Vulnerability prediction method and device, electronic equipment and storage medium

Abstract

This application provides a vulnerability prediction method, apparatus, electronic device, and storage medium, relating to the field of network security technology, and capable of solving the problem of low security and stability in data centers. The method includes: acquiring log data from the data center, the log data carrying event content and the event level corresponding to the event content; determining vulnerability log data based on a vulnerability database and the log data, the event level corresponding to the vulnerability event content in the vulnerability log data being the vulnerability level; inputting the vulnerability event content from the vulnerability log data into a vulnerability prediction model, outputting first predicted event content, the first predicted event content having a correlation with the vulnerability event content, the event level corresponding to the first predicted event content being the vulnerability level; and the vulnerability prediction model being trained based on the vulnerability event content and the predicted event content. This application improves the efficiency and accuracy of vulnerability detection in data centers.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and in particular to a vulnerability prediction method, apparatus, electronic device, and storage medium. Background Technology

[0002] As a core component of modern information technology, data centers carry a large amount of sensitive data and critical business operations. With the increasing size of data centers, their security issues are becoming more and more prominent.

[0003] In related technologies, vulnerability detection in data centers typically relies on static analysis and dynamic scanning. However, this approach requires a global screening of all log data in the data center to determine the existence of vulnerabilities. Furthermore, this global screening method can only detect vulnerabilities that have already appeared, and cannot predict vulnerabilities that may appear in the future, resulting in low security and stability of the data center. Summary of the Invention

[0004] This application provides a vulnerability prediction method, apparatus, electronic device, and storage medium that can solve the problem of low security and stability in data centers.

[0005] To achieve the above objectives, this application adopts the following technical solution:

[0006] Firstly, this application provides a vulnerability prediction method, which includes: acquiring log data from a data center, wherein the log data carries event content and the event level corresponding to the event content; determining vulnerability log data based on a vulnerability database and the log data, wherein the event level corresponding to the vulnerability event content of the vulnerability log data is the vulnerability level; inputting the vulnerability event content of the vulnerability log data into a vulnerability prediction model; outputting a first predicted event content, wherein the first predicted event content and the vulnerability event content are correlated, and the event level corresponding to the first predicted event content is the vulnerability level; and the vulnerability prediction model is trained based on the vulnerability event content and the predicted event content.

[0007] The vulnerability prediction method provided in this application acquires log data from a data center and performs precise filtering based on a vulnerability database. This enables timely detection of existing vulnerability events within the data center. Furthermore, based on the detected existing vulnerability events, a trained vulnerability prediction model can be used to predict potential vulnerability events in the data center, thus identifying possible future vulnerability events. Compared to traditional vulnerability detection methods, this invention can predict and identify vulnerabilities before they actually occur, significantly reducing security risks and protecting sensitive data and critical business operations in the data center from attacks and damage, thereby improving the security and stability of the data center.

[0008] In conjunction with the first aspect above, in one possible implementation, the vulnerability prediction method provided in this application embodiment may further include: obtaining historical vulnerability event content and historical predicted event content, wherein one historical predicted event content corresponds to one historical vulnerability event content; and training an initial prediction model based on the historical vulnerability event content and the historical predicted event content to obtain a vulnerability prediction model.

[0009] In conjunction with the first aspect above, in one possible implementation, the above-mentioned training of the initial prediction model based on historical vulnerability event content and historical predicted event content to obtain a vulnerability prediction model includes: dividing the historical vulnerability event content and historical predicted event content into a training set and a test set; using the training set to train the initial prediction model to obtain a trained initial prediction model; using the test set to test the trained initial prediction model to obtain adjustment parameters; and adjusting the trained initial prediction model according to the adjustment parameters to obtain a vulnerability prediction model.

[0010] In conjunction with the first aspect above, in one possible implementation, the initial prediction model is trained using a training set to obtain the trained initial prediction model, including: inputting historical vulnerability event content and historical prediction event content from the training set into the initial prediction model, outputting the correlation between historical vulnerability event content and historical prediction event content, and obtaining the trained initial prediction model after outputting the correlation between all historical vulnerability event content and all historical prediction event content from the training set.

[0011] In conjunction with the first aspect above, in one possible implementation, the above-mentioned use of a test set to test the trained initial prediction model and obtain adjustment parameters includes: inputting the content of historical vulnerability events in the test set into the trained initial prediction model to obtain the content of the second predicted event, and determining the adjustment parameters based on the content of the second predicted event and the content of historical predicted events in the test set.

[0012] In conjunction with the first aspect above, in one possible implementation, adjusting the trained initial prediction model according to the adjustment parameters to obtain the vulnerability prediction model includes: updating the learning rate of the trained initial prediction model according to the adjustment parameters when the adjustment parameters are less than the preset parameters; adjusting the trained initial prediction model based on the updated learning rate to obtain the adjusted initial prediction model; and testing the adjusted initial prediction model using a test set so that if the obtained adjustment parameters are equal to the preset parameters, the adjusted initial prediction model is determined as the vulnerability prediction model.

[0013] In conjunction with the first aspect above, in one possible implementation, the determination of vulnerability log data based on the vulnerability database and log data includes: preprocessing the log data, extracting key fields from the log data, the key fields including the event content and the event level corresponding to the event content; and determining the log data as vulnerability log data if the event level corresponding to the event content exists in the vulnerability database.

[0014] Secondly, this application provides a vulnerability prediction device, comprising: an acquisition unit for acquiring log data from a data center, the log data carrying event content and the event level corresponding to the event content; a determination unit for determining vulnerability log data based on a vulnerability database and the log data, wherein the event level corresponding to the vulnerability event content of the vulnerability log data is a vulnerability level; and a processing unit for inputting the vulnerability event content of the vulnerability log data into a vulnerability prediction model and outputting a first predicted event content, wherein the first predicted event content and the vulnerability event content are correlated, the event level corresponding to the first predicted event content is a vulnerability level, and the vulnerability prediction model is trained based on the vulnerability event content and the predicted event content.

