Efficient and intelligent information vulnerability automatic repair method and system

Abstract

The invention discloses an efficient and intelligent information vulnerability automatic repairing method and system. The method comprises the steps of operating a target system in a sandbox environment, obtaining activity records of all system information in the target system, comparing a reference behavior with a real-time detection behavior, and marking vulnerabilities possibly existing in information abnormal behaviors; constructing a vulnerability behavior simulation model, identifying vulnerabilities possibly existing in the information abnormal behavior, and generating a vulnerability repair strategy and a score; simulating the validity of the vulnerability repair strategies under various attack scenes in a sandbox environment to obtain vulnerability repair scores under simulated attacks, and adjusting the vulnerability behavior simulation model by comparing the vulnerability repair scores with the vulnerability repair scores under the simulated attacks; according to the method, the information abnormal behavior in the target system is identified, the vulnerability repair strategy is generated through the model, the stability of vulnerability repair is ensured, the vulnerability repair strategy is tested and adjusted in various attack environments, and the defense capability of an actual system is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of vulnerability repair, and in particular to an efficient and intelligent information vulnerability automatic repair method and system. Background Art

[0002] With the continuous development of information technology, the complexity of network systems and application software is increasing, and the number of vulnerabilities in information systems is also increasing dramatically. Existing vulnerability detection and repair technologies usually rely on manual screening or automated tools based on static analysis, which mainly rely on known vulnerability feature libraries. However, in the face of increasingly complex unknown vulnerabilities and changing attack methods, traditional methods are inefficient and prone to misjudgment and omissions. More importantly, these tools have poor real-time performance and cannot comprehensively analyze all operations of the system in a short period of time, which may cause the system to be attacked before it is repaired. In addition, traditional repair methods are mostly based on simple vulnerability shielding or disabling functions, lacking intelligent repair methods for different attack scenarios, making the system's defense capabilities insufficient when facing complex attacks. Summary of the invention

[0003] The purpose of this section is to summarize some aspects of embodiments of the present invention and briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section and the specification abstract and the invention title of this application to avoid blurring the purpose of this section, the specification abstract and the invention title, and such simplifications or omissions cannot be used to limit the scope of the present invention.

[0004] In view of the above existing problems, the present invention is proposed. Therefore, the present invention provides an efficient and intelligent information vulnerability automatic repair method to solve the problems mentioned in the background technology.

[0005] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0006] In a first aspect, the present invention provides an efficient and intelligent method for automatically repairing information vulnerabilities, comprising:

[0007] Running the target system in a sandbox environment, obtaining activity records of all system information in the target system, defining normal activities as baseline behaviors, comparing the baseline behaviors with real-time detection behaviors, and marking possible vulnerabilities in abnormal information behaviors;

[0008] Constructing a vulnerability behavior simulation model, identifying possible vulnerabilities in the abnormal information behavior through the vulnerability behavior simulation model, and generating vulnerability repair strategies and scores based on the vulnerability identification results;

[0009] The effectiveness of vulnerability repair strategies under various attack scenarios is simulated in a sandbox environment to obtain the vulnerability repair score under simulated attacks. By comparing the vulnerability repair score with the vulnerability repair score under simulated attacks, the vulnerability behavior simulation model is adjusted to achieve automatic repair of model information vulnerabilities.

[0010] As a preferred solution of the efficient and intelligent information vulnerability automatic repair method described in the present invention, it includes:

[0011] When the target system is in a no-load state, the system call frequency, memory usage, and data access latency in all time periods are recorded and weighted averaged to obtain the comprehensive value of the benchmark behavior.

[0012] As a preferred solution of the efficient and intelligent automatic repair method for information vulnerabilities of the present invention, the following steps are performed: comparing the baseline behavior with the real-time detection behavior to mark possible vulnerabilities in the abnormal information behavior, including:

[0013] The system call frequency, memory usage, and data access latency detected in real time in the current time period are weighted averaged to obtain a comprehensive value of the real-time detection behavior;

[0014] The comprehensive value of the benchmark behavior is compared with the comprehensive value of the real-time detection behavior. If the comprehensive value of the real-time detection behavior exceeds the comprehensive value of the benchmark behavior, it indicates that there is abnormal information behavior in the system in the current time period, and the abnormal information is marked as a vulnerability.

