A vulnerability assessment method and device, electronic equipment and storage medium

Abstract

The application relates to the technical field of software security, in particular to a vulnerability evaluation method and device, electronic equipment and a storage medium, which are used for improving the accuracy of vulnerability evaluation. The method comprises the following steps: positioning a target vulnerability, extracting a full path of the target vulnerability from a trigger entry to a burst point, and identifying trigger conditions and trigger steps of the target vulnerability according to the full path; determining trigger condition complexity and the number of utilization steps of the target vulnerability based on the trigger conditions and the trigger steps, wherein the number of utilization steps represents the number of steps required for the target vulnerability to be utilized; and determining the exploitability score of the target vulnerability based on the number of utilization steps, the trigger condition complexity, and the risk degree, the utilization concealment degree and the utilization success rate of the target vulnerability, wherein the utilization concealment degree represents the difficulty of discovering the target vulnerability.

Description

Technical Field

[0001] The present application relates to the field of software security technology, and in particular to a vulnerability assessment method, device, electronic device, and storage medium. Background Art

[0002] With the advancement and development of technology, software application scenarios are increasing. However, the existence of software vulnerabilities poses serious security risks to the security of applications.

[0003] Traditional vulnerability assessments typically determine reference vulnerabilities that match the target vulnerability based on the similarity between the target vulnerability and the reference vulnerabilities contained in the vulnerability library. The risk level of the reference vulnerability is then used as the risk level of the target vulnerability. This approach cannot comprehensively and accurately assess the level of the target vulnerability, and thus cannot accurately determine the priority for remediating the target vulnerability. Summary of the Invention

[0004] The embodiments of the present application provide a vulnerability assessment method, apparatus, electronic device, and storage medium to improve the accuracy of vulnerability assessment.

[0005] The specific technical solutions provided in the embodiments of this application are as follows:

[0006] In a first aspect, a vulnerability assessment method is provided, the method comprising:

[0007] Locate the target vulnerability, extract the entire path from the trigger entry to the outbreak point, and identify the triggering conditions and steps of the target vulnerability based on the entire path;

[0008] Based on the trigger conditions and trigger steps, the trigger condition complexity and the number of exploitation steps of the target vulnerability are determined. The number of exploitation steps represents the number of steps required to exploit the target vulnerability.

[0009] The exploitability score of the target vulnerability is determined based on the number of exploit steps, the complexity of the triggering conditions, the risk level, exploit stealth, and exploit success rate of the target vulnerability. The exploit stealth represents the difficulty of discovering the target vulnerability.

[0010] In a possible embodiment, after determining the exploitability score of the target vulnerability based on the number of exploit steps, the complexity of the triggering conditions, and the risk level, exploit stealthiness, and exploit success rate of the target vulnerability, the following steps are further included:

[0011] Determine the priority of remediation of target vulnerabilities based on exploitability score and risk level.

[0012] Through the above method, the accuracy of repair priority determination is improved.

[0013] In a possible embodiment, the target vulnerability is located and the entire path of the target vulnerability from the triggering entry to the outbreak point is extracted, including:

[0014] Perform instrumentation in code areas suspected of containing the target vulnerability, identify the outbreak point of the target vulnerability, and obtain the code segment corresponding to the outbreak point;

[0015] Identify the triggering entry of the target vulnerability through code segments combined with taint analysis technology;

[0016] Get the full path based on the trigger entry and outbreak point.

[0017] Through the above method, the trigger entry and outbreak point can be accurately identified.

[0018] In a possible embodiment, obtaining the full path based on the trigger entry and the outbreak point includes:

[0019] Through symbolic execution technology, the possible execution path of the target vulnerability is obtained, and the data flow and control flow information on the execution path are collected;

[0020] Based on data flow information and control flow information, combined with the abstract syntax tree, the full path is obtained.

[0021] Through the above method, the entire path of the target vulnerability from the trigger entry to the outbreak point can be accurately obtained.

[0022] In one possible embodiment, before determining the exploitability score of the target vulnerability based on the number of exploit steps, the complexity of the triggering conditions, and the risk level, exploit stealthiness, and exploit success rate of the target vulnerability, the following steps may be further included:

[0023] Determine the risk level of the target vulnerability based on the risk level of each reference vulnerability included in the vulnerability library;

[0024] Determine the success rate of exploiting the target vulnerability based on its historical exploitation data.

