Vulnerability assessment method and device, electronic equipment and storage medium

Abstract

The invention relates to the technical field of software security, in particular to a vulnerability assessment method and device, electronic equipment and a storage medium, which are used for improving the accuracy of vulnerability assessment. The method comprises the following steps: positioning a target vulnerability, extracting a full path of the target vulnerability from a trigger entrance to an outbreak point, and identifying a trigger condition and a trigger step of the target vulnerability according to the full path; based on the triggering condition and the triggering step, the triggering condition complexity and the utilization step number of the target vulnerability are determined, and the step number is used for representing the step number needed by utilization of the target vulnerability; based on the utilization step number, the triggering condition complexity, the risk degree of the target vulnerability, the utilization concealment degree and the utilization success rate, the availability score of the target vulnerability is determined, and the discovering difficulty of the target vulnerability is represented through the utilization concealment degree.

Description

Technical Field

[0001] The present application relates to the field of software security technology, and in particular to a vulnerability assessment method, device, electronic device and storage medium. Background Art

[0002] With the advancement and development of technology, software has more and more application scenarios. However, the existence of software vulnerabilities poses serious security risks to the security of applications.

[0003] Traditional vulnerability assessment usually determines the reference vulnerability that matches the target vulnerability based on the similarity between the target vulnerability and the reference vulnerability contained in the vulnerability library, and uses the risk level of the reference vulnerability as the risk level of the target vulnerability. The above method cannot comprehensively and accurately evaluate the level of the target vulnerability, and thus cannot accurately determine the repair priority of the target vulnerability. Summary of the invention

[0004] The embodiments of the present application provide a vulnerability assessment method, device, electronic device and storage medium to improve the accuracy of vulnerability assessment.

[0005] The specific technical solutions provided by the embodiments of this application are as follows:

[0006] In a first aspect, a vulnerability assessment method is provided, the method comprising:

[0007] Locate the target vulnerability, extract the full path of the target vulnerability from the trigger entry to the outbreak point, and identify the triggering conditions and triggering steps of the target vulnerability based on the full path;

[0008] Based on the trigger conditions and trigger steps, the complexity of the trigger conditions and the number of exploitation steps of the target vulnerability are determined. The number of exploitation steps represents: the number of steps required to exploit the target vulnerability;

[0009] The exploitability score of the target vulnerability is determined based on the number of exploit steps, the complexity of the triggering conditions, the risk level, exploit concealment, and exploit success rate of the target vulnerability. The exploit concealment represents the difficulty of discovering the target vulnerability.

[0010] In a possible embodiment, after determining the exploitability score of the target vulnerability based on the number of exploitation steps, the complexity of the triggering condition, and the risk level, exploitation concealment, and exploitation success rate of the target vulnerability, the following further includes:

[0011] Determine the priority of remediation of target vulnerabilities based on exploitability score and risk level.

[0012] Through the above method, the accuracy of determining the repair priority is improved.

[0013] In a possible embodiment, the target vulnerability is located, and the entire path of the target vulnerability from the trigger entry to the outbreak point is extracted, including:

[0014] Perform stubs in the code area suspected to contain the target vulnerability, identify the outbreak point of the target vulnerability, and obtain the code segment corresponding to the outbreak point;

[0015] Identify the triggering entry of the target vulnerability through code segments combined with taint analysis technology;

[0016] Get the full path based on the trigger entry and outbreak point.

[0017] Through the above method, the trigger entry and outbreak point can be accurately identified.

[0018] In a possible embodiment, based on the trigger entry and the outbreak point, the full path is obtained, including:

[0019] Through symbolic execution technology, the possible execution path of the target vulnerability is obtained, and the data flow information and control flow information on the execution path are collected;

[0020] Based on the data flow information and control flow information, combined with the abstract syntax tree, the full path is obtained.

[0021] Through the above method, the entire path of the target vulnerability from the trigger entry to the outbreak point can be accurately obtained.

[0022] In a possible embodiment, before determining the exploitability score of the target vulnerability based on the number of exploitation steps, the complexity of the triggering condition, and the risk level, exploitation concealment, and exploitation success rate of the target vulnerability, the following is further included:

[0023] Determine the risk level of the target vulnerability based on the risk level of each reference vulnerability included in the vulnerability library;

[0024] Determine the success rate of exploiting the target vulnerability based on the historical exploitation data of the target vulnerability.

