Vulnerability processing method and device, electronic equipment and storage medium

Abstract

The invention provides a vulnerability processing method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining vulnerability information containing influence information and repair information through a public information source, determining a target application with a vulnerability in combination with asset management data, and sending a vulnerability notification based on the influence information and the repair information; the vulnerability processing efficiency can be improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a vulnerability processing method, device, electronic device and storage medium. Background Art

[0002] With the rapid development of Internet technology, various application systems and network platforms are becoming increasingly popular, bringing great convenience to people's lives and work. However, while these system platforms bring convenience, they also face increasingly severe security challenges. Vulnerabilities are one of the major threats to system security. Their existence may lead to serious consequences such as data leakage, service interruption, and malware invasion. Therefore, how to timely discover and repair system vulnerabilities to ensure the security and stability of the system has become an important issue in the current information security field.

[0003] Traditional vulnerability handling methods often rely on manual investigation and manual repair, which is not only inefficient, but also prone to missing important vulnerabilities, leaving hidden dangers to system security. In addition, as the complexity and diversity of application systems continue to increase, the types and number of vulnerabilities are also growing rapidly, and traditional vulnerability handling methods can no longer meet current security needs. Summary of the invention

[0004] In view of this, embodiments of the present application provide a vulnerability processing method, device, electronic device and storage medium, which can improve vulnerability processing efficiency.

[0005] The technical solution of the embodiment of the present application is implemented as follows:

[0006] In a first aspect, an embodiment of the present application provides a vulnerability processing method, the method comprising:

[0007] Obtain vulnerability intelligence information through public intelligence sources; wherein the vulnerability intelligence information includes impact information and repair information, the impact information represents the application affected by the vulnerability, and the repair information represents the repair solution for the vulnerability;

[0008] Acquire full asset application information based on the asset management data, and determine target applications having vulnerabilities in the full asset application information based on the vulnerability intelligence information;

[0009] Send vulnerability notification information to the target application; wherein the vulnerability notification information is determined based on the impact information and the repair information.

[0010] In a second aspect, an embodiment of the present application further provides a vulnerability processing device, the device comprising:

[0011] An acquisition module, used to acquire vulnerability intelligence information through public intelligence sources; wherein the vulnerability intelligence information includes impact information and repair information, the impact information represents the application affected by the vulnerability, and the repair information represents the repair solution for the vulnerability;

[0012] A determination module, configured to obtain full asset application information based on the asset management data, and determine a target application having a vulnerability in the full asset application information based on the vulnerability intelligence information;

[0013] A notification module is used to send vulnerability notification information to the target application; wherein the vulnerability notification information is determined based on the impact information and the repair information.

[0014] In a third aspect, an embodiment of the present application further provides an electronic device, comprising: a processor, a storage medium and a bus, wherein the storage medium stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the storage medium through the bus, and the processor executes the machine-readable instructions to execute the vulnerability handling method described in any one of the first aspects.

[0015] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the vulnerability handling method described in any one of the first aspects is executed.

[0016] The embodiments of the present application have the following beneficial effects:

[0017] By obtaining vulnerability intelligence information from public intelligence sources, we can quickly grasp the latest vulnerability dynamics, including vulnerability impact information and repair information, ensure that we can understand and respond to potential security threats in a timely manner, and avoid security risks caused by information lags. By analyzing the impact information, we can accurately determine which applications are affected by the vulnerability, thereby avoiding misoperation of irrelevant applications and improving the efficiency of vulnerability handling. Based on asset management data, we can automatically traverse all applications of the organization and quickly locate target applications with vulnerabilities based on vulnerability intelligence information, significantly reducing the time and cost of manual troubleshooting and improving the timeliness of vulnerability handling. Vulnerability notification information is sent to the target application, which not only contains detailed information about the vulnerability, but also provides targeted repair solutions. This precise notification method enables the management object to quickly understand the severity of the vulnerability and the repair method, so as to take effective countermeasures and reduce the risk of vulnerability exploitation. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 is a flowchart of steps S101-S103 provided in an embodiment of the present application;

[0020] Figure 2 It is a flowchart of steps S201-S202 provided in an embodiment of the present application;

[0021] Figure 3 It is a flowchart of steps S301-S303 provided in an embodiment of the present application;

[0022] Figure 4 It is a flowchart of steps S401-S403 provided in an embodiment of the present application;

[0023] Figure 5 It is a flowchart of steps S501-S502 provided in an embodiment of the present application;

[0024] Figure 6 It is a flowchart of steps S601-S603 provided in an embodiment of the present application;

[0025] Figure 7 It is a structural diagram of a vulnerability processing device provided in an embodiment of the present application;

[0026] Figure 8 It is a schematic diagram of the composition structure of the electronic device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0027] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of explanation and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in this application shows the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowchart can be implemented out of order, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart under the guidance of the content of the present application, or remove one or more operations from the flowchart.