[0025] In a second aspect, a vulnerability assessment device is provided, the device comprising:

[0026] The first processing module is used to locate the target vulnerability, extract the full path of the target vulnerability from the trigger entry to the outbreak point, and identify the triggering conditions and triggering steps of the target vulnerability based on the full path;

[0027] The second processing module is used to determine the trigger condition complexity and the number of exploitation steps of the target vulnerability based on the trigger condition and the triggering steps, where the number of exploitation steps represents the number of steps required to exploit the target vulnerability;

[0028] The evaluation module is used to determine the exploitability score of the target vulnerability based on the number of exploit steps, the complexity of the triggering conditions, and the risk level, exploit stealthiness, and exploit success rate of the target vulnerability. The exploit stealthiness represents the difficulty of discovering the target vulnerability.

[0029] In one possible embodiment, after determining the exploitability score of the target vulnerability based on the number of exploitation steps, the complexity of the triggering conditions, and the risk level, exploit concealment, and exploit success rate of the target vulnerability, the apparatus further includes a determination module configured to:

[0030] Determine the priority of remediation of target vulnerabilities based on exploitability score and risk level.

[0031] In a possible embodiment, when locating the target vulnerability and extracting the entire path of the target vulnerability from the triggering entry to the outbreak point, the first processing module is further configured to:

[0032] Perform instrumentation in code areas suspected of containing the target vulnerability, identify the outbreak point of the target vulnerability, and obtain the code segment corresponding to the outbreak point;

[0033] Identify the triggering entry of the target vulnerability through code segments combined with taint analysis technology;

[0034] Get the full path based on the trigger entry and outbreak point.

[0035] In a possible embodiment, when obtaining the full path based on the trigger entry and the outbreak point, the first processing module is further configured to:

[0036] Through symbolic execution technology, the possible execution path of the target vulnerability is obtained, and the data flow and control flow information on the execution path are collected;

[0037] Based on data flow information and control flow information, combined with the abstract syntax tree, the full path is obtained.

[0038] In one possible embodiment, before determining the exploitability score of the target vulnerability based on the number of exploitation steps, the complexity of the triggering conditions, and the risk level, exploit stealthiness, and exploit success rate of the target vulnerability, the apparatus further includes a third processing module configured to:

[0039] Determine the risk level of the target vulnerability based on the risk level of each reference vulnerability included in the vulnerability library;

[0040] Determine the success rate of exploiting the target vulnerability based on its historical exploitation data.

[0041] In a third aspect, the present application provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of any one of the methods described in the first aspect are implemented.

[0042] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any one of the methods described in the first aspect above.

[0043] In a fifth aspect, the present application provides a computer program product, comprising: a computer program code, which, when executed on a computer, enables the computer to execute any one of the methods described in the first aspect.

[0044] In an embodiment of the present application, the target vulnerability is located, the full path of the target vulnerability from the trigger entry to the outbreak point is extracted, and based on the full path, the trigger conditions and trigger steps of the target vulnerability are identified. Then, based on the trigger conditions and trigger steps, the trigger condition complexity and the number of exploitation steps of the target vulnerability are determined. The number of exploitation steps characterizes: the number of steps required for exploiting the target vulnerability. Finally, based on the number of exploitation steps, the complexity of the trigger conditions, and the risk level, exploitation concealment, and exploitation success rate of the target vulnerability, the exploitability score of the target vulnerability is determined, wherein the exploitation concealment characterizes: the difficulty of the target vulnerability being discovered. In this way, by accurately locating the target vulnerability, it is possible to identify accurate trigger conditions and triggering steps, and obtain the number of exploitation steps and the complexity of the trigger conditions. The number of exploitation steps, the complexity of the trigger conditions, the risk level, the exploitation concealment, and the exploitation success rate of the vulnerability are comprehensively considered to conduct a comprehensive vulnerability assessment, thereby improving the accuracy of the vulnerability assessment and thus improving the accuracy of the repair priority determination. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 This is an implementation process of a vulnerability assessment method provided in an embodiment of the present application;

[0046] Figure 2 This is a schematic diagram of the process of extracting the full path in the embodiment of this application;

[0047] Figure 3 This is another flowchart of a vulnerability assessment method in an embodiment of the present application;

[0048] Figure 4 This is a schematic diagram of the structure of the vulnerability assessment device in an embodiment of the present application;

[0049] Figure 5 This is a schematic diagram of the structure of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solutions and advantages of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application. Unless there is a conflict, the embodiments in the present application and the features in the embodiments can be combined with each other in any way. In addition, although a logical order is shown in the flowchart, in some cases, the steps shown or described can be performed in an order different from that here.

