Vulnerability prediction method and device, electronic equipment and storage medium

Abstract

The invention provides a vulnerability prediction method and device, electronic equipment and a storage medium, relates to the technical field of network security, and can solve the problem that the security and stability of a data center are relatively low. The method comprises the steps that log data of a data center is obtained, the log data carries event content and event levels corresponding to the event content, vulnerability log data is determined based on a vulnerability database and the log data, and the event levels corresponding to vulnerability event content of the vulnerability log data are vulnerability levels. The vulnerability event content of the vulnerability log data is input into the vulnerability prediction model, first prediction event content is output, the first prediction event content and the vulnerability event content have an incidence relation, and the event level corresponding to the first prediction event content is the vulnerability level. The vulnerability prediction model is obtained by training based on the vulnerability event content and the prediction event content. According to the invention, the detection efficiency and detection precision of vulnerabilities of the data center are improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a vulnerability prediction method, device, electronic device and storage medium. Background Art

[0002] As a core component of modern information technology, data centers carry a large amount of sensitive data and key businesses. As data centers grow, their security issues become increasingly prominent.

[0003] In the related technology, when performing vulnerability detection on a data center, it is usually based on static analysis and dynamic scanning. This method requires a global screening of all log data in the data center to determine whether there are vulnerabilities. Moreover, this global screening method can only detect vulnerabilities that have already occurred, but cannot predict vulnerabilities that may appear in the future, resulting in low security and stability of the data center. Summary of the invention

[0004] The present application provides a vulnerability prediction method, device, electronic device and storage medium, which can solve the problem of low security and stability of data centers.

[0005] In order to achieve the above objectives, this application adopts the following technical solutions:

[0006] In a first aspect, the present application provides a vulnerability prediction method, the method comprising: obtaining log data of a data center, the log data carrying event content and an event level corresponding to the event content, determining vulnerability log data based on a vulnerability database and log data, the event level corresponding to the vulnerability event content of the vulnerability log data being the vulnerability level, inputting the vulnerability event content of the vulnerability log data into a vulnerability prediction model, outputting a first predicted event content, the first predicted event content having an association with the vulnerability event content, the event level corresponding to the first predicted event content being the vulnerability level, and the vulnerability prediction model being trained based on the vulnerability event content and the predicted event content.

[0007] The vulnerability prediction method provided in the embodiment of the present application can timely discover existing vulnerability events in the data center by acquiring the log data of the data center and accurately screening based on the vulnerability database. Further, based on the detection of existing vulnerability events, the vulnerability prediction model obtained by training can be used to predict potential vulnerability events in the data center to obtain vulnerability events that may occur in the future. Compared with traditional vulnerability detection methods, the present invention can predict and identify vulnerabilities before they actually occur, significantly reduce security risks, protect sensitive data and key businesses in the data center from attacks and damage, and thus improve the security and stability of the data center.

[0008] In combination with the above-mentioned first aspect, in a possible implementation method, the vulnerability prediction method provided by the embodiment of the present application may also include: obtaining historical vulnerability event content and historical prediction event content, one historical prediction event content corresponds to one historical vulnerability event content, and based on the historical vulnerability event content and the historical prediction event content, training the initial prediction model to obtain a vulnerability prediction model.

[0009] In combination with the first aspect above, in a possible implementation method, the above-mentioned initial prediction model is trained based on the historical vulnerability event content and the historical prediction event content to obtain the vulnerability prediction model, including: dividing the historical vulnerability event content and the historical prediction event content into a training set and a test set; using the training set to train the initial prediction model to obtain the trained initial prediction model; using the test set to test the trained initial prediction model to obtain adjustment parameters; adjusting the trained initial prediction model according to the adjustment parameters to obtain the vulnerability prediction model.

[0010] In combination with the first aspect above, in a possible implementation method, the above-mentioned use of a training set to train the initial prediction model to obtain the trained initial prediction model includes: inputting the historical vulnerability event content and the historical prediction event content in the training set into the initial prediction model, outputting the association relationship between the historical vulnerability time content and the historical prediction event content, and after outputting the association relationship between all historical vulnerability event contents and all historical prediction event contents in the training set, obtaining the trained initial prediction model.

[0011] In combination with the first aspect above, in a possible implementation method, the above-mentioned use of a test set to test the trained initial prediction model to obtain adjustment parameters includes: inputting the historical vulnerability event content in the test set into the trained initial prediction model to obtain the second prediction event content, and determining the adjustment parameters based on the second prediction event content and the historical prediction event content in the test set.

[0012] In combination with the first aspect above, in a possible implementation method, the above-mentioned adjusting the trained initial prediction model according to the adjustment parameter to obtain a vulnerability prediction model includes: when the adjustment parameter is less than the preset parameter, updating the learning rate of the trained initial prediction model according to the adjustment parameter; based on the updated learning rate, adjusting the trained initial prediction model to obtain the adjusted initial prediction model; using a test set to test the adjusted initial prediction model, so as to determine the adjusted initial prediction model as a vulnerability prediction model when the obtained adjustment parameter is equal to the preset parameter.

[0013] In combination with the first aspect above, in a possible implementation method, the above-mentioned determining vulnerability log data based on the vulnerability database and log data includes: preprocessing the log data, extracting key fields in the log data, the key fields including event content, and event level corresponding to the event content; if there is an event level corresponding to the event content in the vulnerability database, determining the log data as vulnerability log data.

[0014] In a second aspect, the present application provides a vulnerability prediction device, which includes: an acquisition unit, used to acquire log data of a data center, the log data carrying event content and an event level corresponding to the event content; a determination unit, used to determine vulnerability log data based on a vulnerability database and log data, the event level corresponding to the vulnerability event content of the vulnerability log data is the vulnerability level; a processing unit, used to input the vulnerability event content of the vulnerability log data into a vulnerability prediction model, and output a first predicted event content, the first predicted event content and the vulnerability event content have an association relationship, the event level corresponding to the first predicted event content is the vulnerability level, and the vulnerability prediction model is trained based on the vulnerability event content and the predicted event content.

