Vulnerability availability evaluation method and device based on federated learning

Abstract

The invention provides a vulnerability availability assessment method and device based on federal learning, and the method comprises the steps: obtaining to-be-assessed vulnerability information which comprises vulnerability text information and vulnerability non-text information; based on the to-be-evaluated vulnerability information, extracting vulnerability text feature information and vulnerability non-text feature information; fusing the vulnerability text feature information and the vulnerability non-text feature information to obtain fused feature information; the fusion feature information is input into a vulnerability availability evaluation model, an evaluation result is output, the evaluation result is used for representing the availability of the to-be-evaluated vulnerability information, and the vulnerability availability evaluation model is obtained by training a classification model based on federated learning.

Description

Technical Field

[0001] The present disclosure relates to the technical field of item vulnerability exploitability prediction and privacy protection, and in particular to a vulnerability exploitability assessment method and device based on federated learning. Background Art

[0002] A vulnerability refers to a defect in the implementation of hardware, software, or a system's security policy that allows an attacker to access or damage a system without authorization. With the rapid growth in the number of publicly disclosed vulnerabilities, the threats posed by vulnerabilities are also increasing, posing a huge challenge to security workers and staff on related platforms. Of all the disclosed vulnerabilities, only a small portion can be widely exploited, and the exploitation value of these vulnerabilities varies. To more effectively exploit vulnerabilities that have been discovered and publicly disclosed, it is necessary to conduct an exploitability assessment of the vulnerabilities.

[0003] In the process of implementing the present disclosure, it is found that in order to address the security issues of data leakage that may occur during vulnerability exploitability assessment, there is an urgent need for a method for vulnerability exploitability assessment that can protect data security while implementing vulnerability exploitability assessment. Summary of the invention

[0004] In view of the above problems, the present disclosure provides a vulnerability exploitability assessment method, apparatus, device, medium and program product based on federated learning.

[0005] According to a first aspect of the present disclosure, a vulnerability exploitability assessment method based on federated learning is provided, comprising: obtaining vulnerability information to be assessed, wherein the vulnerability information to be assessed includes vulnerability text information and vulnerability non-text information; extracting vulnerability text feature information and vulnerability non-text feature information based on the vulnerability information to be assessed; fusing the vulnerability text feature information and the vulnerability non-text feature information to obtain fused feature information; and inputting the fused feature information into a vulnerability exploitability assessment model and outputting an assessment result, wherein the assessment result is used to characterize the exploitability of the vulnerability information to be assessed, and the vulnerability exploitability assessment model is obtained by training a classification model based on federated learning.

[0006] According to an embodiment of the present disclosure, federated learning includes horizontal federated learning; the vulnerability exploitability assessment method based on federated learning also includes: using the framework of horizontal federated learning to train the classification model to obtain a vulnerability exploitability assessment model.

[0007] According to an embodiment of the present disclosure, a classification model is trained using a framework of horizontal federated learning to obtain a vulnerability exploitability assessment model, including: receiving homomorphically encrypted gradient information from N clients, wherein the gradient information is obtained by the client based on sample vulnerability information, sample labels, and a classification model, and N is an integer greater than or equal to 2; aggregating the gradient information to obtain aggregated gradient information; sending the aggregated gradient information to N clients, so that the N clients decrypt the aggregated gradient information and update the classification model; and obtaining a vulnerability exploitability assessment model when it is determined that the trained classification model has iteratively converged.

[0008] According to an embodiment of the present disclosure, the gradient information is aggregated to obtain aggregated gradient information, including: utilizing a federated averaging algorithm to aggregate the gradient information to obtain aggregated gradient information.

[0009] According to an embodiment of the present disclosure, the sample label is obtained by marking the sample vulnerability information according to the sample vulnerability exploitation information.

[0010] According to an embodiment of the present disclosure, based on the vulnerability information to be evaluated, vulnerability text feature information and vulnerability non-text feature information are extracted, including: when it is determined that the vulnerability information to be evaluated is vulnerability text information, using a text feature extraction algorithm to extract the vulnerability text feature information; when it is determined that the vulnerability information to be evaluated is vulnerability non-text information, encoding or normalizing the vulnerability non-text information to extract the vulnerability non-text feature information.

[0011] According to an embodiment of the present disclosure, the classification model includes: a comparative logistic regression algorithm model, a decision tree algorithm model, and a deep learning algorithm model.

