Vulnerability identification method and device, equipment and storage medium

Abstract

The invention relates to the technical field of information security, and provides a vulnerability recognition method and device, equipment and a storage medium, so as to solve the problems of low recognition accuracy and poor expansibility during vulnerability recognition in related technologies. The method comprises the following steps: collecting target attack data; performing word segmentation processing on the target attack data to obtain at least one segmented word included in the target attack data; performing feature addition processing on the at least one segmented word to obtain at least one target feature word, and based on the at least one target feature word, obtaining a target feature word set corresponding to the target attack data; based on the type similarity between each of a plurality of preset reference feature word sets and the target feature word set, determining a vulnerability type of the target attack data; the reference feature word sets are set based on attack data of known vulnerability types, and different reference feature word sets correspond to different vulnerability types of the attack data.

Description

Background Art

[0002] With the rapid development of the Internet and information technology, network security issues are attracting more and more attention. Attackers exploiting vulnerabilities is one of the common attack methods, so vulnerability identification technology has become crucial. If the vulnerability type can be accurately identified through attack traffic, the World Wide Web (web) components related to the identified vulnerability type can be repaired in a targeted manner to prevent being attacked again.

[0003] At present, the scheme for vulnerability identification for attack traffic is mainly based on rule-based vulnerability identification technology. This scheme mainly includes: collecting attack traffic data, and then using the experience of experts in the field of information security technology to analyze the collected attack traffic data to determine the vulnerability type to which each attack traffic data belongs. Then, by defining a series of rules, a rule base is established. Then, the rule base is used to detect and match the attack traffic data to identify vulnerabilities.

[0004] However, there are many known vulnerability types. If the above solution is used for vulnerability identification, it is necessary to define rules for each known vulnerability type in advance before identification. If a certain type of attack traffic data is not defined with rules, it may be misidentified or unidentifiable, so the vulnerability identification accuracy is very low. In addition, since the rules defined for the attack traffic data of a certain protocol cannot be applied to the vulnerability identification of the attack traffic data of other protocols, it can be seen that the scalability of the above solution is very poor.

[0005] Based on the above-mentioned defects existing in the relevant technologies, how to provide a vulnerability identification method with high identification accuracy and strong scalability is urgently needed to be solved. Summary of the invention

[0006] The embodiments of the present application provide a vulnerability identification method, apparatus, device and storage medium to solve the problems of low identification accuracy and poor scalability when performing vulnerability identification in related technologies.

[0007] In a first aspect, an embodiment of the present application provides a vulnerability identification method, including:

[0008] Collect target attack data; perform word segmentation processing on the target attack data to obtain at least one word segmentation included in the target attack data; perform feature addition processing on the at least one word segmentation to obtain at least one target feature word, and based on the at least one target feature word, obtain a target feature word set corresponding to the target attack data; determine the vulnerability type of the target attack data based on the type similarity between each of a plurality of preset reference feature word sets and the target feature word set; wherein the reference feature word set is set based on attack data of known vulnerability types, and different reference feature word sets correspond to different vulnerability types of attack data.

[0009] In a possible implementation, the performing feature adding processing on the at least one segmented word respectively to obtain at least one target feature word includes: for the at least one segmented word, performing the following operations respectively: determining a position of a segmented word in the target attack data according to a preset data format, and determining a segmented word attribute of the segmented word based on the position; the segmented word attribute of the segmented word is used to describe whether the segmented word is a parameter, and the segmented word attribute is determined according to the position of a preset parameter identifier in the target attack data; when the position is a Universal Resource Identifier (URI) and the URI does not include a preset parameter identifier, based on the arrangement order of each segmented word in the URI, adding a front-back sequence feature of the segmented word to the segmented word, and updating the segmented word; when the position is a URI and the URI includes the preset parameter identifier, or the position is a data packet body, based on the segmented word attribute of the segmented word, adding a parameter value of the segmented word to the segmented word, and updating the segmented word; adding a position identifier corresponding to the position to the segmented word, and obtaining a corresponding target feature word.

[0010] In a possible implementation, when the position is a URI and the URI does not include a preset parameter identifier, based on the arrangement order of each segmentation in the URI, adding the front and back order features of the segmentation to the segmentation to update the segmentation includes: judging whether the segmentation is located in a Universal Resource Locator (URL) area in the URI based on the preset data format; when the segmentation is located in the URL area, determining whether the segmentation is located at the starting position of the URL area according to the arrangement order of each segmentation in the URL area; if the segmentation is located at the starting position, adding a preset starting identifier to the segmentation to update the segmentation; if the segmentation is not located at the starting position, adding a segmentation located before the segmentation and adjacent to the segmentation to the segmentation to update the segmentation.

[0011] In a possible implementation, when the position is a URI and the URI does not include a preset parameter identifier, based on the arrangement order of each participle in the URI, the front and back order features of the one participle are added to the one participle, before updating the one participle, the method further includes: when the one participle is located in the URL area of ​​the URI, determining whether the one participle is located at the end position of the URL area according to the arrangement order of each participle in the URL area; if the one participle is located at the end position, adding a corresponding end participle to the at least one participle, the end participle including the one participle and a preset end identifier.

[0012] In a possible implementation, when the position is a URI and the URI includes the preset parameter identifier, or when the position is a data packet body, based on the segmentation attribute of the one segmentation, the parameter value of the one segmentation is added to the one segmentation, and after updating the one segmentation, the method further includes: for a segmentation containing a parameter value, masking the parameter value by representing the parameter value with a preset identifier to obtain a segmentation after the parameter value is masked; and using the segmentation after the parameter value is masked as a new segmentation, so that the at least one segmentation includes the one segmentation containing the parameter value and the segmentation after the parameter value is masked.

[0013] In a possible implementation, obtaining a target feature word set corresponding to the target attack data based on the at least one target feature word includes: based on a feature selection algorithm, removing stop words in the at least one target feature word to obtain a target feature word set corresponding to the target attack data; the stop words are used to characterize redundant feature words in the at least one target feature word, and the stop words are determined based on the proportion of the set including the target feature words in the multiple preset reference feature word sets.

[0014] In a possible implementation, before performing word segmentation processing on the target attack data and obtaining at least one word included in the target attack data, the method further includes: when it is determined according to a preset rule that the data header of the target attack data does not include an attack behavior, removing the data located in the data header of the target attack data; when the data located in the data packet body is in a preset encoding format, decoding the data located in the data packet body; removing noise information in the data located in the data packet body; the noise information includes at least one of a Hypertext Markup Language (html) tag and a script JavaScript code.

[0015] In one possible implementation, before determining the vulnerability type of the target attack data based on the type similarity between each of multiple preset reference feature word sets and the target feature word set, the method includes: establishing an index using each reference feature word included in the reference feature word set as an index value and using at least one reference feature word set in the multiple preset reference feature word sets that contains the corresponding reference feature word as an index item.

[0016] In a possible implementation, the vulnerability type of the target attack data is determined based on the type similarity between each of multiple preset reference feature word sets and the target feature word set, including: in the index, using each target feature word as an index value, respectively determining the index item corresponding to each index value to obtain at least one index item, and using at least one reference feature word set included in each index item as a target reference feature word set to obtain at least one target reference feature word set; respectively calculating the type similarity between the target feature word set and the at least one target reference feature word set; when the type similarity is not less than a preset similarity threshold, determining that the vulnerability type of the attack data corresponding to the corresponding target reference feature word set is the vulnerability type of the target attack data.

[0017] In a possible implementation, after respectively calculating the type similarities between the target feature word set and the at least one target reference feature word set, the method further includes: if the type similarities are all less than the preset similarity threshold, respectively calculating the clustering similarities between at least one unidentified feature word set and the target feature word set; the unidentified feature word set represents a feature word set corresponding to attack data whose vulnerability type is not identified; according to the clustering similarity, determining the vulnerability cluster to which the target feature word set belongs, and adding the target feature word set as an unidentified feature word set to the vulnerability cluster; the vulnerability cluster includes at least one unidentified feature word set, and different vulnerability clusters belong to different vulnerability types; for each vulnerability cluster, when the number of unidentified feature word sets included in a vulnerability cluster reaches a preset number, a reference feature word set corresponding to the vulnerability type to which the vulnerability cluster belongs is set based on each unidentified feature word set in the vulnerability cluster.

[0018] In a possible implementation, the vulnerability cluster to which the target feature word set belongs is determined based on the cluster similarity, and the target feature word set is added to the vulnerability cluster as an unidentified feature word set, including: when the cluster similarity is greater than a preset clustering threshold, the target feature word set is added as an unidentified feature word set to the vulnerability cluster to which the corresponding unidentified feature word set belongs; when the cluster similarities are not greater than the preset clustering threshold, a new vulnerability cluster is created for the target feature word set, and the target feature word set is added to the newly created vulnerability cluster as an unidentified feature word set.

[0019] In a second aspect, the embodiment of the present application further provides a vulnerability identification device, including:

[0020] A collection unit, used for collecting target attack data;

[0021] A processing unit that performs the following operations:

[0022] Performing word segmentation processing on the target attack data to obtain at least one word segment included in the target attack data; performing feature addition processing on the at least one word segmentation to obtain at least one target feature word, and obtaining a target feature word set corresponding to the target attack data based on the at least one target feature word; determining the vulnerability type of the target attack data based on the type similarity between each of a plurality of preset reference feature word sets and the target feature word set; wherein the reference feature word set is set based on attack data of known vulnerability types, and different reference feature word sets correspond to attack data of different vulnerability types.

