Exclusive network vulnerability screening method and device based on vulnerability accessibility

Abstract

The invention relates to an exclusive network vulnerability screening method and device based on vulnerability accessibility. The method comprises the following steps of: obtaining an exclusive network of a user and a vulnerability data set of the exclusive network, and identifying zero-level network assets which can be accessed by the exclusive network and corresponding zero-level vulnerabilities of the zero-level network assets; on the basis of asset address data of zero-level network assets corresponding to the zero-level vulnerabilities, through a springboard vulnerability identification strategy, identifying all levels of network assets corresponding to the exclusive network and all levels of vulnerabilities corresponding to the network assets, and on the basis of all levels of network assets and all levels of vulnerabilities corresponding to the network assets, identifying all levels of network assets corresponding to the exclusive network. Generating target vulnerability sorting information of the vulnerability data set; and based on the target vulnerability sorting information, screening a preset number of target vulnerability data in the vulnerability data set, and performing vulnerability repair processing on each target vulnerability data. By adopting the method, the accuracy of screening the vulnerabilities, needing to be repaired, of the exclusive network can be improved.

Description

Technical Field

[0001] The present application relates to the field of communication graphs and exclusive network technologies, and in particular to an exclusive network vulnerability screening method and device based on vulnerability accessibility. Background Art

[0002] With the development of technology, vulnerability scanners can detect more and more software and hardware vulnerabilities. In order to ensure network security, security operation and maintenance departments are facing more and more heavy vulnerability repair tasks. The key point of vulnerability repair tasks is to identify and analyze vulnerabilities. However, with the expansion of the scale of dedicated networks and the passage of operation time, network connections often become complicated, often resulting in massive vulnerabilities. For massive vulnerabilities, it is often necessary to screen the main vulnerabilities for vulnerability risk repair in order to ensure the cost of vulnerability repair while improving the prevention and control of vulnerability security risks. Therefore, how to screen the vulnerabilities that need to be repaired is the current research focus.

[0003] The current mainstream approach is to identify vulnerabilities based on basic information such as vulnerability attack vectors (the location relationship between the attacker and the affected component, such as local, remote, etc.), attack complexity (difficulty in exploiting vulnerabilities), permission requirements (the permission level required to successfully exploit vulnerabilities), and user interaction (whether user interaction is required to successfully exploit vulnerabilities) and intelligence information such as whether there is exploit code, whether there are exploit tools, and whether real exploit attacks have been generated, combined with factors such as the importance of the assets where the vulnerabilities are located, assess vulnerability risks, and prioritize vulnerabilities, with high-priority vulnerabilities being repaired first. However, the vulnerability priority sorting method cannot avoid the problem that attackers can easily access assets with low-priority vulnerabilities through the network, successfully exploit low-priority vulnerabilities, and then expand the vulnerabilities, making the accuracy of screening vulnerabilities that need to be repaired in exclusive networks low. Summary of the invention

[0004] Based on this, it is necessary to provide a dedicated network vulnerability screening method, device, computer equipment, computer-readable storage medium and computer program product based on vulnerability accessibility to address the above technical problems.

[0005] In a first aspect, the present application provides a method for screening network vulnerabilities based on vulnerability accessibility, including:

[0006] Acquire the user's dedicated network and a vulnerability data set of the dedicated network, and based on the user's dedicated network and the vulnerability data set, identify the zero-level network assets accessible by the dedicated network and each zero-level vulnerability corresponding to each zero-level network asset;

[0007] Based on the asset address data of the zero-level network assets corresponding to each of the zero-level vulnerabilities, the network assets of each level corresponding to the dedicated network and the vulnerabilities of each level corresponding to each of the network assets of each level are identified through a springboard vulnerability identification strategy, and based on each of the network assets of each level and each of the vulnerabilities of each level corresponding to each of the network assets of each level, target vulnerability ranking information of the vulnerability data set is generated;

[0008] Based on the target vulnerability sorting information, a preset number of target vulnerability data are screened in the vulnerability data set, and vulnerability repair processing is performed on each of the target vulnerability data.

[0009] Optionally, the identifying, based on the user's dedicated network and the vulnerability data set, the level-0 network assets accessible by the dedicated network and each level-0 vulnerability corresponding to each level-0 network asset includes:

[0010] Based on the exclusive network exit of the user, query the network assets accessible to the user, and use the network assets accessible to the user as initial zero-level network assets;

[0011] Collecting asset address data of each of the initial zero-level network assets, and based on the vulnerability address data of each vulnerability in the vulnerability data set and the asset address data of each of the zero-level network assets, screening the zero-level network assets corresponding to the vulnerabilities with the same address data;

[0012] The vulnerabilities corresponding to each zero-level network asset are regarded as the zero-level vulnerabilities corresponding to each zero-level network asset.

[0013] Optionally, the asset address data of the level-0 network assets corresponding to each level-0 vulnerability, identifying each level of network assets corresponding to the dedicated network and each level of vulnerability corresponding to each level of network assets through a springboard vulnerability identification strategy, includes:

[0014] Based on the asset address data of each zero-level network asset, query the initial next-level network assets that each zero-level network asset can access, and based on the asset address data of each of the initial next-level network assets and the vulnerability address data of each vulnerability in the vulnerability data set, filter the next-level network assets corresponding to the vulnerabilities with the same address data;

[0015] The vulnerability corresponding to the next-level network asset is used as the next-level vulnerability, and the next-level network asset replaces the zero-level network asset. The step of returning to execute the asset address data based on each zero-level network asset and querying the initial next-level network assets that each zero-level network asset can access is performed until the preset number of iterations is met, thereby obtaining the network assets of each level corresponding to the exclusive network and the vulnerabilities of each level corresponding to each of the network assets of the level.

