Method, device and equipment for optimizing system security vulnerability management based on extension program

Abstract

The invention provides a method for optimizing system security vulnerability management based on an extension program. The method can be applied to the field of information security or the field of artificial intelligence. The method comprises the following steps: in response to a business demand of developing an application system, collecting a code under editing in an integrated development environment in real time; scanning security vulnerabilities of the codes under editing through a customized extension program, analyzing and comparing the codes under editing according to rules in a rule base, and identifying potential security vulnerabilities, the customized extension program being integrated in an integrated development environment, and the rule base being built in the customized extension program; in response to the scanned security vulnerability, obtaining a repair suggestion for the security vulnerability by using a pre-trained vulnerability management model according to the compiled code associated with the security vulnerability; and on the basis of the repair suggestion, adjusting the code under editing so as to repair the security vulnerability. The invention further provides a device and equipment for optimizing system security vulnerability management based on the extension program, a storage medium and a program product.

Description

Technical Field

[0001] The present disclosure relates to the field of information security or artificial intelligence, and more specifically to a method, device, equipment, medium and program product for optimizing system security vulnerability management based on an extended program. Background Art

[0002] In order to ensure the security of the system, security-related tests will be carried out before the application system is put into production. For problems found during the security test, the project team developers need to confirm the problem, analyze the impact, and rectify the code, and then conduct security tests again. The whole process needs to be repeated frequently according to the relevant situations of the security test. Finally, after the security test vulnerabilities are rectified, the application system can be put into production and released.

[0003] At present, although there are some automated security scanning tools, the number of security vulnerabilities discovered during the testing process is large and the false alarm ratio is high. During the vulnerability rectification process, they need to be checked one by one to conduct security and impact analysis, and finally complete the rectification of relevant vulnerabilities. The whole process is relatively complicated and cumbersome, and the rectification process requires a long time cost. In addition, the timeliness requirements in the application production stage are relatively high, so developers and testers need to work overtime frequently to complete the rectification of relevant vulnerabilities, thus forming a "vicious circle", which threatens the safe production of application systems from another perspective. Summary of the invention

[0004] In view of the above problems, embodiments of the present disclosure provide a method, apparatus, device, medium and program product for optimizing system security vulnerability management based on an extension program.

[0005] According to a first aspect of the present disclosure, a method for optimizing system security vulnerability management based on an extension program is provided, the method comprising: in response to the business needs of developing an application system, collecting in-process code in an integrated development environment in real time; scanning the in-process code for security vulnerabilities through a customized extension program, and parsing and comparing the in-process code according to rules in a rule base to identify potential security vulnerabilities, wherein the customized extension program is integrated into the integrated development environment, and the rule base is built into the customized extension program; in response to scanning the security vulnerability, obtaining a repair suggestion for the security vulnerability based on the in-process code associated with the security vulnerability using a pre-trained vulnerability management model; and adjusting the in-process code based on the repair suggestion to repair the security vulnerability.

[0006] According to an embodiment of the present disclosure, the method further includes: in response to scanning the security vulnerability, highlighting the in-progress code associated with the security vulnerability in the window of the integrated development environment.

[0007] According to an embodiment of the present disclosure, scanning the in-process code for security vulnerabilities through a customized extension program includes: in response to executing the in-process code, monitoring the running data of the in-process code through the customized extension program, and identifying potential security vulnerabilities based on the running data.

[0008] According to an embodiment of the present disclosure, in response to scanning the security vulnerability, based on the in-code associated with the security vulnerability, a pre-trained vulnerability management model is used to obtain a repair suggestion for the security vulnerability, including: analyzing the context information of the in-code associated with the security vulnerability through the vulnerability management model, and identifying characteristics of the security vulnerability; and obtaining the repair suggestion output by the vulnerability management model based on the context information and the characteristics of the security vulnerability.

[0009] According to an embodiment of the present disclosure, the method also includes: providing repair suggestions to the developers of the application system through a conversational interface or an intelligent question-and-answer format, and guiding the developers to repair security vulnerabilities, wherein the repair suggestions include but are not limited to examples of repair code snippets for each of the security vulnerabilities, repair steps, and the highest priority repair guidelines obtained based on risk assessment.