[0023] In a possible implementation, the processing unit performs feature adding processing on the at least one segmented word respectively, and when obtaining at least one target feature word, is used to: for the at least one segmented word, respectively perform the following operations: determine the position of a segmented word in the target attack data according to a preset data format, and determine the segmented word attribute of the segmented word based on the position; the segmented word attribute of the segmented word is used to describe whether the segmented word is a parameter, and the segmented word attribute is determined according to the position of a preset parameter identifier in the target attack data; when the position is a uniform resource identifier URI, and the URI does not include a preset parameter identifier, based on the arrangement order of each segmented word in the URI, add the front and back sequence feature of the segmented word to the segmented word, and update the segmented word; when the position is a URI and the URI includes the preset parameter identifier, or the position is a data packet body, based on the segmented word attribute of the segmented word, add the parameter value of the segmented word to the segmented word, and update the segmented word; add the position identifier corresponding to the position to the segmented word, and obtain the corresponding target feature word.

[0024] In a possible implementation, when the position is a URI and the URI does not include a preset parameter identifier, based on the arrangement order of each segmentation in the URI, the front and back order features of the segmentation are added to the segmentation, and when the segmentation is updated, the processing unit is used to: determine whether the segmentation is located in a uniform resource locator URL area in the URI based on the preset data format; when the segmentation is located in the URL area, determine whether the segmentation is located at the starting position of the URL area according to the arrangement order of each segmentation in the URL area; if the segmentation is located at the starting position, add a preset starting identifier to the segmentation and update the segmentation; if the segmentation is not located at the starting position, add a segmentation that is located before the segmentation and adjacent to the segmentation to the segmentation and update the segmentation.

[0025] In a possible implementation, when the position is a URI and the URI does not include a preset parameter identifier, based on the arrangement order of each participle in the URI, the front and back order features of the one participle are added to the one participle, and before updating the one participle, the processing unit is further used to: when the one participle is located in the URL area of ​​the URI, determine whether the one participle is located at the end position of the URL area according to the arrangement order of each participle in the URL area; if the one participle is located at the end position, add a corresponding end participle to the at least one participle, and the end participle includes the one participle and a preset end identifier.

[0026] In a possible implementation, when the position is a URI and the URI includes the preset parameter identifier, or when the position is a data packet body, based on the segmentation attribute of the one segmentation, the parameter value of the one segmentation is added to the one segmentation, and after updating the one segmentation, the processing unit is further used to: for a segmentation containing a parameter value, mask the parameter value by representing the parameter value with a preset identifier to obtain a segmentation after the parameter value is masked; and use the segmentation after the parameter value is masked as a new segmentation, so that the at least one segmentation includes the one segmentation containing the parameter value and the segmentation after the parameter value is masked.

[0027] In one possible implementation, when the processing unit obtains the target feature word set corresponding to the target attack data based on the at least one target feature word, it is used to: remove stop words in the at least one target feature word based on a feature selection algorithm to obtain the target feature word set corresponding to the target attack data; the stop words are used to characterize redundant feature words in the at least one target feature word, and the stop words are determined based on the proportion of the set including the target feature words in the multiple preset reference feature word sets.

[0028] In one possible implementation, the processing unit performs word segmentation processing on the target attack data, and before obtaining at least one word segmentation included in the target attack data, is also used to: when it is determined according to a preset rule that the data header of the target attack data does not include an attack behavior, remove the data located in the data header of the target attack data; when the data located in the data packet body is in a preset encoding format, decode the data located in the data packet body; remove noise information in the data located in the data packet body; the noise information includes at least one of a hypertext markup language html tag and a script JavaScript code.

[0029] In one possible implementation, before determining the vulnerability type of the target attack data based on the type similarity between each of multiple preset reference feature word sets and the target feature word set, the processing unit is also used to: establish an index using each reference feature word included in the reference feature word set as an index value and using at least one reference feature word set in the multiple preset reference feature word sets that contains the corresponding reference feature word as an index item.

[0030] In a possible implementation, when the processing unit determines the vulnerability type of the target attack data based on the type similarity between each of multiple preset reference feature word sets and the target feature word set, it is used to: in the index, use each target feature word as an index value, respectively determine the index item corresponding to each index value to obtain at least one index item, and use at least one reference feature word set included in each index item as a target reference feature word set to obtain at least one target reference feature word set; respectively calculate the type similarity between the target feature word set and the at least one target reference feature word set; when the type similarity is not less than a preset similarity threshold, determine that the vulnerability type of the attack data corresponding to the corresponding target reference feature word set is the vulnerability type of the target attack data.

[0031] In a possible implementation, after the processing unit respectively calculates the type similarity between the target feature word set and the at least one target reference feature word set, it is also used to: if the type similarities are all less than the preset similarity threshold, respectively calculate the cluster similarity between at least one unidentified feature word set and the target feature word set; the unidentified feature word set represents a feature word set corresponding to attack data whose vulnerability type is not identified; according to the cluster similarity, determine the vulnerability cluster to which the target feature word set belongs, and add the target feature word set as an unidentified feature word set to the vulnerability cluster; the vulnerability cluster includes at least one unidentified feature word set, and different vulnerability clusters belong to different vulnerability types; for each vulnerability cluster, when the number of unidentified feature word sets included in a vulnerability cluster reaches a preset number, a reference feature word set corresponding to the vulnerability type to which the vulnerability cluster belongs is set based on each unidentified feature word set in the vulnerability cluster.

[0032] In a possible implementation, the processing unit determines the vulnerability cluster to which the target feature word set belongs based on the cluster similarity, and adds the target feature word set as an unidentified feature word set to the vulnerability cluster, and is used to: when the cluster similarity is greater than a preset clustering threshold, add the target feature word set as an unidentified feature word set to the vulnerability cluster to which the corresponding unidentified feature word set belongs; when the cluster similarities are not greater than the preset clustering threshold, create a new vulnerability cluster for the target feature word set, and add the target feature word set as an unidentified feature word set to the newly created vulnerability cluster.

[0033] In a third aspect, an embodiment of the present application further provides a computer device, comprising a processor and a memory, wherein the memory stores program code, and when the program code is executed by the processor, the processor executes the steps of any one of the above-mentioned vulnerability identification methods.

[0034] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, which includes a program code. When the program product is run on a computer device, the program code is used to enable the computer device to execute the steps of any one of the above-mentioned vulnerability identification methods.

[0035] In a fifth aspect, an embodiment of the present application further provides a computer program product, including computer instructions, which are executed by a processor to perform the steps of any one of the above-mentioned vulnerability identification methods.

[0036] The beneficial effects of this application are as follows:

[0037] The embodiment of the present application provides a vulnerability identification method, device, equipment and storage medium, the method comprising: after segmenting the target attack data, performing feature addition processing on each segmentation to obtain at least one target feature word, and further obtaining a target feature word set corresponding to the target attack data based on the at least one target feature word. The vulnerability type of the target attack data is identified by the similarity between the target feature word set and multiple preset reference feature word sets.

[0038] Based on the above method, since the present application can identify the vulnerability type of the target attack data by comparing the similarity between the reference feature word set and the target feature word set, there is no need to set rules for each vulnerability type in advance, avoiding the problem of incorrect or unrecognizable vulnerability type identification of the attack data due to the failure to set rules for a certain vulnerability type, thereby improving the recognition accuracy. And since the target feature word set is obtained by extracting feature words from the target attack data as text, it can be implemented for attack data under various protocols, that is, the vulnerability identification method provided by the embodiment of the present application is not limited to attack data under a certain protocol, and has strong scalability.

[0039] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0041] Figure 1 This is an optional schematic diagram of an application scenario in an embodiment of the present application;

[0042] Figure 2A schematic diagram of a process flow of a vulnerability identification method provided in an embodiment of the present application;

[0043] Figure 3 A schematic diagram of the data format of http traffic data provided in an embodiment of the present application;

[0044] Figure 4 A schematic diagram of the request line segmentation result provided in an embodiment of the present application;

[0045] Figure 5 A schematic diagram of a feature adding process provided in an embodiment of the present application;

[0046] Figure 6 A schematic diagram of the results of adding features in a forward and backward order provided in an embodiment of the present application;

[0047] Figure 7 A schematic diagram of the result of adding parameter features provided in the embodiment of the present application;

[0048] Figure 8 A schematic diagram of the location identification result provided in the embodiment of the present application;

[0049] Fig. 9 A schematic diagram of a method for setting a reference feature word set provided in an embodiment of the present application;

[0050] Fig.10 The index provided for the embodiments of the present application is intended to indicate the purpose;

[0051] Fig.11 Another schematic diagram of the process of vulnerability identification method provided in the embodiment of the present application;

[0052] Fig.12 A schematic diagram of the structure of a vulnerability identification device provided in an embodiment of the present application;

[0053] Fig.13 A schematic diagram of a hardware structure of a computer device to which an embodiment of the present application is applied;

[0054] Fig.14 A schematic diagram of the hardware composition structure of another computer device to which the embodiment of the present application is applied. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the technical solution of the present application, rather than all of the embodiments. Based on the embodiments recorded in the application documents, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the technical solution of the present application.

[0056] Some of the terms used in the embodiments of the present application are explained below to facilitate understanding by those skilled in the art.

[0057] Attack traffic: The traffic generated when an attacker exploits a component vulnerability in a web service to carry out an intrusion attack. In the embodiments of the present application, the attack traffic is also called attack data.

[0058] URI: represents every available resource on the web.

[0059] URL: A method of specifying the location of a resource on the web. URL is a type of URI.

[0060] Inverted Index: Each item in this index includes an attribute value and the address of each record with this attribute value. Since the attribute value is not determined by the record, but the location of the record is determined by the attribute value, it is called an inverted index.

[0061] The following is a brief introduction to the design concept of the embodiment of the present application:

[0062] At present, the scheme for vulnerability identification for attack traffic is mainly based on rule-based vulnerability identification technology, which mainly includes: collecting attack traffic data, and then using the experience of experts in the field of information security technology to analyze the collected attack traffic data, determine the vulnerability type of each attack traffic data, and define a series of rules for each vulnerability type to establish a rule base. Then, when performing vulnerability identification for attack traffic, the rule base can be used to detect and match the attack traffic data to identify the vulnerability type of the attack traffic.