[0012] A second aspect of the present disclosure provides a vulnerability exploitability assessment device based on federated learning, including: an acquisition module, used to obtain vulnerability information to be assessed, wherein the vulnerability information to be assessed includes vulnerability text information and vulnerability non-text information; an extraction module, used to extract vulnerability text feature information and vulnerability non-text feature information based on the vulnerability information to be assessed; a fusion module, used to fuse the vulnerability text feature information and the vulnerability non-text feature information to obtain fused feature information; and an assessment module, used to input the fused feature information into a vulnerability exploitability assessment model and output an assessment result, wherein the assessment result is used to characterize the exploitability of the vulnerability information to be assessed, and the vulnerability exploitability assessment model is obtained by training a classification model based on federated learning.

[0013] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the above method.

[0014] The fourth aspect of the present disclosure also provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the above method.

[0015] According to the disclosed embodiments, by fusing the extracted vulnerability text information and vulnerability non-text information, more comprehensive vulnerability feature information for the vulnerability information to be evaluated can be obtained. Federated learning is used for model training, so that each participant in the model training can predict the most likely to be exploited vulnerabilities while ensuring information security. Each participant can jointly train a vulnerability exploitability assessment model while storing information locally. Inputting the fused feature information into the vulnerability exploitability assessment model can achieve an accurate assessment of the vulnerability exploitability, while protecting the privacy of the participants and the security of the vulnerability information during the vulnerability exploitability assessment process. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0017] Figure 1 A diagram schematically shows an application scenario of a vulnerability exploitability assessment method and device based on federated learning according to an embodiment of the present disclosure;

[0018] Figure 2 A flowchart of a method for evaluating vulnerability exploitability based on federated learning according to an embodiment of the present disclosure is schematically shown;

[0019] Figure 3 A flowchart of a method for training a vulnerability exploitability assessment model using horizontal federated learning to train a classification model according to an embodiment of the present disclosure is schematically shown;

[0020] Figure 4 A schematic diagram of a horizontal federated learning training vulnerability exploitability assessment model according to an embodiment of the present disclosure is schematically shown;

[0021] Figure 5 A schematic diagram of a vulnerability exploitability assessment model construction method according to an embodiment of the present disclosure is schematically shown;

[0022] Figure 6 A structural block diagram of a vulnerability exploitability assessment device based on federated learning according to an embodiment of the present disclosure is schematically shown; and

[0023] Figure 7A block diagram of an electronic device suitable for implementing a vulnerability exploitability assessment method based on federated learning according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0024] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0025] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0026] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly rigid manner.

[0027] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0028] In the technical solution of the present disclosure, the collection, storage, use, processing, transmission, provision, disclosure and application of the data involved (including but not limited to user personal information) comply with the provisions of relevant laws and regulations, take necessary confidentiality measures, and do not violate public order and good morals.

[0029] In the technical solution of the embodiment of the present disclosure, the user's authorization or consent is obtained before obtaining or collecting the user's personal information.

[0030] In the process of implementing the present disclosure, it is found that vulnerability exploitability assessment can evaluate the exploitability of vulnerabilities through the characteristics of the vulnerabilities to determine which vulnerabilities are most likely to be widely exploited. For example, the Common Vulnerability Scoring System (CVSS) is used to evaluate the exploitability of vulnerabilities. The specific assessment of the Common Vulnerability Scoring System is to construct a fixed calculation formula based on parameters such as vulnerability access complexity, authorization (Authentication) and access method, and then perform weighted calculations to score the exploitability of the vulnerability. The score of the exploitability of the vulnerability is included in the score to measure the probability that the vulnerability can be exploited. However, the CVSS score considers fewer vulnerability features and the constructed formula is simple, resulting in an inaccurate evaluation.

[0031] By building a vulnerability exploitability assessment model, the exploitability of the vulnerability is assessed, that is, open source vulnerability information is collected, the vulnerability information is aggregated, and the model is further improved through more effective natural language processing algorithms and classification prediction algorithms. For example, the vulnerability text description feature is extracted through a convolutional neural network (CNN), and then classified and predicted through a support vector machine (SVM). However, this method also has problems. It considers fewer vulnerability features, resulting in an accuracy rate of only 81.6%. Although an improvement strategy is proposed, the linear SVM classifier is used to predict whether Twitter related to Common Vulnerabilities & Exposures (CVE) contains vulnerability exploitable information. Since the implementation scenario of this strategy is limited to Twitter, the reference vulnerability exploitable field has limitations. In addition, it is proposed to train more than 20 parameters in the CVSS score of the vulnerability through an extreme gradient boosting (eXtreme Gradient Boosting, XGBoost) decision tree, but this method only considers the parameters in the CVSS score and considers fewer vulnerability features, which is not conducive to a comprehensive study of vulnerability exploitability. On this basis, we further considered combining the text features of the vulnerability with other features of the vulnerability such as CVSS, Open Vulnerability and Assessment Language (OVAL), and realized vulnerability exploitability prediction through the text classification tool (FastText) combined with the distributed gradient boosting framework (Light Gradient Boosting Machine, LightGBM) algorithm based on the decision tree algorithm, with an accuracy rate of 91%. We also compared 48 supervised and unsupervised algorithms through experiments, and found that supervised machine learning algorithms can achieve better results in the actual scenario of vulnerability prediction. However, for network platforms, vulnerability information is extremely important, and once leaked, it will bring very serious disasters. The existing vulnerability exploitability assessment method simply aggregates the vulnerability information of all platforms and trains a machine learning model for assessment. It does not consider the security and sensitivity of vulnerability data, which is easy to cause data silos and hinder the effectiveness of vulnerability exploitability assessment in actual use.