[0010] According to an embodiment of the present disclosure, the method also includes: in response to completing the repair of the security vulnerability of the code in progress, obtaining an application system to be put into production; performing a security scan on the entire code of the application system to be put into production to determine whether there is a security vulnerability; and when the application system to be put into production has a security vulnerability, analyzing and rectifying the security vulnerability, and putting the repaired application system into production and releasing it.

[0011] According to an embodiment of the present disclosure, the customized extension program includes but is not limited to a code scanning tool.

[0012] The second aspect of the present disclosure provides a device for optimizing system security vulnerability management based on an extension program, the device comprising: a collection module, for collecting in-process code in an integrated development environment in real time in response to the business needs of developing an application system; a scanning module, for scanning the in-process code for security vulnerabilities through a customized extension program, and parsing and comparing the in-process code according to rules in a rule base to identify potential security vulnerabilities, wherein the customized extension program is integrated in the integrated development environment, and the rule base is built into the customized extension program; a suggestion module, for obtaining a repair suggestion for the security vulnerability in response to scanning the security vulnerability and according to the in-process code associated with the security vulnerability using a pre-trained vulnerability management model; and a repair module, for adjusting the in-process code based on the repair suggestion to repair the security vulnerability.

[0013] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0014] The fourth aspect of the present disclosure further provides a computer-readable storage medium having a computer program or instructions stored thereon, which implements the steps of the above method when the above computer program or instructions are executed by a processor.

[0015] The fifth aspect of the present disclosure further provides a computer program product, including a computer program or instructions, which implement the steps of the above method when the above computer program or instructions are executed by a processor.

[0016] According to the method, apparatus, device, medium and program product for optimizing system security vulnerability management based on extension programs provided in the embodiments of the present disclosure, a security scan of the coded content is performed during the coding process through a customized extension program, and the problems found are highlighted in the window of the integrated development environment. At the same time, various forms of repair suggestions are generated through the vulnerability management model, thereby helping relevant developers to adjust relevant codes in a timely manner, quickly complete the rectification of discovered vulnerabilities, improve the work efficiency of developers, avoid the occurrence of similar security vulnerabilities, thereby promoting the early discovery and early rectification of security vulnerabilities in the application system, reducing the number of security vulnerabilities that may be discovered later from the source, and saving various costs for the rectification of security vulnerabilities in the production stage. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0018] Figure 1 A schematic diagram of an application scenario of a method, apparatus, device, medium, and program product for optimizing system security vulnerability management based on an extended program according to an embodiment of the present disclosure is shown;

[0019] Figure 2 A flowchart of a method for optimizing system security vulnerability management based on an extension program according to an embodiment of the present disclosure is schematically shown;

[0020] Figure 3 Another flowchart of the method for optimizing system security vulnerability management based on an extension program according to an embodiment of the present disclosure is schematically shown;

[0021] Figure 4 A flowchart schematically shows the production release of an application system according to an embodiment of the present disclosure;

[0022] Figure 5A structural block diagram of an apparatus for optimizing system security vulnerability management based on an extension program according to an embodiment of the present disclosure is schematically shown; and

[0023] Figure 6 A block diagram of an electronic device suitable for implementing a method for optimizing system security vulnerability management based on an extension program according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0024] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0025] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0026] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0027] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0028] It should be noted that the method and device for optimizing system security vulnerability management based on extension programs determined in the present disclosure can be used in the financial field, information security or artificial intelligence field, and can also be used in any field other than the financial field. The application field of the method and device for optimizing system security vulnerability management based on extension programs disclosed in the present disclosure is not limited.

[0029] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0030] In the technical solution of the present disclosure, the user information (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0031] In the scenario of using personal information for automated decision-making, the methods, devices, and systems provided by the embodiments of the present disclosure provide users with corresponding operation portals for users to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered. The expression "automated decision-making" here refers to the activity of automatically analyzing and evaluating a person's behavioral habits, interests and hobbies, or economic, health, credit status, etc. through computer programs, and making decisions. The expression "expert decision-making" here refers to the activity of making decisions by people who specialize in a certain field, have specialized experience, knowledge and skills, and have reached a certain level of professionalism.