[0015] As a preferred solution of the efficient and intelligent automatic repair method for information vulnerabilities described in the present invention, a vulnerability behavior simulation model is constructed, and the possible vulnerabilities in the abnormal information behavior are identified through the vulnerability behavior simulation model, including:

[0016] The abnormal information of vulnerability marks is used as the input set of the vulnerability behavior simulation model, and the true and false vulnerabilities of the input set are identified through time windows.

[0017] As a preferred solution of the efficient and intelligent information vulnerability automatic repair method of the present invention, the true and false identification of the vulnerability includes:

[0018] Set a difference threshold between abnormal information, establish multiple associations for the abnormal information in the input set, and calculate the difference between the abnormal information;

[0019] A unique priority weight is assigned to each association relationship. When the time window rolls, if the association relationship corresponding to the highest priority weight continues to occur, that is, it appears in at least one time window and the difference value exceeds the difference threshold, it means that the abnormal information corresponding to the association relationship is a real vulnerability, otherwise it is a false vulnerability, and the vulnerability mark of the corresponding abnormal information is revoked and marked as normal information.

[0020] As a preferred solution of the efficient and intelligent information vulnerability automatic repair method of the present invention, generating a vulnerability repair strategy includes:

[0021] If it is a real vulnerability, then calculate the proportion of the real vulnerability in the total amount of information to obtain the amount of information requests affected by the real vulnerability;

[0022] According to the amount of information requests under the influence of the real vulnerability, the number of interfaces and CPU resource consumption rate required by the information request amount in the target system are considered, and the breadth of the vulnerability in the target system is evaluated according to the number of interfaces;

[0023] Through the breadth of the propagation, the CPU resource consumption rate is limited in scope, and the access rights of the corresponding interface are improved;

[0024] Based on the breadth of said propagation and access rights, a vulnerability remediation score is obtained.

[0025] As a preferred solution of the efficient and intelligent automatic information vulnerability repair method described in the present invention, the effectiveness of vulnerability repair strategies under various attack scenarios is simulated in a sandbox environment to obtain vulnerability repair scores under simulated attacks, and the vulnerability behavior simulation model is adjusted by comparing the vulnerability repair scores with the vulnerability repair scores under simulated attacks, including:

[0026] Simulate multiple attack methods in a sandbox environment, score the vulnerability repair strategy for each attack, and obtain vulnerability repair scores under multiple attacks;

[0027] The vulnerability repair score is compared with the vulnerability repair scores under multiple attacks. If the vulnerability repair scores under multiple attacks are lower than the vulnerability repair score, the vulnerability repair strategy is readjusted.

[0028] In a second aspect, the present invention provides an efficient and intelligent information vulnerability automatic repair system, which includes:

[0029] A baseline behavior monitoring module is configured to run a target system in a sandbox environment, obtain activity records of all system information in the target system, define normal activities as baseline behaviors, compare the baseline behaviors with real-time detection behaviors, and mark possible vulnerabilities in abnormal information behaviors;

[0030] A vulnerability simulation and strategy generation module is configured to construct a vulnerability behavior simulation model, identify possible vulnerabilities in the information abnormal behavior through the vulnerability behavior simulation model, and generate a vulnerability repair strategy and score based on the vulnerability identification result;

[0031] The repair verification and model optimization module is configured to simulate the effectiveness of vulnerability repair strategies under various attack scenarios in a sandbox environment, obtain the vulnerability repair score under the simulated attack, and adjust the vulnerability behavior simulation model by comparing the vulnerability repair score with the vulnerability repair score under the simulated attack, thereby achieving automatic repair of model information vulnerabilities.

[0032] In a third aspect, the present invention provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, wherein: the processor implements any step of the above method when executing the computer program.

[0033] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: the computer program implements any step of the above method when executed by a processor.

[0034] Compared with the prior art, the invention has the following beneficial effects:

[0035] 1. The present invention establishes a comparison mechanism between baseline behavior and real-time behavior by running the target system in a sandbox environment, thereby being able to quickly identify abnormal behavior and significantly reduce the probability of false alarms;

[0036] 2. In-depth identification of marked abnormal behaviors and generation of corresponding repair strategies and scores; not only can it accurately locate real vulnerabilities, but also distinguish false vulnerabilities, thereby improving the pertinence of vulnerability repair strategies and avoiding the problem of system performance degradation or functional limitations caused by the one-size-fits-all approach of traditional methods;

