Vulnerability assessment method, electronic equipment, storage medium and program

Abstract

The embodiment of the invention discloses a vulnerability assessment method, electronic equipment, a storage medium and a program, and the method comprises the steps: obtaining vulnerability assessment associated data of a target platform; creating an initial vulnerability scoring model by adopting a linear regression method according to the vulnerability assessment associated data; adjusting an initial model weight in the initial vulnerability scoring model to obtain a target vulnerability scoring model; and evaluating the to-be-evaluated vulnerability associated data of the target platform according to the target vulnerability scoring model to obtain a vulnerability priority evaluation result. According to the technical scheme of the embodiment of the invention, the efficiency and accuracy of vulnerability assessment can be improved.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of network security technology, and in particular to a vulnerability assessment method, device, electronic device, storage medium and program. Background Art

[0002] Vulnerability prioritization technology is a key link in the field of information security, which helps enterprises or organizations determine which security vulnerabilities need immediate attention and repair. An effective vulnerability prioritization system can help security teams with limited resources focus their efforts on the vulnerabilities that are most likely to be exploited and have the greatest impact.

[0003] At present, there are two common implementation schemes for vulnerability prioritization technology: CVSS (Common Vulnerability Scoring System): It is an open and standardized framework for evaluating and communicating the severity of software vulnerabilities. CVSS quantifies the impact of vulnerabilities through a series of metrics and provides a score to represent the severity of the vulnerability. CVSS consists of three metric groups: Base Metrics, Temporal Metrics, and Environmental Metrics. After the base score is generated by the base metric group, the base score is adjusted according to the temporal metric group and the environmental metric group. The CVSS score can be queried on the NVD official website or obtained from the vulnerability scanning results of vulnerability scanner software such as Nessus. The two versions currently in use are: CVSS v2.0 and CVSS v3.0 and v3.1. EPSS (Exploit Prediction Scoring System): It is a scoring system developed by the FIRST (Forum of Incident Response and Security Teams) organization to evaluate the possibility of software vulnerabilities being actually exploited. EPSS predicts the likelihood of a vulnerability being exploited based on historical data and current threat intelligence. EPSS is a dynamic score, which means that the score will change with new threat intelligence and technology development. By combining CVSS and / or EPSS systems with relevant vulnerability assessment models, the final vulnerability priority assessment results can be obtained.

[0004] In the process of implementing the present invention, the inventors found that the prior art has the following defects: Most of the models currently used for vulnerability priority assessment are trained by machine learning, but since EPSS data is updated every day, if only machine learning is used to train the model for vulnerability assessment, the dynamic nature of EPSS cannot be reflected in the model unless the model is retrained every day. Although some models used for vulnerability priority assessment do not need to be repeatedly trained, the model weights have not been adjusted and verified, and the accuracy is low, resulting in low vulnerability assessment accuracy. Summary of the invention

[0005] Embodiments of the present invention provide a vulnerability assessment method, device, electronic device, storage medium and program, which can improve the efficiency and accuracy of vulnerability assessment.

[0006] According to one aspect of the present invention, a vulnerability assessment method is provided, comprising:

[0007] Obtain vulnerability assessment related data of the target platform;

[0008] Creating an initial vulnerability scoring model using a linear regression method based on the vulnerability assessment associated data;

[0009] Adjusting the initial model weights in the initial vulnerability scoring model to obtain a target vulnerability scoring model;

[0010] The vulnerability-related data to be assessed of the target platform is assessed according to the target vulnerability scoring model to obtain a vulnerability priority assessment result.

[0011] According to another aspect of the present invention, there is provided a vulnerability assessment device, comprising:

[0012] A vulnerability assessment related data acquisition module is used to acquire vulnerability assessment related data of the target platform;

[0013] An initial vulnerability scoring model creation module is used to create an initial vulnerability scoring model using a linear regression method based on the vulnerability assessment associated data;

[0014] A target vulnerability scoring model acquisition module is used to adjust the initial model weights in the initial vulnerability scoring model to obtain a target vulnerability scoring model;

[0015] The vulnerability assessment result acquisition module is used to evaluate the vulnerability-related data to be evaluated of the target platform according to the target vulnerability scoring model to obtain a vulnerability priority assessment result.

[0016] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0017] at least one processor; and

[0018] a memory communicatively connected to the at least one processor; wherein,

[0019] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the vulnerability assessment method described in any embodiment of the present invention.

[0020] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the vulnerability assessment method described in any embodiment of the present invention when executed.

[0021] According to another aspect of the present invention, a computer program product is provided, including a computer program, wherein when the computer program is executed by a processor, the vulnerability assessment method described in any embodiment of the present invention is implemented.

[0022] The embodiment of the present invention creates an initial vulnerability scoring model by using a linear regression method according to the acquired vulnerability assessment associated data, and adjusts the initial model weights in the initial vulnerability scoring model to obtain a target vulnerability scoring model to further improve the accuracy of the model assessment, thereby evaluating the vulnerability associated data to be evaluated according to the acquired target vulnerability scoring model to obtain a vulnerability priority assessment result. Since the initial vulnerability scoring model is created by using a linear regression method, there is no need to repeatedly train the model using dynamically changing training data. After the vulnerability scoring model is created and the weights are adjusted, it can be applied to vulnerability assessments of all dynamic data, which can solve the problems of low efficiency or low model accuracy resulting in low vulnerability assessment accuracy when the existing model needs to be repeatedly retrained for vulnerability assessment, and can improve the efficiency and accuracy of vulnerability assessment.