[0032] Embodiments of the present disclosure provide a method, apparatus, device, medium, and program product for optimizing system security vulnerability management based on an extended program.

[0033] Figure 1 The application scenario diagram of the method, apparatus, device, medium and program product for optimizing system security vulnerability management based on extended programs according to an embodiment of the present disclosure is schematically shown.

[0034] like Figure 1 As shown, the application scenario 100 according to this embodiment may include terminal devices 101, 102, 103, a network 104, and a server 105. The network 104 is used to provide a medium for communication links between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0035] The user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0036] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0037] The server 105 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0038] It should be noted that the method for optimizing system security vulnerability management based on extension programs provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the device for optimizing system security vulnerability management based on extension programs provided in the embodiment of the present disclosure can generally be set in the server 105. The method for optimizing system security vulnerability management based on extension programs provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Accordingly, the device for optimizing system security vulnerability management based on extension programs provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0039] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to the implementation requirements.

[0040] The following will be based on Figure 1 The scene described by Figures 2 to 4 The method for optimizing system security vulnerability management based on an extension program in an embodiment of the present disclosure is described in detail.

[0041] The inventor has found through research that in the relevant technology, the scheme of security vulnerability management generally conducts security testing of the application system after the development task is completed. The time of discovering security vulnerabilities is relatively delayed, the number of vulnerabilities is large, and there are certain false alarms, so the vulnerability analysis and rectification process is relatively long, complicated and indispensable. At the same time, during the vulnerability rectification process, the developers need to sort out the development ideas again and rectify the security vulnerabilities in combination with the current situation. The whole process needs to have a good working state, but the time of the general production stage is relatively tight, which is easy to bring great work pressure to the developers. The combination of the two can easily cause the work related to vulnerability rectification to fall into a "vicious circle", resulting in more vulnerabilities and worse code quality. In response to the above problems, the disclosed embodiment provides a method for optimizing system security vulnerability management based on extension programs, so as to reduce the work intensity of the project team in rectifying security vulnerabilities, improve the effectiveness and quality of rectification work, and ensure the orderly and controllable process of system application production.

[0042] Figure 2 The flowchart of the method for optimizing system security vulnerability management based on extension program according to an embodiment of the present disclosure is schematically shown.

[0043] like Figure 2 As shown, the method for managing system security vulnerabilities based on extended program optimization in this embodiment includes operations S210 to S240.

[0044] In operation S210 , in response to a business requirement for developing an application system, the code being compiled in the integrated development environment is collected in real time.

[0045] In an embodiment of the present disclosure, before the code in progress in the integrated development environment is collected in real time, the consent or authorization of the user (developer) may be obtained. For example, before operation S210, a request to collect the code in progress in the integrated development environment in real time may be issued to the user. When the user agrees or authorizes that the code in progress in the integrated development environment may be collected in real time, the operation S210 is performed.

[0046] In operation S220, the in-process code is scanned for security vulnerabilities through a customized extension program, and the in-process code is parsed and compared according to the rules in the rule base to identify potential security vulnerabilities, wherein the customized extension program is integrated into the integrated development environment, and the rule base is built into the customized extension program.

[0047] In operation S230, in response to scanning the security vulnerability, a repair suggestion for the security vulnerability is obtained based on the in-progress code associated with the security vulnerability using a pre-trained vulnerability management model.

[0048] In the embodiments of the present disclosure, a corresponding operation entry may be provided for the user to choose to agree or reject the automated decision result. That is, before obtaining the repair suggestion processing / decision for the security vulnerability using the pre-trained vulnerability management model, an instruction for the user to agree or reject the processing / decision input through the corresponding operation entry may be obtained. If the user agrees to carry out the processing / decision, the pre-trained vulnerability management model is used to obtain the repair suggestion processing / decision for the security vulnerability, that is, step S240 is executed. If the user refuses to carry out the processing / decision, the expert decision process is entered.

[0049] In operation S240, based on the repair suggestion, the code in progress is adjusted to repair the security vulnerability.