[0016] Optionally, the generating target vulnerability ranking information of the vulnerability data set based on each of the hierarchical network assets and each hierarchical vulnerability corresponding to each of the hierarchical network assets includes:

[0017] For each vulnerability, sort it in order from small to large level to obtain vulnerability sorting information, and based on the access association information between network assets of each level, identify the number of network assets associated with each level of network assets and the asset importance of each level of network assets;

[0018] Based on the number of network assets associated with the graded network assets corresponding to each vulnerability and the asset importance of each graded network asset, the vulnerability ranking information is adjusted to obtain target vulnerability ranking information of the vulnerability data set.

[0019] Optionally, the filtering a preset number of target vulnerability data in the vulnerability data set based on the target vulnerability sorting information includes:

[0020] Calculate the exploitability of each vulnerability based on the number of network assets associated with the level of network assets corresponding to each vulnerability and the asset importance of each level of network assets;

[0021] Based on the target vulnerability ranking information, a vulnerability risk weight value of each vulnerability is generated, and based on the exploitability of each vulnerability and the vulnerability risk weight value of each vulnerability, a vulnerability accessibility index value of each vulnerability is calculated;

[0022] According to the vulnerability accessibility index value of each vulnerability from large to small, a preset number of vulnerabilities are screened as target vulnerability data.

[0023] Optionally, performing vulnerability repair processing on each target vulnerability data includes:

[0024] Based on the asset address data of the hierarchical network assets corresponding to each of the target vulnerabilities, the vulnerability location information of each of the target vulnerabilities is identified, and based on the vulnerability data set, the vulnerability type of each of the target vulnerabilities is identified;

[0025] Based on the vulnerability location information of each target vulnerability and the vulnerability type of each target vulnerability, the vulnerability repair solution of the target vulnerability is queried in the vulnerability repair database, and the vulnerability repair solution is sent to the staff client; the vulnerability repair solution is used to guide the staff to perform vulnerability repair processing on the target vulnerability.

[0026] In a second aspect, the present application also provides a dedicated network vulnerability screening device based on vulnerability accessibility, comprising:

[0027] an acquisition module, configured to acquire the user's exclusive network and a vulnerability data set of the exclusive network, and identify, based on the user's exclusive network and the vulnerability data set, the zero-level network assets accessible by the exclusive network and each zero-level vulnerability corresponding to each zero-level network asset;

[0028] A generating module, for identifying the network assets of each level corresponding to the dedicated network and the vulnerabilities of each level corresponding to the network assets of each level through a springboard vulnerability identification strategy based on the asset address data of the zero-level network assets corresponding to each of the zero-level vulnerabilities, and generating target vulnerability ranking information of the vulnerability data set based on the network assets of each level and each level vulnerability corresponding to the network assets of each level;

[0029] The screening module is used to screen a preset number of target vulnerability data in the vulnerability data set based on the target vulnerability sorting information, and perform vulnerability repair processing on each of the target vulnerability data.

[0030] Optionally, the acquisition module is specifically used to:

[0031] Based on the exclusive network exit of the user, query the network assets accessible to the user, and use the network assets accessible to the user as initial zero-level network assets;

[0032] Collecting asset address data of each of the initial zero-level network assets, and based on the vulnerability address data of each vulnerability in the vulnerability data set and the asset address data of each of the zero-level network assets, screening the zero-level network assets corresponding to the vulnerabilities with the same address data;

[0033] The vulnerabilities corresponding to each zero-level network asset are regarded as the zero-level vulnerabilities corresponding to each zero-level network asset.

[0034] Optionally, the generating module is specifically used for:

[0035] Based on the asset address data of each zero-level network asset, query the initial next-level network assets that each zero-level network asset can access, and based on the asset address data of each of the initial next-level network assets and the vulnerability address data of each vulnerability in the vulnerability data set, filter the next-level network assets corresponding to the vulnerabilities with the same address data;

[0036] The vulnerability corresponding to the next-level network asset is used as the next-level vulnerability, and the next-level network asset replaces the zero-level network asset. The step of returning to execute the asset address data based on each zero-level network asset and querying the initial next-level network assets that each zero-level network asset can access is performed until the preset number of iterations is met, thereby obtaining the network assets of each level corresponding to the exclusive network and the vulnerabilities of each level corresponding to each of the network assets of the level.

[0037] Optionally, the generating module is specifically used for:

[0038] For each vulnerability, sort it in order from small to large level to obtain vulnerability sorting information, and based on the access association information between network assets of each level, identify the number of network assets associated with each level of network assets and the asset importance of each level of network assets;

[0039] Based on the number of network assets associated with the graded network assets corresponding to each vulnerability and the asset importance of each graded network asset, the vulnerability ranking information is adjusted to obtain target vulnerability ranking information of the vulnerability data set.

[0040] Optionally, the screening module is specifically used for:

[0041] Calculate the exploitability of each vulnerability based on the number of network assets associated with the level of network assets corresponding to each vulnerability and the asset importance of each level of network assets;

[0042] Based on the target vulnerability ranking information, a vulnerability risk weight value of each vulnerability is generated, and based on the exploitability of each vulnerability and the vulnerability risk weight value of each vulnerability, a vulnerability accessibility index value of each vulnerability is calculated;

[0043] According to the vulnerability accessibility index value of each vulnerability from large to small, a preset number of vulnerabilities are screened as target vulnerability data.