[0015] In conjunction with the second aspect above, in one possible implementation, the acquisition unit is further configured to acquire historical vulnerability event content and historical predicted event content, with one historical predicted event content corresponding to one historical vulnerability event content; the processing unit is further configured to train the initial prediction model based on the historical vulnerability event content and the historical predicted event content to obtain a vulnerability prediction model.

[0016] In conjunction with the second aspect above, in one possible implementation, the processing unit is specifically used to: divide the historical vulnerability event content and the historical predicted event content into a training set and a test set; train the initial prediction model using the training set to obtain the trained initial prediction model; test the trained initial prediction model using the test set to obtain adjustment parameters; and adjust the trained initial prediction model according to the adjustment parameters to obtain the vulnerability prediction model.

[0017] In conjunction with the second aspect above, in one possible implementation, the processing unit is specifically used to: input the historical vulnerability event content and historical predicted event content from the training set into the initial prediction model, output the correlation between the historical vulnerability event content and the historical predicted event content, and after outputting the correlation between all historical vulnerability event content and all historical predicted event content in the training set, obtain the trained initial prediction model.

[0018] In conjunction with the second aspect above, in one possible implementation, the processing unit is specifically used to: input the content of historical vulnerability events in the test set into the trained initial prediction model to obtain the content of the second predicted event, and determine the adjustment parameters based on the content of the second predicted event and the content of historical predicted events in the test set.

[0019] In conjunction with the second aspect above, in one possible implementation, the processing unit is specifically used for: updating the learning rate of the trained initial prediction model according to the adjusted parameters when the adjusted parameters are less than the preset parameters; adjusting the trained initial prediction model based on the updated learning rate to obtain the adjusted initial prediction model; and testing the adjusted initial prediction model using a test set so that, if the obtained adjusted parameters are equal to the preset parameters, the adjusted initial prediction model is determined as the vulnerability prediction model.

[0020] In conjunction with the second aspect above, in one possible implementation, the determining unit is specifically used for: preprocessing log data, extracting key fields from the log data, the key fields including event content and the event level corresponding to the event content; and, if the event level corresponding to the event content exists in the vulnerability database, determining the log data as vulnerability log data.

[0021] Thirdly, this application provides an electronic device comprising: a processor and a communication interface; the communication interface and the processor are coupled, the processor being configured to run computer programs or instructions to implement the vulnerability prediction method as described in the first aspect and any possible implementation thereof.

[0022] Fourthly, this application provides a computer-readable storage medium storing a computer program or instructions that, when executed on an electronic device, cause the electronic device to perform the vulnerability prediction method as described in the first aspect and any possible implementation thereof.

[0023] Fifthly, this application provides a computer program product containing a computer program or instructions, which, when run on an electronic device, causes the electronic device to execute the vulnerability prediction method as described in the first aspect and any possible implementation thereof.

[0024] In a sixth aspect, this application provides a chip including a processor and a communication interface, the communication interface being coupled to the processor, the processor being used to run computer programs or instructions to implement the vulnerability prediction method as described in the first aspect and any possible implementation thereof.

[0025] Specifically, the chip provided in this application also includes a memory for storing computer programs or instructions.

[0026] It should be noted that the aforementioned computer program or instructions may be stored, in whole or in part, on a computer-readable storage medium. This computer-readable storage medium may be packaged together with the processor of the device, or it may be packaged separately from the processor of the device; this application does not impose any limitation on this.

[0027] In a seventh aspect, this application provides a vulnerability prediction system, comprising: a vulnerability prediction device and a data server, wherein the vulnerability prediction device is used to execute the vulnerability prediction method as described in the first aspect and any possible implementation thereof.

[0028] The descriptions of aspects two through seven in this application can be referenced to the detailed description of aspect one; and the beneficial effects of the descriptions of aspects two through seven can be referenced to the analysis of the beneficial effects of aspect one, which will not be repeated here.

[0029] In this application, the name of the aforementioned vulnerability prediction device does not limit the device or functional module itself. In actual implementation, these devices or functional modules may appear under other names. As long as the function of each device or functional module is similar to that of this application, it falls within the scope of the claims of this application and its equivalents.

[0030] These or other aspects of this application will become more readily apparent in the following description.

[0031] The above solution offers at least the following beneficial effects: Based on the aforementioned technical solution, the vulnerability prediction method provided in this application, by acquiring log data from the data center and performing precise filtering based on a vulnerability database, can promptly discover existing vulnerability events in the data center. Furthermore, based on the detection of existing vulnerability events, it can also predict potential vulnerability events in the data center using a trained vulnerability prediction model to obtain future possible vulnerability events. Compared to traditional vulnerability detection methods, this invention can predict and identify vulnerabilities before they actually occur, significantly reducing security risks and protecting sensitive data and critical business operations in the data center from attacks and damage, thereby improving the security and stability of the data center. Attached Figure Description

[0032] Figure 1 This is a schematic diagram of the architecture of a vulnerability prediction system provided in an embodiment of this application;

[0033] Figure 2 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of this application;

[0034] Figure 3 A flowchart illustrating a vulnerability prediction method provided in this application embodiment;

[0035] Figure 4 A flowchart illustrating the training process of a vulnerability prediction model provided in an embodiment of this application;

[0036] Figure 5 This is a schematic diagram of the structure of a vulnerability prediction device provided in an embodiment of this application. Detailed Implementation

[0037] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0038] In this article, the term "and / or" is merely a description of the relationship between related objects, indicating that there can be three kinds of relationships. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone.

[0039] The terms "first" and "second," etc., in the specification and drawings of this application are used to distinguish different objects or to distinguish different treatments of the same object, rather than to describe a specific order of objects.

[0040] Furthermore, the terms "comprising" and "having," and any variations thereof, used in the description of this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the steps or units listed, but may optionally include other steps or units not listed, or may optionally include other steps or units inherent to such process, method, product, or apparatus.

[0041] It should be noted that in the embodiments of this application, the words "exemplary" or "for example" are used to indicate that they are examples, illustrations, or descriptions. Any embodiment or design scheme described as "exemplary" or "for example" in the embodiments of this application should not be construed as being better or more advantageous than other embodiments or design schemes. Specifically, the use of the words "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0042] In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0043] As a core component of modern information technology, data centers carry a large amount of sensitive data and critical business operations. With the increasing size of data centers, their security issues are becoming more and more prominent.