[0037] 3. By comparing the repair scores under different attack scenarios, the vulnerability behavior simulation model is dynamically adjusted; this enables the model to self-learn and continuously improve its ability to identify and repair different types of vulnerabilities, thereby achieving intelligent vulnerability repair and reducing dependence on manual intervention. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. Among them:

[0039] Figure 1This is an overall flow chart of an efficient and intelligent information vulnerability automatic repair method according to an embodiment of the present invention;

[0040] Figure 2 This is a multi-parameter loss curve diagram during the vulnerability repair process of the efficient and intelligent information vulnerability automatic repair method described in an embodiment of the present invention. DETAILED DESCRIPTION

[0041] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0042] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0043] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0044] The present invention is described in detail with reference to schematic diagrams. When describing the embodiments of the present invention, for the sake of convenience, the cross-sectional diagrams showing the device structure will not be partially enlarged according to the general scale, and the schematic diagrams are only examples, which should not limit the scope of protection of the present invention. In addition, in actual production, the three-dimensional dimensions of length, width and depth should be included.

[0045] At the same time, in the description of the present invention, it should be noted that the directions or positional relationships indicated by the terms "upper, lower, inner and outer" are based on the directions or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore cannot be understood as limiting the present invention. In addition, the terms "first, second or third" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance.

[0046] In the present invention, unless otherwise clearly specified and limited, the terms "install, connect, connect" should be understood in a broad sense, for example: it can be a fixed connection, a detachable connection or an integral connection; it can also be a mechanical connection, an electrical connection or a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0047] Example 1

[0048] Reference Figure 1 , which is the first embodiment of the present invention, and provides an efficient and intelligent information vulnerability automatic repair method, comprising:

[0049] S1. Run the target system in a sandbox environment, obtain activity records of all system information in the target system, define normal activities as baseline behaviors, compare the baseline behaviors with real-time detection behaviors, and mark possible vulnerabilities in abnormal information behaviors;

[0050] It should be explained that a sandbox environment is an isolated testing and operating environment used for testing without affecting the actual system and data. Testing in a sandbox environment ensures that there is no impact on the real system.

[0051] Furthermore, the benchmark behavior refers to recording the system call frequency, memory usage, and data access latency in all time periods when the target system is in a no-load state, and performing weighted average to obtain a comprehensive value of the benchmark behavior;

[0052] Furthermore, the same processing method as the comprehensive value of the benchmark behavior is adopted to perform weighted average of the system call frequency, memory occupancy rate and data access delay of the current time period detected in real time to obtain the comprehensive value of the real-time detection behavior;

[0053] It should be noted that in the calculation of the comprehensive value of the real-time detection behavior, the target system can be in a no-load or loaded state;

[0054] Specifically, the weights of the weighted average are the weight values ​​of the call frequency, memory occupancy, and data access latency of the corresponding system;

[0055] It should be noted that recording the system call frequency, memory usage, and data access latency when the target system is under no-load conditions can avoid the impact of fluctuations in business activities, user requests, or other loads, thereby obtaining a more stable reference value; otherwise, if the information is recorded under load conditions, the comprehensive value of the baseline behavior will deviate, thereby affecting the misjudgment of abnormal information behavior;

[0056] Furthermore, the comprehensive value of the baseline behavior is compared with the comprehensive value of the real-time detection behavior. If the comprehensive value of the real-time detection behavior exceeds the comprehensive value of the baseline behavior, it means that there is abnormal information behavior in the system in the current time period, and the abnormal information is marked as a vulnerability;

[0057] S2. Build a vulnerability behavior simulation model to identify possible vulnerabilities in information abnormal behavior, and generate vulnerability repair strategies and scores based on vulnerability identification results;

[0058] Furthermore, to construct a vulnerability behavior simulation model, it is necessary to use the abnormal information of vulnerability markers as the input set of the vulnerability behavior simulation model, and identify the true and false vulnerabilities of the input set through time windows;

[0059] It should be explained that in practice, real vulnerabilities usually show stable or gradually worsening characteristics within a certain time range, so continuous observation is required, so the time window method is adopted; if the abnormal information continues to appear in multiple time windows, it is a real vulnerability; if it only appears in a certain time window, it is a false vulnerability or a false alarm, which requires further judgment;

[0060] Furthermore, the false vulnerability is determined as follows:

[0061] Set a difference threshold between abnormal information, establish multiple associations for the abnormal information in the input set, and calculate the difference between the abnormal information;