[0032] In view of the security issues of data leakage that may occur during the vulnerability exploitability prediction process, there is an urgent need for a method that can achieve vulnerability exploitability prediction while protecting data security, so that multiple network companies can jointly train a vulnerability exploitability prediction model while ensuring the security of their own vulnerability data, thereby helping security workers quickly find the vulnerabilities that are most likely to be exploited.

[0033] The present disclosure takes into account that federated learning is intended to solve data locality and privacy issues in various cross-device and cross-scenario operations. When faced with massive amounts of privacy data, unlike traditional machine learning methods, federated learning does not need to centralize all privacy data to train models. On the contrary, when the privacy data is stored locally on the data holder, a model can be trained together to protect the privacy and security of the data. Federated learning was first proposed by Google, with the goal of establishing a joint machine learning model with data distributed on multiple devices. Federated learning is a distributed training method that introduces a variety of privacy protection technologies and uses data distributed on multiple participants to collaboratively build a global machine learning model. The present disclosure integrates feature information into a vulnerability exploitability assessment model obtained through federated learning training, which can achieve an accurate assessment of vulnerability exploitability. At the same time, in the process of vulnerability exploitability assessment, it protects the privacy of the participants and the security of vulnerability information, and solves the problems of data leakage and data silos.

[0034] An embodiment of the present disclosure provides a vulnerability exploitability assessment method based on federated learning, comprising: obtaining vulnerability information to be assessed, wherein the vulnerability information to be assessed includes vulnerability text information and vulnerability non-text information; extracting vulnerability text feature information and vulnerability non-text feature information based on the vulnerability information to be assessed; fusing the vulnerability text feature information and the vulnerability non-text feature information to obtain fused feature information; and inputting the fused feature information into a vulnerability exploitability assessment model and outputting an assessment result, wherein the assessment result is used to characterize the exploitability of the vulnerability information to be assessed, and the vulnerability exploitability assessment model is obtained by training a classification model based on federated learning.

[0035] Figure 1 The application scenario diagram of the vulnerability exploitability assessment method, apparatus, device, medium and program product based on federated learning according to an embodiment of the present disclosure is schematically shown.

[0036] like Figure 1 As shown, the application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 is used to provide a medium for a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0037] The user may use at least one of the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications may be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0038] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0039] The server 105 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0040] It should be noted that the vulnerability exploitability assessment method based on federated learning provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the vulnerability exploitability assessment device based on federated learning provided in the embodiment of the present disclosure can generally be set in the server 105. The vulnerability exploitability assessment method based on federated learning provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Accordingly, the vulnerability exploitability assessment device based on federated learning provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0041] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0042] The following will be based on Figure 1 The scene described by Figure 2 to Figure 5 The vulnerability exploitability assessment method based on federated learning in the disclosed embodiment is described in detail.

[0043] Figure 2 The flowchart of the vulnerability exploitability assessment method based on federated learning according to an embodiment of the present disclosure is schematically shown.

[0044] like Figure 2 As shown, the vulnerability exploitability assessment method 200 based on federated learning in this embodiment includes operations S210 to S240.

[0045] In operation S210 , vulnerability information to be evaluated is obtained, wherein the vulnerability information to be evaluated includes vulnerability text information and vulnerability non-text information.

[0046] According to an embodiment of the present disclosure, the vulnerability information to be evaluated can be obtained by collecting multiple open source data sets through crawlers, etc. The open source data sets may include: data from a vulnerability information disclosure platform and data from a vulnerability exploitation information platform.

[0047] Among them, vulnerability information disclosure platforms can include: the National Vulnerability Database (NVD), which is a repository of vulnerability management data based on standards. The vulnerabilities in the NVD database are indexed by exposure identifiers (CVE-ID), providing a download channel for vulnerability information. For all vulnerability information, NVD combines vulnerability information for each year in json format. Each entry includes a descriptive text summary of the vulnerability, CVSS scores and related indicators, information about affected products and vendors, vulnerability categories based on the Common Weakness Enumeration (CWE) system, and reference URLs.