[0044] Optionally, the screening module is specifically used for:

[0045] Based on the asset address data of the hierarchical network assets corresponding to each of the target vulnerabilities, the vulnerability location information of each of the target vulnerabilities is identified, and based on the vulnerability data set, the vulnerability type of each of the target vulnerabilities is identified;

[0046] Based on the vulnerability location information of each target vulnerability and the vulnerability type of each target vulnerability, the vulnerability repair solution of the target vulnerability is queried in the vulnerability repair database, and the vulnerability repair solution is sent to the staff client; the vulnerability repair solution is used to guide the staff to perform vulnerability repair processing on the target vulnerability.

[0047] In a third aspect, the present application provides a computer device, wherein the computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of any one of the methods in the first aspect are implemented.

[0048] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the steps of any one of the methods in the first aspect are implemented.

[0049] In a fifth aspect, the present application provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the steps of any one of the methods in the first aspect are implemented.

[0050] The above-mentioned exclusive network vulnerability screening method and device based on vulnerability accessibility obtains the exclusive network of the user and the vulnerability data set of the exclusive network, and identifies the zero-level network assets accessible to the exclusive network and the zero-level vulnerabilities corresponding to each zero-level network asset based on the exclusive network of the user and the vulnerability data set; based on the asset address data of the zero-level network assets corresponding to each zero-level vulnerability, through the springboard vulnerability identification strategy, identifies the various levels of network assets corresponding to the exclusive network and the various levels of vulnerabilities corresponding to each level of network assets, and based on each level of network assets and each level of vulnerability corresponding to each level of network assets, generates the target vulnerability sorting information of the vulnerability data set; based on the target vulnerability sorting information, screens a preset number of target vulnerability data in the vulnerability data set, and performs vulnerability repair processing on each target vulnerability data. This solution identifies the vulnerability level of the vulnerability corresponding to each network asset by identifying the network assets accessible to the exclusive network and the access order between the network assets. Since network assets of each level can use network assets of the next level as a springboard for vulnerability attacks, the lower the level of the vulnerability, the greater the risk to the exclusive network and the higher the risk to the networks of each level accessible by the exclusive network. The target vulnerability sorting information is determined, and the generated target vulnerability sorting information is sorting information for sorting vulnerabilities based on the accessibility of the network assets of each exclusive network. The exploitability of each vulnerability can be clearly identified, thereby guiding the staff of the security operation and maintenance team to identify the vulnerability risks with the highest exploitation rate in massive vulnerability alerts and perform targeted repair work, and accurately eliminate the risk of vulnerability exploitation attacks in the shortest time, thereby comprehensively improving the accuracy of screening vulnerabilities that need to be repaired in the exclusive network. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0052] Figure 1 It is a flowchart of a dedicated network vulnerability screening method based on vulnerability accessibility in one embodiment;

[0053] Figure 2 is a structural block diagram of a dedicated network vulnerability screening device based on vulnerability accessibility in one embodiment;

[0054] Figure 3 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0056] The dedicated network vulnerability screening method based on vulnerability accessibility provided in the embodiment of the present application can be applied to the application environment of dedicated network management and control. The method can be applied to a terminal, a server, or a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. The terminal can be, but is not limited to, various personal computers, laptops, mid-size computers, etc. Among them, the terminal identifies the vulnerability level of the vulnerability corresponding to each network asset by identifying the network assets accessible to the exclusive network and the access order between the network assets. Since the network assets of each level can use the network assets of the next level as a springboard for vulnerability attacks, the lower the level of the vulnerability, the greater the risk to the exclusive network and the risk to the networks of all levels accessible by the exclusive network, thereby determining the target vulnerability sorting information, so that the generated target vulnerability sorting information is the sorting information for sorting vulnerabilities based on the accessibility of the vulnerabilities to the network assets of each exclusive network, which can clarify the exploitability of each vulnerability, thereby guiding the staff of the security operation and maintenance team to identify the vulnerability risks with the highest exploitation rate in massive vulnerability alarms and perform targeted repair work, and accurately eliminate the risk of vulnerability exploitation attacks in the shortest time, thereby comprehensively improving the accuracy of screening vulnerabilities that need to be repaired in the exclusive network.

[0057] In an exemplary embodiment, Figure 1 As shown, a dedicated network vulnerability screening method based on vulnerability reachability is provided, and the method is applied to a terminal as an example for explanation, including the following steps S101 to S103. Among them:

[0058] Step S101, obtaining the user's exclusive network and the vulnerability data set of the exclusive network, and based on the user's exclusive network and the vulnerability data set, identifying the zero-level network assets accessible to the exclusive network and the zero-level vulnerabilities corresponding to each zero-level network asset.

[0059] In this embodiment, the terminal responds to the staff's information upload operation to obtain the original asset IP address of the user's exclusive network and the vulnerability database corresponding to each vulnerability in the exclusive network, wherein the vulnerability database includes the vulnerability address data of each vulnerability and the vulnerability type. Then, the terminal uses the user's exclusive network exit (device interface connected to the Internet) as the source to query the accessible user's exclusive network asset IP set to obtain each network asset, and in each network asset, screens the network asset with the same address data as the vulnerability database as the zero-level network asset, and uses the vulnerability of the corresponding zero-level network asset as the zero-level vulnerability, wherein, when the address data of the vulnerability and the network asset are the same, it indicates that the attacker can use the zero-level vulnerability to attack the zero-level network asset corresponding to the zero-level vulnerability using the user's exclusive network as an attack springboard. The specific identification process will be described in detail later. Among them, the network asset is the asset information of each exclusive network of the user.