[0025] In a second aspect, a vulnerability assessment device is provided, the device comprising:

[0026] The first processing module is used to locate the target vulnerability, extract the full path of the target vulnerability from the trigger entry to the outbreak point, and identify the triggering conditions and triggering steps of the target vulnerability based on the full path;

[0027] The second processing module is used to determine the complexity of the triggering condition and the number of exploitation steps of the target vulnerability based on the triggering condition and the triggering steps, wherein the number of exploitation steps represents: the number of steps required for exploiting the target vulnerability;

[0028] The evaluation module is used to determine the exploitability score of the target vulnerability based on the number of exploitation steps, the complexity of the triggering conditions, and the risk level, exploit concealment and exploit success rate of the target vulnerability, where the exploit concealment represents: the difficulty of discovering the target vulnerability.

[0029] In a possible embodiment, after determining the exploitability score of the target vulnerability based on the number of exploitation steps, the complexity of the triggering condition, and the risk level, exploit concealment, and exploit success rate of the target vulnerability, the device further includes a determination module, which is used to:

[0030] Determine the priority of remediation of target vulnerabilities based on exploitability score and risk level.

[0031] In a possible embodiment, when locating the target vulnerability and extracting the full path of the target vulnerability from the triggering entry to the outbreak point, the first processing module is further used to:

[0032] Perform stubs in the code area suspected to contain the target vulnerability, identify the outbreak point of the target vulnerability, and obtain the code segment corresponding to the outbreak point;

[0033] Identify the triggering entry of the target vulnerability through code segments combined with taint analysis technology;

[0034] Get the full path based on the trigger entry and outbreak point.

[0035] In a possible embodiment, when acquiring the full path based on the trigger entry and the outbreak point, the first processing module is further used to:

[0036] Through symbolic execution technology, the possible execution path of the target vulnerability is obtained, and the data flow information and control flow information on the execution path are collected;

[0037] Based on the data flow information and control flow information, combined with the abstract syntax tree, the full path is obtained.

[0038] In a possible embodiment, before determining the exploitability score of the target vulnerability based on the number of exploitation steps, the complexity of the triggering condition, and the risk level, exploitation concealment, and exploitation success rate of the target vulnerability, the device further includes a third processing module, which is used to:

[0039] Determine the risk level of the target vulnerability based on the risk level of each reference vulnerability included in the vulnerability library;

[0040] Determine the success rate of exploiting the target vulnerability based on the historical exploitation data of the target vulnerability.

[0041] In a third aspect, the present application provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of any one of the methods described in the first aspect are implemented.

[0042] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of any one of the methods described in the first aspect above.

[0043] In a fifth aspect, the present application provides a computer program product, comprising: a computer program code, when the computer program code is run on a computer, the computer executes any one of the methods described in the first aspect.

[0044] In the embodiment of the present application, the target vulnerability is located, the full path of the target vulnerability from the trigger entry to the outbreak point is extracted, and the trigger conditions and trigger steps of the target vulnerability are identified based on the full path, and then the trigger condition complexity and the number of exploitation steps of the target vulnerability are determined based on the trigger conditions and triggering steps, and the number of exploitation steps is characterized by: the number of steps required for the exploitation of the target vulnerability, and finally based on the number of exploitation steps, the complexity of the trigger conditions, and the risk level, exploitation concealment and exploitation success rate of the target vulnerability, the exploitability score of the target vulnerability is determined, wherein the exploitation concealment is characterized by: the difficulty of the target vulnerability being discovered. In this way, by accurately locating the target vulnerability, it is possible to identify accurate trigger conditions and triggering steps, and obtain the number of exploitation steps and the complexity of the trigger conditions, comprehensively considering the number of exploitation steps, the complexity of the trigger conditions, the risk level, the exploitation concealment and the exploitation success rate of the vulnerability to conduct a comprehensive vulnerability assessment, thereby improving the accuracy of the vulnerability assessment, thereby improving the accuracy of the repair priority determination. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 An implementation process of a vulnerability assessment method provided in an embodiment of the present application;

[0046] Figure 2 This is a schematic diagram of the process of extracting the full path in the embodiment of the present application;

[0047] Figure 3 Another schematic diagram of a vulnerability assessment method in an embodiment of the present application;

[0048] Figure 4 This is a schematic diagram of the structure of a vulnerability assessment device in an embodiment of the present application;

[0049] Figure 5 Schematic diagram of the structure of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the drawings in the embodiment of the present application. Obviously, the described embodiment is only a part of the embodiment of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be arbitrarily combined with each other. In addition, although the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in an order different from that here.