[0048] Among them, the vulnerability exploitation information platform can select public websites, such as Securityfocus, GreyNoise, Exploit-DB, and some vulnerability exploitation web pages in Github.

[0049] In operation S220 , vulnerability text feature information and vulnerability non-text feature information are extracted based on the vulnerability information to be evaluated.

[0050] According to an embodiment of the present disclosure, after obtaining the information to be evaluated obtained in operation S210, the vulnerability text information in the vulnerability information to be evaluated can be extracted using text feature extraction technology to obtain vulnerability text feature information. The vulnerability non-text information in the vulnerability information to be evaluated can be extracted using non-text feature extraction technology to obtain vulnerability non-text feature information.

[0051] For example, for the text description of the vulnerability, the FastText method is used to extract text features; for processing text features such as access vectors, access complexity, authentication, confidentiality impact, integrity impact, availability impact and CWE-ID, one-hot encoding is preferably used for processing, and for digital features such as basic scores, exploitability scores, impact scores and Product Count, this embodiment preferably uses a normalized method to process them and scale these numbers to between 0 and 1; for OVAL vectors and CPE information that are originally 0 or 1, this embodiment preferably inputs them as binary vectors.

[0052] Among them, vulnerability text information refers to information that describes vulnerability information in text form; vulnerability non-text information refers to information that characterizes vulnerability information in other forms, for example, it can be at least one of the following: CVSS score, Common Platform Enumeration (CPE) information, Common Weakness Enumeration (CWE) information, OVAL, etc.

[0053] In operation S230, the vulnerability text feature information and the vulnerability non-text feature information are fused to obtain fused feature information.

[0054] According to an embodiment of the present disclosure, the vulnerability text feature information and the vulnerability non-text feature information extracted in operation S220 may be fused through a dot product technology to obtain fused feature information.

[0055] In operation S240, the fused feature information is input into a vulnerability exploitability assessment model, and an assessment result is output, wherein the assessment result is used to characterize the exploitability of the vulnerability information to be assessed. The vulnerability exploitability assessment model is obtained by training a classification model based on federated learning.

[0056] Among them, participants who participate in the training of the vulnerability exploitability assessment model can train the classification model by themselves according to the local vulnerability information of the participants to obtain the vulnerability exploitability assessment model.

[0057] According to the embodiment of the present disclosure, the vulnerability feature information merged in operation S230 is input into the exploitability assessment model to obtain an assessment result.

[0058] Among them, federated learning conducts distributed classification model training through data distributed on multiple devices. Each participant in federated learning will retain its own data and use its own data to train its own model locally.

[0059] Federated learning is a distributed machine learning framework with privacy protection and secure encryption technology. It aims to enable decentralized participants to collaborate in machine learning model training without disclosing private data to other participants.

[0060] The training process of the classic federated learning framework can be simply summarized into the following steps: the coordinator establishes a basic model and informs each participant of the basic structure and parameters of the model; each participant uses local data to train the model and returns the results to the coordinator; the coordinator aggregates the models of each participant to build a more accurate global model to improve the overall model performance and effect.

[0061] The federated learning framework includes many technologies, such as model training technology of traditional machine learning, algorithm technology of coordinator parameter integration, communication technology of efficient transmission between coordinators and participants, encryption technology of privacy protection, etc. In addition, there is an incentive mechanism in the federated learning framework, all data holders can participate, and the benefits are universal.

[0062] According to the disclosed embodiments, by fusing the extracted vulnerability text information and vulnerability non-text information, more comprehensive vulnerability feature information for the vulnerability information to be evaluated can be obtained. Federated learning is used for model training, so that each participant in the model training can predict the most likely to be exploited vulnerabilities while ensuring information security. Each participant can jointly train a vulnerability exploitability assessment model while storing information locally. Inputting the fused feature information into the vulnerability exploitability assessment model can achieve an accurate assessment of the vulnerability exploitability, while protecting the privacy of the participants and the security of the vulnerability information during the vulnerability exploitability assessment process.

[0063] The vulnerability features extracted in the vulnerability exploitability assessment method may include: vulnerability text description, access vector, access complexity, authentication, confidentiality impact, integrity impact, availability impact, basic score, exploitability score, impact score, CPE information, CWE-ID, Product Count, OVAL, and vulnerability exploitation label.

[0064] According to an embodiment of the present disclosure, the vulnerability exploitability assessment method based on federated learning also includes: using a horizontal federated learning framework to train a classification model to obtain a vulnerability exploitability assessment model.