[0028] In the following description, reference is made to “some embodiments”, which describe a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0029] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0030] In the following description, the terms "first\second\third" involved are merely used to distinguish similar objects and do not represent a specific ordering of the objects. It can be understood that "first\second\third" can be interchanged with a specific order or sequence where permitted, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0031] It should be noted that the term "comprising" will be used in the embodiments of the present application to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.

[0032] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0033] See also Figure 1 , Figure 1 is a flow chart of steps S101-S103 of the vulnerability handling method provided in the embodiment of the present application, which will be combined with Figure 1 Steps S101-S103 are shown for explanation.

[0034] In step S101, vulnerability intelligence information is obtained through public intelligence sources; wherein the vulnerability intelligence information includes impact information and repair information, the impact information represents the application affected by the vulnerability, and the repair information represents the repair solution for the vulnerability.

[0035] In step S102, all asset application information is obtained based on the asset management data, and target applications having vulnerabilities in the all asset application information are determined based on the vulnerability intelligence information.

[0036] In step S103, vulnerability notification information is sent to the target application; wherein the vulnerability notification information is determined based on the impact information and the repair information.

[0037] The embodiment of the present application aims to efficiently identify, locate and notify applications with security vulnerabilities through a series of steps so that they can be repaired in a timely manner, thereby improving the security of the overall system. The specific steps include obtaining vulnerability intelligence information from public intelligence sources, determining target applications affected by the vulnerability based on asset management data, and sending vulnerability notification information to these target applications.

[0038] First, collect intelligence information about specific vulnerabilities using public intelligence sources, such as security bulletins, vulnerability databases, and professional security forums. Intelligence information should include two parts:

[0039] Impact information: Clarify the application type, version, operating system, etc. affected by the vulnerability to quickly locate potentially affected systems.

[0040] Repair information: Provides repair solutions for the vulnerability, such as patches, upgrade guides, configuration adjustment suggestions, etc.

[0041] Next, you need to obtain all asset application information within the organization, which usually includes application name, version, deployment location, responsible person, etc. Compare the collected vulnerability intelligence information with the asset management data to identify target applications with vulnerabilities.

[0042] Finally, based on the impact information and repair information, generate vulnerability notification information for the target application. The notification should clearly state the nature of the vulnerability, potential impact, repair steps and deadline, etc. According to the communication habits of the person or team responsible for the target application, choose an appropriate notification method, such as email, SMS, instant messaging, internal announcement system, etc. After sending the notification, you can also establish a tracking mechanism to ensure that the person responsible understands and takes the necessary repair measures. This can be achieved by requiring a reply confirmation, setting a repair deadline and subsequent inspections.

[0043] In some embodiments, see Figure 2 , Figure 2 It is a flow chart of steps S201-S202 provided in an embodiment of the present application. The public intelligence source includes multiple sub-intelligence sources. The acquisition of vulnerability intelligence information through the public intelligence source can be achieved through steps S201-S202, which will be explained in combination with each step.

[0044] In step S201, the plurality of sub-intelligence sources are prioritized; wherein the priorities of the plurality of sub-intelligence sources are determined based on the intelligence quality.

[0045] In step S202, vulnerability intelligence is acquired from the plurality of sub-intelligence sources in sequence based on the priority sorting, and a union of the acquired vulnerability intelligence is taken to obtain the vulnerability intelligence information.

[0046] Here, the intelligence quality of each sub-intelligence source needs to be evaluated. This includes considering factors such as the accuracy, timeliness, completeness, and whether the intelligence has been verified. Based on the evaluation results of the intelligence quality, a priority is assigned to each sub-intelligence source. Sub-intelligence sources with high priorities should be given priority when obtaining vulnerability intelligence.