[0062] For each association, a unique priority weight is assigned. When the time window rolls over, if the association corresponding to the highest priority weight continues to occur, that is, it appears in at least one time window and the difference value exceeds the difference threshold, it means that the abnormal information corresponding to the association is a real vulnerability, otherwise it is a false vulnerability, and the vulnerability mark of the corresponding abnormal information is revoked and marked as normal information;

[0063] Furthermore, the false positive judgment is as follows:

[0064] When the time window rolls, if the association interval corresponding to the highest priority weight occurs, that is, there is an empty time window between the current time window and the next time window, it is a false alarm;

[0065] Furthermore, if it is a real vulnerability, the proportion of the real vulnerability in the total amount of information is calculated to obtain the amount of information requests affected by the real vulnerability;

[0066] Furthermore, according to the amount of information requests under the influence of the real vulnerability, the number of interfaces and CPU resource consumption rate required by the information request volume in the target system are considered, and the breadth of the vulnerability propagation in the target system is evaluated based on the number of interfaces;

[0067] It should be noted that if the number of interfaces is greater, it means that the vulnerability may spread through more channels or modules, making the spread wider and the repair more difficult;

[0068] Furthermore, by spreading the vulnerability, the CPU resource usage of the vulnerability-related interfaces is limited, and the access rights of the corresponding interfaces are increased to avoid abnormally high resource consumption causing system instability;

[0069] Going a step further, based on the breadth of spread and access rights, a vulnerability remediation score is obtained;

[0070] It should be noted that the vulnerability remediation score reflects the effectiveness of the vulnerability remediation strategy. The lower the score, the worse the vulnerability remediation effect;

[0071] S3. Simulate the effectiveness of vulnerability repair strategies under various attack scenarios in a sandbox environment, obtain vulnerability repair scores under simulated attacks, and adjust the vulnerability behavior simulation model by comparing the vulnerability repair scores with those under simulated attacks, thereby achieving automatic repair of model information vulnerabilities;

[0072] Furthermore, multiple attack methods are simulated in the sandbox environment, and the vulnerability repair strategy is scored for each attack to obtain vulnerability repair scores under multiple attacks;

[0073] Specifically, it simulates multiple attack methods including brute force cracking, SQL injection, and denial of service attacks;

[0074] Furthermore, the vulnerability repair score is compared with the vulnerability repair score under multiple attacks. If the vulnerability repair score under multiple attacks is lower than the vulnerability repair score, the vulnerability repair strategy is readjusted;

[0075] It should be noted that if the vulnerability remediation scores under multiple attacks are lower than the vulnerability remediation score, it means that the vulnerability remediation strategy does not perform well in the simulated attack scenario, and it is necessary to improve the CPU resource utilization rate and the access rights of the corresponding interface under the corresponding simulated attack mode.

[0076] Furthermore, this embodiment also provides an efficient and intelligent information vulnerability automatic repair system, including:

[0077] A baseline behavior monitoring module is configured to run a target system in a sandbox environment, obtain activity records of all system information in the target system, define normal activities as baseline behaviors, compare the baseline behaviors with real-time detection behaviors, and mark possible vulnerabilities in abnormal information behaviors;

[0078] A vulnerability simulation and strategy generation module is configured to construct a vulnerability behavior simulation model, identify possible vulnerabilities in the information abnormal behavior through the vulnerability behavior simulation model, and generate a vulnerability repair strategy and score based on the vulnerability identification result;

[0079] The repair verification and model optimization module is configured to simulate the effectiveness of vulnerability repair strategies under various attack scenarios in a sandbox environment, obtain the vulnerability repair score under the simulated attack, and adjust the vulnerability behavior simulation model by comparing the vulnerability repair score with the vulnerability repair score under the simulated attack, thereby achieving automatic repair of model information vulnerabilities.

[0080] This embodiment also provides a computer device, which is applicable to the case of an efficient and intelligent information vulnerability automatic repair method, including:

[0081] Memory and processor; the memory is used to store computer executable instructions, and the processor is used to execute computer executable instructions to implement the efficient and intelligent information vulnerability automatic repair method proposed in the above embodiment.

[0082] The computer device may be a terminal, and the computer device includes a processor, a memory, a communication interface, a display screen and an input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, an operator network, NFC (near field communication) or other technologies. The display screen of the computer device may be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device may be a touch layer covering the display screen, or a key, trackball or touchpad provided on the housing of the computer device, or an external keyboard, touchpad or mouse, etc.