[0065] Federated Learning (aka Federated Machine Learning) can include horizontal federated learning. Federated learning can also include vertical federated learning and federated transfer learning. Horizontal federated learning is preferably used. Among them, horizontal federated learning is also called feature-aligned federated learning, that is, the data features of the participants in horizontal federated learning are aligned. Horizontal federated learning is suitable for situations where the data features of the participants overlap a lot, but the sample IDs overlap less. Simply put, horizontal federated learning is to combine multiple rows of samples with the same features from multiple participants for federated learning.

[0066] According to the embodiment of the present disclosure, since there are many features involved in the vulnerability exploitability assessment training and the features overlap with each other, the classification model is trained using a horizontal federated learning framework, which has a higher training accuracy.

[0067] Figure 3 The flowchart schematically shows a method for training a classification model by using a horizontal federated learning framework to obtain a vulnerability exploitability assessment model according to an embodiment of the present disclosure.

[0068] like Figure 3 As shown, the method 300 of this embodiment uses the framework of horizontal federated learning to train the classification model to obtain the vulnerability exploitability assessment model includes operations S310 to S340.

[0069] In operation S310, gradient information after homomorphic encryption is received from N clients, wherein the gradient information is obtained by the client based on sample vulnerability information, sample labels, and a classification model, and N is an integer greater than or equal to 2.

[0070] According to the disclosed embodiment, it is assumed that there are N clients participating in the training of the vulnerability exploitability assessment model, where N is an integer greater than or equal to 2. The N clients use their own data locally to calculate the gradient of the model in the pre-built vulnerability exploitability assessment model. After calculating the gradient of the model, the gradient information is transmitted to the server through homomorphic encryption, and the server is responsible for receiving the homomorphically encrypted gradient information from these clients. The gradient information is obtained by the client based on the sample vulnerability information, sample labels and classification model.

[0071] Among them, the client's own local data refers to each customer's own evaluation vulnerability information; the pre-built vulnerability exploitability model is the vulnerability exploitability evaluation model built by the participants, which mainly includes the text feature processing of the vulnerability description, the processing of the non-text features of the vulnerability, and the construction of the classification prediction model. The main operations include: processing the text description of the selected vulnerability, then processing other features of the vulnerability, merging the processed features with the extracted text features, and obtaining trainable data; finally, using the classification prediction model for training and evaluation, and performing vulnerability exploitability evaluation. Among them, the homomorphic encryption algorithm refers to an encryption algorithm that satisfies the homomorphic operation properties of the ciphertext, that is, after the data is homomorphically encrypted, a specific calculation is performed on the ciphertext, and the plaintext obtained after the corresponding homomorphic decryption is equivalent to directly performing the same calculation on the plaintext data, realizing the "calculable but invisible" of the data. Based on the characteristics of the homomorphic encryption algorithm that is easy to implement and easy to encapsulate into a high-level language, this embodiment gives priority to using this algorithm to perform encryption operations in the federated learning process.

[0072] According to an embodiment of the present disclosure, the sample vulnerability information and the sample tag corresponding to the sample vulnerability information may be merged by using the Common Vulnerabilities and Exposures Identifier (CVE-ID) as a unified locator.

[0073] In operation S320, the gradient information is aggregated to obtain aggregated gradient information.

[0074] According to an embodiment of the present disclosure, after the server receives the encrypted gradient information sent from the client, it aggregates the data to obtain aggregated gradient information.

[0075] In operation S330 , the aggregated gradient information is sent to N clients, so that the N clients decrypt the aggregated gradient information and update the classification model.

[0076] According to an embodiment of the present disclosure, after the server completes the aggregation of gradient information, the obtained aggregated gradient information result is returned to the corresponding client, so that after the client receives the gradient information sent by the server, it decrypts the gradient information and uses the decrypted gradient information to update its own training model.

[0077] Among them, after the client receives the encrypted gradient information, it uses the decryption algorithm corresponding to the previous encryption algorithm to decrypt the gradient information, that is, homomorphic decryption.

[0078] In operation S340 , when it is determined that the trained classification model has iteratively converged, a vulnerability exploitability assessment model is obtained.

[0079] Figure 4 A schematic diagram of a vulnerability exploitability assessment model for horizontal federated learning training according to an embodiment of the present disclosure is schematically shown.

[0080] like Figure 4 As shown, referring to the execution content of each operation of operation S310 to operation S340, it can be understood that the classification model is trained using the framework of horizontal federated learning to obtain a vulnerability exploitability assessment model. Figure 4 As shown, the server receives homomorphically encrypted gradient information from N companies, securely aggregates the gradient information, and obtains an aggregated result, namely, aggregated gradient information; the server then sends the aggregated gradient information to companies A to N, which then decrypt the aggregated gradient information and update the classification model to obtain the latest vulnerability exploitability assessment model.