[0047] According to the determined priority order, vulnerability intelligence is obtained from each sub-intelligence source in turn. This means that it starts with the sub-intelligence source with the highest priority and then gradually expands to the sub-intelligence sources with lower priorities. During the acquisition process, the vulnerability intelligence provided by each sub-intelligence source is merged to form a union containing all relevant intelligence. This step ensures that the vulnerability intelligence information obtained is both comprehensive and accurate. The vulnerability intelligence information after the union is comprehensively processed, including removing duplicate information, integrating similar intelligence, supplementing missing details, etc., to form the final vulnerability intelligence information. Since vulnerability intelligence changes dynamically, the above process needs to be repeated regularly to ensure that the vulnerability intelligence information obtained is always up to date.

[0048] In some embodiments, see Figure 3 , Figure 3 It is a flow chart of steps S301-S303 provided in an embodiment of the present application. Sending vulnerability notification information to the target application can be implemented through steps S301-S303, which will be explained in combination with each step.

[0049] In step S301, a management object corresponding to the target application is determined.

[0050] In step S302, the vulnerability notification information for describing the vulnerability and providing a repair solution is determined according to the impact information and the repair information.

[0051] In step S303, the vulnerability notification information is sent to the management object, so that the management object repairs the vulnerability based on the vulnerability notification information.

[0052] Here, you first need to identify the management object of each target application, that is, the person or team responsible for the security and maintenance of the application. This is usually based on the organization's asset management data or responsibility allocation matrix. At the same time, you need to collect the contact information of these management objects so that vulnerability notification information can be effectively sent to them.

[0053] Based on the impact information and repair information in the previously collected vulnerability intelligence information, develop vulnerability notification information that describes the vulnerability and provides a repair solution. The notification information includes key information such as the nature of the vulnerability, potential impact, repair steps, and deadline. At the same time, it can also include some additional suggestions or guidance to help the managed object deal with the vulnerability more effectively.

[0054] According to the contact information and preferences of the managed object, select the appropriate communication channel (such as email, SMS, instant messaging, internal system, etc.) to send the vulnerability notification information. After sending, you should ensure that the notification information is successfully received. You can verify it by asking for reply confirmation, setting up an automatic reply mechanism, or conducting follow-up. After sending the notification information, you can also provide necessary support or resources to help the managed object to fix the vulnerability more effectively. Then establish a tracking mechanism to regularly monitor the progress of vulnerability repairs and maintain communication with the managed object to ensure that the problem is resolved in a timely manner.

[0055] In some embodiments, see Figure 4 , Figure 4 It is a flow chart of steps S401-S403 provided in an embodiment of the present application. Determining the target application having vulnerabilities in the full asset application information based on the vulnerability intelligence information can be achieved through steps S401-S403, which will be explained in combination with each step.

[0056] In step S401, a first application and first version information corresponding to the first application are determined based on the full asset application information.

[0057] In step S402, a second application affected by the vulnerability is determined based on the impact information, and second version information corresponding to the second application is determined based on the repair information.

[0058] In step S403, when the first application matches the second application and the first version information is the same as the second version information, the first application is determined as the target application.

[0059] Here, all asset application information is obtained from the organization's asset management system, including application name, deployment location, responsible person, version information, etc. From this information, each application (called the first application) and its corresponding version information (called the first version information) are extracted. Based on the previously collected vulnerability intelligence information, the applications affected by the vulnerability (called the second application) and the corresponding version information of these applications (called the second version information) are determined.

[0060] The first application is matched with the second application to check whether they are the same application. If the application matches successfully, the first version information is further compared with the second version information. If the first version information matches the affected version mentioned in the vulnerability intelligence, it indicates that the application has a vulnerability. When the first application matches the second application and the first version information is the same as the second version information, the first application is determined as a target application with a vulnerability.

[0061] In some embodiments, see Figure 5 , Figure 5 It is a flowchart of steps S501-S502 provided in an embodiment of the present application. The method also includes steps S501-S502, which will be described in combination with each step.

[0062] In step S501, if the vulnerability notification information is not confirmed within the first preset time and / or the vulnerability is not repaired within the second preset time, the repair resources required for the repair solution are obtained based on the repair information.

[0063] In step S502, the vulnerability is repaired based on the repair resource.