[0051] The terms "first" and "second" in the specification and claims of this application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the term "comprising" and any of its variations are intended to cover non-exclusive protection. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. "Multiple" in this application can mean at least two, for example, two, three or more, and the embodiments of this application are not limited thereto.

[0052] The following description of exemplary embodiments of the present application is made in conjunction with the accompanying drawings, which include various details of the embodiments of the present application to facilitate understanding, and they should be considered as merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope disclosed in this application. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description. It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, which should be considered as exemplary, and their purpose is only to illustrate the feasibility of the implementation of the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0053] In the technical solution of this application, the acquisition, transmission, storage, and use of data comply with the requirements of relevant national laws and regulations.

[0054] The following is a brief introduction to the design concept of the embodiment of this application:

[0055] With the advancement and development of technology, software application scenarios are increasing. However, the existence of software vulnerabilities poses serious security risks to the security of applications. Effective vulnerability prioritization is crucial for timely vulnerability repair.

[0056] Traditional vulnerability assessment usually determines the reference vulnerability that matches the target vulnerability based on the similarity between the target vulnerability and the reference vulnerability contained in the vulnerability library, and uses the risk level of the reference vulnerability as the risk level of the target vulnerability.

[0057] However, vulnerability assessment based solely on risk level cannot comprehensively and accurately assess target vulnerabilities, and therefore cannot accurately determine the priority for remediation. For example, if the target vulnerability is deeply buried and requires many steps to trigger, even though the risk level of the target vulnerability is high, it is difficult to trigger the target vulnerability during actual operation. Therefore, the remediation priority of the target vulnerability is lower than that of vulnerabilities with lower risk levels and easier to trigger.

[0058] In view of this, in an embodiment of the present application, a vulnerability assessment method, device, electronic device and storage medium are provided to locate the target vulnerability, extract the full path of the target vulnerability from the trigger entry to the outbreak point, and identify the trigger conditions and trigger steps of the target vulnerability based on the full path. Then, based on the trigger conditions and trigger steps, the trigger condition complexity and the number of exploitation steps of the target vulnerability are determined. The number of exploitation steps characterizes: the number of steps required for the exploitation of the target vulnerability. Finally, based on the number of exploitation steps, the complexity of the trigger conditions, and the risk level, exploitation concealment and exploitation success rate of the target vulnerability, the exploitability score of the target vulnerability is determined, wherein the exploitation concealment characterizes: the difficulty of the target vulnerability being discovered. In this way, by accurately locating the target vulnerability, it is possible to identify accurate trigger conditions and trigger steps, and obtain the number of exploitation steps and the complexity of the trigger conditions. The number of exploitation steps, the complexity of the trigger conditions, the risk level, the exploitation concealment and the exploitation success rate of the vulnerability are comprehensively considered to obtain a comprehensive and accurate vulnerability assessment, which facilitates the subsequent accurate determination of the repair priority of the target vulnerability and improves the accuracy of vulnerability identification and the efficiency of repair work.

[0059] The preferred embodiments of the present application are described below in conjunction with the drawings in the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application and are not used to limit the present application. In addition, the embodiments of the present application and the features in the embodiments may be combined with each other if there is no conflict.

[0060] See Figure 1 FIG. 1 is a flowchart of an implementation of a vulnerability assessment method provided in an embodiment of the present application. The specific implementation process of the method is as follows:

[0061] Step 10: Locate the target vulnerability, extract the full path of the target vulnerability from the trigger entry to the outbreak point, and identify the triggering conditions and triggering steps of the target vulnerability based on the full path.

[0062] Among them, the outbreak point is: the location where the target vulnerability is detonated, the trigger entry is: the location where the target vulnerability is discovered, and the trigger conditions include environmental conditions, network conditions, code conditions, etc.