[0044] In related technologies, vulnerabilities in data centers are typically detected through static analysis and dynamic scanning. Specifically, all log data in the data center is screened globally to identify existing vulnerabilities, while potential vulnerabilities that have not yet occurred cannot be identified or alerted.

[0045] Therefore, existing vulnerability detection methods still cannot solve the problem of low security and stability in data centers.

[0046] Therefore, this application provides a vulnerability prediction method applicable to scenarios involving the prediction of potential vulnerabilities in data centers. This method acquires log data from the data center and performs precise filtering based on a vulnerability database, enabling timely detection of existing vulnerability events within the data center. Furthermore, based on the detected existing vulnerability events, a trained vulnerability prediction model can be used to predict potential future vulnerability events within the data center. Compared to traditional vulnerability detection methods, this invention can predict and identify vulnerabilities before they actually occur, significantly reducing security risks and protecting sensitive data and critical business operations in the data center from attacks and damage, thereby improving the security and stability of the data center.

[0047] The embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0048] Figure 1 This is a schematic diagram of the architecture of a vulnerability prediction system provided in an embodiment of this application. Figure 1 As shown, the vulnerability prediction system 100 includes: a log collection module 110, a log preprocessing module 120, a vulnerability detection module 130, and a vulnerability prediction module 140.

[0049] The log collection module 110, log preprocessing module 120, vulnerability detection module 130, and vulnerability prediction module 140 are connected sequentially via a communication link. This communication link can be a wired communication link or a wireless communication link, and this application does not limit it in this regard.

[0050] The log collection module 110 can acquire log data from the data center, which carries event content and the event level corresponding to the event content.

[0051] The log preprocessing module 120 can preprocess the log data obtained by the log collection module 110 and extract key fields from the log data. These key fields include the event content and the event level corresponding to the event content.

[0052] The vulnerability detection module 130 can determine vulnerability log data based on the vulnerability database and log data. The event level corresponding to the vulnerability event content of the vulnerability log data is the vulnerability level.

[0053] Specifically, if the event content in the vulnerability database corresponds to an event level, the log data can be identified as vulnerability log data.

[0054] The vulnerability prediction module 140 can input the vulnerability event content of the vulnerability log data into the vulnerability prediction model and output the first predicted event content. The first predicted event content is related to the vulnerability event content, and the event level corresponding to the first predicted event content is the vulnerability level. The vulnerability prediction model is trained based on the vulnerability event content and the predicted event content.

[0055] In this way, through the collaboration of multiple modules, existing vulnerability events in the data center can be detected, and further, based on existing vulnerability events, potential vulnerability events in the data center can be predicted through vulnerability prediction models to obtain possible future vulnerability events, thereby reducing the operational risks of the data center and improving the security and stability of the data center.

[0056] When implemented in hardware, the various modules of the vulnerability prediction system 100 can be integrated into, for example... Figure 2 This is implemented in the hardware structure of the electronic device shown. Specifically, as... Figure 2 As shown, the basic hardware structure of electronic devices is introduced.

[0057] Figure 2 This is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of this application. Figure 2 As shown, the electronic device includes at least one processor 201, a communication line 202, and at least one communication interface 204, and may also include a memory 203. The processor 201, memory 203, and communication interface 204 are connected via the communication line 202.

[0058] The processor 201 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of this application, such as one or more digital signal processors (DSPs), or one or more field-programmable gate arrays (FPGAs).

[0059] Communication line 202 may include a path for transmitting information between the aforementioned components.

[0060] The communication interface 204 is used to communicate with other devices or communication networks. It can use any transceiver-like device, such as Ethernet, radio access network (RAN), wireless local area network (WLAN), etc.

[0061] The memory 203 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of including or storing desired program code having the form of instructions or data structures and accessible by a computer, but not limited thereto.

[0062] In one possible design, the memory 203 can exist independently of the processor 201, meaning the memory 203 can be an external memory of the processor 201. In this case, the memory 203 can be connected to the processor 201 via a communication line 202 to store execution instructions or application code, and its execution is controlled by the processor 201 to implement the vulnerability prediction method provided in the following embodiments of this application. In another possible design, the memory 203 can also be integrated with the processor 201, meaning the memory 203 can be an internal memory of the processor 201. For example, the memory 203 can be a cache, which can be used to temporarily store some data and instruction information.

[0063] As one possible implementation, processor 201 may include one or more CPUs, for example Figure 2 CPU0 and CPU1 in the example. As another possible implementation, the electronic device may include multiple processors, such as... Figure 2 The processors 201 and 207 are included. As another possible implementation, the electronic device may also include an output device 205 and an input device 206.

[0064] It should be noted that the various embodiments of this application can be referenced or learned from each other. For example, the same or similar steps, method embodiments, system embodiments and device embodiments can be referenced from each other without limitation.

[0065] Figure 3 This application provides a flowchart of a vulnerability prediction method, and the entity executing the method can be, for example, such as... Figure 1 The vulnerability prediction system 100 shown can also be any unit / module in the vulnerability prediction system 100, such as an integrated circuit or a chip. This application embodiment does not specifically limit this.

[0066] For example, such as Figure 3 As shown, the vulnerability prediction method provided in this application includes the following steps:

[0067] S301. Obtain log data from the data center.

[0068] In some embodiments, a data center can be an information center composed of multiple devices. For example, a data center in a communication equipment room; a data center in a power grid.

[0069] A data center primarily consists of physical machines and an operating system. During data center operation, both physical machines and the operating system generate and store log data. The physical machine's log data records various events that occur during server operation, including hardware status, system events, and application logs. The operating system's log data records the usage of hosts and virtual machines during operation, including real-time load and system logs.

[0070] In some embodiments, log data carries event content and the event level corresponding to the event content.

[0071] In one example, log data from the operation of physical machines in a data center can be collected to obtain the event content and the corresponding event level of the physical machines during operation.