[0015] In combination with the above-mentioned second aspect, in a possible implementation method, the acquisition unit is also used to obtain historical vulnerability event content and historical prediction event content, and one historical prediction event content corresponds to one historical vulnerability event content; the processing unit is also used to train the initial prediction model based on the historical vulnerability event content and the historical prediction event content to obtain a vulnerability prediction model.

[0016] In combination with the above-mentioned second aspect, in a possible implementation method, the processing unit is specifically used to: divide the historical vulnerability event content and the historical prediction event content into a training set and a test set; use the training set to train the initial prediction model to obtain the trained initial prediction model; use the test set to test the trained initial prediction model to obtain adjustment parameters; adjust the trained initial prediction model according to the adjustment parameters to obtain a vulnerability prediction model.

[0017] In combination with the above-mentioned second aspect, in a possible implementation method, the processing unit is specifically used to: input the historical vulnerability event content and the historical prediction event content in the training set into the initial prediction model, output the association relationship between the historical vulnerability time content and the historical prediction event content, and after outputting the association relationship between all historical vulnerability event contents and all historical prediction event contents in the training set, obtain the trained initial prediction model.

[0018] In combination with the above-mentioned second aspect, in a possible implementation method, the processing unit is specifically used to: input the historical vulnerability event content in the test set into the trained initial prediction model to obtain the second prediction event content, and determine the adjustment parameters based on the second prediction event content and the historical prediction event content in the test set.

[0019] In combination with the above-mentioned second aspect, in a possible implementation method, the processing unit is specifically used to: when the adjustment parameter is less than the preset parameter, update the learning rate of the trained initial prediction model according to the adjustment parameter; based on the updated learning rate, adjust the trained initial prediction model to obtain an adjusted initial prediction model; use a test set to test the adjusted initial prediction model, so as to determine the adjusted initial prediction model as a vulnerability prediction model when the obtained adjustment parameter is equal to the preset parameter.

[0020] In combination with the above-mentioned second aspect, in a possible implementation method, the determination unit is specifically used to: preprocess the log data, extract key fields in the log data, the key fields include event content, and event level corresponding to the event content; if there is an event level corresponding to the event content in the vulnerability database, the log data is determined as vulnerability log data.

[0021] In a third aspect, the present application provides an electronic device comprising: a processor and a communication interface; the communication interface and the processor are coupled, and the processor is used to run a computer program or instructions to implement the vulnerability prediction method described in the first aspect and any possible implementation method of the first aspect.

[0022] In a fourth aspect, the present application provides a computer-readable storage medium, in which a computer program or instruction is stored. When the computer program or instruction is run on an electronic device, the electronic device executes the vulnerability prediction method described in the first aspect and any possible implementation of the first aspect.

[0023] In a fifth aspect, the present application provides a computer program product comprising a computer program or instructions. When the computer program product runs on an electronic device, the electronic device executes the vulnerability prediction method as described in the first aspect and any possible implementation of the first aspect.

[0024] In a sixth aspect, the present application provides a chip, the chip comprising a processor and a communication interface, the communication interface and the processor are coupled, and the processor is used to run a computer program or instructions to implement the vulnerability prediction method described in the first aspect and any possible implementation method of the first aspect.

[0025] Specifically, the chip provided in the present application also includes a memory for storing computer programs or instructions.

[0026] It should be noted that the above-mentioned computer program or instruction may be stored in whole or in part on a computer-readable storage medium, wherein the computer-readable storage medium may be packaged together with the processor of the device, or may be packaged separately from the processor of the device, which is not limited in this application.

[0027] In a seventh aspect, the present application provides a vulnerability prediction system, comprising: a vulnerability prediction device and a data server, wherein the vulnerability prediction device is used to execute the vulnerability prediction method as described in the first aspect and any possible implementation method of the first aspect.

[0028] The descriptions of the second to seventh aspects of the present application can refer to the detailed description of the first aspect; and the beneficial effects of the descriptions of the second to seventh aspects can refer to the beneficial effect analysis of the first aspect, which will not be repeated here.

[0029] In this application, the name of the vulnerability prediction device does not limit the device or functional module itself. In actual implementation, these devices or functional modules may appear with other names. As long as the functions of each device or functional module are similar to those of this application, they fall within the scope of the claims of this application and their equivalent technologies.

[0030] These and other aspects of the present application will become more apparent from the following description.

[0031] The above scheme brings at least the following beneficial effects: Based on the above technical scheme, the vulnerability prediction method provided by the present application can timely discover the vulnerability events that already exist in the data center by acquiring the log data of the data center and accurately screening based on the vulnerability database. Further, on the basis of detecting the existing vulnerability events, the vulnerability prediction model obtained by training can be used to predict the potential vulnerability events in the data center to obtain the vulnerability events that may occur in the future. Compared with the traditional vulnerability detection method, the present invention can predict and identify the vulnerability before it actually occurs, significantly reduce security risks, protect sensitive data and key businesses in the data center from attacks and damage, thereby improving the security and stability of the data center. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 A schematic diagram of the architecture of a vulnerability prediction system provided in an embodiment of the present application;

[0033] Figure 2 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application;

[0034] Figure 3 A flowchart of a vulnerability prediction method provided in an embodiment of the present application;

[0035] Figure 4 A training flow chart of a vulnerability prediction model provided in an embodiment of the present application;

[0036] Figure 5 A schematic diagram of the structure of a vulnerability prediction device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0037] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0038] The term "and / or" in this article is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone.

[0039] The terms "first" and "second" and the like in the specification and drawings of this application are used to distinguish different objects, or to distinguish different treatments of the same object, rather than to describe a specific order of objects.

[0040] In addition, the terms "including" and "having" and any variations thereof mentioned in the description of the present application are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but may optionally include other steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or devices.

[0041] It should be noted that, in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design scheme described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or design schemes. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0042] In the description of the present application, unless otherwise specified, “plurality” means two or more.

[0043] As a core component of modern information technology, data centers carry a large amount of sensitive data and key businesses. As data centers grow, their security issues become increasingly prominent.