[0064] Here, a time threshold (called the first preset time) is set to monitor the confirmation of the vulnerability notification information. If the vulnerability notification information is not confirmed within the first preset time after being sent, it is deemed unconfirmed. Another time threshold (called the second preset time) is set to monitor the progress of vulnerability repair. If the vulnerability is not repaired within the second preset time after the notification is sent, it is deemed not to be repaired in time.

[0065] When the vulnerability notification information is not confirmed or the vulnerability is not fixed in time, determine the resources required to fix the vulnerability based on the repair information in the previously collected vulnerability intelligence information. These resources include patch files, upgrade guides, specific tools, technical support, etc., and ensure that all necessary repair resources are ready for vulnerability repair. Use the prepared repair resources to repair the vulnerability. This includes installing patches, upgrading software, adjusting configurations, etc.

[0066] After the repair is completed, necessary verification tests are performed to ensure that the vulnerability has been successfully repaired and no new problems have been introduced. The repair results are fed back to the relevant management objects or responsible persons, and the vulnerability status in the asset management system is updated. The entire processing process is recorded, including the sending of vulnerability notifications, confirmation of the situation, acquisition of repair resources, execution of repair operations, and verification of repair results, etc., for subsequent auditing and tracking.

[0067] In some embodiments, see Figure 6 , Figure 6It is a flow chart of steps S601-S603 provided in an embodiment of the present application. Sending vulnerability notification information to the target application can be implemented through steps S601-S603, which will be explained in combination with each step.

[0068] In step S601, the vulnerability hazard level is determined based on the impact information and the full asset application information; wherein the determination rule is based on at least one of the impact degree on the application, the usage of the application with the vulnerability, and the business demand information.

[0069] In step S602, the notification content is determined based on the vulnerability hazard level; wherein the notification content includes a repair priority for the vulnerability.

[0070] In step S603, the vulnerability notification information is determined and sent based on the notification content.

[0071] Here, the vulnerability hazard level is evaluated by combining the impact information in the vulnerability intelligence information and the organization's full asset application information. The evaluation rules should be based on at least one of the impact on the application (such as business interruption and data leakage that the vulnerability may cause), the usage of the application with the vulnerability (such as the importance of the application, the number of users, the frequency of use, etc.), and the business demand information (such as the criticality of the current business, the upcoming business peak period, etc.). Based on the evaluation results, the vulnerability is divided into different hazard levels, such as high, medium, and low.

[0072] Determine the level of detail and urgency of the notification content based on the vulnerability's hazard level. For high-hazard vulnerabilities, the notification content should be more detailed and clear, and emphasize the urgency of repair. Clarify the priority of vulnerability repair in the notification content so that the management object can reasonably arrange resources and give priority to high-risk vulnerabilities. Select an appropriate notification format (such as email, SMS, instant messaging, internal system, etc.) based on the preferences and actual situation of the management object. Send the vulnerability notification information containing key information such as repair priority to the management object, and ensure that it can be received in a timely manner.

[0073] In some embodiments, the method further includes: performing an effect evaluation on the repaired vulnerability to verify the effectiveness and stability of the repair measures;

[0074] And, regularly retest and verify fixed vulnerabilities.

[0075] Here, the main purpose of evaluating the effectiveness of the fixed vulnerabilities is to verify the effectiveness and stability of the repair measures, to ensure that the vulnerabilities have been completely fixed and that the repair process has not introduced new problems. Evaluation methods may include re-running previously failed test cases, conducting penetration tests, checking system logs to confirm that there are no abnormal behaviors, etc. These methods are designed to verify the effectiveness of the repair measures from different angles. Based on the evaluation results, it can be determined whether the repair measures are successful and whether further adjustments or optimizations are needed.

[0076] The purpose of retesting and verifying fixed vulnerabilities on a regular basis is to ensure that the vulnerability does not reappear over a long period of time and that the security of the system is continuously maintained. The retesting cycle should be determined based on the severity of the vulnerability, the criticality of the system, and the business needs of the organization. For high-risk vulnerabilities, the retesting cycle may be shorter to ensure that problems are discovered and measures are taken in a timely manner. The verification method is similar to the effect evaluation, but it focuses more on the evaluation of long-term stability and overall system security. This may include continuous monitoring of system logs, regular security audits, and updating security policies. During the effect evaluation and regular retesting process, feedback is collected on the effectiveness, stability, and possible problems of the repair measures. Based on the feedback collected, in-depth analysis is conducted to identify potential problems or improvement points, and corresponding improvement measures are formulated. Improvement measures are incorporated into the continuous monitoring process to ensure that the security of the system is continuously improved.