[0072] In another example, log data from the operating system in the data center during operation can be collected to obtain the event content and the event level corresponding to the event content during the operation of the operating system.

[0073] The event level is used to characterize the degree of impact of the event on the normal operation of the data center. The higher the event level, the greater the impact on the normal operation of the data center.

[0074] The following are specific examples of collecting data from various physical machines or operating systems in a data center:

[0075] 1) For the first brand server, log data can be obtained through the first acquisition command (ilocli eventlog show), and then the log data can be collected to the specified data collection engine (such as LOGSTASH) through the first output command (echo "$ServerIP-$ServerSn", "output result"|nc$LOGSTASH_HOST$LOGSTASH_PORT).

[0076] 2) For servers from the second brand, log data can be obtained through the second get command (racadm getlogs), and then the log data can be collected to the specified data collection engine (such as LOGSTASH) through the second output command (echo "$ServerIP-$ServerSn", "output result"|nc$LOGSTASH_HOST$LOGSTASH_PORT).

[0077] 3) For servers that have enabled the Intelligent Platform Management Interface (IPMI) protocol, log data can be obtained through the third-party acquisition command (ipmitool sel list), and then the log data can be collected into the specified data collection engine (such as LOGSTASH) through the third-party output command (echo "$ServerIP-$ServerSn", "output result"|nc$LOGSTASH_HOST$LOGSTASH_PORT).

[0078] 4) For servers that have enabled system logs (such as the Syslog protocol), you can configure Syslog forwarding information ($LOGSTASH_HOST and $LOGSTASH_PORT) to collect log data.

[0079] 5) For the first type of operating system, log data can be obtained through the fourth acquisition command (tail -f / var / log / syslog), and then the log data can be collected to the specified data collection engine (such as LOGSTASH) through the fourth output command (echo "output result"|nc $LOGSTASH_HOST$LOGSTASH_PORT).

[0080] 6) For the second type of operating system, log data can be obtained through the fifth command (tail -f / var / log / messages), and then the log data can be collected to the specified data collection engine (such as LOGSTASH) through the fifth command (echo "output result"|nc$LOGSTASH_HOST$LOGSTASH_PORT).

[0081] 7) For the third type of system, log data can be obtained through the sixth command (Get-EventLog-LogName System and Get-EventLog-LogName Application in PowerShell), and then the log data can be collected to the specified data collection engine (such as LOGSTASH) through the sixth output command (echo "output result"|nc$LOGSTASH_HOST$LOGSTASH_PORT).

[0082] 8) For services running in the operating system, you can obtain them using the seventh command (tail -f / var / log / ). <service-name>The log data is obtained by using the .log command, and then collected into the specified data collection engine (such as LOGSTASH) by the seventh output command (echo "output result"|nc$LOGSTASH_HOST$LOGSTASH_PORT).

[0083] Example 1: The received log data could be: 192.168.1.100-server1[02 / Oct / 2023:11:00:00+0000]"Source:PERC H730""Severity:Critical""Event ID:33333""Description:Physical disk 0:0:0 has failed."

[0084] S302. Based on the vulnerability database and log data, determine the vulnerability log data.

[0085] Optionally, the log data can be preprocessed to extract key fields from the log data.

[0086] The key fields include the event content and the event level corresponding to the event content.

[0087] In some embodiments, after the acquired log data is collected to a specified location, a filtering plugin can be used to parse the log data to obtain the event content and the event level corresponding to the event content in the log data.

[0088] For example, consider a data collection engine (such as LOGSTASH) where the log data is stored. Unstructured log data can be parsed and converted into structured data (such as fields) using a filtering plugin (Grok) within the data collection engine (such as LOGSTASH). The configuration code for the filtering plugin (Grok) is as follows:

[0089]

[0090] Example 2, combined with Example 1, can parse the log data in Example 1 to obtain multiple fields as shown in Table 1. Table 1 only shows the corresponding fields extracted from the parsed log data in Example 1. In actual scenarios, there may be more or fewer fields corresponding to the log data, which are not listed here.

[0091] Table 1

[0092] IP address (client IP) 192.168.1.100 Event Name (hostname) Server1 Event time (timestamp) Date: **** / * / *Time**:**:** Source of the event PERC H730 Severity serious Event ID 33333 Event description Physical disk 0:0:0 failed

[0093] In some embodiments, after obtaining the fields shown in Table 1, the event content and the event level corresponding to the event content can be extracted from them.

[0094] Alternatively, if the vulnerability database contains an event level corresponding to the event content, the log data can be identified as vulnerability log data.

[0095] The vulnerability database stores vulnerability events at various vulnerability levels. For example, vulnerability levels can be categorized into four levels: critical, urgent, major, and error.

[0096] In some embodiments, the vulnerability data can be filtered from multiple vulnerability levels stored in the vulnerability database based on the event level corresponding to the event content carried by the acquired log data. Once the event level corresponding to the event content carried by the log data is stored in the vulnerability database, the log data is identified as vulnerability log data.

[0097] For example, referring to Table 1, if the event level extracted from the log data is severe, then since the vulnerability database includes severe vulnerability levels, the log data can be identified as vulnerability log data. Similarly, the event content carried by the log data is also identified as vulnerability event content.

[0098] S303. Input the vulnerability event content from the vulnerability log data into the vulnerability prediction model and output the first predicted event content.

[0099] Among them, the content of the first predicted event is related to the content of the vulnerability event, and the event level corresponding to the content of the first predicted event is the vulnerability level.

[0100] In this embodiment of the application, the correlation between the first predicted event content and the vulnerability event content means that the existence of the vulnerability event content may lead to the further occurrence of the first predicted event content.

[0101] For example, as shown in Table 2, the correlation between vulnerability event content and predicted event content is illustrated. Table 2 only shows a portion of the correlation between vulnerability event content and predicted event content. In actual use, there may be more or fewer correlations between vulnerability event content and predicted event content, which will not be listed here.

[0102] Table 2

[0103]

[0104] For example, the vulnerability event content of disk failure can be input into the vulnerability prediction model, and the vulnerability prediction model will output the first predicted event content of file read / write error.