[0044] In the related art, vulnerabilities in the data center are usually detected through static analysis and dynamic scanning. Specifically, all log data in the data center is globally screened to determine existing vulnerabilities from all log data. However, potential vulnerabilities that have not yet occurred cannot be identified and no alarm can be issued.

[0045] Therefore, existing vulnerability detection methods still cannot solve the problem of low security and stability of data centers.

[0046] In view of this, an embodiment of the present application provides a vulnerability prediction method that can be applied to the scenario of predicting potential vulnerabilities in a data center. Among them, the method can timely discover vulnerability events that already exist in the data center by acquiring the log data of the data center and accurately screening based on the vulnerability database. Further, based on the detection of existing vulnerability events, the potential vulnerability events in the data center can be predicted through the vulnerability prediction model obtained through training to obtain vulnerability events that may occur in the future. Compared with traditional vulnerability detection methods, the present invention can predict and identify vulnerabilities before they actually occur, significantly reduce security risks, protect sensitive data and key businesses in the data center from attacks and damage, thereby improving the security and stability of the data center.

[0047] The implementation of the embodiments of the present application will be described in detail below in conjunction with the accompanying drawings.

[0048] Figure 1 This is a schematic diagram of the architecture of a vulnerability prediction system provided in an embodiment of the present application. Figure 1 As shown, the vulnerability prediction system 100 includes: a log collection module 110 , a log preprocessing module 120 , a vulnerability detection module 130 and a vulnerability prediction module 140 .

[0049] The log collection module 110, the log preprocessing module 120, the vulnerability detection module 130 and the vulnerability prediction module 140 are sequentially connected via a communication link. The communication link may be a wired communication link or a wireless communication link, which is not limited in the present application.

[0050] The log collection module 110 can obtain log data of the data center, and the log data carries event content and event levels corresponding to the event content.

[0051] The log preprocessing module 120 may preprocess the log data acquired by the log collecting module 110 and extract key fields in the log data, where the key fields include event content and event levels corresponding to the event content.

[0052] The vulnerability detection module 130 may determine the vulnerability log data based on the vulnerability database and the log data, and the event level corresponding to the vulnerability content of the vulnerability log data is the vulnerability level.

[0053] Specifically, when there is an event level corresponding to the event content in the vulnerability database, the log data may be determined as vulnerability log data.

[0054] The vulnerability prediction module 140 can input the vulnerability event content of the vulnerability log data into a vulnerability prediction model, and output a first predicted event content. The first predicted event content is associated with the vulnerability event content. The event level corresponding to the first predicted event content is the vulnerability level. The vulnerability prediction model is trained based on the vulnerability event content and the predicted event content.

[0055] In this way, through the collaboration between multiple modules, it is possible to detect existing vulnerability events in the data center, and further based on the existing vulnerability events, predict potential vulnerability events in the data center through the vulnerability prediction model to obtain vulnerability events that may occur in the future, thereby reducing the operating risk of the data center and improving the security and stability of the data center.

[0056] When implemented by hardware, the various modules in the vulnerability prediction system 100 can be integrated into Figure 2 The hardware structure of the electronic device shown is implemented. Specifically, Figure 2 As shown, the basic hardware structure of electronic equipment is introduced.

[0057] Figure 2 The hardware structure diagram of an electronic device provided in an embodiment of the present application is shown in FIG. Figure 2 As shown, the electronic device includes at least one processor 201, a communication line 202, and at least one communication interface 204, and may also include a memory 203. The processor 201, the memory 203 and the communication interface 204 may be connected via the communication line 202.

[0058] The processor 201 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application, such as one or more digital signal processors (DSP), or one or more field programmable gate arrays (FPGA).

[0059] The communication link 202 may include a pathway for transmitting information between the above-mentioned components.

[0060] The communication interface 204 is used to communicate with other devices or communication networks, and can use any transceiver-like device, such as Ethernet, radio access network (RAN), wireless local area network (WLAN), etc.

[0061] The memory 203 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, an optical disc storage (including compressed optical discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to include or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to these.

[0062] In one possible design, the memory 203 can exist independently of the processor 201, that is, the memory 203 can be a memory outside the processor 201. In this case, the memory 203 can be connected to the processor 201 through the communication line 202, and is used to store execution instructions or application code, and the execution is controlled by the processor 201 to implement the vulnerability prediction method provided in the following embodiment of the present application. In another possible design, the memory 203 can also be integrated with the processor 201, that is, the memory 203 can be the internal memory of the processor 201. For example, the memory 203 is a high-speed cache that can be used to temporarily store some data and instruction information.

[0063] As a possible implementation, the processor 201 may include one or more CPUs, for example Figure 2 As another possible implementation, the electronic device may include multiple processors, such as Figure 2 As another possible implementation, the electronic device may further include an output device 205 and an input device 206.

[0064] It should be pointed out that the various embodiments of the present application can learn from or refer to each other. For example, the same or similar steps, method embodiments, system embodiments and device embodiments can all refer to each other without limitation.

[0065] Figure 3 A flowchart of a vulnerability prediction method provided in an embodiment of the present application, the subject executing the method may be as follows Figure 1 The vulnerability prediction system 100 shown may also be each unit / module in the vulnerability prediction system 100, such as an integrated circuit or a chip, which is not specifically limited in the embodiment of the present application.

[0066] For example, Figure 3 As shown, the vulnerability prediction method provided in the embodiment of the present application includes the following steps:

[0067] S301. Obtain log data of a data center.

[0068] In some embodiments, the data center may be an information center composed of multiple devices, for example, a data center in a communication room or a data center in a power grid.

[0069] The data center mainly includes physical machines and operating systems. During the operation of the data center, both physical machines and operating systems will generate and store log data. The log data of the physical machine records various events during the operation of the server, including hardware status, system events, application logs, etc.; the log data of the operating system records the use of the host and virtual machine during operation, including real-time load, system logs, etc.

[0070] In some embodiments, the log data carries event content and an event level corresponding to the event content.

[0071] In one example, log data during the operation of a physical machine in a data center may be collected to obtain event content during the operation of the physical machine and an event level corresponding to the event content.