[0063] However, there are many known vulnerability types. If the above solution is used for vulnerability identification, it is necessary to define rules for each known vulnerability type in advance before identification. If a certain type of attack traffic data is not defined with rules, it may be misidentified or unidentifiable, so the vulnerability identification accuracy is very low. In addition, since the rules defined for the attack traffic data of a certain protocol cannot be applied to the vulnerability identification of the attack traffic data of other protocols, it can be seen that the scalability of the above solution is very poor.

[0064] In view of this, the embodiment of the present application provides a vulnerability identification method, device, equipment and storage medium. The method includes: after segmenting the target attack data, adding features to each segmentation to obtain at least one target feature word, and further obtaining a target feature word set corresponding to the target attack data based on the at least one target feature word. The vulnerability type of the target attack data is identified by the similarity between the target feature word set and multiple preset reference feature word sets. Based on the above method, since the present application can identify the vulnerability type of the target attack data by comparing the similarity between the reference feature word set and the target feature word set, there is no need to set rules for each vulnerability type separately in advance, avoiding the problem of incorrect or unrecognizable vulnerability type identification of the attack data due to the failure to set a rule for a certain vulnerability type, thereby improving the recognition accuracy. And since the target feature word set is obtained by extracting feature words from the target attack data as text, it can be implemented for attack data under various protocols, that is, the vulnerability identification method provided by the embodiment of the present application is not limited to attack data under a certain protocol, and has strong scalability.

[0065] The preferred embodiments of the present application are described below in conjunction with the drawings in the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application. In addition, the embodiments and features in the embodiments of the present application may be combined with each other if there is no conflict.

[0066] Figure 1 One of the application scenarios is shown, including a physical terminal device 110 and a server 120. The physical terminal device 110 can establish a communication connection with the server 120 through a wired network or a wireless network. The physical terminal device 110 can upload target attack data. The server 120 can collect the target attack data uploaded by the physical terminal device 110, perform word segmentation processing on the target attack data, and perform feature addition processing to obtain a target feature word set corresponding to the target attack data, and then identify the vulnerability type of the target attack data by calculating the similarity between the target feature word set and the reference feature word set.

[0067] Optionally, the physical terminal device 110 may detect the traffic data upon receiving it, and if the traffic data is attack data, upload it to the server 120 via a wired network or a wireless network.

[0068] It should be noted that in the embodiment of the present application, the number of physical terminal devices 110 can be one or more, and similarly, the number of servers 120 can be one or more, that is, the embodiment of the present application does not limit the number of physical terminal devices 110 or servers 120.

[0069] Among them, the physical terminal device 110 of the embodiment of the present application can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc., but is not limited to this.

[0070] The server 120 of the embodiment of the present application can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (Content Delivery Network, CDN), and big data and artificial intelligence platforms. This application does not make any restrictions here.

[0071] certainly, Figure 1 The application scenarios shown are only exemplary, and the embodiments of the present application can be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, smart transportation, assisted driving, etc., and the present application does not limit this. Figure 1 The functions that can be implemented by each device in the application scenario shown will be described in the subsequent method embodiments, and will not be described in detail here.

[0072] Below, the method flow provided in each embodiment of the present application is described in conjunction with the accompanying drawings, with the server 120 being used as an example for execution.

[0073] See also Figure 2 , is a flow chart of a vulnerability identification method provided in an embodiment of the present application, and the specific implementation process of the method is as follows:

[0074] Step 201, collecting target attack data.

[0075] In the embodiment of the present application, the target attack data collected by the server may be HyperText Transfer Protocol (http) traffic data, and the http traffic data may include three parts: URI, data header (Header) and data body (Body), and the http traffic data may be divided into http request data and http response data. For http request data, the URI is the request line, the Header is the request header and the Body is the request package. For http response data, the URI is the response line, the Header is the response header and the Body is the response package. Since the data formats of http response data and http request data are similar, Figure 3 The data format of http traffic data is explained by taking http request data as an example. Figure 3As shown in the figure, the request line can include the request method, URL, and protocol version, separated by spaces. The request header can include multiple header fields, each of which includes a header field name and a corresponding value. The header field name can include metadata such as the request method and request header. The request body contains the body of the request.

[0076] It should be understood that the content of the response line of the http response data is different from the content of the request line of the http request data. The response line includes the protocol version, the status response code and the description of the status response code, while the response header and response body of the http response data have the same data format as the http request data, which will not be repeated here.

[0077] It should be noted that, in this application, the target attack data is described as http traffic data, but the target attack data can also be User Datagram Protocol (User Datagram Protocol, UDP) traffic data, Transmission Control Protocol (Transmission Control Protocol, TCP) traffic data, File Transfer Protocol (File Transfer Protocol, FTP) traffic data, etc., and the embodiments of this application are not limited to this.

[0078] Optionally, when the application scenario includes multiple physical terminal devices, each physical terminal device can upload attack data, that is, the server connected to the multiple physical terminal devices can collect at least one attack data and execute the attack data as target attack data in turn. Figure 2 Steps 202 to 204 are shown.

[0079] Step 202: perform word segmentation processing on the target attack data to obtain at least one word segmentation included in the target attack data.

[0080] When the server performs word segmentation processing on the target attack data, the word segmentation tool and algorithm in the related technology can be used to segment all data included in the target attack data into at least one word segment, which can be a word or a phrase.

[0081] In one possible implementation, since the request method and protocol version in the http request data usually do not contain information that is helpful for vulnerability identification, when the target attack data is http request data, the request method and protocol version data in the target attack data can be removed before word segmentation processing, that is, when word segmentation processing is performed on the request line, word segmentation processing is only performed on the URL.

[0082] In one example, see Figure 4 The schematic diagram of the request line segmentation result provided in the embodiment of the present application is as follows: Figure 4As shown, the target attack data is http request data. Figure 3 The data format of the http request data shown in the figure shows that the request method of the target attack data is "GET", the protocol version is "HTTP / 1.1" and the URL is:

[0083] “ / index.php?option=com_dcnews&view=dcnews&controller= / etc / passwd”. The URL in the request line in the target attack data is segmented, and the segmentation result is: index.php, option, com_dcnews, view, dcnews, controller, etc, passwd.

[0084] It should be noted that this application does not limit the word segmentation tools and algorithms used, for example, it can be jieba, Natural Language Toolkit (Natural Language Toolkit, NLTK), etc.

[0085] In a possible implementation, before performing word segmentation on the target attack data, some or all of the following operations may be performed:

[0086] 1) When it is determined according to a preset rule that the data header of the target attack data does not include an attack behavior, the data located in the data header of the target attack data is removed.

[0087] For example, it can be determined whether the data header includes an attack behavior by judging whether the data header includes one or more keywords in the preset keyword set. For example, if the preset keyword set includes wget and curl, which are download commands for Linux, then when the data header includes one or more of wget and curl, it can be determined that the data header includes an attack behavior. For another example, / etc / passwd is a sensitive file path for a Linux machine. Then, when the data header includes / etc / passwd, it can be determined that the data header includes an attack behavior. When it is determined that the data header does not include any keyword in the preset keyword set, it can be determined that the data header does not include an attack behavior, and at this time, the data located in the data header of the target attack data can be removed.

[0088] 2) When the data in the data packet body is in a preset coding format, the data in the data packet body is decoded.

[0089] For example, the preset encoding format may include Base64, Json, etc. At this time, the data of the data packet body can be decoded according to the encoding format to obtain the original data of the data packet body, so as to perform subsequent word segmentation processing on the original data of the data packet body to improve the recognition accuracy.

[0090] 3) removing noise information in the data in the data packet body, wherein the noise information includes at least one of an HTML tag and a JavaScript code.

[0091] Since the data in the data packet body may include noise information such as HTML tags and JavaScript codes, which is not helpful for vulnerability identification, it can be removed to reduce the number of target feature words included in the target feature word set, thereby improving the efficiency of vulnerability identification.

[0092] It should be noted that the above operations may be performed in the order of 1), 2), 3) or in the order of 2), 1), 3) or in the order of 2), 3), 1), and this application does not limit this.

[0093] In a possible implementation, after obtaining at least one segmented word included in the target attack data, the at least one segmented word may be normalized, that is, the changed form of the word may be normalized to the original form. For example, the numeric quantifiers in at least one segmented word may be uniformly replaced with "num". The normalization process may reduce the repetition of words in the segmented words and improve the representativeness of the subsequent target feature words.

[0094] In a possible implementation, after obtaining at least one segmented word included in the target attack data, case standardization processing can be performed. For example, each segmented word can be converted to lowercase. By case standardization processing, the influence of case can be avoided, making the segmented words more standardized and reducing the deviation of the subsequent determination of the target feature words.

[0095] Step 203 , performing feature adding processing on at least one word segment respectively to obtain at least one target feature word, and based on the at least one target feature word, obtaining a target feature word set corresponding to the target attack data.

[0096] In a possible implementation, feature addition processing is performed on at least one word segment respectively. When at least one target feature word is obtained, the following operations can be performed on at least one word segment respectively: Figure 5 The process shown includes:

[0097] Step 2031, determining the position of a segmented word in the target attack data according to a preset data format, and determining the segmented word attribute of the segmented word based on the position.

[0098] The preset data formats may include: Figure 3The data format of the http request data and the data format of the http response data shown in the target attack data may include the URI, the data header, and the data packet body. The word segmentation attribute of a word segmentation is used to describe whether the word segmentation is a parameter, and the word segmentation attribute is determined according to the position of the preset parameter identifier in the target attack data. The parameter may include a query parameter. The preset parameter identifier may include "=".