[0063] In an embodiment of the present application, a program code file is obtained and a vulnerability detection is performed on it. When a vulnerability is detected in the software, the existing vulnerability is used as a target vulnerability, and information about the target vulnerability is obtained. The target vulnerability is then located, and the full path of the target vulnerability from the trigger entry to the outbreak point is extracted. Based on the full path, the propagation of user input data in the program is tracked to determine how the data affects the program flow and status, thereby identifying the triggering conditions and triggering steps of the vulnerability.

[0064] Optionally, in an embodiment of the present application, a possible embodiment is provided for locating a target vulnerability and extracting the entire path of the target vulnerability from the trigger entry to the outbreak point. Specifically, the following operations are performed:

[0065] Step 100: Perform instrumentation in a code region suspected of containing a target vulnerability, identify the outbreak point of the target vulnerability, and obtain the code segment corresponding to the outbreak point.

[0066] In an embodiment of the present application, a stub is inserted in a code area suspected of containing a target vulnerability, and detailed information during program runtime, such as variable values, memory access patterns, and function call sequences, is collected. The vulnerability outbreak point is obtained based on the instrumented content, the outbreak point of the target vulnerability is obtained, and the vulnerable statement at the outbreak point is located. After the location is completed, the code segment corresponding to the outbreak point is obtained based on the abstract syntax tree (AST).

[0067] Step 101: Identify the triggering entry of the target vulnerability through code segments combined with taint analysis technology.

[0068] In an embodiment of the present application, based on the acquired code segments, static taint analysis is performed to track the flow of data in the program, identify data propagation paths that may be affected by malicious intent, and identify the triggering entry of the target vulnerability.

[0069] In this way, the trigger entry and outbreak point can be accurately identified.

[0070] Step 102: Based on the trigger entry and the burst point, obtain the full path.

[0071] Optionally, in an embodiment of the present application, a possible embodiment is provided for obtaining the full path based on the trigger entry and the outbreak point, and the following operations are specifically performed:

[0072] Step 1020: Obtain the possible execution path of the target vulnerability through symbolic execution technology, and collect data flow information and control flow information on the execution path.

[0073] Among them, symbolic execution technology helps determine which paths may lead to vulnerability triggering.

[0074] In an embodiment of the present application, after identifying the trigger entry, the program input is replaced with symbolic variables through symbolic execution technology, and all possible execution paths of the target vulnerability are explored through a symbolic solver, and data flow information and control flow information on the execution path are collected.

[0075] Step 1021: Based on the data flow information and the control flow information, combined with the abstract syntax tree, the full path is obtained.

[0076] In an embodiment of the present application, based on data flow and control flow information, combined with data flow graphs, function dependency graphs and abstract syntax trees, the full path of the target vulnerability from the trigger entry to the outbreak point is obtained.

[0077] In this way, the entire path of the target vulnerability from the trigger entry to the outbreak point can be accurately obtained.

[0078] Based on the above embodiments, participation Figure 2 As shown in FIG, a schematic diagram of the process of extracting the full path in an embodiment of the present application is shown, and the process is as follows:

[0079] Step 20: Obtain information about the target vulnerability.

[0080] Step 21: Instrumentation and tracing.

[0081] Step 22: Identify the executable path.

[0082] Step 23: Taint analysis.

[0083] Step 24: Data flow and control flow construction.

[0084] Step 25: Full path extraction.

[0085] Step 11: Based on the trigger conditions and trigger steps, determine the trigger condition complexity and the number of exploit steps of the target vulnerability.

[0086] Among them, the number of exploit steps represents the number of steps required to exploit the target vulnerability, and the complexity of the triggering conditions represents the complexity of the conditions required to trigger the target vulnerability, which measures the technical difficulty required for an attacker to successfully exploit the target vulnerability.

[0087] Step 12: Determine the exploitability score of the target vulnerability based on the number of exploit steps, the complexity of the triggering conditions, and the risk level, exploit stealth, and exploit success rate of the target vulnerability.

[0088] Among them, the degree of exploitation represents the difficulty of discovering the target vulnerability, and the success rate represents the probability of the target vulnerability being successfully exploited.

[0089] In the embodiment of the present application, the exploitability score of the target vulnerability is calculated based on the scores and weight coefficients of the number of exploitation steps, complexity of triggering conditions, risk level, exploitation concealment, and exploitation success rate of the target vulnerability.