[0072] In another example, log data during the operation of the operating system of the data center may be collected to obtain event contents during the operation of the operating system and event levels corresponding to the event contents.

[0073] The event level is used to represent the degree of impact of the event content on the normal operation of the data center. The higher the event level, the greater the impact on the normal operation of the data center.

[0074] The following is a description of specific examples of collecting data from various physical machines or operating systems in a data center:

[0075] 1) For the first brand server, you can use the first acquisition command (ilocli eventlog show) to obtain log data, and then use the first output command (echo "$ServerIP-$ServerSn", "output result" | nc$LOGSTASH_HOST$LOGSTASH_PORT) to collect the log data to the specified data collection engine (such as LOGSTASH).

[0076] 2) For the second brand of server, you can get the log data through the second acquisition command (racadm getlogs), and then collect the log data to the specified data collection engine (such as LOGSTASH) through the second output command (echo "$ServerIP-$ServerSn", "output result" | nc$LOGSTASH_HOST$LOGSTASH_PORT).

[0077] 3) For servers that have enabled the intelligent platform management interface (IPMI) protocol, log data can be obtained through the third acquisition command (ipmitool sel list), and then the third output command (echo "$ServerIP-$ServerSn", "output result" | nc$LOGSTASH_HOST$LOGSTASH_PORT) can be used to collect the log data to a specified data collection engine (such as LOGSTASH).

[0078] 4) For servers that have system logs (such as Syslog protocol) enabled, you can configure Syslog forwarding information ($LOGSTASH_HOST and $LOGSTASH_PORT) to collect log data.

[0079] 5) For the first type of operating system, the log data can be obtained through the fourth acquisition command (tail-f / var / log / syslog), and then the log data can be collected to the specified data collection engine (such as LOGSTASH) through the fourth output command (echo "output result" | nc$LOGSTASH_HOST$LOGSTASH_PORT).

[0080] 6) For the second type of operating system, the log data can be obtained through the fifth acquisition command (tail-f / var / log / messages), and then the log data can be collected to the specified data collection engine (such as LOGSTASH) through the fifth output command (echo "output result" | nc$LOGSTASH_HOST$LOGSTASH_PORT).

[0081] 7) For the third type of system, you can obtain log data through the sixth acquisition command (Get-EventLog-LogName System and Get-EventLog-LogName Application in PowerShell), and then collect the log data to the specified data collection engine (such as LOGSTASH) through the sixth output command (echo "output result" | nc$LOGSTASH_HOST$LOGSTASH_PORT).

[0082] 8) For services running in the operating system, you can use the seventh acquisition command (tail -f / var / log / <service-name>.log) to obtain log data, and then collect the log data to the specified data collection engine (such as LOGSTASH) through the seventh output command (echo "output result" | nc$LOGSTASH_HOST$LOGSTASH_PORT).

[0083] Example 1: The received log data may be: 192.168.1.100-server1[02 / Oct / 2023:11:00:00+0000]"Source:PERC H730""Severity:Critical""Event ID:33333""Description:Physical disk 0:0:0 has failed.".

[0084] S302: Determine vulnerability log data based on the vulnerability database and the log data.

[0085] Optionally, the log data may be preprocessed first to extract key fields from the log data.

[0086] Among them, the key fields include event content and the event level corresponding to the event content.

[0087] In some embodiments, after the acquired log data is collected at a designated location, a filter plug-in may be used to parse the log data to obtain event content in the log data and event levels corresponding to the event content.

[0088] For example, the designated location for storing log data is a data collection engine (such as LOGSTASH). The unstructured log data can be parsed and converted into structured data (such as fields) through the filter plug-in (Grok) in the data collection engine (such as LOGSTASH). The configuration code of the filter plug-in (Grok) is as follows:

[0089]

[0090] Example 2, combined with Example 1, the log data in Example 1 can be parsed to obtain multiple fields as shown in Table 1. Table 1 only shows the corresponding fields extracted by parsing the log data in Example 1. In actual scenarios, more or fewer fields corresponding to the log data may be included, which are not listed one by one here.

[0091] Table 1

[0092] IP address (client ip) 192.168.1.100 Event name (hostname) Server1 Event time (timestamp) Date:**** / * / *Time**:**:** Event source PERC H730 Severity serious Event ID 33333 Event content (description) Physical disk 0:0:0 failed

[0093] In some embodiments, after obtaining the fields shown in Table 1, the event content and the event level corresponding to the event content can be extracted therefrom.

[0094] Further optionally, when there is an event level corresponding to the event content in the vulnerability database, the log data is determined as vulnerability log data.

[0095] The vulnerability database stores vulnerability event contents of various vulnerability levels. For example, vulnerability levels can be divided into four levels: severe, urgent, major, and error.

[0096] In some embodiments, the acquired log data can be screened from a variety of vulnerability levels stored in a vulnerability database based on the event level corresponding to the event content carried by the log data. After the event level corresponding to the event content carried by the log data is stored in the vulnerability database, the log data is determined to be vulnerability log data.

[0097] For example, in conjunction with Table 1, if the event level extracted from the log data is severe, since the vulnerability level in the vulnerability database includes severe, the log data can be determined as vulnerability log data. Similarly, the event content carried by the log data is also determined as vulnerability event content.

[0098] S303: Input the vulnerability event content of the vulnerability log data into the vulnerability prediction model, and output the first predicted event content.

[0099] Among them, there is a correlation between the first prediction event content and the vulnerability event content, and the event level corresponding to the first prediction event content is the vulnerability level.

[0100] In the embodiment of the present application, the association relationship between the first predicted event content and the vulnerability event content means that the presence of the vulnerability event content may lead to the further occurrence of the first predicted event content.

[0101] For example, as shown in Table 2, the association relationship between vulnerability event content and predicted event content is displayed. Table 2 only shows the association relationship between some vulnerability event content and predicted event content. In actual use, it may also include more or fewer association relationships between vulnerability event content and predicted event content, which are not listed one by one here.