[0023] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0025] Figure 1 is a flow chart of a vulnerability assessment method provided in Embodiment 1 of the present invention;

[0026] Figure 2 is a flow chart of a vulnerability assessment method provided by Embodiment 2 of the present invention;

[0027] Figure 3 Schematic diagram of the principle of a random forest algorithm provided in the second embodiment of the present invention;

[0028] Figure 4 This is a flow chart of distributing and processing vulnerabilities through a timed script provided by the second embodiment of the present invention;

[0029] Figure 5 is a schematic diagram of a vulnerability assessment device provided by Embodiment 3 of the present invention;

[0030] Figure 6 A schematic diagram of the structure of an electronic device provided in Embodiment 4 of the present invention. DETAILED DESCRIPTION

[0031] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0032] It should be noted that the terms "include", "have" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or apparatus comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to these processes, methods, products or apparatus.

[0033] Embodiment 1

[0034] Figure 1 This is a flowchart of a vulnerability assessment method provided by the first embodiment of the present invention. This embodiment is applicable to the case where vulnerabilities are assessed based on a model created by a linear regression method. The method can be executed by a vulnerability assessment device, which can be implemented by software and / or hardware and can generally be integrated in an electronic device. The electronic device can be a terminal device or a server device. As long as it can be used to execute the vulnerability assessment method, the embodiment of the present invention does not limit the specific device type of the electronic device. Accordingly, Figure 1 As shown, the method includes the following operations:

[0035] S110. Obtain vulnerability assessment related data of the target platform.

[0036] The target platform may be a platform type that needs to be evaluated for vulnerabilities, such as a log management platform or other types of business system platforms, as long as there are vulnerability storage functions and vulnerability management requirements. The embodiment of the present invention does not limit the type, function, and organizational structure of the target platform. Vulnerability assessment related data may be data collected and obtained from the target platform and can be used as a reference for vulnerability assessment analysis. The embodiment of the present invention does not limit the data type and data content of vulnerability assessment related data.

[0037] In an embodiment of the present invention, when it is necessary to perform vulnerability assessment analysis on a target platform, relevant sample data may be first collected from the target platform, and the collected sample data may be parsed and processed to obtain vulnerability assessment associated data for reference in vulnerability assessment analysis. Optionally, the vulnerability assessment associated data may include data of multiple dimensions, such as but not limited to relevant data of the CVSS system and / or EPSS system and asset data of the target platform.

[0038] S120: Creating an initial vulnerability scoring model using a linear regression method according to the vulnerability assessment associated data.

[0039] The initial vulnerability scoring model may be a vulnerability scoring model initially constructed based on vulnerability assessment associated data, and is used to evaluate vulnerability priorities in the target platform.

[0040] Taking into account the dynamic update characteristics of EPSS data, in order to reflect the dynamic nature of EPSS in the model, the embodiment of the present invention uses the linear regression method to create an initial vulnerability scoring model in a formula mode based on the vulnerability assessment associated data. Optionally, the initial vulnerability scoring model can be composed of variables and model weights. It is understandable that since the initial vulnerability scoring model is a model initially created based on the vulnerability assessment associated data, the accuracy of its model weights may not meet the requirements and needs to be further adjusted to improve the accuracy of the model weights.

[0041] S130: Adjust the initial model weights in the initial vulnerability scoring model to obtain a target vulnerability scoring model.

[0042] The initial model weights may be weights of various variables involved in the initial vulnerability scoring model, and the target vulnerability scoring model may be a vulnerability scoring model generated by further adjusting the accuracy of the weights of the initial vulnerability scoring model.

[0043] Since the initial model weights in the initial vulnerability scoring model are preliminarily assessed weight factors, they are less stable. It is necessary to optimize the initial model weights of each variable in the initial vulnerability scoring model, and then fine-tune them to eventually derive relatively stable weight factors, thereby constructing the target vulnerability scoring model based on the stable weight factors. It is understandable that the vulnerability scoring accuracy of the target vulnerability scoring model is higher than that of the initial vulnerability scoring model.

[0044] S140: Evaluate the vulnerability-related data to be evaluated of the target platform according to the target vulnerability scoring model to obtain a vulnerability priority evaluation result.

[0045] The vulnerability-related data to be evaluated may be relevant reference data for vulnerability evaluation, or may be vulnerability evaluation-related data collected in real time from the target platform. The vulnerability priority evaluation result may be the result of vulnerability priority evaluation performed in real time on the target platform.

[0046] Accordingly, after obtaining the target vulnerability scoring model, the vulnerability-related data to be evaluated that needs to be evaluated can be collected in real time for the target platform, and the vulnerability-related data to be evaluated can be input into the target vulnerability scoring model to calculate the scoring results of each vulnerability in the target platform. Furthermore, the final vulnerability priority assessment results of the target platform can be generated based on the scoring results of each vulnerability in the target platform. In the vulnerability priority assessment results, the priority of each vulnerability of the target platform can be identified to distinguish the threat level of the vulnerability, so as to facilitate network security personnel to quickly identify the types of vulnerabilities that need immediate attention and repair. Accordingly, vulnerability repair measures can be executed on the target platform based on the vulnerability priority assessment results to ensure the security, reliability and stability of the target platform.

[0047] Since the formula parameters and model weights in the target vulnerability scoring model are fixed, and the variable data is dynamic, it is sufficient to repeatedly evaluate the vulnerability priority evaluation results of each vulnerability in the target platform based on the daily updated vulnerability association data to be evaluated. It can be seen that the combination of formulas and dynamic data can adapt to the ever-changing vulnerability environment without the need to frequently retrain the model.