[0051] The terms "first" and "second" in the specification and claims of the present application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the term "comprising" and any of their variations are intended to cover non-exclusive protection. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. "Multiple" in the present application can mean at least two, for example, two, three or more, and the embodiments of the present application are not limited.

[0052] The following is a description of exemplary embodiments of the present application in conjunction with the accompanying drawings, including various details of the embodiments of the present application to facilitate understanding, which should be considered as merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of the present application. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description. It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, which should be considered as exemplary, and their purpose is only to illustrate the feasibility of the implementation of the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0053] In the technical solution of this application, the acquisition, transmission, storage, and use of data are in compliance with the requirements of relevant national laws and regulations.

[0054] The following is a brief introduction to the design concept of the embodiment of the present application:

[0055] With the advancement and development of technology, software application scenarios are increasing. However, the existence of software vulnerabilities poses serious security risks to the security of applications. Effective vulnerability prioritization is crucial for timely repair of vulnerabilities.

[0056] Traditional vulnerability assessment usually determines the reference vulnerability that matches the target vulnerability based on the similarity between the target vulnerability and the reference vulnerability contained in the vulnerability library, and uses the risk level of the reference vulnerability as the risk level of the target vulnerability.

[0057] However, vulnerability assessment based solely on risk level cannot fully and accurately assess the target vulnerability, and thus cannot accurately determine the priority of fixing the target vulnerability. For example, when the target vulnerability is deeply buried and requires many steps to trigger, although the risk level of the target vulnerability is high at this time, it is difficult to trigger the target vulnerability during actual operation, and the priority of fixing the target vulnerability is lower than that of vulnerabilities with low risk levels and easy to trigger.

[0058] In view of this, in the embodiment of the present application, a vulnerability assessment method, device, electronic device and storage medium are provided to locate the target vulnerability, extract the full path of the target vulnerability from the trigger entry to the outbreak point, and identify the trigger conditions and trigger steps of the target vulnerability based on the full path, and then determine the trigger condition complexity and the number of exploitation steps of the target vulnerability based on the trigger conditions and trigger steps, and characterize the number of steps required for exploiting the target vulnerability. Finally, based on the number of exploitation steps, the complexity of the trigger conditions, and the risk level, the concealment of the exploitation and the success rate of the exploitation of the target vulnerability, the exploitability score of the target vulnerability is determined, wherein the concealment of the exploitation characterizes the difficulty of the target vulnerability being discovered. In this way, by accurately locating the target vulnerability, it is possible to identify accurate trigger conditions and trigger steps, and obtain the number of exploitation steps and the complexity of the trigger conditions, comprehensively considering the number of exploitation steps, the complexity of the trigger conditions, the risk level, the concealment of the exploitation and the success rate of the exploitation of the vulnerability, and obtain a comprehensive and accurate vulnerability assessment, which is convenient for the subsequent accurate determination of the repair priority of the target vulnerability, and improves the accuracy of vulnerability identification and the efficiency of repair work.

[0059] The preferred embodiments of the present application are described below in conjunction with the drawings in the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application. In addition, the embodiments of the present application and the features in the embodiments may be combined with each other if there is no conflict.

[0060] See also Figure 1 As shown, it is an implementation flow chart of a vulnerability assessment method provided in an embodiment of the present application. The specific implementation process of the method is as follows:

[0061] Step 10: Locate the target vulnerability, extract the full path of the target vulnerability from the trigger entry to the outbreak point, and identify the triggering conditions and triggering steps of the target vulnerability based on the full path.

[0062] Among them, the outbreak point is: the location where the target vulnerability is detonated, the trigger entry is: the location where the target vulnerability is discovered, and the trigger conditions include environmental conditions, network conditions, code conditions, etc.

[0063] In an embodiment of the present application, a program code file is obtained and a vulnerability detection is performed on it. When a vulnerability is detected in the software, the existing vulnerability is used as a target vulnerability, and information about the target vulnerability is obtained. The target vulnerability is then located, and the entire path of the target vulnerability from the trigger entry to the outbreak point is extracted. The propagation of user input data in the program is tracked based on the entire path to determine how the data affects the program flow and status, thereby identifying the triggering conditions and triggering steps of the vulnerability.