[0099] In one example, determining the segmentation attribute of a segmentation based on the position of the segmentation in the target attack data can be determined by determining whether a preset parameter identifier "=" is adjacent to the segmentation and located after the segmentation in the target attack data. If the preset parameter identifier "=" is adjacent to the segmentation and located after the segmentation, it can be determined that the segmentation is a parameter; if the word or symbol adjacent to the segmentation and located after the segmentation is not the preset parameter identifier "=", it can be determined that the segmentation is not a parameter.

[0100] For example, Figure 4 The word "option" in the request line of the target attack data shown in the figure can be determined as a parameter because the symbol "=" is adjacent to and after "option" in the request line. Similarly, it can be seen that "view" and "controller" in the request line are also parameters.

[0101] Step 2032, when the location is a URI, and the URI does not include a preset parameter identifier, based on the arrangement order of each word in the URI, the front and back order feature of a word is added to a word, and the word is updated.

[0102] When the preset parameter identifier is not included in the URI, it means that the URI does not include parameters. At this time, it is necessary to add the front and back order features of each word in the URL area to improve the representativeness of subsequent target feature words and improve the accuracy of vulnerability identification.

[0103] In some embodiments, based on the arrangement order of each participle in the URI, the front and back order features of a participle are added to a participle. When updating a participle, it can be determined whether a participle is located in the URL area in the URI based on a preset data format. And when a participle is located in the URL area, it is determined whether a participle is located at the starting position of the URL area according to the arrangement order of each participle in the URL area. If a participle is located at the starting position, a preset starting identifier is added to a participle and the participle is updated. If a participle is not located at the starting position, a participle that is located before a participle and adjacent to a participle is added to a participle and the participle is updated.

[0104] For example, assuming the default start identifier is $, the URL of the target attack data is:

[0105] " / vendor / phpunit / phpunit / src / Util / PHP / eval-stdin.php".

[0106] Then the above-mentioned URL can obtain the segmentation result after the segmentation processing through step 202, including: vendor, phpunit, phpunit, src, Util, PHP, eval-stdin.php. Based on this, if the segmentation to be processed with feature addition is "vendor", since there are no other segmentations before the segmentation in the URL, it can be determined that it is located at the starting position of the URL area, and $ can be added to the segmentation to obtain the updated segmentation "$ / vendor". If the segmentation to be processed with feature addition is "phpunit", since there are other segmentations before the segmentation in the URL, it can be determined that it is not located at the starting position, and the segmentation "vendor" located before the segmentation and adjacent to the segmentation can be added to the segmentation to obtain the updated segmentation "vendor / phpunit".

[0107] On the contrary, if the word is not in the URL area, there is no need to add the sequence feature to the word. For example, if the word is Figure 4 If the request method in the target attack data shown is "GET", there is no need to update the word.

[0108] In a possible implementation, when the position of a word in the target attack data is a URI, and the URI does not include a preset parameter identifier, based on the arrangement order of each word in the URI, the front and back order features of a word are added to the word. Before updating a word, the following operations may be performed: when a word is located in the URL area of ​​the URI, it is determined whether the word is located at the end of the URL area according to the arrangement order of each word in the URL area. If a word is located at the end, a corresponding end word is added to at least one word, and the end word includes a word and a preset end identifier.

[0109] For example, assuming the default ending identifier is $, the URL of the target attack data is:

[0110] " / vendor / phpunit / phpunit / src / Util / PHP / eval-stdin.php".

[0111] For the final participle "eval-stdin.php", a corresponding final participle "eval-stdin.php / $" may be added to at least one participle.

[0112] In one example, see Figure 6 The schematic diagram of the result of adding the features in the order provided in the embodiment of the present application is as follows: Figure 6 As shown, the target attack data is http request data, and the request method of the target attack data is "GET", the URL is " / cgi-bin / slogin / login.py", and the protocol version is "HTTP / 1.1". Then, the URL can be segmented by the method shown in step 202 to obtain the segmentation results, including: cgi-bin, slogin, login.py, and then the front and back sequence features are added to each segmentation to obtain the updated segmentation $ / cgi-bin, cgi-bin / slogin, slogin / login.py, and the newly added end segmentation login.py / $.

[0113] It should be noted that the above-mentioned start identifier and end identifier are only exemplary, and other symbols may be used as the start identifier or the end identifier, and the start identifier and the end identifier may be the same or different, which is not limited in this application.

[0114] Step 2033: When the location is a URI and the URI includes a preset parameter identifier, or when the location is a data packet body, based on the segmentation attribute of a segmentation, a parameter value of a segmentation is added to a segmentation, thereby updating the segmentation.

[0115] If the position of a word segment is a URI, and the URI of the target attack data includes a preset parameter identifier, it can be determined whether it is a parameter based on the word segment attribute of the word segment. If the word segment is a parameter, the parameter value of the word segment can be added to the word segment to update a word segment. The parameter value of the word segment is the word segment or phrase that is located after the corresponding preset parameter identifier and adjacent to the corresponding preset parameter identifier in the target attack data.

[0116] Alternatively, if the position of a word segment is a data packet body, it can be determined whether it is a parameter based on the word segmentation attribute of the word segmentation. If the word segmentation is a parameter, the parameter value of the word segmentation can be added to the word segmentation to update the word segmentation. The parameter value of the word segmentation is the word segmentation or phrase located after the corresponding preset parameter identifier and adjacent to the corresponding preset parameter identifier in the target attack data.

[0117] For example, Figure 4As shown in the target attack data request line, the URL of the target attack data is " / index.php?option=com_dcnews&view=dcnews&controller= / etc / passwd". For each word in the URL: index.php, option, com_dcnews, view, dcnews, controller, etc, passwd, since the request line includes a parameter identifier, when performing a feature adding operation on each word, it can be determined whether the corresponding word is a parameter according to the word attribute of each word. For example, in this example, according to the method shown in step 2031, it can be determined that "option", "view" and "controller" are parameters. Taking "option" as an example, since the word after the parameter identifier "=" adjacent to "option" is "com_dcnews", the parameter value of "option" is "com_dcnews". Similarly, it can be determined that the parameter value of "view" is "dcnews" and the parameter value of "controller" is " / etc / passwd".

[0118] The parameter value of the word belonging to the parameter is added to the word. After the corresponding word is updated, at least one word corresponding to the URL area may include: index.php, option=com_dcnews, com_dcnews, view=dcnews, dcnews, controller= / etc / passwd, etc, passwd.

[0119] In some embodiments, the word corresponding to the parameter value included in at least one word after the corresponding word is updated can be deleted. For example, the at least one word after the corresponding word is updated in the above example can include: index.php, option=com_dcnews, view=dcnews, controller= / etc / passwd.

[0120] In a possible implementation, when the position is a URI and the URI includes a preset parameter identifier, or the position is a data packet body, based on the segmentation attribute of a segmentation, a parameter value of a segmentation is added to a segmentation, and after updating a segmentation, the parameter value of a segmentation containing a parameter value can be masked by using a preset identifier to represent the parameter value, thereby obtaining a segmentation after the parameter value is masked. The segmentation after the parameter value is masked is used as a new segmentation, so that at least one segmentation includes a segmentation containing a parameter value and a segmentation after the parameter value is masked.

[0121] For example, the preset identifier may be "*", and the parameter value masking for the updated segmentation in the above example may obtain option=*, view=*, and controller=*. After the segmentation after the parameter value masking is used as a new segmentation, at least one segmentation in the above example may include index.php, option=com_dcnews, option=*, view=dcnews, view=*, controller= / etc / passwd, and controller=*.

[0122] In one example, see Figure 7 The following is a schematic diagram of the parameter feature addition results provided in the embodiment of the present application. Figure 7 As shown, the target attack data is http request data, and the URL in the request line is " / index.php?option=com_market&view=market&controller= / etc / passwd".

[0123] After word segmentation of the data in the URL area, we can get: index.php, option, com_market, view, dcnews, controller, etc, passwd. After adding parameter features to the parameters in the word segmentation through the above operations such as parameter value addition and parameter masking, we can get: index.php, option=com_market, option=*, view=market, view=*, controller= / etc / passwd, controller=*.

[0124] It should be noted that the above-mentioned preset identifiers are only exemplary, and other symbols may also be used as preset identifiers, which is not limited in this application.

[0125] Based on the above scheme, for URI, since the inclusion of a preset parameter identifier indicates that the URL includes parameters, and the parameters have no sequential relationship, when the preset parameter identifier is included in the URI, adding parameter values ​​instead of adding sequential features can avoid adding too many redundant features and improve the efficiency of vulnerability identification.

[0126] In a possible implementation, if a word segment is located at the data header in the target attack data, it can be determined according to the preset data format whether the word segment is Figure 3 The header field name shown in the figure, if the word is a header field name, and the attack behavior is in the value corresponding to the word field name, the value corresponding to the word can be added to the word to update the word.

[0127] For example, the data header of the target attack data includes the following data:

[0128] User-Agent: (){:;};echo;echo; / bin / cat / etc / passwd.

[0129] Since the value corresponding to the User-Agent field includes the attack behavior / cat / etc / passwd, if feature addition processing is performed on the word User-Agent, updated word User-Agent=cat, User-Agent=etc, User-Agent=passwd, and User-Agent=echo can be obtained.

[0130] In some embodiments, the corresponding value of the above-mentioned segmentation containing the corresponding value can be masked by using a preset identifier to represent the corresponding value, so as to obtain the segmentation after the corresponding value is masked. The segmentation after the corresponding value is masked is used as a new segmentation, so that at least one segmentation includes a segmentation containing the corresponding value and the segmentation after the corresponding value is masked.