[0090] Among them, each weight coefficient is used to adjust the importance of different factors in the evaluation. The value of each weight coefficient is adaptively adjusted based on expert experience and historical data analysis, and the sum of each weight coefficient is 100.

[0091] In an embodiment of the present application, the exploitability score of the target vulnerability can be expressed as: Score = 100-(w1*N+w2*C+w3*R+w4*S+w5*P), where N is the score of the number of exploit steps, C is the score of the complexity of the trigger conditions, R is the score of the risk level, S is the score of the exploit concealment, P is the score of the exploit success rate, and w1 to w5 are weight coefficients.

[0092] In this way, the accuracy and intelligence of vulnerability assessment are improved based on the weight coefficient and adaptive weight adjustment mechanism.

[0093] In an embodiment of the present application, the number of exploitation steps is divided into multiple levels, and a score is assigned to each level. According to the number of steps required to exploit the target vulnerability, the number of exploitation steps of the target vulnerability is classified into the corresponding level and a score is assigned.

[0094] For example, the number of exploitation steps is divided into 3 levels, and a score is assigned to each level, where the number of exploitation steps is less than 3 and is 20 points, 3-5 and 10 points, and more than 5 and 0 points. Assuming that the number of steps required to exploit the target vulnerability is 2, the score of the number of exploitation steps of the target vulnerability is 20 points.

[0095] In an embodiment of the present application, the complexity of the trigger conditions is divided into multiple levels, and a score is assigned to each level. According to the number of trigger conditions of the target vulnerability, the complexity of the trigger conditions of the target vulnerability is classified into the corresponding level and assigned a score.

[0096] For example, the complexity of trigger conditions is divided into three levels (including: simple, medium, and complex), and scores are assigned to each level, with simple getting 0 points, medium getting 10 points, and complex getting 20 points. Assuming that the trigger condition of the target vulnerability requires a virtual machine and attack code, and the level of the trigger condition complexity is complex, the score of the trigger condition complexity of the target vulnerability is 20 points.

[0097] In an embodiment of the present application, the risk degree is divided into multiple levels, a score is assigned to each level, a reference vulnerability matching the target vulnerability is determined in the vulnerability library, the risk degree of the matching reference vulnerability is used as the risk degree of the target vulnerability, and then a score is assigned to the risk degree of the target vulnerability based on the risk degree of the target vulnerability.

[0098] For example, the risk level is divided into three levels (including: low risk, medium risk, and high risk), and scores are assigned to each level. Low risk gets 20 points, medium risk gets 10 points, and high risk gets 0 points. Assuming that the risk level of the target vulnerability is medium risk, the risk level score of the target vulnerability is 10 points.

[0099] In the embodiment of the present application, the exploit concealment is divided into multiple levels, a score is assigned to each level, and then the score is assigned to the exploit concealment of the target vulnerability according to the exploit concealment of the target vulnerability.

[0100] For example, the exploit stealthiness is divided into three levels (including: easy to be discovered, relatively hidden, and very hidden), and a score is assigned to each level. Easy to be discovered gets 0 points, relatively hidden gets 10 points, and very hidden gets 20 points. Assuming that the exploit stealthiness of the target vulnerability is relatively hidden, the exploit stealthiness score of the target vulnerability is 10 points.

[0101] Among them, easy to be discovered means that vulnerability exploitation behavior can be easily detected by existing security monitoring systems or log analysis tools; relatively hidden means that specific monitoring strategies or analysis tools are required to discover vulnerability exploitation behavior; very hidden means that the exploitation behavior is difficult to be discovered by existing security measures and requires advanced threat detection technology or specialized security analysis.

[0102] In the embodiment of the present application, the exploitation success rate p of the target vulnerability is determined based on the number of exploits and the number of successes in the historical exploitation data of the target vulnerability, and a score is assigned.

[0103] For example, the score of the exploitation success rate of the target vulnerability is P=100-p, where p is the exploitation success rate. Assuming that the exploitation success rate of the target vulnerability is 0.5, the score of the exploitation success rate of the target vulnerability is 99.5 points.

[0104] Furthermore, in an embodiment of the present application, after determining the exploitability score of the target vulnerability, the repair priority of the target vulnerability is determined based on the exploitability score and the risk level, and an accurate repair priority is obtained to provide a basis for vulnerability repair personnel. The repair strategy of the target vulnerability can also be determined based on the exploitability score and the risk level.