[0060] Step S102, based on the asset address data of the zero-level network assets corresponding to each zero-level vulnerability, through the springboard vulnerability identification strategy, identify the various levels of network assets corresponding to the exclusive network and the various levels of vulnerabilities corresponding to the various levels of network assets, and based on the various levels of network assets and each level of vulnerability corresponding to the various levels of network assets, generate the target vulnerability sorting information of the vulnerability data set.

[0061] In this embodiment, the terminal identifies the network assets of each level corresponding to the exclusive network and the vulnerabilities of each level corresponding to the network assets of each level through the springboard vulnerability identification strategy based on the asset address data of the zero-level network assets corresponding to each zero-level vulnerability. Among them, the network assets of each level are network assets that can be accessed by the network assets of the upper level of the network assets of this level. And each level of vulnerability is the level of the network assets that can be reached by the vulnerability, wherein the higher the vulnerability level, the lower the accessibility of the network assets that can be reached by the vulnerability of this level. Since the high-level network assets are network assets that are multiple network assets away from the user's exclusive network, it is relatively difficult for the attacker to attack the network assets when actually attacking. Therefore, the risk of the vulnerability is lower and the accessibility of the vulnerability is worse. Finally, the terminal generates the target vulnerability sorting information of the vulnerability data set based on the network assets of each level and each level of vulnerability corresponding to the network assets of each level. The specific generation process will be described in detail later.

[0062] Step S103 , based on the target vulnerability ranking information, a preset number of target vulnerability data are screened in the vulnerability data set, and vulnerability repair processing is performed on each target vulnerability data.

[0063] In this embodiment, the terminal selects a preset number of target vulnerability data in the vulnerability data set based on the target vulnerability sorting information, and performs vulnerability repair processing on each target vulnerability data. Before the vulnerability repair processing, it is necessary to generate a repair plan for each target vulnerability data, so as to guide the staff to repair each target vulnerability data, which effectively improves the repair efficiency of each target vulnerability data. The specific repair processing process will be described in detail later.

[0064] Based on the above scheme, by identifying the network assets that can be accessed by the exclusive network and the access order between the network assets, the vulnerability level of the vulnerability corresponding to each network asset is identified. Since the network assets of each level can use the network assets of the next level as a springboard for vulnerability attacks, the lower the level of the vulnerability, the greater the risk to the exclusive network and the risk to the networks of all levels that can be accessed by the exclusive network. The target vulnerability sorting information is determined, so that the generated target vulnerability sorting information is the sorting information for sorting vulnerabilities based on the accessibility of the network assets of each exclusive network. The exploitability of each vulnerability can be clearly identified, thereby guiding the staff of the security operation and maintenance team to identify the vulnerability risks with the highest exploitation rate in massive vulnerability alarms and perform targeted repair work, and accurately eliminate the risk of vulnerability exploitation attacks in the shortest time, thereby comprehensively improving the accuracy of screening vulnerabilities that need to be repaired in the exclusive network.

[0065] Optionally, based on the user's exclusive network and the vulnerability data set, identify the zero-level network assets that the exclusive network can access and the zero-level vulnerabilities corresponding to each zero-level network asset, including: based on the user's exclusive network exit, query the network assets that the user can access, and use the network assets that the user can access as the initial zero-level network assets; collect the asset address data of each initial zero-level network asset, and based on the vulnerability address data of each vulnerability in the vulnerability data set and the asset address data of each zero-level network asset, screen the zero-level network assets corresponding to the vulnerabilities with the same address data; use the vulnerabilities corresponding to each zero-level network asset as the zero-level vulnerabilities corresponding to each zero-level network asset.

[0066] In this embodiment, the terminal queries the network assets accessible to the user based on the user's dedicated network exit, and uses the network assets accessible to the user as initial zero-level network assets.

[0067] Then, the terminal collects the asset address data of each initial zero-level network asset, and based on the vulnerability address data of each vulnerability in the vulnerability data set and the asset address data of each zero-level network asset, screens the zero-level network assets corresponding to the vulnerability with the same address data. Finally, the terminal uses the vulnerabilities corresponding to each zero-level network asset as the zero-level vulnerabilities corresponding to each zero-level network asset. For example, (1) taking the user-exclusive network exit (device interface connected to the Internet) as the source, query the accessible user-exclusive network asset IP set, recorded as AssetExp0, AssetExp0 = {IP1, IP2, IP3, IP4...}, AssetExp0 is the directly exposed asset of the user-exclusive network. (2) Use each item of AssetExp0 to match the IP address resource of the asset where the vulnerability is located in the vulnerability data set. The matched vulnerability set is recorded as VulExp0, VulExp0 = {Vul1, Vul2, Vul3...}, VulExp0 is the directly exposed vulnerability of the user's exclusive network, and the asset IP set where the directly exposed vulnerability is located is recorded as VulAsset0, VulAsset0 = {IP1, IP2}, and VulAsset0 is a subset of AssetExp0. Among them, the existence of the directly exposed vulnerability (i.e., zero-level vulnerability) leads to the possibility that the asset where the directly exposed vulnerability is located (i.e., the user's exclusive network) is attacked by attackers. After the asset where the directly exposed vulnerability is located is attacked, it can be used as an attack springboard for the attacker to attack the non-directly exposed assets (i.e., zero-level network assets) of the user's exclusive network. This makes the risk range of the user's network assets larger and the risk impact higher.