[0105] Optionally, the vulnerability prediction model is trained based on the vulnerability event content and the predicted event content.

[0106] In the vulnerability prediction method provided in this application, by acquiring log data from the data center and performing precise filtering based on a vulnerability database, existing vulnerability events in the data center can be discovered in a timely manner. Furthermore, based on the detection of existing vulnerability events, a trained vulnerability prediction model can be used to predict potential vulnerability events in the data center, thereby obtaining possible future vulnerability events. Compared to traditional vulnerability detection methods, this invention can predict and identify vulnerabilities before they actually occur, significantly reducing security risks and protecting sensitive data and critical business operations in the data center from attacks and damage, thereby improving the security and stability of the data center.

[0107] The following provides a detailed explanation of the construction and detection of the vulnerability database mentioned above.

[0108] In this embodiment of the application, the event levels of the event content included in the log data can be divided into the following nine types:

[0109] Ⅰ. Critical: Indicates the most serious error, which may cause the system to crash or malfunction.

[0110] II. Emergency: Indicates that the system is unavailable and immediate action is required.

[0111] III. Major: Indicates a serious error that may affect the performance or functionality of the system, but the system can still continue to run.

[0112] IV. Error: Indicates an error situation, but usually does not cause the system to crash.

[0113] V. Minor: Indicates minor errors that usually do not immediately affect system operation, but require attention and handling.

[0114] VI. Warning: Indicates a situation that requires attention, but usually does not lead to immediate problems.

[0115] VII. Notice: Indicates important information, but is a lower level than a warning.

[0116] VIII. Information: Represents normal system operation information, used to record system status or operations.

[0117] IX. Debug or Trace: Indicates detailed information used for debugging purposes.

[0118] For example, critical, emergency, major, and error can be defined as vulnerability levels to build a vulnerability database.

[0119] The following provides an exemplary description of the process of "determining vulnerability log data based on vulnerability database and log data" in S302 above, from both hardware (such as physical machine) and software (such as operating system) perspectives.

[0120] In one alternative implementation, the hardware-level log data may include: lifecycle logs, system event logs, temperature and environmental logs, Baseboard Management Controller (BMC) event logs, and security logs.

[0121] Lifecycle Log: The lifecycle log records all hardware changes and maintenance activities of the physical machine from the time it leaves the factory to the present, including firmware updates, hardware replacements, etc.

[0122] The log data for hardware replacement is as follows:

[0123] 192.168.1.100-00X12345678Date / Time:2023-10-01 10:30:00Source:Lifecycle Controller Severity:Informational Event ID:22222Description:Harddrive 0 replaced with new drive serial number 123456789.

[0124] System event log: The system event log records various events related to the server hardware, including hardware failures.

[0125] The hardware failure log data is as follows:

[0126] 192.168.1.100-00X12345678Date / Time:2023-10-02 14:30:00Source:SystemBoard Severity:Critical Event ID:12345Description:Disk 0in RAID 0has failed.

[0127] Temperature and environmental logs: Temperature and environmental logs record temperature events for various components.

[0128] The log data for the abnormal motherboard temperature is as follows:

[0129] 192.168.1.100-00X12345678Date / Time:2023-10-02 14:00:00Source:Temperature Sensor Severity:Warning Event ID:66666Description:server1sensors,MB Temp:+75.0℃(high=+70.0℃,crit=+75.0℃).

[0130] BMC Event Log: BMC events record the operation logs on the BMC.

[0131] The operation log data is as follows:

[0132] 192.168.1.100-00X12345678Date / Time:2023-10-02 17:00:00Source:BMCSeverity:Warning Event ID:22222Description:Configuration change:Networksettings updated.

[0133] Security Logs: Security logs record security-related activities, including login attempts, permission changes, security alerts, etc.

[0134] The login attempt log data is as follows:

[0135] 192.168.1.100-00X12345678Date / Time:2023-10-02 23:00:00Source:BMCSeverity:Warning Event ID:88888Description:Failed login attempt from192.168.1.200.User:admin,Reason:Authentication failed.

[0136] For example, by combining the above-mentioned hardware-level log data, three types of vulnerability events can be identified: hardware failure, login failure, and abnormal temperature.

[0137] Keywords related to hardware failures may include: Disk, DIMM, Power supply, Hard drive, Physical disk, RAID, Fan, Network.

[0138] Keywords that indicate a login failure can include: Failed login.

[0139] Keywords for temperature anomalies may include: CPU temperature, GPU temperature, MB Temp, Memory module temperature, Disk temperature, Power supply temperature, systemtemperature, Ambient temperature, RAID controller temperature, Cooler Temp, Chassis temperature, Battery temperature, Switch temperature, Storage devicetemperature.

[0140] As a further example, the following configuration can be added to the filtering module (e.g., filter) of a data collection engine (e.g., LOGSTASH) to identify corresponding vulnerability log data from the vulnerability database. The configuration is as follows:

[0141]

[0142]

[0143] In another alternative implementation, the software-level log data may include: authentication failure logs, system error logs, and system resource logs.

[0144] Authentication failure log: The authentication failure log records various login failures.

[0145] The login failure log data is as follows:

[0146] 192.168.1.100-server1[02 / Oct / 2023:11:00:00+0000]"Source:server1""Severity:Error""Event ID:33333""Description:sudo:pam_unix(sudo:auth):authentication failure;logname=USER=root.".

[0147] 192.168.1.100-server1[02 / Oct / 2023:11:00:00+0000]"Source:server1""Severity:Error""Event ID:33333""Description:Permission denied,pleasetryagain.".

[0148] System Error Log: The system error log records errors that occur during system operation.

[0149] The system error log data is as follows:

[0150] 192.168.1.100-server1[02 / Oct / 2023:11:00:00+0000]"Source:server1""Severity:Error""Event ID:33333""Description:kernel:[123.456789]segfault at0000000000000000 ip 0000000000400000 sp 00007fffffffe000 error4 in myservice[400000+1000].".

[0151] System resource logs: System resource logs record system load logs, such as various logs indicating that CPU, memory, or disk space is about to run out.