[0105] Specifically, in an embodiment of the present application, weights can be assigned to the exploitability score and the risk level, and a comprehensive evaluation score can be obtained based on the exploitability score and its weight, as well as the risk level and its weight. Based on the comprehensive evaluation score, the repair priority of the target vulnerability can be determined.

[0106] Based on the above embodiments, see Figure 3 FIG. 1 is another flow chart of a vulnerability assessment method according to an embodiment of the present application, which specifically includes:

[0107] Step 30: Start.

[0108] Step 31: Software source code.

[0109] Step 32: Vulnerability detection.

[0110] Step 33: Target vulnerability location.

[0111] Among them, target vulnerability positioning includes: identification of the outbreak point and trigger entry of the target vulnerability.

[0112] Step 34: Extract the entire path of the target vulnerability from the trigger entry to the outbreak point.

[0113] Step 35: Determine the exploitability score of the target vulnerability.

[0114] Step 36: Determine the comprehensive assessment score based on the exploitability score and risk level.

[0115] Step 37: Output the comprehensive evaluation score.

[0116] Based on the same inventive concept, a vulnerability assessment device is also provided in the embodiment of the present application. Figure 4 FIG. 1 is a schematic diagram of the structure of the vulnerability assessment device in an embodiment of the present application, which specifically includes:

[0117] The first processing module 401 is used to locate the target vulnerability, extract the full path of the target vulnerability from the trigger entry to the outbreak point, and identify the triggering conditions and triggering steps of the target vulnerability based on the full path;

[0118] The second processing module 402 is configured to determine the trigger condition complexity and the number of exploitation steps of the target vulnerability based on the trigger condition and the triggering steps, where the number of exploitation steps represents the number of steps required to exploit the target vulnerability.

[0119] The evaluation module 403 is used to determine the exploitability score of the target vulnerability based on the number of exploitation steps, the complexity of the triggering conditions, and the risk level, exploit stealthiness and exploit success rate of the target vulnerability. The exploit stealthiness represents the difficulty of discovering the target vulnerability.

[0120] In one possible embodiment, after determining the exploitability score of the target vulnerability based on the number of exploitation steps, the complexity of the triggering conditions, and the risk level, exploit concealment, and exploit success rate of the target vulnerability, the apparatus further includes a determination module 404 configured to:

[0121] Determine the priority of remediation of target vulnerabilities based on exploitability score and risk level.

[0122] In a possible embodiment, when locating the target vulnerability and extracting the entire path of the target vulnerability from the trigger entry to the outbreak point, the first processing module 401 is further configured to:

[0123] Perform instrumentation in code areas suspected of containing the target vulnerability, identify the outbreak point of the target vulnerability, and obtain the code segment corresponding to the outbreak point;

[0124] Identify the triggering entry of the target vulnerability through code segments combined with taint analysis technology;

[0125] Get the full path based on the trigger entry and outbreak point.

[0126] In a possible embodiment, when obtaining the full path based on the trigger entry and the outbreak point, the first processing module 401 is further configured to:

[0127] Through symbolic execution technology, the possible execution path of the target vulnerability is obtained, and the data flow and control flow information on the execution path are collected;

[0128] Based on data flow information and control flow information, combined with the abstract syntax tree, the full path is obtained.

[0129] In one possible embodiment, before determining the exploitability score of the target vulnerability based on the number of exploitation steps, the complexity of the triggering conditions, and the risk level, exploit concealment, and exploit success rate of the target vulnerability, the apparatus further includes a third processing module 405, which is configured to:

[0130] Determine the risk level of the target vulnerability based on the risk level of each reference vulnerability included in the vulnerability library;

[0131] Determine the success rate of exploiting the target vulnerability based on its historical exploitation data.

[0132] Based on the above embodiments, see Figure 5 Shown is a schematic structural diagram of an electronic device in an embodiment of the present application.

[0133] An embodiment of the present application provides an electronic device, which may include a processor 510 (Center Processing Unit, CPU), a memory 520, an input device 530 and an output device 540, etc. The input device 530 may include a keyboard, a mouse, a touch screen, etc., and the output device 540 may include a display device, such as a liquid crystal display (LCD), a cathode ray tube (CRT), etc.