[0102] Table 2

[0103]

[0104] Exemplarily, the vulnerability event content of a disk failure may be input into the vulnerability prediction model, and the vulnerability prediction model may output the first prediction event content of a file read or write error.

[0105] Optionally, the vulnerability prediction model is trained based on vulnerability event content and predicted event content.

[0106] In the vulnerability prediction method provided in the embodiment of the present application, by obtaining the log data of the data center and accurately screening based on the vulnerability database, it is possible to timely discover the vulnerability events that already exist in the data center. Further, based on the detection of the existing vulnerability events, the vulnerability prediction model obtained by training can be used to predict the potential vulnerability events in the data center to obtain the vulnerability events that may occur in the future. Compared with the traditional vulnerability detection method, the present invention can predict and identify the vulnerability before it actually occurs, significantly reduce security risks, protect sensitive data and key services in the data center from attacks and damage, and thus improve the security and stability of the data center.

[0107] The following is a detailed description of the construction and detection of the vulnerability database mentioned above.

[0108] In the embodiment of the present application, the event levels of the event content included in the log data can be divided into the following 9 types:

[0109] Ⅰ. Critical: Indicates the most serious error, which may cause the system to crash or fail to operate normally.

[0110] Ⅱ. Emergency: Indicates that the system is unavailable and immediate action is required.

[0111] III. Major: Indicates a serious error that may affect the performance or functionality of the system, but the system continues to operate.

[0112] IV. Error: Indicates an error condition, but usually does not cause the system to crash.

[0113] V. Minor: Indicates a less serious error that usually does not immediately affect system operation but requires attention and processing.

[0114] VI. Warning: Indicates a situation that requires attention but usually does not cause immediate problems.

[0115] Ⅶ. Notice: Indicates important information, but at a lower level than a warning.

[0116] VIII. Information: Indicates normal system operation information, used to record system status or operation.

[0117] IX. Debug or Trace: Indicates detailed information for debugging purposes.

[0118] Exemplarily, critical, emergency, major, and error may be defined as vulnerability levels, and a vulnerability database may be constructed.

[0119] The following is an exemplary description of the process of “determining vulnerability log data based on the vulnerability database and log data” in the above S302 from two levels: hardware (such as a physical machine) and software (such as an operating system).

[0120] In an optional implementation, the log data at the hardware level may include: life cycle log, system event log, temperature and environment log, baseboard management controller (Baseboard Management Controller, BMC) event log, and security log.

[0121] Lifecycle log: The lifecycle log records all hardware changes and maintenance activities of the physical machine from the factory to the present, including firmware updates, hardware replacements, etc.

[0122] The log data for hardware replacement is as follows:

[0123] 192.168.1.100-00X12345678Date / Time:2023-10-01 10:30:00Source:Lifecycle Controller Severity:Informational Event ID:22222Description:Harddrive 0 replaced with new drive serial number 123456789.

[0124] System event log: The system event log records various events of the server hardware, including hardware failures.

[0125] The log data of hardware failure is as follows:

[0126] 192.168.1.100-00X12345678Date / Time:2023-10-02 14:30:00Source:SystemBoard Severity:Critical Event ID:12345Description:Disk 0in RAID 0has failed.

[0127] Temperature and Environmental Log: The temperature and environmental log records temperature events for various components.

[0128] The log data of abnormal motherboard temperature is as follows:

[0129] 192.168.1.100-00X12345678Date / Time:2023-10-02 14:00:00Source:Temperature Sensor Severity:Warning Event ID:66666Description:server1sensors,MB Temp:+75.0℃(high=+70.0℃,crit=+75.0℃).

[0130] BMC event log: BMC events record the operation logs on the BMC.

[0131] The log data of the operation log is as follows:

[0132] 192.168.1.100-00X12345678Date / Time:2023-10-02 17:00:00Source:BMCSeverity:Warning Event ID:22222Description:Configuration change:Networksettings updated.

[0133] Security Log: The security log records security-related activities, including login attempts, permission changes, security alerts, etc.

[0134] The log data for the login attempt is as follows:

[0135] 192.168.1.100-00X12345678Date / Time:2023-10-02 23:00:00Source:BMCSeverity:Warning Event ID:88888Description:Failed login attempt from192.168.1.200.User:admin,Reason:Authentication failed.

[0136] Exemplarily, combining the above hardware-level log data, three types of vulnerability events can be determined: hardware failure, login failure, and temperature abnormality.

[0137] Keywords for hardware failure may include: Disk, DIMM, Power supply, Hard drive, Physicaldisk, RAID, Fan, and Network.

[0138] Keywords for failed login may include: Failed login.

[0139] Keywords for temperature anomalies may include: CPU temperature, GPU temperature, MB Temp, Memory module temperature, Disk temperature, Power supply temperature, systemtemperature, Ambient temperature, RAID controller temperature, Cooler Temp, Chassis temperature, Battery temperature, Switch temperature, Storage devicetemperature.

[0140] Further exemplary, the following configuration may be added to a filter module (such as filter) of a data collection engine (such as LOGSTASH) to identify corresponding vulnerability log data from a vulnerability database. The configuration is as follows:

[0141]

[0142]

[0143] In another optional implementation, the log data at the software level may include: authentication failure log, system error log, and system resource log.

[0144] Authentication failure log: The authentication failure log records various login failures.

[0145] The log data for failed logins is as follows:

[0146] 192.168.1.100-server1[02 / Oct / 2023:11:00:00+0000]"Source:server1""Severity:Error""Event ID:33333""Description:sudo:pam_unix(sudo:auth):authentication failure;logname=USER=root.".

[0147] 192.168.1.100-server1[02 / Oct / 2023:11:00:00+0000]"Source:server1""Severity:Error""Event ID:33333""Description:Permission denied,pleasetryagain.".

[0148] System error log: The system error log records the error log during system operation.

[0149] The error log data of the system operation is as follows:

[0150] 192.168.1.100-server1[02 / Oct / 2023:11:00:00+0000]"Source:server1""Severity:Error""Event ID:33333""Description:kernel:[123.456789]segfault at0000000000000000 ip 0000000000400000 sp 00007fffffffe000 error4 in myservice[400000+1000].".