[0152] The log data for CPU exhaustion is as follows:

[0153] 192.168.1.100-server1[02 / Oct / 2023:11:00:00+0000]Source:SystemSeverity:Warning Event ID:12345 Description:CPU usage is above 95%formore than 5 minutes.

[0154] 192.168.1.100-server1[02 / Oct / 2023:11:00:00+0000]Source:ApplicationSeverity:Error Event ID:67890 Description:Process'app-server'isexperiencing high CPU usage.PID:12345,CPU Usage:98%.

[0155] 192.168.1.100-server1[02 / Oct / 2023:11:00:00+0000]Source:SystemSeverity:Warning Event ID:66666Description:CPU usage is above 90% for more than 3minutes.

[0156] The log data for memory exhaustion is as follows:

[0157] 192.168.1.100-server1[02 / Oct / 2023:11:00:00+0000]Source:SystemSeverity:Critical Event ID:22222Description:Memory usage is above 95%formore than 5minutes.

[0158] 192.168.1.100-server1[02 / Oct / 2023:11:00:00+0000]Source:KernelSeverity:Critical Event ID:33333Description:Out of memory:Kill process12345(app-server)score 980or sacrifice child.

[0159] 192.168.1.100-server1[02 / Oct / 2023:11:00:00+0000]Source:SystemSeverity:Critical Event ID:77777Description:Memory usage is above 95%formore than 5minutes.

[0160] The log data indicating that disk space is exhausted is as follows:

[0161] 192.168.1.100-server1[02 / Oct / 2023:11:00:00+0000]Source:SystemSeverity:Critical Event ID:44444Description:Disk space on / is below 5%.

[0162] 192.168.1.100-server1[02 / Oct / 2023:11:00:00+0000]Source:ApplicationSeverity:Error Event ID:55555Description:Failed to write log filed due to insufficient disk space.

[0163] 192.168.1.100-server1[02 / Oct / 2023:11:00:00+0000]Source:SystemSeverity:Critical Event ID:88888Description:Disk space on / var / log isbelow5%.

[0164] For example, by combining the above software-level log data, three types of vulnerability events can be identified: authentication failure, system error, and system resource shortage.

[0165] Keywords that indicate authentication failure may include: Failed password, authentication failure, and Permission denied.

[0166] Key words for system errors can include: kernel, segfault.

[0167] Keywords indicating system resource shortages include: CPU usage, memory usage, and disk space.

[0168] As a further example, the following configuration can be added to the filtering module (such as filter) of the data collection engine (such as LOGSTASH) to identify the corresponding vulnerability log data from the vulnerability database.

[0169] The configuration is as follows:

[0170]

[0171]

[0172] As described in S303 above, optionally, the vulnerability prediction model is trained based on the vulnerability event content and the predicted event content. The following section combines... Figure 4 The training process of the vulnerability prediction model is described in detail.

[0173] For example, such as Figure 4 As shown, the training process of a vulnerability prediction model may include the following steps:

[0174] S401. Obtain historical vulnerability event content and historical predicted event content.

[0175] One historical predicted event corresponds to one historical vulnerability event.

[0176] In some embodiments, historical vulnerability event content refers to vulnerability events that have already occurred, while historical predicted event content refers to vulnerability events that are related to those vulnerability events. In other words, historical predicted vulnerability event content refers to potential vulnerability events that may occur due to the historical vulnerability event content.

[0177] Furthermore, the initial prediction model can be trained based on the content of historical vulnerability events and the content of historical predicted events to obtain a vulnerability prediction model. Specifically, this includes the following steps S402 to S405:

[0178] S402. Divide the historical vulnerability event content and the historical predicted event content into training set and test set.

[0179] In some embodiments, in conjunction with Table 2, feature transformation can be performed on the vulnerability event content and the predicted event content to obtain the feature values ​​corresponding to the vulnerability event content and the target variables corresponding to the predicted event content. As shown in Table 3, some feature values ​​and some target variables are displayed. In actual scenarios, more or fewer feature values ​​and target variables may be included.

[0180] Table 3

[0181]

[0182] Among them, for fan failure, abnormal heat sink temperature and duration: the target variable is different for different heat sink temperatures, and the target variable is also different for different durations.

[0183] Furthermore, the feature values ​​and target variables can be divided into training and test sets according to a specific ratio.

[0184] For example, the feature values ​​and the target variable can be split into training and validation sets in an 8:2 ratio.

[0185] S403. The initial prediction model is trained using the training set to obtain the trained initial prediction model.

[0186] Optionally, the initial parameters of the training model can be configured according to the dimension of the feature values ​​to obtain an initial prediction model.

[0187] For example, referring to Table 3, since the feature values ​​include both numerical and time dimensions, the maximum learning depth of the training model can be set to 2.

[0188] Furthermore, since the learning rate of the training model can represent the update magnitude of the model after each iteration, the initial learning rate of the training model can be set to 0.1.

[0189] In some embodiments, the historical vulnerability event content and historical predicted event content in the training set can be input into the initial prediction model first, and the correlation between the historical vulnerability event content and the historical predicted event content can be output. Then, after outputting the correlation between all historical vulnerability event content and all historical predicted event content in the training set, the trained initial prediction model is obtained.

[0190] For example, each set of training data (historical vulnerability event content and historical predicted event content) in the training set can be sequentially input into the initial prediction model to learn the correlation between the historical vulnerability event content and the historical predicted event content. Once all training data has been trained, the initial prediction model is considered to have been trained.

[0191] S404. Test the trained initial prediction model using a test set to obtain the adjustment parameters.

[0192] Optionally, the content of historical vulnerability events in the test set can be input into the trained initial prediction model to obtain the content of the second predicted event, and then the adjustment parameters can be determined based on the content of the second predicted event and the content of historical predicted events in the test set.

[0193] In some embodiments, the content of each historical vulnerability event in the test set can be sequentially input into the trained initial prediction model to obtain the second predicted event content output by the current initial prediction model. Then, the second predicted event content output by each model is compared with the corresponding historical predicted event content in the test set to determine the precision and recall of each initial prediction model. Finally, the adjustment parameters are calculated based on the precision and recall.