[0048] The embodiment of the present invention creates an initial vulnerability scoring model by using a linear regression method according to the acquired vulnerability assessment associated data, and adjusts the initial model weights in the initial vulnerability scoring model to obtain a target vulnerability scoring model to further improve the accuracy of the model assessment, thereby evaluating the vulnerability associated data to be evaluated according to the acquired target vulnerability scoring model to obtain a vulnerability priority assessment result. Since the initial vulnerability scoring model is created by using a linear regression method, there is no need to repeatedly train the model using dynamically changing training data. After the vulnerability scoring model is created and the weights are adjusted, it can be applied to vulnerability assessments of all dynamic data, which can solve the problems of low efficiency or low model accuracy resulting in low vulnerability assessment accuracy when the existing model needs to be repeatedly retrained for vulnerability assessment, and can improve the efficiency and accuracy of vulnerability assessment.

[0049] Embodiment 2

[0050] Figure 2 is a flowchart of a vulnerability assessment method provided by the second embodiment of the present invention. This embodiment is specific based on the above embodiment. In this embodiment, a plurality of specific optional implementation methods are provided for obtaining vulnerability assessment associated data of the target platform, creating an initial vulnerability scoring model using a linear regression method, adjusting the initial model weights in the initial vulnerability scoring model, and evaluating the vulnerability associated data to be evaluated according to the target vulnerability scoring model. Figure 2 As shown, the method of this embodiment may include:

[0051] S210: Collect all vulnerability-related data of the target platform.

[0052] Among them, the full amount of vulnerability-related data includes vulnerability CVE (Common Vulnerabilities & Exposures) data, vulnerability CVE EPSS data and vulnerability-related asset data.

[0053] Among them, the full amount of vulnerability-related data can be all the data content related to the vulnerability collected on the target platform. The vulnerability CVE data can be the vulnerability data related to CVE. The EPSS data of the vulnerability CVE can be data such as the EPSS score of the vulnerability CVE. The vulnerability-related asset data can be data related to the vulnerability asset.

[0054] In an embodiment of the present invention, before regenerating a model for evaluating vulnerability priority, all vulnerability-related data such as vulnerability CVE data, EPSS data of vulnerability CVE, and vulnerability-related asset data may be first collected for the target platform.

[0055] Exemplarily, in the process of collecting the full amount of vulnerability-related data, first, the full amount of vulnerability CVE data can be collected. Optionally, the vulnerability CVE data may include but is not limited to the CVE number, CVSS score, and CVE severity, etc. Secondly, the EPSS score of each vulnerability CVE may be collected as the EPSS data of the vulnerability CVE. Finally, data related to the assets involved in the vulnerability may be collected, including the importance of the asset, the CIA (Confidentiality, Integrity, Availability) score of the area where the asset is located, and the CIA score of the business system to which the asset belongs, etc., and the data related to the assets involved in the vulnerability may be used as vulnerability-related asset data. In the process of collecting the full amount of vulnerability-related data for the target platform, the data sources that may be involved may include but are not limited to: the full amount of CVE data, the daily CSV file that provides EPSS data, and the asset management data of the target platform, etc.

[0056] S220: Perform feature extraction on the full amount of vulnerability-related data to obtain the vulnerability assessment-related data.

[0057] Among them, the vulnerability assessment associated data may include vulnerability EPSS data, vulnerability severity data, vulnerability exploitation probability data, vulnerability CIA scoring data, and vulnerability asset importance identification data. Vulnerability EPSS data can be used to characterize the scoring results of vulnerability EPSS. Vulnerability severity data can be used to characterize the emergency severity of the vulnerability, which can be determined based on data from the CVSS system such as CVSS scoring. Vulnerability exploitation probability data can be used to characterize the probability of the vulnerability being exploited. Vulnerability asset importance identification data can be used to identify the importance of assets associated with the vulnerability.

[0058] Accordingly, after collecting the full amount of vulnerability-related data, feature extraction can be performed on the full amount of vulnerability-related data and normalized into standard fields, such as CVE number, EPSS, severity, probability of vulnerability being exploited, CIA score, and vulnerability asset importance identification such as whether it is an important asset or host. Among them, the CVE number can be used as a reference when associating data from the EPSS system and the CVSS system. Optionally, the above-mentioned vulnerability assessment-related data can be stored in the form of an Excel spreadsheet, and each row in the table can represent the vulnerability assessment-related data corresponding to a vulnerability. Each row of vulnerability assessment-related data can include relevant information such as CVE number, EPSS, severity, and whether it is an important asset or host. These vulnerability assessment-related data can be used as variable parameters in the vulnerability scoring model.

[0059] It should be noted that traditional vulnerability assessment solutions use CVSS, EPSS, or a combination of the two to determine the vulnerability repair order to achieve vulnerability priority assessment. This does not take into account the impact of the area where the assets are located and the business system to which they belong in the actual environment, and therefore cannot truly reflect the actual security situation of the business environment.

[0060] In the process of collecting vulnerability assessment related data, the embodiment of the present invention not only combines the data of vulnerability scoring systems such as CVSS and EPSS, but also integrates the data of the asset center in the target platform, the data of the business system in the target platform, and the data of the vulnerability center in the target platform, including but not limited to the dimensions of the importance, region, and business system of the enterprise assets, so as to achieve all-round data integration and analysis and provide a more comprehensive and accurate vulnerability priority assessment. This integration method can make the final scoring results of the vulnerabilities in the target platform better adapt to the complex and changing business environment, thereby improving the accuracy and efficiency of vulnerability repair.