[0131] For example, for the above example, since the header fields are all User-Agent, the corresponding value-masked word can include User-Agent=*. After using it as a new word, at least one word can include: User-Agent=cat, User-Agent=etc, User-Agent=passwd, User-Agent=echo User-Agent=*.

[0132] Step 2034, according to the position of a segmented word in the target attack data, a position identifier corresponding to the position is added to a segmented word to obtain a corresponding target feature word.

[0133] Since the position of a word in the target attack data may include the URI, the data header, and the data packet body, the position identifiers corresponding to the URI, the data header, and the data packet body may be pre-set. For example, the position identifier corresponding to the URI may be "uri", the position identifier corresponding to the data header may be "header", and the position identifier corresponding to the data packet body may be "body".

[0134] For example, for Figure 7In the parameter feature addition result shown, "index.php" is located at URI, so the location identifier "uri" can be added to the segmentation to obtain the corresponding target feature word "uri:index.php". For another example, the segmentation word "User-Agent=etc" located at the data header can be added with the location identifier "header" to obtain the corresponding target feature word "header:User-Agent=etc".

[0135] Furthermore, if a word segment is extracted from a query parameter in the target attack data, the position of the word segment can be considered as the query parameter, and the position mark "query" corresponding to the query parameter is added to the word segment. Figure 4 "option", "view" and "controller" in the request line of the target attack data shown are query parameters. After adding parameter features through the method of step 2033, the position identifiers corresponding to the query parameters can be added to the word segmentation to obtain the corresponding target feature words: query:option=com_dcnews, query:option=*, query:view=dcnews, query:view=*, query:controller= / etc / passwd, query:controller=*.

[0136] It should be noted that the above-mentioned location identifiers are only exemplary and can be set according to actual conditions, which is not limited in this application.

[0137] See also Figure 8 The schematic diagram of adding the location identifier provided in the embodiment of the present application is as follows: Figure 8 As shown, the target attack data can be http request data, which includes a request line and a request header. Since the request header can be determined not to include attack behavior according to preset rules, the data in the request header can be removed before word segmentation. In addition, the request method and protocol version in the request line usually do not contain information that is helpful for vulnerability identification, so the data of the request method and protocol version in the request line can also be removed. By performing word segmentation, adding parameter features, and adding location identifiers on the removed target attack data using the above method, the following target feature words can be obtained:

[0138] uri:index.php, query:option=*, query:option=com_dcnews, query:view=*, query:view=dcnews, query:controller=*, query:controller=etc, query:controller=passwd.

[0139] It can be seen that since index.php is located in the request line and is not a query parameter, the location identifier "uri" corresponding to the request line can be added before the word segmentation. Since option, view, and controller are query parameters, the location identifier "query" corresponding to the query parameter can be added before option=*, option=com_dcnews, view=*, view=dcnews, controller=*, controller=etc, and controller=passwd.

[0140] It should be understood that the word segmentation processing and parameter feature addition can refer to the relevant description shown in step 202 and step 2033, which will not be repeated here.

[0141] pass Figure 5 After obtaining at least one target feature word in the process shown, the stop words in the at least one target feature word can also be removed based on the feature selection algorithm, and the more representative feature words in the at least one target feature word can be selected to obtain a target feature word set corresponding to the target attack data. Among them, the stop words are used to characterize the redundant feature words in the at least one target feature word, and the stop words can be determined according to the proportion of the set including the target feature word in multiple preset reference feature word sets.

[0142] In one example, when the ratio of the number of reference feature word sets including the target feature word A to the number of preset reference feature word sets in the preset multiple reference feature word sets is greater than a certain preset ratio, the target feature word A can be determined to be a stop word. For example, the preset ratio can be 80%, and the number of preset reference feature word sets is 10. Then, in the preset 10 reference feature word sets, if more than 8 reference feature words include the target feature word A, the target feature word A can be determined to be a stop word.

[0143] In a possible implementation, since some words with fewer letters have no actual meaning in the attack data and are relatively redundant, stop words can also be determined based on the number of letters in the target feature words. For example, words with 1 letter can be used as stop words, such as "a", "b", etc.

[0144] In some embodiments, the feature selection algorithm may select algorithms such as term frequency-inverse document frequency (TF-IDF), mutual information, chi-square test, etc., which is not limited in this application.

[0145] Based on the above scheme, the feature selection algorithm can remove redundant information in the target feature words, improve the representativeness of each target feature word, and thus improve the accuracy of vulnerability identification.

[0146] Step 204 : determining the vulnerability type of the target attack data based on the type similarity between each of the plurality of preset reference feature word sets and the target feature word set.

[0147] The reference feature word set is set based on attack data of known vulnerability types, and different reference feature word sets correspond to different vulnerability types of attack data. For example, the vulnerability type may include various known vulnerability types in related technologies, such as unauthorized command execution in WebLogic, security vulnerabilities in Apache Solr, etc.

[0148] In some embodiments, see Fig. 9 A schematic diagram of a method for setting a reference feature word set provided in an embodiment of the present application, firstly, collect attack data of multiple known vulnerability types, for example, data 00001 belonging to vulnerability type A, data 00002 belonging to vulnerability type B, data 00003 belonging to vulnerability type C, etc. Then, the collected attack data of multiple known vulnerability types can be subjected to word segmentation processing, feature addition processing, etc. by the methods shown in the above steps 202 and 203 to determine the reference feature word set corresponding to the vulnerability type of each attack data. For example, reference feature word set A corresponding to vulnerability type A, reference feature word set B corresponding to vulnerability type B, reference feature word set C corresponding to vulnerability type C, etc.

[0149] In one possible implementation, the collected attack data of multiple known vulnerability types may be attack data belonging to the same vulnerability type. In this case, for the collected vulnerability data of the same vulnerability type, after word segmentation and feature addition, the union of the reference feature words obtained can be used as the reference feature word set of the vulnerability type. For example, among the collected attack data of multiple known vulnerability types, only the vulnerability type of data 1 and data 2 is vulnerability type A, and the reference feature words obtained according to data 1 include: aaa, bbb, and ccc, and the reference feature words obtained according to data 2 include: bbb, ccc, and ddd, then it can be determined that the reference feature word set corresponding to vulnerability type A includes: aaa, bbb, ccc, and ddd.

[0150] In a possible implementation, a vulnerability database may be established in advance, which may include various reference feature word sets, and the vulnerability types corresponding to the reference feature word sets are stored in the vulnerability database as labels of the reference feature word sets. Different reference feature word sets in the vulnerability database correspond to different vulnerability types of attack data.

[0151] In another possible implementation, the vulnerability database may also be used to store vulnerability data of multiple known vulnerability types and a feature word set obtained by executing steps 202 and 203 for each vulnerability data. The vulnerability types of different vulnerability data may be the same.

[0152] In one possible implementation, before determining the vulnerability type of the target attack data based on the type similarity between each of multiple preset reference feature word sets and the target feature word set, in order to avoid completely traversing the target feature word set and comparing the type similarities with multiple preset reference feature word sets one by one, thereby reducing the number of type similarity comparisons and improving vulnerability identification efficiency, an inverted index can also be established for multiple preset reference feature word sets.

[0153] Specifically, each reference feature word included in the reference feature word set can be used as an index value, and at least one reference feature word set including the corresponding reference feature word in multiple preset reference feature word sets can be used as an index item to create an index. The index can be implemented in the form of an index table.

[0154] In one example, see Fig.10 The index provided for the embodiment of the present application is intended to indicate the following: Fig.10As shown, it is assumed that a plurality of preset reference feature word sets include: reference feature word set X, reference feature word set Y and reference feature word set Z, wherein reference feature word set X includes reference feature word A, reference feature word B and reference feature word C, reference feature word set Y includes reference feature word C, reference feature word D and reference feature word E, and reference feature word set Z includes reference feature word A, reference feature word B and reference feature word E. In the established index table, reference feature word A, reference feature word B, reference feature word C, reference feature word D and reference feature word E can be used as index values ​​respectively. When reference feature word A is the index value, since reference feature word set X and reference feature word set Z both include reference feature word A, reference feature word set X and reference feature word set Z can be used as index items corresponding to reference feature word A. Similarly, when reference feature word B is the index value, the corresponding index items are reference feature word set X and reference feature word set Z; when reference feature word C is the index value, the corresponding index items are reference feature word set X and reference feature word set Y; when reference feature word D is the index value, the corresponding index item is reference feature word set Y; when reference feature word E is the index value, the corresponding index item is reference feature word set Y and reference feature word set Z.

[0155] It should be noted that Fig.10 The index table shown is an exemplary representation of the index, and this application does not limit this.

[0156] In a possible implementation, based on Fig.10 The index table established by the method shown uses each target feature word as an index value, determines the index item corresponding to each index value, obtains at least one index item, and uses at least one reference feature word set included in each index item as a target reference feature word set, obtains at least one target reference feature word set. The type similarity between the target feature word set and the at least one target reference feature word set is calculated respectively.

[0157] For example, Fig.10 Taking the index table shown as an example, if the target feature word set includes target feature word A and target feature word B, wherein target feature word A is the same as reference feature word A, and target feature word B is the same as reference feature word B. Since it can be determined through the index table that the reference feature word set including reference feature word A is reference feature word set X and reference feature word set Z, and the reference feature word set including reference feature word B is also reference feature word set X and reference feature word set Z, it can be determined that the target reference feature word set is reference feature word set X and reference feature word set Z. At this time, the type similarity between the target feature word set and the reference feature word set X, and the type similarity between the target feature word set and the reference feature word set Z can be calculated respectively.

[0158] In some embodiments, the type similarity can be calculated by using the Jaccard similarity coefficient, where the Jaccard similarity coefficient is a statistic used to compare the similarity of finite sample sets, which is equal to the ratio of the intersection and union of two sets and satisfies formula (1).