[0068] Based on the above solution, by adapting the asset address data, the direct exposure vulnerabilities adapted by the user's zero-level network assets are queried, which improves the screening efficiency and accuracy of direct exposure vulnerabilities.

[0069] Optionally, based on the asset address data of the zero-level network assets corresponding to each zero-level vulnerability, the springboard vulnerability identification strategy is used to identify the various levels of network assets corresponding to the exclusive network and the various levels of vulnerabilities corresponding to the network assets of each level, including: based on the asset address data of each zero-level network asset, querying the initial next-level network assets that each zero-level network asset can access, and based on the asset address data of each initial next-level network asset and the vulnerability address data of each vulnerability in the vulnerability data set, screening the next-level network assets corresponding to the vulnerabilities with the same address data; using the vulnerability corresponding to the next-level network asset as the next-level vulnerability, and replacing the zero-level network asset with the next-level network asset, and returning to execute the step of querying the initial next-level network assets that each zero-level network asset can access based on the asset address data of each zero-level network asset, until the preset number of iterations is met, and obtaining the various levels of network assets corresponding to the exclusive network and the various levels of vulnerabilities corresponding to the network assets of each level.

[0070] In this embodiment, the terminal queries the initial next-level network assets that each zero-level network asset can access based on the asset address data of each zero-level network asset, and screens the next-level network assets corresponding to the vulnerabilities with the same address data based on the asset address data of each initial next-level network asset and the vulnerability address data of each vulnerability in the vulnerability data set.

[0071] Then, the terminal uses the vulnerability corresponding to the next-level network asset as the next-level vulnerability, and replaces the zero-level network asset with the next-level network asset, and returns to execute the asset address data based on each zero-level network asset, and queries the initial next-level network asset that each zero-level network asset can access. That is, the terminal iteratively executes the above steps until the preset number of iterations is met, and obtains the network assets of each level corresponding to the exclusive network, and the vulnerabilities of each level corresponding to the network assets of each level. Among them, the preset number of iterations is the number of iterations preset by the staff in the terminal. After the last iteration is completed, the terminal uses the vulnerabilities in the vulnerability database that have not been screened as level vulnerabilities as the highest level vulnerability data. Among them, the highest level vulnerability data is characterized by the lowest accessibility of the vulnerability data. The accessibility of the vulnerability decreases as the vulnerability level increases.

[0072] Specifically, for example, (3) the terminal uses each IP address in VulAsset0 as a source to query the set of user-specific network asset IPs that can be accessed, which is recorded as AssetExp1 (i.e., the next-level network assets), where AssetExp1 = {{IP5, IP6, IP7…}, {IP8, IP9, IP10…}, {IP11, IP12, IP13…}…}, and AssetExp1 is the first-level springboard exposure asset of the user-specific network.

[0073] (4) The terminal uses each item of AssetExp1 to match the IP address resource of the asset where the vulnerability is located in the vulnerability data set. The matched vulnerability set is recorded as VulExp1 (i.e., the next level vulnerability), where VulExp1 = {{Vul4, Vul5, Vul6...}{Vul7, Vul8, Vul9...}}, VulExp1 is the first-level springboard exposure vulnerability of the user's exclusive network, and the asset IP set where the first-level springboard exposure vulnerability is located is recorded as VulAsset1, VulAsset1 = {{IP5, IP6}{IP8, IP9}, {IP11, IP12}...}, and VulAsset1 is a subset of AssetExp1.

[0074] (5) The terminal uses each IP address in VulAsset1 as a source to query the set of IP addresses of the user-specific network assets that can be accessed, which is recorded as AssetExp2, where AssetExp2 = {{IP14, IP15, IP16…}, {IP17, IP18, IP19…}, {IP21, IP22, IP23…}…}, and AssetExp0 is the secondary springboard exposed asset of the user-specific network.

[0075] (6) The terminal uses each item of AssetExp2 to match the IP address resource of the asset where the vulnerability is located in the vulnerability data set. The matched vulnerability set is recorded as VulExp2, where VulExp2 = {{Vul14, Vul15, Vul16...}{Vul17, Vul18, Vul19...}}, and VulExp2 is the secondary springboard exposure vulnerability of the user's exclusive network. The asset IP set where the secondary springboard exposure vulnerability is located is recorded as VulAsset2, where VulAsset2 = {{IP14, IP15}, {IP117, IP19}, {IP21}}, and VulAsset2 is a subset of AssetExp2.

[0076] (7) The vulnerability data that has not been matched so far is classified into the level 3 and above springboard exposure vulnerability set VulExp3, VulExp3 = {Vul21, Vul22, Vul23...}.

[0077] Based on the above solution, by hierarchically screening network assets at each level and vulnerabilities at each level, the comprehensiveness and accuracy of the analysis of potential network assets that may be attacked by each vulnerability and the reachability of each vulnerability are improved.

[0078] Optionally, based on each level of network assets and each level of vulnerability corresponding to each level of network assets, target vulnerability sorting information of the vulnerability data set is generated, including: sorting each vulnerability in ascending order of level to obtain vulnerability sorting information, and based on the access association information between each level of network assets, identifying the number of network assets associated with each level of network assets and the asset importance of each level of network assets; based on the number of network assets associated with the level of network assets corresponding to each vulnerability and the asset importance of each level of network assets, adjusting the vulnerability sorting information to obtain the target vulnerability sorting information of the vulnerability data set.