[0077] In summary, the embodiments of the present application have the following beneficial effects:

[0078] (1) Comprehensive and efficient vulnerability management: By obtaining vulnerability intelligence information from multiple public intelligence sources, prioritizing and merging them, the comprehensiveness and accuracy of vulnerability intelligence are ensured, and the efficiency of vulnerability management is improved. Combined with asset management data, target applications with vulnerabilities can be quickly located, reducing the time and cost of vulnerability investigation.

[0079] (2) Accurate and timely vulnerability notification: Based on vulnerability intelligence information and full asset application information, the vulnerability hazard level and repair priority can be accurately determined, so as to send targeted vulnerability notification information to the managed object. The timely delivery of vulnerability notification information enables the managed object to respond quickly and take repair measures, reducing the risk of vulnerability exploitation.

[0080] (3) Automated repair resource scheduling and repair execution: When the vulnerability notification information is not confirmed or the vulnerability is not repaired in time, the repair resources required for the repair plan can be automatically obtained, and the repair operation can be performed based on these resources, which improves the efficiency and success rate of the repair. The automated repair process reduces human intervention and reduces the error rate and risk in the repair process.

[0081] (4) Continuous vulnerability effect evaluation and retesting: Evaluate the effect of fixed vulnerabilities to verify the effectiveness and stability of the repair measures and ensure that the vulnerabilities are completely repaired. Regular retesting and verification of fixed vulnerabilities can timely discover and deal with potential problems and prevent the recurrence of vulnerabilities.

[0082] (5) Improve the security protection capabilities of the organization: Through the embodiments of the present application, the organization can promptly discover and repair vulnerabilities, reducing the risk of system attacks. The transparency and visualization of the vulnerability handling process enables the organization to better understand its security status and formulate more effective security protection strategies accordingly.

[0083] In summary, the embodiments of the present application have significant beneficial effects in improving vulnerability management efficiency, ensuring that vulnerabilities are repaired in a timely manner, and improving organizational security protection capabilities.

[0084] Based on the same inventive concept, the embodiment of the present application also provides a vulnerability processing device corresponding to the vulnerability processing method in the first embodiment. Since the principle of solving the problem by the device in the embodiment of the present application is similar to the above-mentioned vulnerability processing method, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0085] like Figure 7 As shown, Figure 7 : is a schematic diagram of the structure of a vulnerability processing device 700 provided in an embodiment of the present application. The vulnerability processing device 700 includes:

[0086] The acquisition module 701 is used to acquire vulnerability intelligence information through public intelligence sources; wherein the vulnerability intelligence information includes impact information and repair information, the impact information represents the application affected by the vulnerability, and the repair information represents the repair solution for the vulnerability;

[0087] A determination module 702 is used to obtain full asset application information based on the asset management data, and determine a target application having a vulnerability in the full asset application information based on the vulnerability intelligence information;

[0088] The notification module 703 is used to send vulnerability notification information to the target application; wherein the vulnerability notification information is determined based on the impact information and the repair information.

[0089] Those skilled in the art should understand that Figure 7 The implementation functions of each unit in the vulnerability processing device 700 shown can be understood by referring to the relevant description of the aforementioned vulnerability processing method. Figure 7 The functions of each unit in the vulnerability processing device 700 shown can be implemented by a program running on a processor, or by a specific logic circuit.

[0090] In a possible implementation, the public intelligence source includes multiple sub-intelligence sources, and the acquisition module 701 acquires vulnerability intelligence information through the public intelligence source, including:

[0091] Prioritizing the multiple sub-intelligence sources; wherein the priorities of the multiple sub-intelligence sources are determined based on the intelligence quality;

[0092] Based on the priority sorting, vulnerability intelligence is acquired from the multiple sub-intelligence sources in sequence, and the acquired vulnerability intelligence is unioned to obtain the vulnerability intelligence information.

[0093] In a possible implementation, the notification module 703 sends vulnerability notification information to the target application, including:

[0094] Determine a management object corresponding to the target application;

[0095] Determine the vulnerability notification information for describing the vulnerability and providing a repair solution through the impact information and the repair information;

[0096] The vulnerability notification information is sent to the management object, so that the management object repairs the vulnerability based on the vulnerability notification information.