[0081] According to the embodiments of the present disclosure, multiple vulnerability information is stored locally through federated learning to jointly train a vulnerability exploitability model, thereby improving the evaluation effect of individual training by a single participant while ensuring the security of vulnerability data.

[0082] According to an embodiment of the present disclosure, the gradient information is aggregated to obtain aggregated gradient information, including: utilizing a federated averaging algorithm to aggregate the gradient information to obtain aggregated gradient information.

[0083] According to an embodiment of the present disclosure, before the server sends the gradient information to the client, it is necessary to aggregate the gradient information first, and the aggregation of the gradient information preferably uses a federated average algorithm.

[0084] Among them, the federated average algorithm first updates the parameters one or more times locally (that is, performs one or more gradient descents locally), then uploads the updated parameters to the server, and then the server aggregates the parameters, and finally sends the aggregated parameters to each participant. That is, the federated learning algorithm is used to average the gradient information of each participant. Assuming that there are K clients in total, the central server first initializes the model parameters and executes several rounds. Each round selects at least 1 and at most K clients to participate in the training. Next, each selected client simultaneously trains its own model locally based on the current round (t round) model sent by the server, using its own data, and uploads it back to the server. The server aggregates the models of each client collected by weighted average according to the number of samples from each party to obtain the model for the next round.

[0085] According to the embodiment of the present disclosure, a federated averaging algorithm is used to aggregate gradient information, thereby solving the problem that other algorithms have high communication overhead and are not suitable for participants with small bandwidth, thereby improving the accuracy and generalization performance of the vulnerability exploitability assessment model.

[0086] According to an embodiment of the present disclosure, the sample label is obtained by marking the sample vulnerability information according to the sample vulnerability exploitation information.

[0087] According to the embodiments of the present disclosure, during the data collection and processing process, multiple open source data sets are collected by crawlers and other means, and after processing the collected data, vulnerability information and vulnerability exploitation information suitable for analysis are obtained. Then, the collected vulnerabilities are annotated according to the vulnerability exploitation information, providing sample labels for the subsequent vulnerability exploitability assessment model training, and then the vulnerability information is classified according to the category of the vulnerability manufacturer to obtain the vulnerability data group for federated learning.

[0088] The method of marking the new sample vulnerability information includes, but is not limited to: marking the exploited information as 1 and marking the unexploited information as 0, so as to distinguish whether the vulnerability information is exploited.

[0089] Among them, the vulnerability information comes from the vulnerability disclosure platform. Preferably, the National Vulnerability Database (NVD) of the United States is selected as the vulnerability information disclosure platform, which is a repository of vulnerability management data based on standards. The vulnerabilities in the NVD database are indexed by CVE-ID, providing a download channel for vulnerability information. For all vulnerability information, NVD combines the vulnerability information of each year in json format. Each entry includes a descriptive text summary of the vulnerability, CVSS score and related indicators, information about the affected products and vendors, vulnerability categories based on the Common Weakness Enumeration (CWE) system, and reference URLs. Among them, the Common Vulnerability Scoring System (CVSS) contains a score for the exploitability of the vulnerability, which is used to measure the probability that the vulnerability can be exploited. CVSS constructs a fixed calculation formula based on parameters such as the access complexity, authorization (Authentication) and access method of the vulnerability, and then performs a weighted calculation to score the exploitability of the vulnerability.

[0090] The vulnerability exploitation information comes from the vulnerability exploitation information platform. Preferably, Securityfocus, GreyNoise, Exploit-DB and some vulnerability exploitation webpages in Github are selected as the vulnerability exploitation information platform. These platforms contain vulnerability exploitation information, which is the basis for determining whether the vulnerability is exploited, that is, the label of the sample when performing classification prediction, the exploited label is 1, and the unexploited label is 0.

[0091] According to the embodiments of the present disclosure, by labeling sample vulnerability information, accurate and effective sample labels are provided for subsequent training of vulnerability exploitability assessment models.

[0092] Figure 5 A schematic diagram of a vulnerability exploitability assessment model construction method according to an embodiment of the present disclosure is schematically shown.

[0093] According to an embodiment of the present disclosure, based on the vulnerability information to be evaluated, vulnerability text feature information and vulnerability non-text feature information are extracted, including: when it is determined that the vulnerability information to be evaluated is vulnerability text information, using a text feature extraction algorithm to extract the vulnerability text feature information; when it is determined that the vulnerability information to be evaluated is vulnerability non-text information, encoding or normalizing the vulnerability non-text information to extract the vulnerability non-text feature information.