[0064] Optionally, in an embodiment of the present application, a possible embodiment is provided to locate the target vulnerability and extract the full path of the target vulnerability from the trigger entry to the outbreak point, and the following operations are specifically performed:

[0065] Step 100: Perform a stub in a code region suspected of containing a target vulnerability, identify the outbreak point of the target vulnerability, and obtain a code segment corresponding to the outbreak point.

[0066] In an embodiment of the present application, a stub is inserted in a code area suspected of containing a target vulnerability, and detailed information during program runtime, such as variable values, memory access patterns, and function call sequences, is collected. The vulnerability outbreak point is obtained based on the inserted content, the outbreak point of the target vulnerability is obtained, and the vulnerable statement at the outbreak point is located. After the positioning is completed, the code segment corresponding to the outbreak point is obtained based on the abstract syntax tree (AST).

[0067] Step 101: Identify the trigger entry of the target vulnerability through code segments combined with taint analysis technology.

[0068] In an embodiment of the present application, based on the acquired code segments, static taint analysis is performed to track the flow of data in the program, identify data propagation paths that may be affected by malicious intent, and identify the triggering entry of the target vulnerability.

[0069] In this way, the trigger entry and outbreak point can be accurately identified.

[0070] Step 102: Based on the trigger entry and the burst point, the full path is obtained.

[0071] Optionally, in the embodiment of the present application, a possible embodiment is provided for obtaining the full path based on the trigger entry and the burst point, and the following operations are specifically performed:

[0072] Step 1020: Obtain the possible execution path of the target vulnerability through symbolic execution technology, and collect data flow information and control flow information on the execution path.

[0073] Among them, symbolic execution technology helps determine which paths may lead to vulnerability triggering.

[0074] In an embodiment of the present application, after identifying the trigger entry, the program input is replaced with symbolic variables through symbolic execution technology, and all possible execution paths of the target vulnerability are explored through a symbolic solver, and data flow information and control flow information on the execution path are collected.

[0075] Step 1021: Based on the data flow information and the control flow information, combined with the abstract syntax tree, the full path is obtained.

[0076] In an embodiment of the present application, based on data flow and control flow information, combined with a data flow graph, a function dependency graph, and an abstract syntax tree, the full path of the target vulnerability from the trigger entry to the outbreak point is obtained.

[0077] In this way, the entire path of the target vulnerability from the trigger entry to the outbreak point can be accurately obtained.

[0078] Based on the above embodiments, Figure 2 As shown, it is a schematic diagram of the process of extracting the full path in the embodiment of the present application, and the process is as follows:

[0079] Step 20: Obtain information about the target vulnerability.

[0080] Step 21: Instrumentation tracing.

[0081] Step 22: Identify the executable path.

[0082] Step 23: Taint analysis.

[0083] Step 24: Data flow and control flow construction.

[0084] Step 25: Full path extraction.

[0085] Step 11: Based on the trigger conditions and trigger steps, determine the trigger condition complexity and the number of exploit steps of the target vulnerability.

[0086] Among them, the number of exploit steps represents the number of steps required to exploit the target vulnerability, and the complexity of the triggering conditions represents the complexity of the conditions required to trigger the target vulnerability, which measures the technical difficulty required for an attacker to successfully exploit the target vulnerability.

[0087] Step 12: Determine the exploitability score of the target vulnerability based on the number of exploit steps, the complexity of the triggering conditions, and the risk level, exploit stealth, and exploit success rate of the target vulnerability.

[0088] Among them, the degree of exploitation concealment represents the difficulty of discovering the target vulnerability, and the exploitation success rate represents the probability of the target vulnerability being successfully exploited.

[0089] In the embodiment of the present application, the exploitability score of the target vulnerability is calculated based on the scores and weight coefficients of the number of exploitation steps, complexity of triggering conditions, risk level, exploit concealment, and exploitation success rate of the target vulnerability.

[0090] Among them, each weight coefficient is used to adjust the importance of different factors in the evaluation. The value of each weight coefficient is adaptively adjusted based on expert experience and historical data analysis, and the sum of each weight coefficient is 100.