[0159]

[0160] Where P and Q represent the target feature word set and target reference feature word set for which type similarity needs to be calculated, respectively, and J(P, Q) represents the type similarity between P and Q.

[0161] It should be noted that the algorithm used to calculate type similarity can also be a Simhash algorithm, an edit distance algorithm, etc., which is not limited in this application.

[0162] After at least one type similarity is calculated by formula (1), when the type similarity is not less than a preset similarity threshold, the vulnerability type of the attack data corresponding to the corresponding target reference feature word set is determined to be the vulnerability type of the target attack data.

[0163] For example, assuming that the similarity threshold is 0.9, and the type similarity between the target feature word set and the reference feature word set X in the above example is 0.83, and the type similarity between the target feature word set and the reference feature word set Z is 0.93, then it can be determined that the vulnerability type of the attack data corresponding to the reference feature word set Z is the vulnerability type of the target attack data.

[0164] It should be noted that the similarity threshold may be preset based on actual conditions or experience, for example, it may also be 0.85 or 0.95, etc., and this application does not limit this.

[0165] In one possible implementation, target attack data with unidentified vulnerability types and target feature word sets may be clustered with feature word sets corresponding to other attack data with unidentified vulnerability types to expand the reference feature word set and improve the vulnerability type coverage of the reference feature word set.

[0166] Specifically, if the calculated type similarities are all less than the preset similarity threshold, the cluster similarity between at least one unidentified feature word set and the target feature word set can be calculated respectively. Then, based on the cluster similarity, the vulnerability cluster to which the target feature word set belongs is determined, and the target feature word set is added to the vulnerability cluster as an unidentified feature word set. For each vulnerability cluster, when the number of unidentified feature word sets included in a vulnerability cluster reaches a preset number, a reference feature word set corresponding to the vulnerability type to which a vulnerability cluster belongs is set based on each unidentified feature word set in a vulnerability cluster. Among them, the unidentified feature word set represents the feature word set corresponding to the attack data of the unidentified vulnerability type, and each vulnerability cluster includes at least one unidentified feature word set, and different vulnerability clusters belong to different vulnerability types. Cluster similarity can be calculated using formula (1).

[0167] In some embodiments, according to the cluster similarity, the vulnerability cluster to which the target feature word set belongs is determined, and the target feature word set is added to the vulnerability cluster as an unidentified feature word set, including: when the cluster similarity is greater than a preset cluster threshold, the target feature word set is added to the vulnerability cluster to which the corresponding unidentified feature word set belongs as an unidentified feature word set. When the cluster similarities are not greater than the preset cluster threshold, a new vulnerability cluster is created for the target feature word set, and the target feature word set is added to the newly created vulnerability cluster as an unidentified feature word set.

[0168] Optionally, the above clustering method may adopt a single-pass streaming clustering algorithm or a density-based clustering algorithm (Density-Based Spatial Clustering of Applications with Noise, DBSCAN) algorithm, which is not limited in the present application.

[0169] In some embodiments, when vulnerability identification is performed historically, target attack data of unidentified vulnerability types and corresponding target feature word sets can be collected, and they are added to the unidentified database as unidentified attack data and unidentified feature word sets, respectively, and when the number of unidentified attack data included in the unidentified database reaches a preset threshold, each unidentified feature word set in the unidentified database is clustered. A Single-Pass streaming clustering algorithm can be used, that is, the first unidentified feature word set in the database is first used as the cluster center, and the cluster similarity of the first unidentified feature word set and other unidentified feature word sets is calculated in sequence, and when the cluster similarity is not less than the threshold, it is determined that the corresponding two unidentified feature words belong to the same vulnerability cluster, otherwise, the first unidentified feature word set is determined to join a newly created vulnerability cluster. Among them, the first unidentified feature word set can be any unidentified feature word set in the unidentified database. After determining the vulnerability cluster to which the first unidentified feature word set belongs, the vulnerability cluster to which the second unidentified feature word set belongs is determined according to the same method, and so on.

[0170] In one possible implementation, the vulnerability identification method provided in the embodiment of the present application can be implemented using the Python language.

[0171] See also Fig.11 Another flowchart of the vulnerability identification method provided in the embodiment of the present application. The process includes:

[0172] Step 1101, collecting target attack data.

[0173] The server can collect the target attack data uploaded by the physical terminal. The format of the target attack data can refer to the relevant description in step 201, which will not be repeated here.

[0174] Step 1102, determining a target feature word set.

[0175] The server can perform word segmentation processing on the target attack data by the method shown in step 202, perform feature addition processing on the word segmentation by the method shown in step 203 to obtain target feature words, and obtain a target feature word set based on the target feature words. The specific method can refer to the relevant description in the above method embodiment, which will not be repeated here.

[0176] Step 1103: whether the type similarity is not less than a preset similarity threshold.

[0177] Determine the type similarity between the target feature word set and each target reference feature word set, and determine whether the type similarity is greater than or equal to a preset similarity threshold, if so, execute step 1104; otherwise, execute step 1105. The calculation method of type similarity can refer to the relevant description in step 204 and will not be repeated here.

[0178] Step 1104, determine the vulnerability type.

[0179] The vulnerability type of the target attack data may be determined according to the vulnerability type of the target reference feature word set whose type similarity with the target feature word set is not less than a preset similarity threshold.

[0180] Step 1105, adding vulnerability clusters through clustering.

[0181] When the type similarity between the target feature word set and each target reference feature word set is less than the preset similarity threshold, they can be clustered with the unrecognized feature word set and added to the feature cluster as an unrecognized feature word set. The specific method can be found in the relevant description in the above method embodiment, which will not be repeated here.

[0182] Step 1106, setting a reference feature word set.

[0183] An expert in a related field may identify each unidentified feature word set in a vulnerability cluster whose number of unidentified reference feature word sets reaches a preset number, determine the vulnerability type corresponding to the vulnerability cluster, and identify the vulnerability type as a label for each unidentified feature word set in the vulnerability cluster, and set it as a reference feature word set.

[0184] Optionally, the vulnerability clusters may be sorted according to the number of unidentified feature word sets included in each vulnerability cluster. Unidentified feature word sets in the top N vulnerability clusters are identified to determine the vulnerability type, where N may be preset based on actual conditions or experience, and this application does not limit this.

[0185] Based on the same inventive concept as the above method embodiment, the present application embodiment also provides a vulnerability identification device. Fig.12 The vulnerability identification device 1200 shown may include:

[0186] A collection unit 1201 is used to collect target attack data;

[0187] The processing unit 1202 is configured to perform the following operations:

[0188] Performing word segmentation processing on the target attack data to obtain at least one word segment included in the target attack data; performing feature addition processing on the at least one word segmentation to obtain at least one target feature word, and obtaining a target feature word set corresponding to the target attack data based on the at least one target feature word; determining the vulnerability type of the target attack data based on the type similarity between each of a plurality of preset reference feature word sets and the target feature word set; wherein the reference feature word set is set based on attack data of known vulnerability types, and different reference feature word sets correspond to attack data of different vulnerability types.

[0189] In a possible implementation, the processing unit 1202 performs feature adding processing on the at least one segmented word respectively, and when obtaining at least one target feature word, is used to: for the at least one segmented word, respectively perform the following operations: determine the position of a segmented word in the target attack data according to a preset data format, and determine the segmented word attribute of the segmented word based on the position; the segmented word attribute of the segmented word is used to describe whether the segmented word is a parameter, and the segmented word attribute is determined according to the position of a preset parameter identifier in the target attack data; when the position is a uniform resource identifier URI, and the URI does not include a preset parameter identifier, based on the arrangement order of each segmented word in the URI, add the front and back sequence feature of the segmented word to the segmented word, and update the segmented word; when the position is a URI and the URI includes the preset parameter identifier, or the position is a data packet body, based on the segmented word attribute of the segmented word, add the parameter value of the segmented word to the segmented word, and update the segmented word; add the position identifier corresponding to the position to the segmented word, and obtain the corresponding target feature word.

[0190] In a possible implementation, when the position is a URI and the URI does not include a preset parameter identifier, based on the arrangement order of each word segment in the URI, the front-back order feature of the word segment is added to the word segment, and when the word segment is updated, the processing unit 1202 is used to: determine whether the word segment is located in a uniform resource locator URL area in the URI based on the preset data format; when the word segment is located in the URL area, determine whether the word segment is located at the starting position of the URL area according to the arrangement order of each word segment in the URL area; if the word segment is located at the starting position, add a preset starting identifier to the word segment, and update the word segment; if the word segment is not located at the starting position, add a word segment that is located before the word segment and adjacent to the word segment to the word segment, and update the word segment.

[0191] In a possible implementation, when the position is a URI and the URI does not include a preset parameter identifier, based on the arrangement order of each participle in the URI, the front and back order features of the one participle are added to the one participle, and before updating the one participle, the processing unit 1202 is further used to: when the one participle is located in the URL area of ​​the URI, determine whether the one participle is located at the end position of the URL area according to the arrangement order of each participle in the URL area; if the one participle is located at the end position, add a corresponding end participle to the at least one participle, and the end participle includes the one participle and a preset end identifier.

[0192] In a possible implementation, when the position is a URI and the URI includes the preset parameter identifier, or when the position is a data packet body, based on the segmentation attribute of the one segmentation, the parameter value of the one segmentation is added to the one segmentation, and after updating the one segmentation, the processing unit 1202 is further used to: for a segmentation containing a parameter value, mask the parameter value by representing the parameter value with a preset identifier to obtain a segmentation after the parameter value is masked; and use the segmentation after the parameter value is masked as a new segmentation, so that the at least one segmentation includes the one segmentation containing the parameter value and the segmentation after the parameter value is masked.