[0194] Precision refers to the proportion of instances that the model predicts as positive, but which are actually positive; recall refers to the proportion of instances that the model correctly predicts as positive, but which are actually positive. The adjustment parameter can be the harmonic mean of precision and recall (such as the F1 score).

[0195] For example, the F1 score can be calculated using the following formula (a). Formula (a) is as follows:

[0196] F1 = 2 * (Precision * Recall) / (Precision + Recall) (Formula 1)

[0197] Where precision = true positives / (true positives + false positives); recall = true positives / (true positives + false negatives).

[0198] It should be noted that true positives represent the number of instances that the model correctly predicts as positive, false positives represent the number of instances that the model incorrectly predicts as positive, and false negatives represent the number of instances that the model incorrectly predicts as negative.

[0199] Thus, because the harmonic mean assigns greater weight to smaller values, in the calculation of the F1 score, if one indicator is low, even if the other indicator is high, the F1 score will still be low, thereby ensuring the effectiveness of the adjustment parameters.

[0200] S405. Adjust the initial prediction model after training according to the adjustment parameters to obtain the vulnerability prediction model.

[0201] Optionally, if the adjusted parameter is less than the preset parameter, the learning rate of the trained initial prediction model can be updated according to the adjusted parameter. Then, the trained initial prediction model can be adjusted based on the updated learning rate to obtain the adjusted initial prediction model. Finally, the adjusted initial prediction model can be tested using a test set. If the obtained adjusted parameter is equal to the preset parameter, the adjusted initial prediction model can be determined as the vulnerability prediction model.

[0202] In some embodiments, the default parameter is 1.

[0203] For example, the learning rate of the initial prediction model after each adjustment can be calculated using the following formula (II): Formula (II) is as follows:

[0204] Adjusted learning rate = Current learning rate - (1 - F1 score) * 0.01 (Formula 2)

[0205] Where 1 is the prediction parameter and 0.01 is the preset constant.

[0206] For example, if the F1 score calculated by formula (I) is 0.5, then the learning rate of the adjusted initial prediction model can be calculated by formula (II) as 0.095 = 0.1 - (1 - 0.5) * 0.01.

[0207] Furthermore, after each adjustment of the learning rate of the initial prediction model, the test set is used for testing until the obtained F1 score is equal to the preset parameters. Then, the initial prediction model at this time is determined as the final vulnerability prediction model.

[0208] In this way, by continuously training and iterating to adjust the accuracy of the prediction model, the accuracy of the final predicted vulnerability events can be improved, thereby enhancing the security of the data center.

[0209] This application embodiment can divide the vulnerability prediction device into functional modules or functional units according to the above method examples. For example, each function can be divided into its own functional modules or functional units, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module or functional unit. The module or unit division in this application embodiment is illustrative and represents only one logical functional division; other division methods may be used in actual implementation.

[0210] like Figure 5 The diagram shown is a structural schematic of a vulnerability prediction device 500 provided in an embodiment of this application. The vulnerability prediction device 500 includes: an acquisition unit 501, a determination unit 502, and a processing unit 503.

[0211] The system includes: an acquisition unit 501 for acquiring log data from the data center, the log data carrying event content and the event level corresponding to the event content; a determination unit 502 for determining vulnerability log data based on the vulnerability database and log data, the event level corresponding to the vulnerability event content in the vulnerability log data being the vulnerability level; and a processing unit 503 for inputting the vulnerability event content from the vulnerability log data into the vulnerability prediction model and outputting a first predicted event content, the first predicted event content being correlated with the vulnerability event content, the event level corresponding to the first predicted event content being the vulnerability level, and the vulnerability prediction model being trained based on the vulnerability event content and the predicted event content.

[0212] In one possible implementation, the acquisition unit 501 is further configured to acquire historical vulnerability event content and historical predicted event content, with one historical predicted event content corresponding to one historical vulnerability event content; the processing unit is further configured to train the initial prediction model based on the historical vulnerability event content and the historical predicted event content to obtain a vulnerability prediction model.

[0213] In one possible implementation, the processing unit 503 is specifically used to: divide the historical vulnerability event content and the historical predicted event content into a training set and a test set; train the initial prediction model using the training set to obtain the trained initial prediction model; test the trained initial prediction model using the test set to obtain adjustment parameters; and adjust the trained initial prediction model according to the adjustment parameters to obtain the vulnerability prediction model.

[0214] In one possible implementation, the processing unit 503 is specifically used to: input the historical vulnerability event content and historical predicted event content from the training set into the initial prediction model, output the correlation between the historical vulnerability event content and the historical predicted event content, and after outputting the correlation between all historical vulnerability event content and all historical predicted event content in the training set, obtain the trained initial prediction model.

[0215] In one possible implementation, the processing unit 503 is specifically used to: input the content of historical vulnerability events in the test set into the trained initial prediction model to obtain the content of the second predicted event, and determine the adjustment parameters based on the content of the second predicted event and the content of historical predicted events in the test set.

[0216] In one possible implementation, the processing unit 503 is specifically used to: update the learning rate of the trained initial prediction model according to the adjustment parameter when the adjustment parameter is less than the preset parameter; adjust the trained initial prediction model based on the updated learning rate to obtain the adjusted initial prediction model; and test the adjusted initial prediction model using a test set so that the adjusted initial prediction model is determined as the vulnerability prediction model when the obtained adjustment parameter is equal to the preset parameter.

[0217] In one possible implementation, the determining unit 502 is specifically used to: preprocess the log data, extract key fields from the log data, the key fields including event content and the event level corresponding to the event content; and if the event level corresponding to the event content exists in the vulnerability database, determine the log data as vulnerability log data.

[0218] In the vulnerability prediction device provided in this application embodiment, by acquiring log data from the data center and performing precise filtering based on a vulnerability database, existing vulnerability events in the data center can be discovered in a timely manner. Furthermore, based on the detection of existing vulnerability events, a trained vulnerability prediction model can be used to predict potential vulnerability events in the data center, thereby obtaining possible future vulnerability events. Compared to traditional vulnerability detection methods, this invention can predict and identify vulnerabilities before they actually occur, significantly reducing security risks and protecting sensitive data and critical business operations in the data center from attacks and damage, thereby improving the security and stability of the data center.