[0061] S230: Determine an initial vulnerability threat score corresponding to each vulnerability according to the vulnerability assessment associated data, and create an original vulnerability scoring model according to the initial vulnerability threat score and the vulnerability assessment associated data.

[0062] The initial vulnerability threat score may be data obtained by initially scoring the threats of various vulnerabilities in the target platform. The original vulnerability scoring model may be a model including known variable types and unknown weight coefficients.

[0063] Optionally, the threat level of each vulnerability of the target platform can be scored according to the vulnerability assessment associated data by manual scoring to obtain an initial vulnerability threat score, and the initial vulnerability threat score is used as the target value, and the vulnerability assessment associated data is used to determine the type of each variable in the vulnerability scoring model. At the same time, corresponding weight parameters can be configured for each variable, and the weight parameters can be unknown quantities, so as to create an original vulnerability scoring model based on the initial vulnerability threat score, variable parameters, and weight parameters of unknown quantities.

[0064] S240: Calculate the initial model weight of each variable in the original vulnerability scoring model using the linear regression method and the vulnerability assessment associated data to obtain the initial vulnerability scoring model.

[0065] Among them, linear regression is a common machine learning method, which is usually used to establish a linear relationship model between features and target variables. In the linear regression model, it is assumed that there is a linear relationship between the input features and the output results, and the weight of the feature is determined by minimizing the error between the predicted value and the true value.

[0066] Optionally, each row of vulnerability assessment-related data can be used as a row of training data, and the linear regression method can be used to input each row of training data into each variable corresponding to the original vulnerability scoring model, thereby solving the initial model weights of each variable in the original vulnerability scoring model based on the initial vulnerability threat score and known variable data in the original vulnerability scoring model to obtain the value of the initial model weight. Further, the initial model weights of each variable in the original vulnerability scoring model are assigned according to the solution results of the initial model weights to obtain the initial vulnerability scoring model.

[0067] In an optional embodiment of the present invention, the initial vulnerability scoring model can be the following formula: Total_score = a*Rscore+b*EPSSS_score+c*Percentile_score+d*CIA_total_score+e*is_important_bonus. Wherein, Total_score represents the vulnerability score, and in the original vulnerability scoring model, the value of Total_score can be the initial vulnerability threat score. Rscore can be vulnerability severity data, for example, it can be the threat level of the vulnerability, and a is the initial model weight corresponding to the vulnerability severity data. EPSSS_score can be vulnerability EPSS data, for example, it can be the EPSS score of the vulnerability, and b is the initial model weight corresponding to the vulnerability EPSS data. Percentile_score can be vulnerability exploitation probability data, and c is the initial model weight corresponding to the vulnerability exploitation probability data. CIA_total_score can be vulnerability CIA scoring data, and d is the initial model weight corresponding to the vulnerability CIA scoring data. is_important_bonus can be vulnerability asset importance identification data, and e is the initial model weight corresponding to the vulnerability asset importance identification data.

[0068] S250, adjusting the initial model weights in the initial vulnerability scoring model by using a random forest algorithm to obtain a target vulnerability scoring model.

[0069] In an embodiment of the present invention, optionally, a random forest algorithm can be used to optimize and adjust the initial model weights in the initial vulnerability scoring model to obtain the desired target vulnerability scoring model. The random forest model is a supervised ensemble learning algorithm based on decision trees, which learns multiple estimators through training and obtains the final prediction value by combining the results of multiple estimators.

[0070] In an optional embodiment of the present invention, the adjusting the initial model weights in the initial vulnerability scoring model to obtain the target vulnerability scoring model may include: constructing a decision tree adapted to the random forest algorithm based on the vulnerability assessment associated data; obtaining the feature weight ratio of the weight features of each decision tree to the initial model weight; calculating the average value of each initial model weight based on the feature weight ratio of the weight features to obtain the target model weight; and replacing and updating the corresponding initial model weights based on the target model weights to obtain the target vulnerability scoring model.

[0071] The target model weight may be a model weight with higher accuracy and stability obtained by optimizing and adjusting the initial model weight using a random forest method.

[0072] Exemplarily, the weight features of the initial model weights may include, but are not limited to, CVE number, host IP (Internet Protocol, a protocol for interconnecting networks) address, status value, vulnerability asset importance identifier (is_important), region, threat level (risk), EPSS score, business system, vulnerability exploitation probability, and CIA score (cia_score), etc.

[0073] Figure 3 Schematic diagram of the principle of a random forest algorithm provided by the second embodiment of the present invention. In a specific example, Figure 3 As shown in the figure, the weight features corresponding to the initial model weights can be extracted based on vulnerability assessment related data such as vulnerability EPSS data, vulnerability severity data, vulnerability exploitation probability data, vulnerability CIA score data, and vulnerability asset importance identification data, and a sample set can be constructed based on the initial model weights. Correspondingly, the random forest method can use the bootstrapping algorithm to extract n samples of initial model weights from the sample set to generate a decision tree, and generate nodes of the decision tree through d weight features in the initial model weights. Repeating these two steps can generate k decision trees. Each decision tree will output an answer, which will be averaged by using a combiner to average the answers of multiple decision trees and generate the final answer. The final answer generated is the target model weight corresponding to a certain initial model weight. The random forest method can evaluate the importance of weight features. By averaging the contribution of each weight feature on each tree (Gini index or out-of-bag error rate), the average weight of each weight feature is obtained, thereby highlighting which features have a higher weight ratio. This scheme uses the feature weight ratio obtained by random forest and fine-tunes the initial model weight by weight ratio. It is understandable that the random forest method may need to be repeatedly performed to eventually obtain relatively stable target model weights.