[0083] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, the efficient and intelligent information vulnerability automatic repair method proposed in the above embodiment is implemented.

[0084] The storage medium proposed in this embodiment and the data storage method proposed in the above embodiment belong to the same inventive concept. The technical details not fully described in this embodiment can be found in the above embodiment, and this embodiment has the same beneficial effects as the above embodiment.

[0085] Example 2

[0086] Reference Figure 2, which is the second embodiment of the present invention, and this embodiment provides an efficient and intelligent information vulnerability automatic repair method, including: in order to evaluate the advantages of the method of the present invention in practical applications, a simulation experiment scenario is constructed to compare with the traditional vulnerability repair method; the simulation experiment is run on a medium-configuration server (4-core CPU, 8GB memory), and the target system is a simulated user data management system, including multiple API interface modules; the experiment is carried out in a sandbox environment to isolate the actual system and ensure that it will not affect the real business data; real-time system data is collected under load conditions (simulating 100 concurrent requests) and compared with the benchmark behavior, and the data in Table 1 are as follows;

[0087] Table 1

[0088]

[0089] As can be seen from Table 1, in terms of resource consumption control, the traditional method still has high resource consumption (65% CPU usage and 580MB memory usage) after the vulnerability is repaired, while the method of the present invention significantly reduces the resource consumption after repair to the level of the baseline behavior by limiting the range of resource consumption rate and adjusting the access rights. The CPU consumption rate is reduced to 20% and the memory usage rate is reduced to 270MB, indicating that the method of the present invention has obvious advantages in reducing system load and ensuring the stability of the system; secondly, in terms of repair effectiveness and system stability, the repair effectiveness of the traditional method is about 65%, indicating that the vulnerability defense effect after its repair is poor, and the score in the system stability score is only 55, and there is a certain system fluctuation; while the effectiveness of the method of the present invention reaches 95% after repair, and the system stability score is 90, indicating that the system repair solution can not only cope with vulnerability threats, but also significantly improve the overall stability of the system; this difference is due to the fact that the present invention compares and optimizes the repair scores under multiple simulated attack scenarios to ensure the applicability and defense capabilities of the repair solution under various attack methods;

[0090] In addition, reference Figure 2It can be seen that the CPU usage rate decreases rapidly over time, from an initial value of about 65% to a target value close to 20%, and is close to being stable within 50 seconds, which verifies that the method of the present invention has efficient CPU resource optimization capabilities when dealing with vulnerabilities, and can alleviate the high load state of the system in a relatively short time, thereby improving the overall response speed; while the rate of decrease in memory occupancy is relatively slow compared to the CPU, but it still tends to be stable after about 50 seconds, which verifies that the present invention can effectively clean up and release memory space, so that the system can gradually return to a healthy state with low occupancy, thereby avoiding system instability caused by memory leaks or resource abuse; finally, the data access delay decreases rapidly at the beginning of the repair, from about 300ms to nearly 130ms, indicating that the present invention effectively reduces the delay of data access during the vulnerability repair process and improves the access efficiency of the system.

[0091] Those skilled in the art will appreciate that the embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the application can adopt the form of complete hardware embodiments, complete software embodiments, or embodiments in combination with software and hardware. Moreover, the application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program codes. The scheme in the embodiments of the present application can be implemented in various computer languages, for example, object-oriented programming language Java and literal scripting language JavaScript, etc.

[0092] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0093] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0094] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0095] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0096] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. An efficient and intelligent method for automatically repairing information vulnerabilities, characterized in that: include: Running the target system in a sandbox environment, obtaining activity records of all system information in the target system, defining normal activities as baseline behaviors, comparing the baseline behaviors with real-time detection behaviors, and marking possible vulnerabilities in abnormal information behaviors; Constructing a vulnerability behavior simulation model, identifying possible vulnerabilities in the abnormal information behavior through the vulnerability behavior simulation model, and generating vulnerability repair strategies and scores based on the vulnerability identification results; The effectiveness of vulnerability repair strategies under various attack scenarios is simulated in a sandbox environment to obtain the vulnerability repair score under simulated attacks. By comparing the vulnerability repair score with the vulnerability repair score under simulated attacks, the vulnerability behavior simulation model is adjusted to achieve automatic repair of model information vulnerabilities.