[0193] In one possible implementation, when the processing unit 1202 obtains the target feature word set corresponding to the target attack data based on the at least one target feature word, it is used to: remove stop words in the at least one target feature word based on a feature selection algorithm to obtain the target feature word set corresponding to the target attack data; the stop words are used to characterize redundant feature words in the at least one target feature word, and the stop words are determined based on the proportion of the set including the target feature words in the multiple preset reference feature word sets.

[0194] In one possible implementation, the processing unit 1202 performs word segmentation processing on the target attack data, and before obtaining at least one word segmentation included in the target attack data, is also used to: when it is determined according to a preset rule that the data header of the target attack data does not include an attack behavior, remove the data located in the data header of the target attack data; when the data located in the data packet body is in a preset encoding format, decode the data located in the data packet body; remove noise information in the data located in the data packet body; the noise information includes at least one of a hypertext markup language html tag and a script JavaScript code.

[0195] In one possible implementation, before determining the vulnerability type of the target attack data based on the type similarity between each of multiple preset reference feature word sets and the target feature word set, the processing unit 1202 is also used to: establish an index using each reference feature word included in the reference feature word set as an index value and using at least one reference feature word set in the multiple preset reference feature word sets that contains the corresponding reference feature word as an index item.

[0196] In one possible implementation, when the processing unit 1202 determines the vulnerability type of the target attack data based on the type similarity between each of multiple preset reference feature word sets and the target feature word set, it is used to: in the index, use each target feature word as an index value, respectively determine the index item corresponding to each index value to obtain at least one index item, and use at least one reference feature word set included in each index item as a target reference feature word set to obtain at least one target reference feature word set; respectively calculate the type similarity between the target feature word set and the at least one target reference feature word set; when the type similarity is not less than a preset similarity threshold, determine that the vulnerability type of the attack data corresponding to the corresponding target reference feature word set is the vulnerability type of the target attack data.

[0197] In a possible implementation, after the processing unit 1202 respectively calculates the type similarity between the target feature word set and the at least one target reference feature word set, it is also used to: if the type similarities are all less than the preset similarity threshold, then respectively calculate the cluster similarity between at least one unidentified feature word set and the target feature word set; the unidentified feature word set represents a feature word set corresponding to attack data whose vulnerability type is not identified; according to the cluster similarity, determine the vulnerability cluster to which the target feature word set belongs, and add the target feature word set as an unidentified feature word set to the vulnerability cluster; the vulnerability cluster includes at least one unidentified feature word set, and different vulnerability clusters belong to different vulnerability types; for each vulnerability cluster, when the number of unidentified feature word sets included in a vulnerability cluster reaches a preset number, a reference feature word set corresponding to the vulnerability type to which the vulnerability cluster belongs is set based on each unidentified feature word set in the vulnerability cluster.

[0198] In one possible implementation, the processing unit 1202 determines the vulnerability cluster to which the target feature word set belongs based on the cluster similarity, and adds the target feature word set as an unidentified feature word set to the vulnerability cluster, and is used to: when the cluster similarity is greater than a preset clustering threshold, add the target feature word set as an unidentified feature word set to the vulnerability cluster to which the corresponding unidentified feature word set belongs; when the cluster similarities are not greater than the preset clustering threshold, create a new vulnerability cluster for the target feature word set, and add the target feature word set as an unidentified feature word set to the newly created vulnerability cluster.

[0199] For the convenience of description, the above parts are divided into units according to their functions and described separately. Of course, when implementing this application, the functions of each unit can be implemented in the same or multiple software or hardware.

[0200] After introducing the vulnerability identification method and apparatus according to an exemplary embodiment of the present application, next, a computer device according to another exemplary embodiment of the present application is introduced.

[0201] Those skilled in the art will appreciate that various aspects of the present application may be implemented as a system, method or program product. Therefore, various aspects of the present application may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to as "circuit", "module" or "system" herein.

[0202] Based on the same inventive concept as the above method embodiment, the present application embodiment also provides a computer device. In one embodiment, the computer device may be a server, such as Figure 1 In this embodiment, the structure of the computer device is as follows: Fig.13 As shown, it may include at least a memory 1301 , a communication module 1303 , and at least one processor 1302 .

[0203] The memory 1301 is used to store computer programs executed by the processor 1302. The memory 1301 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and programs required for running the instant messaging function, etc.; the data storage area may store various instant messaging information and operation instruction sets, etc.

[0204] The memory 1301 may be a volatile memory, such as a random-access memory (RAM); the memory 1301 may also be a non-volatile memory, such as a read-only memory, a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD); or the memory 1301 may be any other medium that can be used to carry or store a desired computer program in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 1301 may be a combination of the above memories.

[0205] The processor 1302 may include one or more central processing units (CPU) or a digital processing unit, etc. The processor 1302 is used to implement the above vulnerability identification method when calling the computer program stored in the memory 1301 .

[0206] The communication module 1303 is used to communicate with terminal devices and other servers.

[0207] The specific connection medium between the memory 1301, the communication module 1303 and the processor 1302 is not limited in the embodiment of the present application. Fig.13 In the embodiment, the memory 1301 and the processor 1302 are connected via a bus 1304. The bus 1304 is connected to the processor 1302 via a bus 1304. Fig.13 The connections between the other components are only for illustration and are not intended to be limiting. The bus 1304 can be divided into an address bus, a data bus, a control bus, etc. For ease of description, Fig.13 The diagram shows that only one thick line is used, but this does not mean that there is only one bus or only one type of bus.

[0208] The memory 1301 stores a computer storage medium, and the computer storage medium stores computer executable instructions, and the computer executable instructions are used to implement the vulnerability identification method of the embodiment of the present application. The processor 1302 is used to execute the above-mentioned vulnerability identification method.

[0209] In another embodiment, the computer device may also be other computer devices, such as Figure 1 The physical terminal device 110 shown in FIG. 1 is a physical terminal device 110 shown in FIG. 1 . In this embodiment, the structure of the computer device can be as follows: Fig.14As shown, it includes: a communication component 1410, a memory 1420, a display unit 1430, a camera 1440, a sensor 1450, an audio circuit 1460, a Bluetooth module 1470, a processor 1480 and other components.

[0210] The communication component 710 is used to communicate with the server. In some embodiments, a wireless fidelity (WiFi) module may be included. The WiFi module belongs to a short-range wireless transmission technology. The electronic device can help the object to send and receive information through the WiFi module.

[0211] The memory 1420 can be used to store software programs and data. The processor 1480 executes various functions and data processing of the physical terminal device 210 by running the software programs or data stored in the memory 1420. The memory 1420 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage device. The memory 1420 stores an operating system that enables the physical terminal device 110 to run. In the present application, the memory 1420 can store an operating system and various application programs, and can also store a computer program for executing the vulnerability identification method of the embodiment of the present application.

[0212] The display unit 1430 can also be used to display information input by the object or information provided to the object and a graphical user interface (GUI) of various menus of the physical terminal device 110. Specifically, the display unit 1430 may include a display screen 1432 disposed on the front of the physical terminal device 110. The display screen 1432 may be configured in the form of a liquid crystal display, a light emitting diode, etc. The display unit 1430 may be used to display a defect detection interface, a model training interface, etc. in the embodiment of the present application.

[0213] The display unit 1430 can also be used to receive input digital or character information and generate signal input related to the object setting and function control of the physical terminal device 110. Specifically, the display unit 1430 may include a touch screen 1431 set on the front of the physical terminal device 110, which can collect touch operations of objects on or near it, such as clicking a button, dragging a scroll box, etc.

[0214] The touch screen 1431 can be covered on the display screen 1432, or the touch screen 1431 and the display screen 1432 can be integrated to realize the input and output functions of the physical terminal device 110, and the integrated display screen can be referred to as a touch display screen. In this application, the display unit 1430 can display the application and the corresponding operation steps.

[0215] The camera 1440 can be used to capture static images, and the subject can publish the images taken by the camera 1440 through the application. The camera 1440 can be one or more. The object generates an optical image through the lens and projects it onto the photosensitive element. The photosensitive element can be a charge coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor. The photosensitive element converts the optical signal into an electrical signal, and then transmits the electrical signal to the processor 780 to convert it into a digital image signal.

[0216] The physical terminal device may also include at least one sensor 1450, such as an acceleration sensor 1451, a distance sensor 1452, a fingerprint sensor 1453, and a temperature sensor 1454. The terminal device may also be configured with other sensors such as a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, a light sensor, and a motion sensor.

[0217] The audio circuit 1460, the speaker 1461, and the microphone 1462 can provide an audio interface between the object and the terminal device 110. The audio circuit 1460 can transmit the electrical signal converted from the received audio data to the speaker 1461, which is converted into a sound signal for output. The physical terminal device 210 can also be configured with a volume button for adjusting the volume of the sound signal. On the other hand, the microphone 1462 converts the collected sound signal into an electrical signal, which is received by the audio circuit 1460 and converted into audio data, and then the audio data is output to the communication component 1410 to be sent to, for example, another physical terminal device 110, or the audio data is output to the memory 1420 for further processing.

[0218] The Bluetooth module 1470 is used to exchange information with other Bluetooth devices having Bluetooth modules through the Bluetooth protocol. For example, the physical terminal device can establish a Bluetooth connection with a wearable electronic device (such as a smart watch) that also has a Bluetooth module through the Bluetooth module 1470 to exchange data.

[0219] The processor 1480 is the control center of the physical terminal device. It uses various interfaces and lines to connect various parts of the entire terminal. It executes various functions of the terminal device and processes data by running or executing software programs stored in the memory 1420 and calling data stored in the memory 1420. In some embodiments, the processor 1480 may include one or more processing units; the processor 1480 may also integrate an application processor and a baseband processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the baseband processor mainly processes wireless communications. It is understandable that the above-mentioned baseband processor may not be integrated into the processor 1480. In the present application, the processor 1480 can run the operating system, application programs, user interface display and touch response, as well as the vulnerability identification method of the embodiment of the present application. In addition, the processor 1480 is coupled to the display unit 1430.