[0094] For example, Figure 5 As shown, in the process of building a vulnerability exploitability assessment model, vulnerability text feature information and vulnerability non-text information can be extracted separately. For vulnerability text feature information, the disclosed embodiment uses a related natural language processing algorithm to extract text features from the text description of the vulnerability; for vulnerability non-text feature information, these features are processed by encoding and normalization. After the feature processing is completed, these features are merged, and after the vulnerability exploitation information is labeled according to the features, classification and prediction are performed through machine learning. The machine learning methods used include: comparative logistic regression (LR), decision tree (XGBoost) and deep learning (DNN) algorithms. Preferably, deep learning is used for classification and prediction.

[0095] Table 1

[0096]

[0097] Table 1 shows the processing methods corresponding to various features in the construction of the vulnerability exploitability assessment model according to the embodiment of the present disclosure.

[0098] As shown in Table 1, for text feature information, when it is determined that the vulnerability information to be evaluated is vulnerability text information, a text feature extraction algorithm is used to extract vulnerability text feature information, and preferably the FastText method is used for text feature extraction processing; when it is determined that the vulnerability information to be evaluated is vulnerability non-text information, for example, text features such as access vector, access complexity, identity authentication, confidentiality impact, integrity impact, availability impact and CWE-ID are preferably processed in a one-hot encoding manner, and for digital features such as basic score, exploitability score, impact score and Product Count, this embodiment preferably processes them in a normalized manner, and preferably scales these numbers to between 0 and 1 for subsequent model training; for OVAL vectors and CPE information that are originally 0 or 1, this embodiment preferably inputs them as binary vectors.

[0099] According to the embodiments of the present disclosure, vulnerability text information is obtained by using a text extraction algorithm, and vulnerability non-text information is encoded and normalized to obtain vulnerability non-text feature information, so that the vulnerability features involved in the training of the vulnerability exploitability assessment model are richer and the obtained vulnerability exploitability assessment has a higher accuracy.

[0100] According to an embodiment of the present disclosure, the classification model includes: a comparative logistic regression algorithm model, a decision tree algorithm model and a deep learning algorithm model. This embodiment preferably adopts a deep learning algorithm model, and a supervised deep learning algorithm is preferably used in the deep learning algorithm model.

[0101] According to the embodiments of the present disclosure, a classification model is used to build a vulnerability information exploitability assessment model, so that the model training process is faster and more efficient. Preferably, a supervised deep learning algorithm is used so that vulnerability assessment can achieve more accurate results in actual scenarios.

[0102] Based on the above-mentioned vulnerability exploitability assessment method based on federated learning, the present disclosure also provides a vulnerability exploitability assessment device based on federated learning. Figure 7 The device is described in detail.

[0103] Figure 6 The structural block diagram of a vulnerability exploitability assessment device based on federated learning according to an embodiment of the present disclosure is schematically shown.

[0104] like Figure 6 As shown, the vulnerability exploitability assessment device 600 based on federated learning of this embodiment includes an acquisition module 610 , an extraction module 620 , a fusion module 630 and an assessment module 640 .

[0105] The acquisition module 610 is used to acquire vulnerability information to be evaluated, wherein the vulnerability information to be evaluated includes vulnerability text information and vulnerability non-text information. In one embodiment, the acquisition module 610 can be used to perform the operation S210 described above, which will not be repeated here.

[0106] The extraction module 620 is used to extract vulnerability text feature information and vulnerability non-text feature information based on the vulnerability information to be evaluated. In one embodiment, the extraction module 620 can be used to perform the operation S220 described above, which will not be repeated here.

[0107] The fusion module 630 is used to fuse the vulnerability text feature information and the vulnerability non-text feature information to obtain fused feature information. In one embodiment, the fusion module 630 can be used to perform the operation S230 described above, which will not be repeated here.

[0108] The evaluation module 640 is used to input the fused feature information into the vulnerability exploitability evaluation model and output an evaluation result, wherein the evaluation result is used to characterize the exploitability of the vulnerability information to be evaluated, and the vulnerability exploitability evaluation model is obtained by training the classification model based on federated learning. In one embodiment, the evaluation module 640 can be used to perform the operation S240 described above, which will not be repeated here.

[0109] According to an embodiment of the present disclosure, the federated learning adopted by the evaluation module 640 includes horizontal federated learning.

[0110] According to an embodiment of the present disclosure, any multiple modules in the acquisition module 610, the extraction module 620, the fusion module 630 and the evaluation module 640 can be combined in one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the acquisition module 610, the extraction module 620, the fusion module 630 and the evaluation module 640 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in any appropriate combination of any of them. Alternatively, at least one of the acquisition module 610, the extraction module 620, the fusion module 630 and the evaluation module 640 can be at least partially implemented as a computer program module, and when the computer program module is run, the corresponding function can be performed.

[0111] Figure 7A block diagram of an electronic device suitable for implementing a vulnerability exploitability assessment method based on federated learning according to an embodiment of the present disclosure is schematically shown.