2. The efficient and intelligent automatic information vulnerability repair method according to claim 1, characterized in that: The benchmark behaviors include: When the target system is in a no-load state, the system's call frequency, memory usage, and data access latency in all time periods are recorded and weighted averaged to obtain a comprehensive value of the benchmark behavior.

3. The efficient and intelligent automatic information vulnerability repair method according to claim 1 or 2, characterized in that: Compare baseline behavior with real-time detection behavior to flag possible vulnerabilities in information anomaly behavior, including: The system call frequency, memory usage, and data access latency detected in real time in the current time period are weighted averaged to obtain a comprehensive value of the real-time detection behavior; The comprehensive value of the benchmark behavior is compared with the comprehensive value of the real-time detection behavior. If the comprehensive value of the real-time detection behavior exceeds the comprehensive value of the benchmark behavior, it indicates that there is abnormal information behavior in the system in the current time period, and the abnormal information is marked as a vulnerability.

4. The efficient and intelligent automatic information vulnerability repair method according to claim 3 is characterized in that: Constructing a vulnerability behavior simulation model, and identifying possible vulnerabilities in the abnormal information behavior through the vulnerability behavior simulation model, including: The abnormal information of vulnerability marks is used as the input set of the vulnerability behavior simulation model, and the true and false vulnerabilities of the input set are identified through time windows.

5. The efficient and intelligent automatic information vulnerability repair method according to claim 4, characterized in that: Identification of the true or false of the vulnerability, including: Set a difference threshold between abnormal information, establish multiple associations for the abnormal information in the input set, and calculate the difference between the abnormal information; A unique priority weight is assigned to each association relationship. When the time window rolls, if the association relationship corresponding to the highest priority weight continues to occur, that is, it appears in at least one time window and the difference value exceeds the difference threshold, it means that the abnormal information corresponding to the association relationship is a real vulnerability, otherwise it is a false vulnerability, and the vulnerability mark of the corresponding abnormal information is revoked and marked as normal information.

6. The efficient and intelligent automatic information vulnerability repair method according to claim 5, characterized in that: Generate vulnerability remediation strategies based on vulnerability identification results, including: If it is a real vulnerability, then calculate the proportion of the real vulnerability in the total amount of information to obtain the amount of information requests affected by the real vulnerability; According to the amount of information requests under the influence of the real vulnerability, the number of interfaces and CPU resource consumption rate required by the information request amount in the target system are considered, and the breadth of the vulnerability in the target system is evaluated according to the number of interfaces; Through the breadth of the propagation, the CPU resource consumption rate is limited in scope, and the access rights of the corresponding interface are improved; Based on the breadth of said propagation and access rights, a vulnerability remediation score is obtained.

7. The efficient and intelligent automatic information vulnerability repair method according to claim 6, characterized in that: The effectiveness of vulnerability repair strategies under various attack scenarios is simulated in the sandbox environment to obtain vulnerability repair scores under simulated attacks. By comparing the vulnerability repair scores with the vulnerability repair scores under simulated attacks, the vulnerability behavior simulation model is adjusted, including: Simulate multiple attack methods in a sandbox environment, score the vulnerability repair strategy for each attack, and obtain vulnerability repair scores under multiple attacks; The vulnerability repair score is compared with the vulnerability repair scores under multiple attacks. If the vulnerability repair scores under multiple attacks are lower than the vulnerability repair score, the vulnerability repair strategy is readjusted.

8. An efficient and intelligent automatic information vulnerability repair system, based on the efficient and intelligent automatic information vulnerability repair method according to any one of claims 1 to 7, characterized in that: include: A baseline behavior monitoring module is configured to run a target system in a sandbox environment, obtain activity records of all system information in the target system, define normal activities as baseline behaviors, compare the baseline behaviors with real-time detection behaviors, and mark possible vulnerabilities in abnormal information behaviors; A vulnerability simulation and strategy generation module is configured to construct a vulnerability behavior simulation model, identify possible vulnerabilities in the information abnormal behavior through the vulnerability behavior simulation model, and generate a vulnerability repair strategy and score based on the vulnerability identification result; The repair verification and model optimization module is configured to simulate the effectiveness of vulnerability repair strategies under various attack scenarios in a sandbox environment, obtain the vulnerability repair score under the simulated attack, and adjust the vulnerability behavior simulation model by comparing the vulnerability repair score with the vulnerability repair score under the simulated attack, thereby achieving automatic repair of model information vulnerabilities.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images