[0097] In a possible implementation, the determination module 702 determines the target application having a vulnerability in the full asset application information based on the vulnerability intelligence information, including:

[0098] Determine a first application and first version information corresponding to the first application based on the full asset application information;

[0099] Determine a second application affected by the vulnerability based on the impact information, and determine second version information corresponding to the second application based on the repair information;

[0100] When the first application matches the second application, and the first version information is the same as the second version information, the first application is determined as the target application.

[0101] In a possible implementation, the notification module 703 further includes:

[0102] If the vulnerability notification information is not confirmed within the first preset time and / or the vulnerability is not repaired within the second preset time, obtaining repair resources required for the repair solution based on the repair information;

[0103] The vulnerability is repaired based on the repair resources.

[0104] In a possible implementation, the notification module 703 sends vulnerability notification information to the target application, including:

[0105] Determine the vulnerability hazard level based on the impact information and the full asset application information; wherein the determination rule is determined based on at least one of the impact degree on the application, the usage of the application with the vulnerability, and the business demand information;

[0106] Determining notification content based on the vulnerability hazard level; wherein the notification content includes a repair priority for the vulnerability;

[0107] The vulnerability notification information is determined and sent based on the notification content.

[0108] In a possible implementation, the notification module 703 further includes:

[0109] Conduct effect evaluation on fixed vulnerabilities to verify the effectiveness and stability of the repair measures;

[0110] And, regularly retest and verify fixed vulnerabilities.

[0111] The above vulnerability processing device has the following beneficial effects:

[0112] (1) Comprehensive and efficient vulnerability management: By obtaining vulnerability intelligence information from multiple public intelligence sources, prioritizing and merging them, the comprehensiveness and accuracy of vulnerability intelligence are ensured, and the efficiency of vulnerability management is improved. Combined with asset management data, target applications with vulnerabilities can be quickly located, reducing the time and cost of vulnerability investigation.

[0113] (2) Accurate and timely vulnerability notification: Based on vulnerability intelligence information and full asset application information, the vulnerability hazard level and repair priority can be accurately determined, so as to send targeted vulnerability notification information to the managed object. The timely delivery of vulnerability notification information enables the managed object to respond quickly and take repair measures, reducing the risk of vulnerability exploitation.

[0114] (3) Automated repair resource scheduling and repair execution: When the vulnerability notification information is not confirmed or the vulnerability is not repaired in time, the repair resources required for the repair plan can be automatically obtained, and the repair operation can be performed based on these resources, which improves the efficiency and success rate of the repair. The automated repair process reduces human intervention and reduces the error rate and risk in the repair process.

[0115] (4) Continuous vulnerability effect evaluation and retesting: Evaluate the effect of fixed vulnerabilities to verify the effectiveness and stability of the repair measures and ensure that the vulnerabilities are completely repaired. Regular retesting and verification of fixed vulnerabilities can timely discover and deal with potential problems and prevent the recurrence of vulnerabilities.

[0116] (5) Improve the security protection capabilities of the organization: Through the embodiments of the present application, the organization can promptly discover and repair vulnerabilities, reducing the risk of system attacks. The transparency and visualization of the vulnerability handling process enables the organization to better understand its security status and formulate more effective security protection strategies accordingly.

[0117] In summary, the embodiments of the present application have significant beneficial effects in improving vulnerability management efficiency, ensuring that vulnerabilities are repaired in a timely manner, and improving organizational security protection capabilities.

[0118] like Figure 8 As shown, Figure 8 The present invention provides a schematic diagram of the structure of an electronic device 800 according to an embodiment of the present invention. The electronic device 800 includes:

[0119] A processor 801, a storage medium 802 and a bus 803, wherein the storage medium 802 stores machine-readable instructions executable by the processor 801. When the electronic device 800 is running, the processor 801 communicates with the storage medium 802 via the bus 803, and the processor 801 executes the machine-readable instructions to perform the steps of the vulnerability handling method described in the embodiment of the present application.

[0120] In actual application, the components in the electronic device 800 are coupled together via bus 803. It is understood that bus 803 is used to realize the connection and communication between these components. Bus 803 includes not only a data bus, but also a power bus, a control bus and a status signal bus. However, for the sake of clarity, Figure 8 Various buses are labeled as bus 803.