[0074] In a specific example, Figure 3 As shown in the figure, assume that one of the initial model weights x is taken as the root node of the three decision trees, and the orange path is the leaf node after each decision. Each decision tree can calculate the feature weight ratio of the initial model weight x through the corresponding algorithm logic. Finally, the target model weight y corresponding to the initial model weight x is calculated through the feature weight ratio calculated by each decision tree.

[0075] In random forests, feature importance is usually calculated based on the splitting effect of each feature at the tree node. The measure of splitting effect may be Giniimpurity (classification problem) or the reduction of mean-square error (MSE) (i.e. regression problem). In the embodiment of the present invention, a regression model is used to predict the score, so the feature importance can be calculated based on the reduction of MSE. The following is the entire calculation process of random forest:

[0076] (1) Training decision trees: Each decision tree uses a certain feature to split at a specific node. For example, if a certain feature EPSS reduces the MSE by 5 in the split, then this contribution is counted as the importance of EPSS.

[0077] (2) Accumulated contribution: For all node splits of each decision tree, calculate the MSE reduction caused by each feature and accumulate them.

[0078] (3) Standardization: Normalize the sum of the MSE reductions of all features to obtain feature importance.

[0079] In a specific example, Figure 3 As shown, the initial model weights are selected based on the vulnerability assessment associated data and used in the split nodes of multiple decision trees to calculate their respective contributions to the MSE:

[0080] EPSS: used in tree 1 and tree 3, reducing the total MSE to 12.5;

[0081] percentile: used in tree 2 and tree 4, reducing the total MSE to 15.8;

[0082] CIA_total_score: used in one tree, reducing the total MSE to 6.1;

[0083] Rscore: used in some nodes of the tree, reducing the total MSE to 5.4;

[0084] is_important_bonus: does not significantly reduce MSE, the total is 0.2.

[0085] Now normalize the sum of these MSE reductions: sum = 12.5 + 15.8 + 6.1 + 5.4 + 0.2 = 40.

[0086] Next, the average value is calculated based on multiple decision trees to represent the standardized importance of each weight:

[0087] The target model weight corresponding to EPSS is: 12.5 / 40=0.3125;

[0088] The target model weight corresponding to percentile is: 15.8 / 40=0.395;

[0089] The target model weight corresponding to CIA_total_score is: 6.1 / 40=0.1525;

[0090] The target model weight corresponding to Rscore is: 5.4 / 40=0.135;

[0091] The target model weight corresponding to is_important_bonus is: 0.2 / 40=0.005.

[0092] S260: Evaluate the vulnerability-related data to be evaluated according to the target vulnerability scoring model to obtain a vulnerability priority evaluation result.

[0093] For example, each vulnerability involved in the vulnerability association data to be evaluated can be evaluated according to the target vulnerability scoring model to obtain a corresponding evaluation score. Further, each vulnerability is sorted according to the evaluation score, and vulnerabilities with an evaluation score greater than or equal to a first threshold are marked as high-risk vulnerabilities, vulnerabilities with an evaluation score greater than a second threshold and less than the first threshold are marked as medium-level vulnerabilities, and vulnerabilities with an evaluation score less than or equal to the second threshold are marked as low-priority vulnerabilities, etc.

[0094] It should be noted that the vulnerability priority assessment results can be configured as needed, for example, to multiple priority categories such as emergency, continue to resolve, high priority, normal processing and low priority. The embodiment of the present invention does not limit the priority type involved in the vulnerability priority assessment results.

[0095] In an optional embodiment of the present invention, after evaluating the vulnerability-related data to be evaluated according to the target vulnerability scoring model to obtain a vulnerability priority evaluation result, the method may also include: determining the vulnerabilities to be processed according to the vulnerability priority evaluation result; and performing vulnerability dispatch processing on the vulnerabilities to be processed through a scheduled script.

[0096] The vulnerability to be processed may be a vulnerability type that needs to be processed in a timely manner, such as a vulnerability with a higher priority level, or all vulnerabilities, etc. The embodiment of the present invention does not limit the priority level of the vulnerability to be processed. The scheduled script may be an automated script that can be executed according to a scheduled period, such as a SOAR (Security Orchestration, Automation and Response) script that is executed on a scheduled basis.

[0097] Accordingly, after obtaining the vulnerability priority assessment results, an analysis can be performed based on the vulnerability priority assessment results, and the vulnerability types that need to be pushed to the relevant person in charge for vulnerability handling can be determined as pending vulnerabilities. Optionally, a scheduled script can be executed, such as a scheduled SOAR script, to distribute and handle the pending vulnerabilities in a cycle, and the vulnerability information that needs to be handled in a timely manner can be notified to the relevant person in charge, so as to realize the automatic distribution of vulnerability handling work orders.

[0098] In an optional embodiment of the present invention, the vulnerability dispatching processing of the vulnerability to be processed through a scheduled script may include: when it is determined that the script startup time has been reached, determining the vulnerability owner of the vulnerability to be processed according to the vulnerability assessment associated data through the scheduled script; when it is determined that the vulnerability to be processed meets the vulnerability processing task merging conditions, merging the vulnerability tasks of the vulnerability to be processed to obtain a merged vulnerability processing task; and dispatching the merged vulnerability processing task to the corresponding vulnerability owner for vulnerability processing.

[0099] Among them, the script start time can be the time to start the timed script to distribute the vulnerabilities to be processed. The vulnerability owner can be the relevant asset owner or asset sorter, as long as he has the authority to process or distribute the vulnerabilities. The embodiment of the present invention does not limit the specific role of the vulnerability owner. The vulnerability processing task merging condition can be a condition for merging vulnerability processing tasks. The merged vulnerability processing task can be a task that includes information related to multiple vulnerabilities to be processed, which is used to indicate the processing of multiple vulnerabilities to be processed.

