tool to obtain relevant data about vulnerabilities in the project code; The vulnerability information is generated by using the relevant data, and the vulnerability database is generated by using the vulnerability information.

5. The method according to claim 1, characterized in that The correlation determination method includes a correlation calculation formula and a cluster center calculation formula. The correlation degree of the vulnerability to be evaluated belonging to a first preset number of vulnerability categories is obtained according to the vulnerability data of the vulnerability to be evaluated and the correlation determination method, including: Obtaining a first intermediate correlation matrix according to the vulnerability data, the preset cluster center and the correlation calculation formula; Obtaining an intermediate cluster center according to the vulnerability data, the first intermediate correlation matrix and the cluster center calculation formula; Determine a change value between the intermediate cluster center and the preset cluster center, and determine whether the change value is less than a second preset threshold; When the change value is greater than or equal to the second preset threshold, the preset cluster center is deleted, the intermediate cluster center is used as the preset cluster center, and subsequent steps are performed from the first intermediate correlation matrix obtained according to the vulnerability data, the preset cluster center and the correlation calculation formula until the change value is less than the second preset threshold, then the process ends; When the change value is less than the second preset threshold, a first target correlation matrix is ​​obtained according to the vulnerability data, the intermediate cluster center and the correlation calculation formula, wherein the first target correlation matrix contains the correlations of the first preset number of vulnerability categories.

6. The method according to claim 5, characterized in that Before obtaining the first intermediate correlation matrix according to the vulnerability data, the preset cluster center and the correlation calculation formula, the method further includes: Obtaining an objective function, wherein the objective function is used to determine the total distance from the sample data to the cluster center, the total distance is proportional to the correlation in the objective function, and the total distance is proportional to the cluster center in the objective function; Determine a distance expression from the sample data to the cluster center in the objective function; Obtaining a first intermediate function according to the distance expression and the objective function; constructing a second intermediate function according to a preset strategy and the first intermediate function, wherein the preset strategy is used to determine a minimum value of a function value of the first intermediate function; Taking a partial derivative of the correlation degree in the second intermediate function to obtain a third intermediate function, wherein the third intermediate function is used to determine the correlation degree in the objective function; Obtaining a target parameter expression according to the preset constraint condition and the third intermediate function; The correlation degree calculation formula is obtained according to the target parameter expression and the third intermediate function.

7. The method according to claim 6, characterized in that After constructing the second intermediate function, the method further includes: Taking partial derivative of the cluster center in the second intermediate function to obtain a fourth intermediate function, wherein the fourth intermediate function includes a variable parameter; The cluster center calculation formula is obtained by combining the fourth intermediate function and the first preset range of the variable parameter.

8. The method according to claim 1, characterized in that: The vulnerability risk value determination method includes a vulnerability risk value calculation formula, and the vulnerability risk value of the vulnerability to be evaluated is obtained according to the correlation degree corresponding to the target vulnerability category and the vulnerability risk value determination method, including: According to the correlations corresponding to the target vulnerability categories, a second target correlation matrix is ​​obtained, wherein the second target correlation matrix includes second target correlations corresponding to the target vulnerability categories, and the sum of the second target correlations in the second target correlation matrix is ​​a preset value; Obtaining a vulnerability classification weight matrix, wherein the vulnerability classification weight matrix is ​​used to determine a target weight corresponding to the second target correlation degree in the second target correlation degree matrix; According to the second target association matrix, the vulnerability classification weight matrix and the vulnerability risk value calculation formula, the product of the second target association and the corresponding target weight is obtained, and the products are summed to obtain the vulnerability risk value.

9. The method according to claim 8, characterized in that The obtaining of the vulnerability classification weight matrix includes: Obtaining security risk data corresponding to the first preset number of vulnerability categories, and generating weights corresponding to the first preset number of vulnerability categories according to the security risk data and a second preset range, wherein the weights corresponding to the first preset number of vulnerability categories include the target weights; The vulnerability classification weight matrix is ​​generated using the weights.

10. The method according to claim 8, characterized in that The step of obtaining a second target correlation matrix according to the correlations corresponding to the target vulnerability categories includes: Summing the correlation degrees corresponding to the target vulnerability categories to obtain a total correlation degree; Determine a ratio of the correlation degree corresponding to the target vulnerability category to the sum of the correlation degrees; Obtaining a second target correlation degree corresponding to the target vulnerability category according to the ratio and the preset value; According to the second target association degree, the second target association degree matrix is ​​obtained.

11. The method according to claim 1, characterized in that Determining the target risk level of the vulnerability to be assessed according to the vulnerability risk value includes: Obtain risk value ranges corresponding to a fourth preset number of risk levels; A target risk value range that includes the vulnerability risk value is determined, and the risk level corresponding to the target risk value range is used as the target risk level.

12. The method according to claim 1, characterized in that Determining, according to the correlation, a target vulnerability category corresponding to the vulnerability to be assessed includes: The correlation degree whose value is greater than or equal to the first preset threshold is taken as the first target correlation degree; The vulnerability category corresponding to the first target correlation degree is used as the target vulnerability category.

13. A vulnerability risk assessment device, characterized in that: The device comprises: A correlation determination module, used to obtain the correlation degree of the vulnerability to be evaluated belonging to a first preset number of vulnerability categories according to the vulnerability data of the vulnerability to be evaluated and the correlation determination method; A vulnerability classification module, used to determine a target vulnerability category corresponding to the vulnerability to be evaluated according to the correlation degree, wherein the target vulnerability category is included in the first preset number of vulnerability categories; A vulnerability risk value determination module, used to obtain the vulnerability risk value of the vulnerability to be evaluated according to the correlation degree corresponding to the target vulnerability category and the vulnerability risk value determination method; The risk level determination module is used to determine the target risk level of the vulnerability to be assessed according to the vulnerability risk value.

14. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the vulnerability risk assessment method according to any one of claims 1 to 12 by executing the computer instructions.

15. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the vulnerability risk assessment method according to any one of claims 1 to 12.

Images