[0121] The electronic device has the following beneficial effects:

[0122] (1) Comprehensive and efficient vulnerability management: By obtaining vulnerability intelligence information from multiple public intelligence sources, prioritizing and merging them, the comprehensiveness and accuracy of vulnerability intelligence are ensured, and the efficiency of vulnerability management is improved. Combined with asset management data, target applications with vulnerabilities can be quickly located, reducing the time and cost of vulnerability investigation.

[0123] (2) Accurate and timely vulnerability notification: Based on vulnerability intelligence information and full asset application information, the vulnerability hazard level and repair priority can be accurately determined, so as to send targeted vulnerability notification information to the managed object. The timely delivery of vulnerability notification information enables the managed object to respond quickly and take repair measures, reducing the risk of vulnerability exploitation.

[0124] (3) Automated repair resource scheduling and repair execution: When the vulnerability notification information is not confirmed or the vulnerability is not repaired in time, the repair resources required for the repair plan can be automatically obtained, and the repair operation can be performed based on these resources, which improves the efficiency and success rate of the repair. The automated repair process reduces human intervention and reduces the error rate and risk in the repair process.

[0125] (4) Continuous vulnerability effect evaluation and retesting: Evaluate the effect of fixed vulnerabilities to verify the effectiveness and stability of the repair measures and ensure that the vulnerabilities are completely repaired. Regular retesting and verification of fixed vulnerabilities can timely discover and deal with potential problems and prevent the recurrence of vulnerabilities.

[0126] (5) Improve the security protection capabilities of the organization: Through the embodiments of the present application, the organization can promptly discover and repair vulnerabilities, reducing the risk of system attacks. The transparency and visualization of the vulnerability handling process enables the organization to better understand its security status and formulate more effective security protection strategies accordingly.

[0127] In summary, the embodiments of the present application have significant beneficial effects in improving vulnerability management efficiency, ensuring that vulnerabilities are repaired in a timely manner, and improving organizational security protection capabilities.

[0128] The embodiment of the present application also provides a computer-readable storage medium, which stores executable instructions. When the executable instructions are executed by at least one processor 801, the vulnerability processing method described in the embodiment of the present application is implemented.

[0129] In some embodiments, the storage medium can be a magnetic random access memory (FRAM), a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a flash memory, a magnetic surface storage, an optical disk, or a compact disc read-only memory (CDROM); it can also be various devices including one or any combination of the above memories.

[0130] In some embodiments, executable instructions may be in the form of a program, software, software module, script or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as a stand-alone program or as a module, component, subroutine or other unit suitable for use in a computing environment.

[0131] As an example, executable instructions may, but do not necessarily, correspond to a file in a file system, may be stored as part of a file that stores other programs or data, for example, in one or more scripts in a HyperText Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple coordinated files (for example, files storing one or more modules, subroutines, or code portions).

[0132] By way of example, executable instructions may be deployed to be executed on one computing device, or on multiple computing devices located at one site, or on multiple computing devices distributed across multiple sites and interconnected by a communication network.

[0133] The computer-readable storage medium has the following advantages:

[0134] (1) Comprehensive and efficient vulnerability management: By obtaining vulnerability intelligence information from multiple public intelligence sources, prioritizing and merging them, the comprehensiveness and accuracy of vulnerability intelligence are ensured, and the efficiency of vulnerability management is improved. Combined with asset management data, target applications with vulnerabilities can be quickly located, reducing the time and cost of vulnerability investigation.

[0135] (2) Accurate and timely vulnerability notification: Based on vulnerability intelligence information and full asset application information, the vulnerability hazard level and repair priority can be accurately determined, so as to send targeted vulnerability notification information to the managed object. The timely delivery of vulnerability notification information enables the managed object to respond quickly and take repair measures, reducing the risk of vulnerability exploitation.

[0136] (3) Automated repair resource scheduling and repair execution: When the vulnerability notification information is not confirmed or the vulnerability is not repaired in time, the repair resources required for the repair plan can be automatically obtained, and the repair operation can be performed based on these resources, which improves the efficiency and success rate of the repair. The automated repair process reduces human intervention and reduces the error rate and risk in the repair process.