[0100] Figure 4 is a flow chart of distributing and processing vulnerabilities through a timed script provided by the second embodiment of the present invention. In a specific example, Figure 4As shown, the scheduled script can be a scheduled SOAR script, and the scheduled cycle time can be executed once a day. The scheduled script can incrementally read the vulnerability priority scoring results in the vulnerability center of the target platform, such as the vulnerability priority scoring results of three priorities, including medium risk, high risk and serious, and determine the vulnerability to be processed based on the vulnerability priority scoring results. Further, the scheduled script associates the asset information in the asset management of the target platform through the asset IP affected by the vulnerability. If the scheduled script can associate the vulnerability to be processed with the corresponding vulnerability person in charge based on the asset information, the vulnerability to be processed will be marked as complete asset information; otherwise, the vulnerability to be processed will be marked as incomplete asset information. The vulnerability to be processed with complete asset information can first determine whether there is an identical vulnerability processing task (hereinafter referred to as task) that has been created. Optionally, it can be judged by the task name. The task name can be named in the form of "asset (for example, it can be an IP address or unique identification information) + person in charge". Therefore, as long as there is a matching task management center of the target platform, it can be judged. If there is no identical task, the vulnerabilities and related information (such as vulnerability priority score, affected assets, and vulnerability ID, etc.) in the batch that have not yet created a task will be uniformly output to a table for reference to create the new task. When creating a new task, the vulnerabilities in the table can be merged by the two dimensions of assets and asset managers, and then all the merged vulnerabilities will be associated with the task to be created; otherwise, the vulnerability will be updated into the existing task. The same processing logic applies to pending vulnerabilities with incomplete asset information, but because of the lack of asset managers, the naming of tasks can be distinguished. For example, the asset sorter who is responsible for sorting out missing asset information can be regarded as the relevant person in charge, so that the task of handling vulnerabilities with missing asset managers can be assigned to the corresponding asset sorters for unified allocation. Therefore, the creation and update of pending vulnerability tasks with incomplete asset information are unified with a task name, that is, the task of "missing asset vulnerability + asset sorter name". Correspondingly, after updating or creating a merged task, the vulnerability custom field can be modified to indicate that the vulnerability has been merged into the task. At the same time, if there are many pending vulnerabilities, the pending vulnerabilities can be filtered according to the vulnerability identification to filter out pending vulnerabilities that need to be processed in a timely manner.

[0101] In summary, the solution of the embodiment of the present invention aggregates CVSS, CVE severity, EPSS, and asset dimension data such as asset importance, asset location, and asset business system, and combines the random forest method to obtain a vulnerability scoring model that can reflect the real security situation of the business environment. After the vulnerability is scored based on the vulnerability scoring model, the automated timed script can merge the vulnerabilities by the assets affected by the vulnerabilities and the corresponding asset managers, and distribute them to the same work order named after the asset and the asset manager.

[0102] Existing vulnerability priority assessment technologies (such as CVSS and EPSS, etc.) do not take the business asset dimension into account in the scoring criteria, so that the vulnerabilities cannot be prioritized according to the real business environment. The technical solution of the embodiment of the present invention scores and prioritizes the vulnerabilities by combining the existing vulnerability priority technology and associating the three dimensions of business assets, namely the region where the assets are located, the business system to which the assets belong, and the importance of the assets. The final score and sorting results can reflect the real vulnerability risk situation of the business environment. At the same time, because there are dynamic data in the selected data source, such as EPSS and asset data, if only the machine learning algorithm is used, the model needs to be retrained according to the changes in the data, which does not meet the actual use scenario. However, the linear model formula can solve this problem. Since the linear model formula is fixed, the data can be dynamic. Therefore, the weight factor of the linear model formula is continuously optimized by combining the characteristics of the linear regression algorithm and the feature importance evaluation of the random forest, so that it can obtain sufficient stability and rationality. If the data changes, it only needs to recalculate the score through the formula, and there is no need to repeatedly train and update the structure of the formula. In addition, the above technical solution also uses the timing script component to realize automatic vulnerability merging and vulnerability work order distribution processing. In the entire automated processing flow, the data of the vulnerability center, the data of the asset center, and the data of the business system in the target platform can be combined. The integrated vulnerability data can be sent to the corresponding business system manager for processing according to the task management function of the asset-using target platform, thus forming a closed loop for vulnerability management. There are multiple available methods for sending vulnerability processing work order reminders, such as email reminders.

[0103] It is understandable that the automated vulnerability handling work order distribution method can greatly shorten the response time from vulnerability discovery to repair through intelligent processes. The traditional vulnerability repair process often requires manual search for the person in charge of the vulnerability, which is prone to delays in the communication process. The automated system can quickly identify the business person in charge of the asset and directly push the vulnerability handling work order to the person in charge. This process not only saves a lot of manpower time, but also ensures that high-priority vulnerabilities can be handled in a timely manner, thereby effectively reducing the risk of malicious exploitation of vulnerabilities during the exposure period. Through email notifications, system tracking and progress feedback, it ensures that every link of the vulnerability repair process can be effectively executed. In the process of vulnerability repair, the work order status can be continuously tracked, and each step of the repair process, including key information such as the acceptance, processing and completion of the work order, is automatically recorded, forming a complete closed-loop management. Through these real-time feedback mechanisms, possible delays or failures in the repair process can be discovered and handled in a timely manner to ensure that the vulnerability repair task is successfully completed. In addition, closed-loop management can also provide subsequent statistical analysis support for vulnerability data. By analyzing the data of completed vulnerability handling work orders, we can identify bottlenecks or efficiency issues in the vulnerability repair process and make corresponding optimizations to further improve the overall vulnerability management capabilities. In this way, we can not only achieve full control of vulnerability repairs, but also improve the response efficiency and protection capabilities of the target platform in similar incidents in the future.