[0220] In addition, it should be noted that in the specific implementation of this application, object data related to vulnerability identification, etc. is involved. When the above embodiments of this application are applied to specific products or technologies, it is necessary to obtain the object's permission or consent, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0221] In some possible implementations, various aspects of the vulnerability identification method provided by the present application may also be implemented in the form of a program product, which includes a computer program. When the program product is run on a computer device, the computer program is used to enable the computer device to execute the steps of the vulnerability identification method according to various exemplary embodiments of the present application described above in this specification. For example, the computer device may execute the following steps: Figure 2 Follow the steps shown in .

[0222] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0223] The program product of the embodiment of the present application may adopt a portable compact disk read-only memory (CD-ROM) and include a computer program, and can be run on an electronic device. However, the program product of the present application is not limited thereto, and in this document, a readable storage medium may be any tangible medium containing or storing a program, which can be used by or in combination with a command execution system, apparatus, or device.

[0224] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, wherein a readable computer program is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. A readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with a command execution system, apparatus, or device.

[0225] The computer program embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0226] The computer program for performing the operations of the present application may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The computer program may be executed entirely on the user's computer device, partially on the user's computer device, as a separate software package, partially on the user's computer device and partially on a remote computer device, or entirely on the remote computer device. In the case of a remote computer device, the remote computer device may be connected to the user's computer device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer device (e.g., via the Internet using an Internet service provider).

[0227] It should be noted that, although several units or subunits of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided into multiple units to be embodied.

[0228] In addition, although the operations of the method of the present application are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0229] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain a computer-usable computer program.

[0230] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program commands. These computer program commands can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the commands executed by the processor of the computer or other programmable data processing device generate commands for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0231] These computer program commands may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the commands stored in the computer readable memory produce an article of manufacture comprising a command device, the command device implementing the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0232] These computer program commands can also be loaded onto a computer or other programmable data processing device so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the commands executed on the computer or other programmable device provide the instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0233] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0234] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A vulnerability identification method, characterized in that: include: Collect target attack data; Performing word segmentation processing on the target attack data to obtain at least one word segmentation included in the target attack data; Perform feature adding processing on the at least one word segment respectively to obtain at least one target feature word, and obtain a target feature word set corresponding to the target attack data based on the at least one target feature word; Based on the type similarity between multiple preset reference feature word sets and the target feature word set, the vulnerability type of the target attack data is determined; wherein the reference feature word set is set based on attack data of known vulnerability types, and different reference feature word sets correspond to different vulnerability types of attack data.

2. The method according to claim 1, characterized in that Performing feature adding processing on the at least one word segment respectively to obtain at least one target feature word includes: For the at least one word segment, the following operations are performed respectively: Determining a position of a segmentation word in the target attack data according to a preset data format, and determining a segmentation attribute of the segmentation word based on the position; the segmentation attribute of the segmentation word is used to describe whether the segmentation word is a parameter, and the segmentation attribute is determined according to the position of a preset parameter identifier in the target attack data; When the location is a uniform resource identifier (URI) and the URI does not include a preset parameter identifier, based on the arrangement order of each participle in the URI, the front-back sequence feature of the participle is added to the participle, and the participle is updated; When the position is a URI and the URI includes the preset parameter identifier, or when the position is a data packet body, based on the word segmentation attribute of the word segmentation, the parameter value of the word segmentation is added to the word segmentation to update the word segmentation; The position identifier corresponding to the position is added to the one participle to obtain a corresponding target feature word.

3. The method according to claim 2, characterized in that When the position is a URI and the URI does not include a preset parameter identifier, based on the arrangement order of each participle in the URI, adding the front and back sequence features of the participle to the participle, and updating the participle, comprises: Based on the preset data format, determining whether the word segment is located in a uniform resource locator (URL) area in the URI; When the one word segment is located in the URL area, determining whether the one word segment is located at the starting position of the URL area according to the arrangement order of each word segment in the URL area; If the one participle is located at the starting position, adding a preset starting identifier to the one participle, and updating the one participle; If the one participle is not located at the starting position, the participle that is located before the one participle and adjacent to the one participle is added to the one participle to update the one participle.

4. The method according to claim 2, characterized in that: When the position is a URI and the URI does not include a preset parameter identifier, based on the arrangement order of each participle in the URI, the front and back sequence features of the participle are added to the participle, and before updating the participle, the method further includes: When the one word segment is located in the URL area of ​​the URI, determining whether the one word segment is located at the end of the URL area according to the arrangement order of each word segment in the URL area; If the one participle is located at the end position, a corresponding end participle is added to the at least one participle, and the end participle includes the one participle and a preset end identifier.

5. The method according to claim 2, characterized in that: When the position is a URI and the URI includes the preset parameter identifier, or when the position is a data packet body, based on the segmentation attribute of the one segmentation, the parameter value of the one segmentation is added to the one segmentation, and after updating the one segmentation, the method further includes: For a word segment containing a parameter value, masking the parameter value by using a preset identifier to represent the parameter value, thereby obtaining a word segment after the parameter value is masked; The word segment after the parameter value is masked is used as a new word segment, so that the at least one word segment includes the word segment containing the parameter value and the word segment after the parameter value is masked.

6. The method according to any one of claims 1 to 5, characterized in that The obtaining, based on the at least one target feature word, a target feature word set corresponding to the target attack data includes: Based on a feature selection algorithm, stop words in the at least one target feature word are removed to obtain a target feature word set corresponding to the target attack data; the stop words are used to characterize redundant feature words in the at least one target feature word, and the stop words are determined based on the proportion of the set including the target feature words in the multiple preset reference feature word sets.

7. The method according to any one of claims 1 to 5, characterized in that Before performing word segmentation processing on the target attack data to obtain at least one word segmentation included in the target attack data, the method further includes: When it is determined according to a preset rule that the data header of the target attack data does not include an attack behavior, removing data located in the data header of the target attack data; When the data in the data packet body is in a preset coding format, decoding the data in the data packet body; The noise information in the data in the data packet body is removed; the noise information includes at least one of a hypertext markup language html tag and a script JavaScript code.

8. The method according to any one of claims 1 to 5, characterized in that Before determining the vulnerability type of the target attack data based on the type similarity between each of the plurality of preset reference feature word sets and the target feature word set, the method includes: An index is established by taking each reference feature word included in the reference feature word set as an index value and taking at least one reference feature word set including a corresponding reference feature word in the plurality of preset reference feature word sets as an index item.

9. The method according to claim 8, characterized in that The determining the vulnerability type of the target attack data based on the type similarity between each of the plurality of preset reference feature word sets and the target feature word set includes: In the index, each target feature word is used as an index value, and the index item corresponding to each index value is determined to obtain at least one index item, and at least one reference feature word set included in each index item is used as a target reference feature word set to obtain at least one target reference feature word set; respectively calculating type similarities between the target feature word set and the at least one target reference feature word set; When the type similarity is not less than a preset similarity threshold, the vulnerability type of the attack data corresponding to the corresponding target reference feature word set is determined to be the vulnerability type of the target attack data.

10. The method according to claim 9, characterized in that After respectively calculating the type similarity between the target feature word set and the at least one target reference feature word set, the method further includes: If the type similarities are all less than the preset similarity threshold, then respectively calculating the cluster similarity between at least one unrecognized feature word set and the target feature word set; the unrecognized feature word set represents a feature word set corresponding to the attack data whose vulnerability type is not recognized; According to the clustering similarity, determine the vulnerability cluster to which the target feature word set belongs, and add the target feature word set as an unidentified feature word set to the vulnerability cluster; the vulnerability cluster includes at least one unidentified feature word set, and different vulnerability clusters belong to different vulnerability types; For each vulnerability cluster, when the number of unidentified feature word sets included in a vulnerability cluster reaches a preset number, a reference feature word set corresponding to the vulnerability type to which the vulnerability cluster belongs is set based on each unidentified feature word set in the vulnerability cluster.

11. The method according to claim 10, characterized in that The step of determining the vulnerability cluster to which the target feature word set belongs according to the cluster similarity, and adding the target feature word set as an unidentified feature word set to the vulnerability cluster includes: When the cluster similarity is greater than a preset cluster threshold, the target feature word set is used as an unidentified feature word set and added to the vulnerability cluster to which the corresponding unidentified feature word set belongs; When the cluster similarities are not greater than a preset cluster threshold, a new vulnerability cluster is created for the target feature word set, and the target feature word set is added to the newly created vulnerability cluster as an unrecognized feature word set.

12. A vulnerability identification device, characterized in that: include: A collection unit, used for collecting target attack data; A processing unit is used to perform the following processing: Performing word segmentation processing on the target attack data to obtain at least one word segmentation included in the target attack data; Perform feature adding processing on the at least one word segment respectively to obtain at least one target feature word, and obtain a target feature word set corresponding to the target attack data based on the at least one target feature word; Based on the type similarity between multiple preset reference feature word sets and the target feature word set, the vulnerability type of the target attack data is determined; wherein the reference feature word set is set based on attack data of known vulnerability types, and different reference feature word sets correspond to different vulnerability types of attack data.

13. A computer device, characterized in that: It comprises a processor and a memory, wherein the memory stores program codes, and when the program codes are executed by the processor, the processor executes the steps of the method according to any one of claims 1 to 11.

14. A computer-readable storage medium, characterized in that: The method comprises a program code, and when the program code is run on a computer device, the program code is used to make the computer device execute the steps of the method according to any one of claims 1 to 11.

15. A computer program product, characterized in that The method comprises computer instructions, which implement the steps of the method according to any one of claims 1 to 11 when executed by a processor.

Images