[0151] System resource log: The system resource log records system load logs, such as various logs when the CPU, memory, or disk space is about to be exhausted.

[0152] The log data of CPU exhaustion is as follows:

[0153] 192.168.1.100-server1[02 / Oct / 2023:11:00:00+0000]Source:SystemSeverity:Warning Event ID:12345 Description:CPU usage is above 95%formore than 5 minutes.

[0154] 192.168.1.100-server1[02 / Oct / 2023:11:00:00+0000]Source:ApplicationSeverity:Error Event ID:67890 Description:Process'app-server'isexperiencing high CPU usage.PID:12345,CPU Usage:98%.

[0155] 192.168.1.100-server1[02 / Oct / 2023:11:00:00+0000]Source:SystemSeverity:Warning Event ID:66666Description:CPU usage is above 90% for morethan 3minutes.

[0156] The log data of memory exhaustion is as follows:

[0157] 192.168.1.100-server1[02 / Oct / 2023:11:00:00+0000]Source:SystemSeverity:Critical Event ID:22222Description:Memory usage is above 95%formore than 5minutes.

[0158] 192.168.1.100-server1[02 / Oct / 2023:11:00:00+0000]Source:KernelSeverity:Critical Event ID:33333Description:Out of memory:Kill process12345(app-server)score 980or sacrifice child.

[0159] 192.168.1.100-server1[02 / Oct / 2023:11:00:00+0000]Source:SystemSeverity:Critical Event ID:77777Description:Memory usage is above 95%formore than 5minutes.

[0160] The log data for disk space exhaustion is as follows:

[0161] 192.168.1.100-server1[02 / Oct / 2023:11:00:00+0000]Source:SystemSeverity:Critical Event ID:44444Description:Disk space on / is below 5%.

[0162] 192.168.1.100-server1[02 / Oct / 2023:11:00:00+0000]Source:ApplicationSeverity:Error Event ID:55555Description:Failed to write log filed due to insufficient disk space.

[0163] 192.168.1.100-server1[02 / Oct / 2023:11:00:00+0000]Source:SystemSeverity:Critical Event ID:88888Description:Disk space on / var / log isbelow5%.

[0164] Exemplarily, in combination with the log data at the software level, three types of vulnerability events can be determined: authentication failure, system error, and system resource shortage.

[0165] Keywords for authentication failure can include: Failed password, authentication failure, and Permission denied.

[0166] Keywords for system errors may include: kernel, segfault.

[0167] Keywords for system resource shortage include: CPU usage, Memory usage, Disk space.

[0168] Further illustratively, the following configuration may be added to a screening module (eg, filter) of a data collection engine (eg, LOGSTASH) to identify corresponding vulnerability log data from a vulnerability database.

[0169] The configuration is as follows:

[0170]

[0171]

[0172] As described in S303 above, optionally, the vulnerability prediction model is trained based on the vulnerability event content and the predicted event content. Figure 4 ,The training process of the vulnerability prediction model is described in detail.

[0173] For example, Figure 4 As shown, the training process of the vulnerability prediction model may include the following steps:

[0174] S401. Obtain historical vulnerability event content and historical prediction event content.

[0175] Among them, one historical prediction event content corresponds to one historical vulnerability event content.

[0176] In some embodiments, the historical vulnerability event content is a vulnerability event that has occurred, and the historical predicted event content is a vulnerability event associated with the vulnerability event. In other words, the historical predicted vulnerability event content is a vulnerability event that may occur due to the historical vulnerability event content.

[0177] Furthermore, the initial prediction model can be trained based on the historical vulnerability event content and the historical prediction event content to obtain a vulnerability prediction model. Specifically, the following steps S402 to S405 are included:

[0178] S402: Divide the historical vulnerability event content and the historical prediction event content into a training set and a test set.

[0179] In some embodiments, in combination with Table 2, feature conversion can be performed on the vulnerability event content and the predicted event content to obtain feature values ​​corresponding to the vulnerability event content and target variables corresponding to the predicted event content. As shown in Table 3, some feature values ​​and some target variables are shown, and more or fewer feature values ​​and target variables may be included in actual scenarios.

[0180] Table 3

[0181]

[0182] Among them, for fan failure, abnormal radiator temperature and duration: different radiator temperatures correspond to different target variables, and different durations correspond to different target variables.

[0183] Furthermore, the feature values ​​and target variables can be divided into training sets and test sets according to a specific ratio.

[0184] For example, the feature values ​​and the target variables can be divided into a training set and a validation set in an 8:2 manner.

[0185] S403: Using the training set to train the initial prediction model to obtain a trained initial prediction model.

[0186] Optionally, initial parameters of the training model may be configured according to the dimension of the feature value to obtain an initial prediction model.

[0187] Exemplarily, in combination with Table 3, since the dimension of the feature value includes two dimensions: numerical value and time, the maximum learning depth of the training model can be set to 2.

[0188] Furthermore, since the learning rate of the training model can represent the update amplitude of the model after each iteration, the initial learning rate of the training model can be set to 0.1.

[0189] In some embodiments, the historical vulnerability event content and historical prediction event content in the training set can be first input into the initial prediction model, and the association relationship between the historical vulnerability event content and the historical prediction event content can be output. Then, after outputting the association relationship between all historical vulnerability event content and all historical prediction event content in the training set, the trained initial prediction model is obtained.

[0190] Exemplarily, each set of training data in the training set (historical vulnerability event content and historical prediction event content) can be input into the initial prediction model in sequence to learn the correlation between historical vulnerability event content and historical prediction event content. After all training data are trained, the initial prediction model is considered to have been trained.

[0191] S404: Use the test set to test the trained initial prediction model to obtain adjustment parameters.

[0192] Optionally, the historical vulnerability event content in the test set may be first input into the trained initial prediction model to obtain the second prediction event content, and then the adjustment parameters may be determined based on the second prediction event content and the historical prediction event content in the test set.