[0104] In the technical solution of the present disclosure, the collection, storage, use, processing, transmission, provision and disclosure of user personal information are in compliance with the relevant laws and regulations and do not violate public order and good morals.

[0105] It should be noted that any arrangement and combination of the technical features in the above embodiments also falls within the protection scope of the present invention.

[0106] Embodiment 3

[0107] Figure 5 is a schematic diagram of a vulnerability assessment device provided by Embodiment 3 of the present invention, such as Figure 5 As shown, the device includes: a vulnerability assessment associated data acquisition module 310, an initial vulnerability scoring model creation module 320, a target vulnerability scoring model acquisition module 330 and a vulnerability assessment result acquisition module 340, wherein:

[0108] A vulnerability assessment related data acquisition module 310 is used to acquire vulnerability assessment related data of a target platform;

[0109] An initial vulnerability scoring model creation module 320 is used to create an initial vulnerability scoring model using a linear regression method based on the vulnerability assessment associated data;

[0110] A target vulnerability scoring model acquisition module 330 is used to adjust the initial model weights in the initial vulnerability scoring model to obtain a target vulnerability scoring model;

[0111] The vulnerability assessment result acquisition module 340 is used to evaluate the vulnerability-related data to be assessed of the target platform according to the target vulnerability scoring model to obtain a vulnerability priority assessment result.

[0112] The embodiment of the present invention creates an initial vulnerability scoring model by using a linear regression method according to the acquired vulnerability assessment associated data, and adjusts the initial model weights in the initial vulnerability scoring model to obtain a target vulnerability scoring model to further improve the accuracy of the model assessment, thereby evaluating the vulnerability associated data to be evaluated according to the acquired target vulnerability scoring model to obtain a vulnerability priority assessment result. Since the initial vulnerability scoring model is created by using a linear regression method, there is no need to repeatedly train the model using dynamically changing training data. After the vulnerability scoring model is created and the weights are adjusted, it can be applied to vulnerability assessments of all dynamic data, which can solve the problems of low efficiency or low model accuracy resulting in low vulnerability assessment accuracy when the existing model needs to be repeatedly retrained for vulnerability assessment, and can improve the efficiency and accuracy of vulnerability assessment.

[0113] Optionally, the vulnerability assessment associated data acquisition module 310 is also used to: collect the full amount of vulnerability associated data of the target platform; wherein the full amount of vulnerability associated data includes vulnerability CVE data, EPSS data of vulnerability CVE and vulnerability associated asset data; perform feature extraction on the full amount of vulnerability associated data to obtain the vulnerability assessment associated data; wherein the vulnerability assessment associated data includes vulnerability EPSS data, vulnerability severity data, vulnerability exploitation probability data, vulnerability CIA scoring data and vulnerability asset importance identification data.

[0114] Optionally, the initial vulnerability scoring model creation module 320 is also used to: determine the initial vulnerability threat score corresponding to each vulnerability based on the vulnerability assessment associated data; create an original vulnerability scoring model based on the initial vulnerability threat score and the vulnerability assessment associated data; use the linear regression method and the vulnerability assessment associated data to calculate the initial model weights of each variable in the original vulnerability scoring model to obtain the initial vulnerability scoring model.

[0115] Optionally, the target vulnerability scoring model acquisition module 330 is also used to: construct a decision tree adapted to the random forest algorithm based on the vulnerability assessment associated data; obtain the feature weight ratio of the weight features of each decision tree to the initial model weight; calculate the average value of each initial model weight based on the feature weight ratio of the weight features to obtain the target model weight; replace and update the corresponding initial model weight according to the target model weight to obtain the target vulnerability scoring model.

[0116] Optionally, the initial vulnerability scoring model can be: Total_score=a*Rscore+b*EPSSS_score+c*Percentile_score+d*CIA_total_score+e*is_important_bonus; wherein Total_score represents the vulnerability score, Rscore is the vulnerability severity data, a is the initial model weight corresponding to the vulnerability severity data, EPSSS_score is the vulnerability EPSS data, b is the initial model weight corresponding to the vulnerability EPSS data, Percentile_score is the vulnerability exploitation probability data, c is the initial model weight corresponding to the vulnerability exploitation probability data, CIA_total_score is the vulnerability CIA scoring data, d is the initial model weight corresponding to the vulnerability CIA scoring data, is_important_bonus is the vulnerability asset importance identification data, and e is the initial model weight corresponding to the vulnerability asset importance identification data.

[0117] Optionally, the above-mentioned device also includes a vulnerability distribution processing module, which is used to: determine the vulnerabilities to be processed according to the vulnerability priority assessment results; and perform vulnerability distribution processing on the vulnerabilities to be processed through a scheduled script.

[0118] Optionally, the vulnerability distribution processing module is also used to: when it is determined that the script startup time has been reached, determine the vulnerability owner of the vulnerability to be processed according to the vulnerability assessment associated data through the scheduled script; when it is determined that the vulnerability to be processed meets the vulnerability processing task merging conditions, merge the vulnerability tasks for the vulnerability to be processed to obtain a merged vulnerability processing task; and distribute the merged vulnerability processing task to the corresponding vulnerability owner for vulnerability processing.