[0112] like Figure 7 As shown, the electronic device 700 according to an embodiment of the present disclosure includes a processor 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage part 708 into a random access memory (RAM) 703. The processor 701 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 701 may also include an onboard memory for caching purposes. The processor 701 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0113] In RAM 703, various programs and data required for the operation of electronic device 700 are stored. Processor 701, ROM 702 and RAM 703 are connected to each other via bus 704. Processor 701 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 702 and / or RAM 703. It should be noted that the program can also be stored in one or more memories other than ROM 702 and RAM 703. Processor 701 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0114] According to an embodiment of the present disclosure, the electronic device 700 may further include an input / output (I / O) interface 705, which is also connected to the bus 704. The electronic device 700 may further include one or more of the following components connected to the I / O interface 705: an input portion 706 including a keyboard, a mouse, etc.; an output portion 707 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 708 including a hard disk, etc.; and a communication portion 709 including a network interface card such as a LAN card, a modem, etc. The communication portion 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 710 as needed, so that a computer program read therefrom is installed into the storage portion 708 as needed.

[0115] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0116] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 702 and / or RAM 703 described above and / or one or more memories other than ROM 702 and RAM 703.

[0117] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the method provided by the embodiment of the present disclosure.

[0118] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 701. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0119] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 709, and / or installed from the removable medium 711. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0120] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 709, and / or installed from the removable medium 711. When the computer program is executed by the processor 701, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0121] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0122] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0123] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0124] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A vulnerability exploitability assessment method based on federated learning, comprising: Acquire vulnerability information to be evaluated, wherein the vulnerability information to be evaluated includes vulnerability text information and vulnerability non-text information; Based on the vulnerability information to be evaluated, extract vulnerability text feature information and vulnerability non-text feature information; Fusing the vulnerability text feature information and the vulnerability non-text feature information to obtain fused feature information; and The fused feature information is input into a vulnerability exploitability assessment model, and an assessment result is output, wherein the assessment result is used to characterize the exploitability of the vulnerability information to be assessed, and the vulnerability exploitability assessment model is obtained by training a classification model based on federated learning.

2. The method according to claim 1, wherein: The federated learning includes horizontal federated learning; The method further comprises: The classification model is trained using the horizontal federated learning framework to obtain the vulnerability exploitability assessment model.

3. The method according to claim 2, wherein: The method of using the horizontal federated learning framework to train the classification model to obtain the vulnerability exploitability assessment model includes: Receive homomorphically encrypted gradient information from N clients, where the gradient information is obtained by the client based on sample vulnerability information, sample labels, and the classification model, and N is an integer greater than or equal to 2; Aggregating the gradient information to obtain aggregated gradient information; Sending the aggregated gradient information to the N clients, so that the N clients decrypt the aggregated gradient information and update the classification model; When it is determined that the trained classification model has iteratively converged, the vulnerability exploitability assessment model is obtained.

4. The method according to claim 3, wherein: The step of aggregating the gradient information to obtain aggregated gradient information includes: The gradient information is aggregated using a federated averaging algorithm to obtain the aggregated gradient information.

5. The method according to claim 3, wherein: The sample label is obtained by marking the sample vulnerability information according to the sample vulnerability exploitation information.

6. The method according to claim 1, wherein: The extracting vulnerability text feature information and vulnerability non-text feature information based on the vulnerability information to be evaluated includes: When it is determined that the vulnerability information to be evaluated is the vulnerability text information, extracting the vulnerability text feature information using a text feature extraction algorithm; When it is determined that the vulnerability information to be evaluated is the vulnerability non-text information, the vulnerability non-text information is encoded or normalized to extract the vulnerability non-text feature information.

7. The method according to claim 2, wherein: The classification models include: comparative logistic regression algorithm model, decision tree algorithm model and deep learning algorithm model.

8. A vulnerability exploitability assessment device based on federated learning, comprising: An acquisition module, used to acquire vulnerability information to be evaluated, wherein the vulnerability information to be evaluated includes vulnerability text information and vulnerability non-text information; An extraction module, used to extract vulnerability text feature information and vulnerability non-text feature information based on the vulnerability information to be evaluated; A fusion module, used to fuse the vulnerability text feature information and the vulnerability non-text feature information to obtain fused feature information; and An evaluation module is used to input the fused feature information into a vulnerability exploitability evaluation model and output an evaluation result, wherein the evaluation result is used to characterize the exploitability of the vulnerability information to be evaluated, and the vulnerability exploitability evaluation model is obtained by training a classification model based on federated learning.

9. An electronic device, comprising: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors are enabled to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the method according to any one of claims 1 to 7.

Images