[0193] In some embodiments, each historical vulnerability event content in the test set can be input into the trained initial prediction model in turn to obtain the second prediction event content output by the current initial prediction model, and then each output second prediction event content is compared with the corresponding historical prediction event content in the test set to determine the accuracy and recall rate of each initial prediction model, and finally the adjustment parameters are calculated based on the accuracy and recall rate.

[0194] Among them, precision refers to the proportion of instances predicted by the model as positive samples that are truly positive samples; recall refers to the proportion of all instances that are truly positive samples that are correctly predicted by the model as positive samples. The adjustment parameter can be the harmonic mean of precision and recall (such as F1 score).

[0195] For example, the F1 score can be calculated by the following formula (1):

[0196] F1 = 2*(precision*recall) / (precision+recall) Formula (I)

[0197] Among them, precision = true positive examples / (true positive examples + false positive examples); recall rate = true positive examples / (true positive examples + false negative examples).

[0198] It should be noted that true positives refer to the number of instances correctly predicted by the model as positive samples, false positives refer to the number of negative sample instances incorrectly predicted by the model as positive samples, and false negatives refer to the number of positive sample instances incorrectly predicted by the model as negative samples.

[0199] In this way, since the harmonic mean can give greater weight to smaller values, in the calculation of the F1 score, if one of the indicators is low, even if the other indicator is high, the F1 score will be low, thus ensuring the effectiveness of the adjustment parameters.

[0200] S405: Adjust the trained initial prediction model according to the adjustment parameters to obtain a vulnerability prediction model.

[0201] Optionally, when the adjustment parameter is less than the preset parameter, the learning rate of the trained initial prediction model can be updated according to the adjustment parameter, and then the trained initial prediction model is adjusted based on the updated learning rate to obtain the adjusted initial prediction model, and finally the adjusted initial prediction model is tested with the test set, so that when the obtained adjustment parameter is equal to the preset parameter, the adjusted initial prediction model is determined as the vulnerability prediction model.

[0202] In some embodiments, the preset parameter is 1.

[0203] For example, the learning rate of the initial prediction model after each adjustment can be calculated by the following formula (II). Formula (II) is as follows:

[0204] Adjusted learning rate = current learning rate - (1-F1 score) * 0.01 Formula (II)

[0205] Among them, 1 is the prediction parameter and 0.01 is the preset constant.

[0206] For example, if the F1 score calculated by formula (1) is 0.5, then the learning rate of the adjusted initial prediction model can be calculated by formula (2) to be 0.095=0.1-(1-0.5)*0.01.

[0207] Furthermore, after adjusting the learning rate of the initial prediction model each time, the test set is continued to be used for testing until the obtained F1 score is equal to the preset parameter, and the initial prediction model at this time is determined as the final vulnerability prediction model.

[0208] In this way, by continuously training and iterating to adjust the accuracy of the prediction model, the accuracy of the vulnerability events finally predicted can be improved, thereby improving the security of the data center.

[0209] The embodiment of the present application can divide the vulnerability prediction device into functional modules or functional units according to the above method example. For example, each functional module or functional unit can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules or functional units. Among them, the division of modules or units in the embodiment of the present application is schematic, which is only a logical function division. There may be other division methods in actual implementation.

[0210] like Figure 5 , which is a schematic diagram of the structure of a vulnerability prediction device 500 provided in an embodiment of the present application. The vulnerability prediction device 500 includes: an acquisition unit 501, a determination unit 502 and a processing unit 503.

[0211] Among them, the acquisition unit 501 is used to obtain the log data of the data center, and the log data carries the event content and the event level corresponding to the event content; the determination unit 502 is used to determine the vulnerability log data based on the vulnerability database and the log data, and the event level corresponding to the vulnerability event content of the vulnerability log data is the vulnerability level; the processing unit 503 is used to input the vulnerability event content of the vulnerability log data into the vulnerability prediction model, and output the first predicted event content. The first predicted event content and the vulnerability event content have an association relationship, and the event level corresponding to the first predicted event content is the vulnerability level. The vulnerability prediction model is trained based on the vulnerability event content and the predicted event content.

[0212] In a possible implementation, the acquisition unit 501 is also used to obtain historical vulnerability event content and historical prediction event content, and one historical prediction event content corresponds to one historical vulnerability event content; the processing unit is also used to train the initial prediction model based on the historical vulnerability event content and the historical prediction event content to obtain a vulnerability prediction model.

[0213] In one possible implementation, the processing unit 503 is specifically used to: divide the historical vulnerability event content and the historical prediction event content into a training set and a test set; use the training set to train the initial prediction model to obtain the trained initial prediction model; use the test set to test the trained initial prediction model to obtain adjustment parameters; adjust the trained initial prediction model according to the adjustment parameters to obtain a vulnerability prediction model.

[0214] In one possible implementation, processing unit 503 is specifically used to: input historical vulnerability event content and historical prediction event content in a training set into an initial prediction model, output the association relationship between historical vulnerability time content and historical prediction event content, and after outputting the association relationship between all historical vulnerability event content and all historical prediction event content in the training set, obtain a trained initial prediction model.

[0215] In a possible implementation, the processing unit 503 is specifically used to: input the historical vulnerability event content in the test set into the trained initial prediction model to obtain the second prediction event content, and determine the adjustment parameters according to the second prediction event content and the historical prediction event content in the test set.

[0216] In one possible implementation, the processing unit 503 is specifically used to: when the adjustment parameter is less than the preset parameter, update the learning rate of the trained initial prediction model according to the adjustment parameter; based on the updated learning rate, adjust the trained initial prediction model to obtain an adjusted initial prediction model; and use a test set to test the adjusted initial prediction model to determine the adjusted initial prediction model as a vulnerability prediction model when the obtained adjustment parameter is equal to the preset parameter.

[0217] In one possible implementation, the determination unit 502 is specifically used to: pre-process the log data, extract key fields in the log data, the key fields include event content, and event level corresponding to the event content; if there is an event level corresponding to the event content in the vulnerability database, determine the log data as vulnerability log data.