[0079] In this embodiment, the terminal sorts each vulnerability in order from small to large levels to obtain vulnerability sorting information, and identifies the number of network assets associated with each level of network assets and the asset importance of each level of network assets based on the access association information between each level of network assets. The more network assets of the next level that each level of network assets can access, the more network assets that can be threatened at the same time when the network asset is used as a springboard. The larger the range of network assets that can be threatened, the greater the risk of the vulnerability. The asset importance of each level of network assets is characterized by the asset importance of the network asset. The higher the importance of the network asset, the greater the loss to the user when the vulnerability destroys the network asset.

[0080] Then, the terminal calculates the key value of the level network asset corresponding to each vulnerability based on the number of network assets associated with the level network asset corresponding to each vulnerability and the asset importance of each level network asset.

[0081] Specifically, the terminal presets a key value algorithm, which normalizes the asset importance of each level of network assets to obtain the asset key weight of each level of network assets. Then, the terminal presets the ratio of different network asset data to network coverage. Then, the terminal calculates the network coverage corresponding to the number of network assets associated with each level of network assets, and multiplies the asset key weight of each level of network assets by the network coverage corresponding to the number of network assets to obtain the key value of the level of network assets corresponding to each vulnerability. Finally, the terminal sorts the vulnerabilities in the sorting position in the vulnerability sorting information according to the key values ​​of the level of network assets corresponding to each vulnerability in order from high to low, to obtain the target vulnerability sorting information of the vulnerability data set.

[0082] Based on the above scheme, by calculating the key value of the hierarchical network asset corresponding to each vulnerability, the target vulnerability ranking information of each vulnerability data set is optimized, thereby improving the accuracy of the obtained target vulnerability ranking information.

[0083] Optionally, based on the target vulnerability sorting information, a preset number of target vulnerability data are screened in the vulnerability data set, including: calculating the exploitability of each vulnerability based on the number of network assets associated with the level of network assets corresponding to each vulnerability and the asset importance of each level of network assets; generating a vulnerability risk weight value for each vulnerability based on the target vulnerability sorting information, and calculating the vulnerability accessibility index value for each vulnerability based on the exploitability of each vulnerability and the vulnerability risk weight value of each vulnerability; and screening a preset number of vulnerabilities as target vulnerability data in order of the vulnerability accessibility index value of each vulnerability from large to small.

[0084] In this embodiment, the terminal calculates the exploitability of each vulnerability based on the number of network assets associated with the level network assets corresponding to each vulnerability and the asset importance of each level network asset. The calculation formula for the exploitability of each vulnerability is:

[0085] Li=xi*a+yi*b

[0086] In the above formula, Li is the exploitability of the vulnerability, xi is the number of network assets associated with the hierarchical network assets corresponding to the vulnerability, yi is the asset importance associated with the hierarchical network assets corresponding to the vulnerability, a is the asset number ratio parameter, b is the asset importance ratio parameter, and i is the position number corresponding to the ranking position information of each vulnerability in the target vulnerability ranking information.

[0087] Then, the terminal generates a vulnerability risk weight value for each vulnerability based on the target vulnerability ranking information. The algorithm for generating the weight value is:

[0088] Ki=(1-i) / c

[0089] In the above formula, Ki is the vulnerability risk weight value of the vulnerability, i is the ranking position number of the vulnerability in the target vulnerability ranking information, and c is the number of all vulnerabilities.

[0090] Then, the terminal multiplies the exploitability of each vulnerability by the vulnerability risk weight value of each vulnerability to obtain the vulnerability accessibility index value of each vulnerability.

[0091] Finally, the terminal selects a preset number of vulnerabilities as target vulnerability data according to the vulnerability reachability index value of each vulnerability from large to small.

[0092] Based on the above scheme, after calculating the vulnerability accessibility index value of each vulnerability, the target vulnerabilities are screened in descending order of the vulnerability accessibility index values, thereby improving the accessibility of the screened target vulnerabilities and the probability of being exploited by attackers.

[0093] Optionally, vulnerability repair processing is performed on each target vulnerability data, including: identifying the vulnerability location information of each target vulnerability based on the asset address data of the hierarchical network assets corresponding to each target vulnerability, and identifying the vulnerability type of each target vulnerability based on the vulnerability data set; based on the vulnerability location information of each target vulnerability and the vulnerability type of each target vulnerability, querying the vulnerability repair plan of the target vulnerability in the vulnerability repair database, and sending the vulnerability repair plan to the staff client; the vulnerability repair plan is used to guide the staff to perform vulnerability repair processing on the target vulnerability.

[0094] In this embodiment, the terminal identifies the vulnerability location information of each target vulnerability based on the asset address data of the hierarchical network assets corresponding to each target vulnerability, and identifies the vulnerability type of each target vulnerability based on the vulnerability data set. Then, based on the vulnerability location information of each target vulnerability and the vulnerability type of each target vulnerability, the terminal queries the vulnerability repair solution of the target vulnerability in the vulnerability repair database, and sends the vulnerability repair solution to the staff client. Among them, the vulnerability repair solution is used to guide the staff to perform vulnerability repair processing on the target vulnerability.

[0095] Based on the above scheme, the asset address data of the hierarchical network assets corresponding to each target vulnerability is used to determine the repair location of each target vulnerability. Then, based on the vulnerability type of each target vulnerability, the repair solution for the target vulnerability is queried in the database, thereby improving the efficiency of staff in repairing the target vulnerability.