[0134] The memory 520 may include a read-only memory (ROM) and a random access memory (RAM), and provides program instructions and data stored in the memory 520 to the processor 510. In the embodiment of the present application, the memory 520 may be used to store the program of any vulnerability assessment method in the embodiment of the present application.

[0135] The processor 510 calls the program instructions stored in the memory 520, and the processor 510 is used to execute any vulnerability assessment method in the embodiments of the present application according to the obtained program instructions.

[0136] Based on the above embodiments, in an embodiment of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the vulnerability assessment method in any of the above method embodiments is implemented.

[0137] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0138] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0139] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0140] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1The steps for the function specified in one or more boxes.

[0141] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A vulnerability assessment method, characterized in that: include: Performing instrumentation in code areas suspected of containing target vulnerabilities, identifying the outbreak point of the target vulnerability, and obtaining the code segment corresponding to the outbreak point; Using the code segment and taint analysis technology, the triggering entry of the target vulnerability is identified; Obtain the possible execution path of the target vulnerability through symbolic execution technology, and collect data flow information and control flow information on the execution path; Acquire a full path based on the data flow information and the control flow information in combination with an abstract syntax tree; Identify the triggering conditions and triggering steps of the target vulnerability based on the full path; Determining, based on the triggering condition and the triggering steps, the complexity of the triggering condition and the number of exploitation steps of the target vulnerability, where the number of exploitation steps represents: the number of steps required to exploit the target vulnerability; An exploitability score of the target vulnerability is determined based on the number of exploitation steps, the complexity of the triggering conditions, and the risk level, exploit stealth, and exploit success rate of the target vulnerability, wherein the exploit stealth represents the difficulty of discovering the target vulnerability.

2. The method according to claim 1, wherein After determining the exploitability score of the target vulnerability based on the number of exploit steps, the complexity of the triggering condition, and the risk level, exploit concealment, and exploit success rate of the target vulnerability, the method further includes: Determine a repair priority for the target vulnerability based on the exploitability score and the risk level.

3. The method according to claim 1, wherein Before determining the exploitability score of the target vulnerability based on the number of exploit steps, the complexity of the triggering condition, and the risk level, exploit concealment, and exploit success rate of the target vulnerability, the method further includes: Determining the risk level of the target vulnerability based on the risk level of each reference vulnerability included in the vulnerability library; Determine the success rate of exploiting the target vulnerability based on historical exploitation data of the target vulnerability.

4. A vulnerability assessment device, characterized in that: include: The first processing module is configured to perform instrumentation in a code region suspected of containing a target vulnerability, identify the outbreak point of the target vulnerability, and obtain the code segment corresponding to the outbreak point; identify the triggering entry of the target vulnerability through the code segment in combination with taint analysis technology; obtain the possible execution path of the target vulnerability through symbolic execution technology, and collect data flow information and control flow information on the execution path; and obtain the full path based on the data flow information and the control flow information in combination with an abstract syntax tree; Identify the triggering conditions and triggering steps of the target vulnerability based on the full path; A second processing module is configured to determine, based on the trigger condition and the trigger step, a complexity of the trigger condition and a number of exploitation steps of the target vulnerability, wherein the number of exploitation steps represents the number of steps required to exploit the target vulnerability; An evaluation module is configured to determine an exploitability score of the target vulnerability based on the number of exploitation steps, the complexity of the triggering conditions, and the risk level, exploit stealthiness, and exploit success rate of the target vulnerability, wherein the exploit stealthiness represents the difficulty of discovering the target vulnerability.

5. The device according to claim 4, characterized in that After determining the exploitability score of the target vulnerability based on the number of exploitation steps, the complexity of the triggering condition, and the risk level, exploit concealment, and exploit success rate of the target vulnerability, the apparatus further includes a determination module configured to: Determine a repair priority for the target vulnerability based on the exploitability score and the risk level.

6. The device according to claim 4, characterized in that Before determining the exploitability score of the target vulnerability based on the number of exploitation steps, the complexity of the triggering condition, and the risk level, exploit concealment, and exploit success rate of the target vulnerability, the apparatus further includes a third processing module, the third processing module being configured to: Determining the risk level of the target vulnerability based on the risk level of each reference vulnerability included in the vulnerability library; Determine the success rate of exploiting the target vulnerability based on historical exploitation data of the target vulnerability.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the method according to any one of claims 1 to 3 are implemented.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 3 are implemented.

Images