[0137] (4) Continuous vulnerability effect evaluation and retesting: Evaluate the effect of fixed vulnerabilities to verify the effectiveness and stability of the repair measures and ensure that the vulnerabilities are completely repaired. Regular retesting and verification of fixed vulnerabilities can timely discover and deal with potential problems and prevent the recurrence of vulnerabilities.

[0138] (5) Improve the security protection capabilities of the organization: Through the embodiments of the present application, the organization can promptly discover and repair vulnerabilities, reducing the risk of system attacks. The transparency and visualization of the vulnerability handling process enables the organization to better understand its security status and formulate more effective security protection strategies accordingly.

[0139] In summary, the embodiments of the present application have significant beneficial effects in improving vulnerability management efficiency, ensuring that vulnerabilities are repaired in a timely manner, and improving organizational security protection capabilities.

[0140] In the several embodiments provided in the present application, it should be understood that the disclosed methods and electronic devices can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0141] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0142] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0143] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a platform server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks, or optical disks.

[0144] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A vulnerability processing method, characterized in that: The method comprises: Obtain vulnerability intelligence information through public intelligence sources; wherein the vulnerability intelligence information includes impact information and repair information, the impact information represents the application affected by the vulnerability, and the repair information represents the repair solution for the vulnerability; Acquire full asset application information based on the asset management data, and determine target applications having vulnerabilities in the full asset application information based on the vulnerability intelligence information; Send vulnerability notification information to the target application; wherein the vulnerability notification information is determined based on the impact information and the repair information.

2. The method according to claim 1, characterized in that The public intelligence source includes multiple sub-intelligence sources, and the vulnerability intelligence information is obtained through the public intelligence source, including: Prioritizing the multiple sub-intelligence sources; wherein the priorities of the multiple sub-intelligence sources are determined based on the intelligence quality; Based on the priority sorting, vulnerability intelligence is acquired from the multiple sub-intelligence sources in sequence, and the acquired vulnerability intelligence is unioned to obtain the vulnerability intelligence information.

3. The method according to claim 1, characterized in that The sending vulnerability notification information to the target application includes: Determine a management object corresponding to the target application; Determine the vulnerability notification information for describing the vulnerability and providing a repair solution through the impact information and the repair information; The vulnerability notification information is sent to the management object, so that the management object repairs the vulnerability based on the vulnerability notification information.

4. The method according to claim 1, characterized in that: Determining a target application having a vulnerability in the full asset application information based on the vulnerability intelligence information includes: Determine a first application and first version information corresponding to the first application based on the full asset application information; Determine a second application affected by the vulnerability based on the impact information, and determine second version information corresponding to the second application based on the repair information; When the first application matches the second application, and the first version information is the same as the second version information, the first application is determined as the target application.

5. The method according to claim 1, characterized in that The method further comprises: If the vulnerability notification information is not confirmed within the first preset time and / or the vulnerability is not repaired within the second preset time, obtaining repair resources required for the repair solution based on the repair information; The vulnerability is repaired based on the repair resources.

6. The method according to claim 1, characterized in that The sending vulnerability notification information to the target application includes: Determine the vulnerability hazard level based on the impact information and the full asset application information; wherein the determination rule is determined based on at least one of the impact degree on the application, the usage of the application with the vulnerability, and the business demand information; Determining notification content based on the vulnerability hazard level; wherein the notification content includes a repair priority for the vulnerability; The vulnerability notification information is determined and sent based on the notification content.

7. The method according to claim 1, characterized in that The method further comprises: Conduct effect evaluation on fixed vulnerabilities to verify the effectiveness and stability of the repair measures; And, regularly retest and verify fixed vulnerabilities.

8. A vulnerability processing device, characterized in that: The device comprises: An acquisition module, used to acquire vulnerability intelligence information through public intelligence sources; wherein the vulnerability intelligence information includes impact information and repair information, the impact information represents the application affected by the vulnerability, and the repair information represents the repair solution for the vulnerability; A determination module, configured to obtain full asset application information based on the asset management data, and determine a target application having a vulnerability in the full asset application information based on the vulnerability intelligence information; A notification module is used to send vulnerability notification information to the target application; wherein the vulnerability notification information is determined based on the impact information and the repair information.

9. An electronic device, characterized in that: include: A processor, a storage medium and a bus, wherein the storage medium stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the storage medium via the bus, and the processor executes the machine-readable instructions to execute the vulnerability processing method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the vulnerability processing method according to any one of claims 1 to 7 is executed.

Images