[0218] In the vulnerability prediction device provided in the embodiment of the present application, by obtaining the log data of the data center and accurately screening based on the vulnerability database, it is possible to timely discover the vulnerability events that already exist in the data center. Further, based on the detection of the existing vulnerability events, the vulnerability prediction model obtained by training can be used to predict the potential vulnerability events in the data center to obtain the vulnerability events that may occur in the future. Compared with the traditional vulnerability detection method, the present invention can predict and identify the vulnerability before it actually occurs, significantly reduce security risks, protect sensitive data and key businesses in the data center from attacks and damage, and thus improve the security and stability of the data center.

[0219] In a possible implementation, the vulnerability prediction device 500 may further include a storage unit 504 ( Figure 5 The storage unit 504 stores a program or instruction. When the acquisition unit 501, the determination unit 502 and the processing unit 503 execute the program or instruction, the vulnerability prediction device 500 can execute the vulnerability prediction method described in the above method embodiment.

[0220] Through the description of the above implementation methods, technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device and unit described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0221] An embodiment of the present application provides a computer program product comprising instructions. When the computer program product is run on a computer, the computer is enabled to execute the vulnerability prediction method in the above method embodiment.

[0222] An embodiment of the present application also provides a computer-readable storage medium, in which instructions are stored. When the instructions are executed on a computer, the computer executes the vulnerability prediction method in the method flow shown in the above method embodiment.

[0223] Among them, the computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read only memory (EPROM), a register, a hard disk, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above, or any other form of computer-readable storage medium known in the art. An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an application specific integrated circuit (ASIC). In the embodiments of the present application, a computer-readable storage medium may be any tangible medium that contains or stores a program, which may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0224] Since the vulnerability prediction device, computer-readable storage medium, and computer program product in the embodiments of the present application can be applied to the above-mentioned method, the technical effects that can be obtained can also refer to the above-mentioned method embodiments, and the embodiments of the present application will not be repeated here.

[0225] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0226] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of this disclosure can be achieved, and this application is not limited here.

[0227] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

[0228] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0229] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0230] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A vulnerability prediction method, characterized in that: The method comprises: Obtaining log data of a data center, the log data carrying event content and event levels corresponding to the event content; Determine vulnerability log data based on the vulnerability database and the log data, wherein the event level corresponding to the vulnerability event content of the vulnerability log data is the vulnerability level; The vulnerability event content of the vulnerability log data is input into a vulnerability prediction model, and a first predicted event content is output. The first predicted event content is associated with the vulnerability event content. The event level corresponding to the first predicted event content is the vulnerability level. The vulnerability prediction model is trained based on the vulnerability event content and the predicted event content.

2. The method according to claim 1, characterized in that The method further comprises Obtain historical vulnerability event content and historical prediction event content, where one historical prediction event content corresponds to one historical vulnerability event content; Based on the historical vulnerability event content and the historical prediction event content, an initial prediction model is trained to obtain the vulnerability prediction model.

3. The method according to claim 2, characterized in that The training of the initial prediction model based on the historical vulnerability event content and the historical prediction event content to obtain the vulnerability prediction model includes: Dividing the historical vulnerability event content and the historical prediction event content into a training set and a test set; Using the training set to train the initial prediction model to obtain a trained initial prediction model; Using the test set to test the trained initial prediction model to obtain adjustment parameters; The trained initial prediction model is adjusted according to the adjustment parameters to obtain the vulnerability prediction model.

4. The method according to claim 3, characterized in that: The step of training the initial prediction model using the training set to obtain the trained initial prediction model includes: Inputting the historical vulnerability event content and the historical predicted event content in the training set into the initial prediction model, and outputting the association relationship between the historical vulnerability event content and the historical predicted event content; After outputting the association relationship between all historical vulnerability event contents and all historical prediction event contents in the training set, a trained initial prediction model is obtained.

5. The method according to claim 3 or 4, characterized in that: The method of using the test set to test the trained initial prediction model to obtain adjustment parameters includes: Inputting the historical vulnerability event content in the test set into the trained initial prediction model to obtain the second prediction event content; The adjustment parameter is determined according to the second predicted event content and the historical predicted event content in the test set.

6. The method according to claim 5, characterized in that The step of adjusting the trained initial prediction model according to the adjustment parameters to obtain the vulnerability prediction model includes: When the adjustment parameter is less than the preset parameter, updating the learning rate of the trained initial prediction model according to the adjustment parameter; Based on the updated learning rate, the trained initial prediction model is adjusted to obtain an adjusted initial prediction model; The adjusted initial prediction model is tested using a test set, so that when the obtained adjustment parameters are equal to the preset parameters, the adjusted initial prediction model is determined as the vulnerability prediction model.

7. The method according to claim 1, characterized in that The determining the vulnerability log data based on the vulnerability database and the log data includes: Preprocessing the log data to extract key fields in the log data, where the key fields include the event content and the event level corresponding to the event content; In a case where an event level corresponding to the event content exists in the vulnerability database, the log data is determined as the vulnerability log data.

8. A vulnerability prediction device, characterized in that: The device comprises: An acquisition unit, used to acquire log data of a data center, wherein the log data carries event content and an event level corresponding to the event content; A determination unit, configured to determine vulnerability log data based on a vulnerability database and the log data, wherein an event level corresponding to the vulnerability event content of the vulnerability log data is a vulnerability level; A processing unit is used to input the vulnerability event content of the vulnerability log data into a vulnerability prediction model, and output a first predicted event content, wherein the first predicted event content is associated with the vulnerability event content, the event level corresponding to the first predicted event content is the vulnerability level, and the vulnerability prediction model is trained based on the vulnerability event content and the predicted event content.

9. An electronic device, characterized in that: include: A processor and a communication interface; the communication interface is coupled to the processor, and the processor is used to run a computer program or instruction to implement the vulnerability prediction method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program or instruction. When an electronic device executes the computer program or instruction, the electronic device executes the vulnerability prediction method according to any one of claims 1 to 7.

11. A computer program product, characterized in that The computer program product includes a computer program or instructions, and when the computer program or instructions are executed on an electronic device, the electronic device executes the vulnerability prediction method according to any one of claims 1 to 7.

Images