[0096] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0097] Based on the same inventive concept, the embodiment of the present application also provides a dedicated network vulnerability screening device based on vulnerability accessibility for implementing the above-mentioned dedicated network vulnerability screening method based on vulnerability accessibility. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above-mentioned method, so the specific limitations in one or more embodiments of the dedicated network vulnerability screening device based on vulnerability accessibility provided below can refer to the limitations of the dedicated network vulnerability screening method based on vulnerability accessibility above, and will not be repeated here.

[0098] In an exemplary embodiment, Figure 2 As shown, a dedicated network vulnerability screening device based on vulnerability accessibility is provided, including: an acquisition module 210, a generation module 220 and a screening module 230, wherein:

[0099] An acquisition module 210 is used to acquire the user's dedicated network and a vulnerability data set of the dedicated network, and based on the user's dedicated network and the vulnerability data set, identify the zero-level network assets accessible by the dedicated network and each zero-level vulnerability corresponding to each zero-level network asset;

[0100] A generating module 220 is used to identify the network assets of each level corresponding to the dedicated network and the vulnerabilities of each level corresponding to each level network asset based on the asset address data of the zero-level network asset corresponding to each zero-level vulnerability, and generate target vulnerability ranking information of the vulnerability data set based on each level network asset and each level vulnerability corresponding to each level network asset through a springboard vulnerability identification strategy;

[0101] The screening module 230 is used to screen a preset number of target vulnerability data in the vulnerability data set based on the target vulnerability sorting information, and perform vulnerability repair processing on each of the target vulnerability data.

[0102] Optionally, the acquisition module 210 is specifically configured to:

[0103] Based on the exclusive network exit of the user, query the network assets accessible to the user, and use the network assets accessible to the user as initial zero-level network assets;

[0104] Collecting asset address data of each of the initial zero-level network assets, and based on the vulnerability address data of each vulnerability in the vulnerability data set and the asset address data of each of the zero-level network assets, screening the zero-level network assets corresponding to the vulnerabilities with the same address data;

[0105] The vulnerabilities corresponding to each zero-level network asset are regarded as the zero-level vulnerabilities corresponding to each zero-level network asset.

[0106] Optionally, the generating module 220 is specifically configured to:

[0107] Based on the asset address data of each zero-level network asset, query the initial next-level network assets that each zero-level network asset can access, and based on the asset address data of each of the initial next-level network assets and the vulnerability address data of each vulnerability in the vulnerability data set, filter the next-level network assets corresponding to the vulnerabilities with the same address data;

[0108] The vulnerability corresponding to the next-level network asset is used as the next-level vulnerability, and the next-level network asset replaces the zero-level network asset. The step of returning to execute the asset address data based on each zero-level network asset and querying the initial next-level network assets that each zero-level network asset can access is performed until the preset number of iterations is met, thereby obtaining the network assets of each level corresponding to the exclusive network and the vulnerabilities of each level corresponding to each of the network assets of the level.

[0109] Optionally, the generating module 220 is specifically configured to:

[0110] For each vulnerability, sort it in order from small to large level to obtain vulnerability sorting information, and based on the access association information between network assets of each level, identify the number of network assets associated with each level of network assets and the asset importance of each level of network assets;

[0111] Based on the number of network assets associated with the graded network assets corresponding to each vulnerability and the asset importance of each graded network asset, the vulnerability ranking information is adjusted to obtain target vulnerability ranking information of the vulnerability data set.

[0112] Optionally, the screening module 230 is specifically used for:

[0113] Calculate the exploitability of each vulnerability based on the number of network assets associated with the level of network assets corresponding to each vulnerability and the asset importance of each level of network assets;

[0114] Based on the target vulnerability ranking information, a vulnerability risk weight value of each vulnerability is generated, and based on the exploitability of each vulnerability and the vulnerability risk weight value of each vulnerability, a vulnerability accessibility index value of each vulnerability is calculated;

[0115] According to the vulnerability accessibility index value of each vulnerability from large to small, a preset number of vulnerabilities are screened as target vulnerability data.

[0116] Optionally, the screening module 230 is specifically used for:

[0117] Based on the asset address data of the hierarchical network assets corresponding to each of the target vulnerabilities, the vulnerability location information of each of the target vulnerabilities is identified, and based on the vulnerability data set, the vulnerability type of each of the target vulnerabilities is identified;

[0118] Based on the vulnerability location information of each target vulnerability and the vulnerability type of each target vulnerability, the vulnerability repair solution of the target vulnerability is queried in the vulnerability repair database, and the vulnerability repair solution is sent to the staff client; the vulnerability repair solution is used to guide the staff to perform vulnerability repair processing on the target vulnerability.

[0119] Each module in the above-mentioned dedicated network vulnerability screening device based on vulnerability accessibility can be implemented in whole or in part by software, hardware and their combination. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0120] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 3 As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a dedicated network vulnerability screening method based on vulnerability accessibility is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0121] Those skilled in the art will understand that Figure 3 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0122] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, steps of a dedicated network vulnerability screening method based on vulnerability reachability are implemented.

[0123] In one embodiment, a computer-readable storage medium is provided on which a computer program is stored. When the computer program is executed by a processor, the steps of the exclusive network vulnerability screening method based on vulnerability accessibility are as follows:

[0124] In one embodiment, a computer program product is provided, including a computer program, which, when executed by a processor, performs the steps of a dedicated network vulnerability screening method based on vulnerability reachability.