[0119] The above vulnerability assessment device can execute the vulnerability assessment method provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method. For technical details not described in detail in this embodiment, please refer to the vulnerability assessment method provided by any embodiment of the present invention.

[0120] Since the vulnerability assessment device described above is a device that can execute the vulnerability assessment method in the embodiment of the present invention, based on the vulnerability assessment method described in the embodiment of the present invention, a person skilled in the art can understand the specific implementation of the vulnerability assessment device of the present embodiment and its various variations, so how the vulnerability assessment device implements the vulnerability assessment method in the embodiment of the present invention is not described in detail here. As long as a person skilled in the art implements the device used in the vulnerability assessment method in the embodiment of the present invention, it belongs to the scope of protection of this application.

[0121] Embodiment 4

[0122] Figure 6 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0123] like Figure 6 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0124] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0125] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a vulnerability assessment method.

[0126] Optionally, the vulnerability assessment method may include: obtaining vulnerability assessment associated data of the target platform; creating an initial vulnerability scoring model using a linear regression method based on the vulnerability assessment associated data; adjusting the initial model weights in the initial vulnerability scoring model to obtain a target vulnerability scoring model; and evaluating the vulnerability associated data to be evaluated of the target platform based on the target vulnerability scoring model to obtain a vulnerability priority assessment result.

[0127] In some embodiments, the vulnerability assessment method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the vulnerability assessment method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the vulnerability assessment method in any other appropriate manner (e.g., by means of firmware).

[0128] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0129] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0130] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0131] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0132] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0133] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0134] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0135] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A vulnerability assessment method, characterized in that: include: Obtain vulnerability assessment related data of the target platform; Creating an initial vulnerability scoring model using a linear regression method based on the vulnerability assessment associated data; Adjusting the initial model weights in the initial vulnerability scoring model to obtain a target vulnerability scoring model; The vulnerability-related data to be assessed of the target platform is assessed according to the target vulnerability scoring model to obtain a vulnerability priority assessment result.

2. The method according to claim 1, characterized in that The step of obtaining vulnerability assessment related data of the target platform includes: Collecting the full amount of vulnerability-related data of the target platform; wherein the full amount of vulnerability-related data includes vulnerability CVE data, EPSS data of vulnerability CVE, and vulnerability-related asset data; Feature extraction is performed on the full amount of vulnerability related data to obtain the vulnerability assessment related data; wherein the vulnerability assessment related data includes vulnerability EPSS data, vulnerability severity data, vulnerability exploitation probability data, vulnerability CIA scoring data and vulnerability asset importance identification data.

3. The method according to claim 1, characterized in that The step of creating an initial vulnerability scoring model using a linear regression method according to the vulnerability assessment associated data includes: Determine an initial vulnerability threat score corresponding to each vulnerability according to the vulnerability assessment associated data; Creating an original vulnerability scoring model based on the initial vulnerability threat score and the vulnerability assessment associated data; The linear regression method and the vulnerability assessment associated data are used to calculate the initial model weights of each variable in the original vulnerability scoring model to obtain the initial vulnerability scoring model.

4. The method according to claim 1, characterized in that The adjusting the initial model weights in the initial vulnerability scoring model to obtain a target vulnerability scoring model includes: Constructing a decision tree adapted to a random forest algorithm according to the vulnerability assessment associated data; Obtaining the feature weight ratio of the weight feature of each decision tree to the initial model weight; Calculate the average value of each of the initial model weights according to the feature weight proportion of the weight feature to obtain the target model weight; The corresponding initial model weights are replaced and updated according to the target model weights to obtain the target vulnerability scoring model.

5. The method according to any one of claims 1 to 4, characterized in that: The initial vulnerability scoring model is: Total_score=a*Rscore+b*EPSSS_score+c*Percentile_score+d*CIA_tota l_score+e*is_important_bonus; Among them, Total_score represents the vulnerability score, Rscore is the vulnerability severity data, a is the initial model weight corresponding to the vulnerability severity data, EPSSS_score is the vulnerability EPSS data, b is the initial model weight corresponding to the vulnerability EPSS data, Percentile_score is the vulnerability exploitation probability data, c is the initial model weight corresponding to the vulnerability exploitation probability data, CIA_total_score is the vulnerability CIA scoring data, d is the initial model weight corresponding to the vulnerability CIA scoring data, is_important_bonus is the vulnerability asset importance identification data, and e is the initial model weight corresponding to the vulnerability asset importance identification data.

6. The method according to claim 1, characterized in that After evaluating the vulnerability-related data to be evaluated according to the target vulnerability scoring model to obtain the vulnerability priority evaluation result, the method further includes: Determine the vulnerabilities to be addressed based on the vulnerability priority assessment results; The vulnerability to be processed is distributed and processed through a scheduled script.

7. The method according to claim 6, characterized in that The vulnerability dispatching process for the vulnerability to be processed by the timed script includes: When it is determined that the script start time has been reached, determining the vulnerability responsible person for the vulnerability to be processed according to the vulnerability assessment associated data through the timed script; When it is determined that the vulnerability to be processed meets the vulnerability processing task merging condition, the vulnerability task merging process is performed on the vulnerability to be processed to obtain a merged vulnerability processing task; The merged vulnerability handling task is dispatched to the corresponding vulnerability person in charge for vulnerability handling.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the vulnerability assessment method described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the vulnerability assessment method described in any one of claims 1-6 when executed.

10. A computer program product comprising a computer program / instructions, wherein: When the computer program / instructions are executed by a processor, the vulnerability assessment method according to any one of claims 1 to 6 is implemented.

Images