[0219] In one possible implementation, the vulnerability prediction device 500 may further include a storage unit 504. Figure 5 (shown in dashed box) The storage unit 504 stores a program or instruction. When the acquisition unit 501, the determination unit 502 and the processing unit 503 execute the program or instruction, the vulnerability prediction device 500 can execute the vulnerability prediction method described in the above method embodiment.

[0220] Through the above description of the embodiments, those skilled in the art will clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device, and unit described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0221] This application provides a computer program product containing instructions that, when run on a computer, cause the computer to execute the vulnerability prediction method in the above method embodiments.

[0222] This application also provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the vulnerability prediction method in the method flow shown in the above method embodiments.

[0223] The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: electrical connections having one or more wires; portable computer disks; hard disks; random access memory (RAM); read-only memory (ROM); erasable programmable read-only memory (EPROM); registers; hard disks; optical fibers; compact disc read-only memory (CD-ROM); optical storage devices; magnetic storage devices; or any suitable combination thereof; or any other form of computer-readable storage medium known in the art. An exemplary storage medium is coupled to a processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium may also be a component of the processor. The processor and the storage medium may reside in an application-specific integrated circuit (ASIC). In the embodiments of this application, the computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0224] Since the vulnerability prediction device, computer-readable storage medium, and computer program product in the embodiments of this application can be applied to the above method, the technical effects that can be obtained can also be referred to the above method embodiments. The embodiments of this application will not be repeated here.

[0225] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0226] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this disclosure can be achieved, and this application does not impose any restrictions here.

[0227] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

[0228] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0229] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0230] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A vulnerability prediction method, characterized in that, The method includes: Obtain log data from the data center, the log data carrying event content and the event level corresponding to the event content; Based on the vulnerability database and the log data, the vulnerability log data is determined, and the event level corresponding to the vulnerability event content of the vulnerability log data is the vulnerability level. The vulnerability event content of the vulnerability log data is input into the vulnerability prediction model, and the first predicted event content is output. The first predicted event content is correlated with the vulnerability event content. The event level corresponding to the first predicted event content is the vulnerability level. The vulnerability prediction model is trained based on the vulnerability event content and the predicted event content. Obtain historical vulnerability event content and historical predicted event content, with one historical predicted event content corresponding to one historical vulnerability event content; The historical vulnerability event content and the historical predicted event content are divided into a training set and a test set; The initial prediction model is trained using the training set to obtain the trained initial prediction model; The initial prediction model after training was tested using the test set to obtain the adjustment parameters; The initial prediction model after training is adjusted according to the adjustment parameters to obtain the vulnerability prediction model; The step of testing the trained initial prediction model using the test set to obtain adjustment parameters includes: Input the historical vulnerability event content from the test set into the trained initial prediction model to obtain the second predicted event content; The adjustment parameters are determined based on the content of the second predicted event and the historical predicted event content in the test set.

2. The method according to claim 1, characterized in that, The step of training the initial prediction model using the training set to obtain the trained initial prediction model includes: The historical vulnerability event content and the historical predicted event content in the training set are input into the initial prediction model, and the correlation between the historical vulnerability event content and the historical predicted event content is output. After outputting the correlation between all historical vulnerability events and all historical predicted events in the training set, the trained initial prediction model is obtained.

3. The method according to claim 2, characterized in that, The step of adjusting the trained initial prediction model according to the adjustment parameters to obtain the vulnerability prediction model includes: If the adjustment parameter is less than the preset parameter, the learning rate of the trained initial prediction model is updated according to the adjustment parameter. Based on the updated learning rate, the trained initial prediction model is adjusted to obtain the adjusted initial prediction model. The adjusted initial prediction model is tested using a test set, and if the adjusted parameters are equal to the preset parameters, the adjusted initial prediction model is determined as the vulnerability prediction model.

4. The method according to claim 1, characterized in that, The process of determining vulnerability log data based on the vulnerability database and the log data includes: The log data is preprocessed to extract key fields, including the event content and the event level corresponding to the event content. If the event level corresponding to the event content exists in the vulnerability database, the log data will be identified as the vulnerability log data.

5. A vulnerability prediction device, characterized in that, The device includes: The acquisition unit is used to acquire log data from the data center, wherein the log data carries event content and the event level corresponding to the event content; The determining unit is used to determine vulnerability log data based on the vulnerability database and the log data, wherein the event level corresponding to the vulnerability event content of the vulnerability log data is the vulnerability level; The processing unit is configured to input the vulnerability event content of the vulnerability log data into the vulnerability prediction model and output the first predicted event content. The first predicted event content is correlated with the vulnerability event content, and the event level corresponding to the first predicted event content is the vulnerability level. The vulnerability prediction model is trained based on the vulnerability event content and the predicted event content. The acquisition unit is also used to acquire historical vulnerability event content and historical predicted event content, with one historical predicted event content corresponding to one historical vulnerability event content. The processing unit is specifically used to divide the historical vulnerability event content and the historical predicted event content into a training set and a test set. The initial prediction model is trained using the training set to obtain the trained initial prediction model; The initial prediction model after training was tested using the test set to obtain the adjustment parameters; The initial prediction model after training is adjusted according to the adjustment parameters to obtain the vulnerability prediction model; The processing unit is also specifically used to input the historical vulnerability event content in the test set into the trained initial prediction model to obtain the second predicted event content. The adjustment parameters are determined based on the content of the second predicted event and the historical predicted event content in the test set.

6. An electronic device, characterized in that, include: A processor and a communication interface; the communication interface is coupled to the processor, the processor being used to run computer programs or instructions to implement the vulnerability prediction method as described in any one of claims 1-4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program or instructions, and when the electronic device executes the computer program or instructions, the electronic device performs the vulnerability prediction method as described in any one of claims 1-4.

8. A computer program product, characterized in that, The computer program product includes a computer program or instructions that, when executed on an electronic device, cause the electronic device to perform the vulnerability prediction method as described in any one of claims 1-4.

Images