[0091] In an embodiment of the present application, the exploitability score of the target vulnerability can be expressed as: Score = 100-(w1*N+w2*C+w3*R+w4*S+w5*P), where N is the score of the number of exploit steps, C is the score of the complexity of the trigger conditions, R is the score of the risk level, S is the score of the exploit concealment, P is the score of the exploit success rate, and w1 to w5 are weight coefficients.

[0092] In this way, based on the weight coefficient and adaptive weight adjustment mechanism, the accuracy and intelligence of vulnerability assessment are improved.

[0093] In an embodiment of the present application, the number of exploitation steps is divided into multiple levels, and a score is assigned to each level. According to the number of steps required for exploiting the target vulnerability, the number of exploitation steps of the target vulnerability is classified into corresponding levels and scores are assigned.

[0094] For example, the number of exploitation steps is divided into 3 levels, and a score is assigned to each level, where the number of exploitation steps less than 3 is 20 points, 3-5 steps are 10 points, and more than 5 steps are 0 points. Assuming that the number of steps required for exploiting the target vulnerability is 2, the score of the number of exploitation steps of the target vulnerability is 20 points.

[0095] In an embodiment of the present application, the complexity of the trigger conditions is divided into multiple levels, and a score is assigned to each level. According to the number of trigger conditions of the target vulnerability, the complexity of the trigger conditions of the target vulnerability is classified into corresponding levels and assigned scores.

[0096] For example, the complexity of trigger conditions is divided into three levels (including: simple, medium, and complex), and scores are assigned to each level, with simple getting 0 points, medium getting 10 points, and complex getting 20 points. Assuming that the trigger condition of the target vulnerability requires a virtual machine and attack code, and the level of the complexity of the trigger condition is complex, the score of the complexity of the trigger condition of the target vulnerability is 20 points.

[0097] In an embodiment of the present application, the risk degree is divided into multiple levels, a score is assigned to each level, a reference vulnerability matching the target vulnerability is determined in the vulnerability library, the risk degree of the matching reference vulnerability is used as the risk degree of the target vulnerability, and then a score is assigned to the risk degree of the target vulnerability based on the risk degree of the target vulnerability.

[0098] For example, the risk level is divided into three levels (including: low risk, medium risk, and high risk), and scores are assigned to each level. Low risk gets 20 points, medium risk gets 10 points, and high risk gets 0 points. Assuming that the risk level of the target vulnerability is medium risk, the risk level score of the target vulnerability is 10 points.

[0099] In the embodiment of the present application, the exploit concealment is divided into multiple levels, a score is assigned to each level, and then the score is assigned to the exploit concealment of the target vulnerability according to the exploit concealment of the target vulnerability.

[0100] For example, the exploit concealment is divided into three levels (including: easy to be discovered, relatively concealed, and very concealed), and a score is assigned to each level, 0 points for easy to be discovered, 10 points for relatively concealed, and 20 points for very concealed. Assuming that the exploit concealment of the target vulnerability is relatively concealed, the exploit concealment score of the target vulnerability is 10 points.

[0101] Among them, easy to be discovered means that vulnerability exploitation behavior can be easily detected by existing security monitoring systems or log analysis tools; relatively hidden means that specific monitoring strategies or analysis tools are required to discover vulnerability exploitation behavior; very hidden means that the exploitation behavior is difficult to be discovered by existing security measures and requires advanced threat detection technology or specialized security analysis.

[0102] In the embodiment of the present application, the exploitation success rate p of the target vulnerability is determined based on the number of exploits and the number of successes in the historical exploitation data of the target vulnerability, and a score is assigned.

[0103] For example, the score of the exploitation success rate of the target vulnerability is P=100-p, where p is the exploitation success rate. Assuming that the exploitation success rate of the target vulnerability is 0.5, the score of the exploitation success rate of the target vulnerability is 99.5 points.

[0104] Furthermore, in an embodiment of the present application, after determining the exploitability score of the target vulnerability, the repair priority of the target vulnerability is determined based on the exploitability score and the risk level, and an accurate repair priority is obtained to provide a basis for vulnerability repair personnel. The repair strategy of the target vulnerability can also be determined based on the exploitability score and the risk level.