[0125] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0126] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0127] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0128] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A dedicated network vulnerability screening method based on vulnerability accessibility, characterized in that: The method comprises: Acquire the user's dedicated network and a vulnerability data set of the dedicated network, and based on the user's dedicated network and the vulnerability data set, identify the zero-level network assets accessible by the dedicated network and each zero-level vulnerability corresponding to each zero-level network asset; Based on the asset address data of the zero-level network assets corresponding to each of the zero-level vulnerabilities, the network assets of each level corresponding to the dedicated network and the vulnerabilities of each level corresponding to each of the network assets of each level are identified through a springboard vulnerability identification strategy, and based on each of the network assets of each level and each of the vulnerabilities of each level corresponding to each of the network assets of each level, target vulnerability ranking information of the vulnerability data set is generated; Based on the target vulnerability sorting information, a preset number of target vulnerability data are screened in the vulnerability data set, and vulnerability repair processing is performed on each of the target vulnerability data.

2. The method according to claim 1, characterized in that The identifying, based on the user's dedicated network and the vulnerability data set, the zero-level network assets accessible by the dedicated network and each zero-level vulnerability corresponding to each zero-level network asset includes: Based on the exclusive network exit of the user, query the network assets accessible to the user, and use the network assets accessible to the user as initial zero-level network assets; Collecting asset address data of each of the initial zero-level network assets, and based on the vulnerability address data of each vulnerability in the vulnerability data set and the asset address data of each of the zero-level network assets, screening the zero-level network assets corresponding to the vulnerabilities with the same address data; The vulnerabilities corresponding to each zero-level network asset are regarded as the zero-level vulnerabilities corresponding to each zero-level network asset.

3. The method according to claim 2, characterized in that The asset address data of the zero-level network assets corresponding to each of the zero-level vulnerabilities is used to identify the network assets of each level corresponding to the dedicated network and the vulnerabilities of each level corresponding to each of the network assets of each level through a springboard vulnerability identification strategy, including: Based on the asset address data of each zero-level network asset, query the initial next-level network assets that each zero-level network asset can access, and based on the asset address data of each of the initial next-level network assets and the vulnerability address data of each vulnerability in the vulnerability data set, filter the next-level network assets corresponding to the vulnerabilities with the same address data; The vulnerability corresponding to the next-level network asset is used as the next-level vulnerability, and the next-level network asset replaces the zero-level network asset. The step of returning to execute the asset address data based on each zero-level network asset and querying the initial next-level network assets that each zero-level network asset can access is performed until the preset number of iterations is met, thereby obtaining the network assets of each level corresponding to the exclusive network and the vulnerabilities of each level corresponding to each of the network assets of the level.

4. The method according to claim 1, characterized in that: The generating target vulnerability ranking information of the vulnerability data set based on each of the hierarchical network assets and each hierarchical vulnerability corresponding to each of the hierarchical network assets includes: For each vulnerability, sort it in order from small to large level to obtain vulnerability sorting information, and based on the access association information between network assets of each level, identify the number of network assets associated with each level of network assets and the asset importance of each level of network assets; Based on the number of network assets associated with the graded network assets corresponding to each vulnerability and the asset importance of each graded network asset, the vulnerability ranking information is adjusted to obtain target vulnerability ranking information of the vulnerability data set.

5. The method according to claim 4, characterized in that The step of screening a preset number of target vulnerability data in the vulnerability data set based on the target vulnerability sorting information includes: Calculate the exploitability of each vulnerability based on the number of network assets associated with the level of network assets corresponding to each vulnerability and the asset importance of each level of network assets; Based on the target vulnerability ranking information, a vulnerability risk weight value of each vulnerability is generated, and based on the exploitability of each vulnerability and the vulnerability risk weight value of each vulnerability, a vulnerability accessibility index value of each vulnerability is calculated; According to the vulnerability accessibility index value of each vulnerability from large to small, a preset number of vulnerabilities are screened as target vulnerability data.

6. The method according to claim 4, characterized in that The performing vulnerability repair processing on each of the target vulnerability data includes: Based on the asset address data of the hierarchical network assets corresponding to each of the target vulnerabilities, the vulnerability location information of each of the target vulnerabilities is identified, and based on the vulnerability data set, the vulnerability type of each of the target vulnerabilities is identified; Based on the vulnerability location information of each target vulnerability and the vulnerability type of each target vulnerability, the vulnerability repair solution of the target vulnerability is queried in the vulnerability repair database, and the vulnerability repair solution is sent to the staff client; the vulnerability repair solution is used to guide the staff to perform vulnerability repair processing on the target vulnerability.

7. A dedicated network vulnerability screening device based on vulnerability accessibility, characterized in that: The device comprises: an acquisition module, configured to acquire the user's exclusive network and a vulnerability data set of the exclusive network, and identify, based on the user's exclusive network and the vulnerability data set, the zero-level network assets accessible by the exclusive network and each zero-level vulnerability corresponding to each zero-level network asset; A generating module, for identifying the network assets of each level corresponding to the dedicated network and the vulnerabilities of each level corresponding to the network assets of each level through a springboard vulnerability identification strategy based on the asset address data of the zero-level network assets corresponding to each of the zero-level vulnerabilities, and generating target vulnerability ranking information of the vulnerability data set based on the network assets of each level and each level vulnerability corresponding to the network assets of each level; The screening module is used to screen a preset number of target vulnerability data in the vulnerability data set based on the target vulnerability sorting information, and perform vulnerability repair processing on each of the target vulnerability data.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images