[0105] Specifically, in the embodiment of the present application, weights can be assigned to the exploitability score and the risk level, and a comprehensive evaluation score can be obtained based on the exploitability score and its weight, as well as the risk level and its weight. Based on the comprehensive evaluation score, the repair priority of the target vulnerability is determined.

[0106] Based on the above embodiments, see Figure 3 FIG. 1 is another flow chart of a vulnerability assessment method in an embodiment of the present application, which specifically includes:

[0107] Step 30: Start.

[0108] Step 31: Software Source Code.

[0109] Step 32: Vulnerability detection.

[0110] Step 33: Locate the target vulnerability.

[0111] Among them, target vulnerability positioning includes: target vulnerability outbreak point identification and trigger entry identification.

[0112] Step 34: Extract the entire path of the target vulnerability from the trigger entry to the outbreak point.

[0113] Step 35: Determine the exploitability score of the target vulnerability.

[0114] Step 36: Determine the overall assessment score based on the exploitability score and risk level.

[0115] Step 37: Output the comprehensive evaluation score.

[0116] Based on the same inventive concept, a vulnerability assessment device is also provided in the embodiment of the present application, see Figure 4 , which is a schematic diagram of the structure of the vulnerability assessment device in an embodiment of the present application, specifically includes:

[0117] The first processing module 401 is used to locate the target vulnerability, extract the full path of the target vulnerability from the trigger entry to the outbreak point, and identify the triggering conditions and triggering steps of the target vulnerability based on the full path;

[0118] The second processing module 402 is used to determine the complexity of the triggering condition and the number of exploitation steps of the target vulnerability based on the triggering condition and the triggering steps, where the number of exploitation steps represents: the number of steps required to exploit the target vulnerability;

[0119] The evaluation module 403 is used to determine the exploitability score of the target vulnerability based on the number of exploitation steps, the complexity of the triggering conditions, and the risk level, exploitation concealment and exploitation success rate of the target vulnerability, wherein the exploitation concealment represents: the difficulty of discovering the target vulnerability.

[0120] In a possible embodiment, after determining the exploitability score of the target vulnerability based on the number of exploitation steps, the complexity of the triggering condition, and the risk level, exploitation concealment, and exploitation success rate of the target vulnerability, the device further includes a determination module 404, which is used to:

[0121] Determine the priority of remediation of target vulnerabilities based on exploitability score and risk level.

[0122] In a possible embodiment, when locating the target vulnerability and extracting the full path of the target vulnerability from the trigger entry to the outbreak point, the first processing module 401 is further used to:

[0123] Perform stubs in the code area suspected to contain the target vulnerability, identify the outbreak point of the target vulnerability, and obtain the code segment corresponding to the outbreak point;

[0124] Identify the triggering entry of the target vulnerability through code segments combined with taint analysis technology;

[0125] Get the full path based on the trigger entry and outbreak point.

[0126] In a possible embodiment, when acquiring the full path based on the trigger entry and the burst point, the first processing module 401 is further used to:

[0127] Through symbolic execution technology, the possible execution path of the target vulnerability is obtained, and the data flow information and control flow information on the execution path are collected;

[0128] Based on the data flow information and control flow information, combined with the abstract syntax tree, the full path is obtained.

[0129] In a possible embodiment, before determining the exploitability score of the target vulnerability based on the number of exploitation steps, the complexity of the triggering condition, and the risk level, exploitation concealment, and exploitation success rate of the target vulnerability, the device further includes a third processing module 405, and the third processing module 405 is used to:

[0130] Determine the risk level of the target vulnerability based on the risk level of each reference vulnerability included in the vulnerability library;

[0131] Determine the success rate of exploiting the target vulnerability based on the historical exploitation data of the target vulnerability.

[0132] Based on the above embodiments, see Figure 5 Shown is a schematic diagram of the structure of an electronic device in an embodiment of the present application.

[0133] An embodiment of the present application provides an electronic device, which may include a processor 510 (Center Processing Unit, CPU), a memory 520, an input device 530 and an output device 540, etc. The input device 530 may include a keyboard, a mouse, a touch screen, etc., and the output device 540 may include a display device, such as a liquid crystal display (Liquid Crystal Display, LCD), a cathode ray tube (Cathode Ray Tube, CRT), etc.

[0134] The memory 520 may include a read-only memory (ROM) and a random access memory (RAM), and provides the processor 510 with program instructions and data stored in the memory 520. In the embodiment of the present application, the memory 520 may be used to store the program of any vulnerability assessment method in the embodiment of the present application.

[0135] The processor 510 calls the program instructions stored in the memory 520, and the processor 510 is used to execute any vulnerability assessment method in the embodiments of the present application according to the obtained program instructions.

[0136] Based on the above embodiments, in an embodiment of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the vulnerability assessment method in any of the above method embodiments is implemented.

[0137] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0138] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0139] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0140] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1The steps for the functions specified in one or more boxes.

[0141] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A vulnerability assessment method, characterized in that: include: Locate the target vulnerability, extract the full path of the target vulnerability from the trigger entry to the outbreak point, and identify the triggering conditions and triggering steps of the target vulnerability based on the full path; Based on the trigger condition and the trigger step, determining the complexity of the trigger condition and the number of exploitation steps of the target vulnerability, wherein the number of exploitation steps represents: the number of steps required for exploiting the target vulnerability; Based on the number of exploitation steps, the complexity of the triggering conditions, and the risk level, exploitation concealment, and exploitation success rate of the target vulnerability, an exploitability score of the target vulnerability is determined, wherein the exploitation concealment represents: the difficulty of discovering the target vulnerability.

2. The method according to claim 1, characterized in that After determining the exploitability score of the target vulnerability based on the number of exploitation steps, the complexity of the triggering condition, and the risk level, exploitation concealment, and exploitation success rate of the target vulnerability, the method further includes: A repair priority of the target vulnerability is determined according to the exploitability score and the risk level.

3. The method according to claim 1, characterized in that The target vulnerability is located and the entire path of the target vulnerability from the triggering entry to the outbreak point is extracted, including: Performing insertion in a code area suspected of containing the target vulnerability, identifying the outbreak point of the target vulnerability, and obtaining a code segment corresponding to the outbreak point; Using the code segment and taint analysis technology, identifying the triggering entry of the target vulnerability; Based on the trigger entry and the outbreak point, the full path is obtained.

4. The method according to claim 3, characterized in that The acquiring the full path based on the trigger entry and the burst point includes: Obtain possible execution paths of the target vulnerability through symbolic execution technology, and collect data flow information and control flow information on the execution path; Based on the data flow information and the control flow information, in combination with an abstract syntax tree, the full path is obtained.

5. The method according to claim 1, characterized in that Before determining the exploitability score of the target vulnerability based on the number of exploitation steps, the complexity of the triggering condition, and the risk level, exploit concealment, and exploitation success rate of the target vulnerability, the following further comprises: Determining the risk level of the target vulnerability according to the risk level of each reference vulnerability included in the vulnerability library; The success rate of exploitation of the target vulnerability is determined according to the historical exploitation data of the target vulnerability.

6. A vulnerability assessment device, characterized in that: include: The first processing module is used to locate the target vulnerability, extract the full path of the target vulnerability from the triggering entry to the outbreak point, and identify the triggering conditions and triggering steps of the target vulnerability according to the full path; A second processing module is used to determine the complexity of the triggering condition and the number of exploitation steps of the target vulnerability based on the triggering condition and the triggering step, wherein the number of exploitation steps represents: the number of steps required for exploiting the target vulnerability; An evaluation module is used to determine the exploitability score of the target vulnerability based on the number of exploitation steps, the complexity of the triggering conditions, and the risk level, exploitation concealment and exploitation success rate of the target vulnerability, wherein the exploitation concealment represents: the difficulty of discovering the target vulnerability.

7. The device according to claim 6, characterized in that After determining the exploitability score of the target vulnerability based on the number of exploitation steps, the complexity of the triggering condition, and the risk level, exploit concealment, and exploit success rate of the target vulnerability, the device further includes a determination module, which is used to: A repair priority of the target vulnerability is determined according to the exploitability score and the risk level.

8. The device according to claim 6, characterized in that Before determining the exploitability score of the target vulnerability based on the number of exploitation steps, the complexity of the triggering condition, and the risk level, exploit concealment, and exploit success rate of the target vulnerability, the device further includes a third processing module, which is used to: Determining the risk level of the target vulnerability according to the risk level of each reference vulnerability included in the vulnerability library; The success rate of exploitation of the target vulnerability is determined according to the historical exploitation data of the target vulnerability.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the method according to any one of claims 1 to 5 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images