[0050] In some exemplary embodiments, after the developer receives the business requirements, the development of the application system begins. First, a self-developed, customized extension (also called a self-developed IDE tool) is installed in the coding tool, i.e., the integrated development environment (IDE in English). The extension is customized to enhance the IDE function, especially the scanning and analysis of code security. After the installation is complete, whenever the developer writes or modifies the code in the IDE, this customized extension will automatically start to collect and analyze the code in real time. When the extension detects potential security vulnerabilities in the code, it will immediately mark these vulnerabilities and intelligently generate detailed repair suggestions for each vulnerability based on the pre-trained vulnerability management model. Then, the developer reviews and evaluates the applicability and feasibility of these suggestions, and combines their own programming experience and project requirements to complete the adjustment and optimization of the existing code, such as adding new lines of code, modifying the existing code logic or structural adjustments, etc., and finally eliminates security vulnerabilities.

[0051] Figure 3 Another flowchart of the method for optimizing system security vulnerability management based on an extension program according to an embodiment of the present disclosure is schematically shown.

[0052] In some exemplary embodiments, Figure 3 As shown in the figure, the coded content is scanned for security vulnerabilities through a customized extension. In this process, static code scanning is to scan the code in progress through a customized extension without actually running the code. Specifically, the customized extension has a built-in rule library, which is based on known security vulnerabilities, best practices, and security standards of programming languages. The extension will parse the code in progress line by line or block by block, and compare it with the rules in the rule library to identify potential security vulnerabilities.

[0053] It is understandable that by means of customized extensions, plug-ins are added to the IDE programs that developers use the most, and the code content written by developers is scanned in advance and at any time, so as to finally handle and resolve the code with security issues as early as possible, discover application system security vulnerabilities in advance, promote the resolution of security issues in the development process, reduce the number of security vulnerabilities that may be scanned when the application system is put into production and released, and reduce the work intensity of relevant personnel at this stage and the cost of later repairs. In addition, through the vulnerability management model, various forms of repair suggestions are provided at the code location where security issues are discovered, without interrupting the development ideas of developers, the coding ability of developers is enhanced, and the difficulty of security vulnerability rectification related work is reduced, thereby promoting the "virtuous cycle" of application system security rectification related work and ensuring the safe production of system applications.

[0054] In an embodiment of the present disclosure, the method further includes: in response to scanning the security vulnerability, highlighting the in-progress code associated with the security vulnerability in the window of the integrated development environment.

[0055] Specifically, in the IDE's editing or code viewing window, the in-progress code directly associated with the security vulnerability will be automatically highlighted, for example, using a striking red color (i.e., a "red prompt"). The red prompt is not limited to the code line itself, but may also include code blocks or entire functions, depending on the scope and nature of the vulnerability. In addition to highlighting, the IDE will also display precise location indication information next to the red prompt or in the relevant area, such as the file name, line number, and column number. In addition, in some IDEs, clicking on the location indication information can also jump directly to the corresponding location in the code, further improving the efficiency of problem solving.

[0056] It is understandable that by highlighting the in-progress code associated with security vulnerabilities, developers can quickly locate the problematic code without having to manually search or scroll. This instant visual feedback greatly shortens the process from problem discovery to problem locating, further improving the efficiency of resolving security vulnerabilities.

[0057] Furthermore, the scanning of the in-process code for security vulnerabilities through the customized extension program includes: in response to executing the in-process code, monitoring the running data of the in-process code through the customized extension program, and identifying the potential security vulnerabilities based on the running data.

[0058] Figure 3 Another flowchart of the method for optimizing system security vulnerability management based on an extension program according to an embodiment of the present disclosure is schematically shown.

[0059] In some exemplary embodiments, referring to Figure 3, the coded content is scanned for security vulnerabilities through a customized extension, including dynamic code analysis. Unlike static code scanning, a secure simulated execution environment can be created without affecting the production environment to execute the in-progress code, i.e. dynamic code analysis, so that the code simulates the runtime situation and monitors its runtime data, including input, output, memory usage, and network activity, etc., so that based on the monitored runtime data, the extension is used to analyze whether the code behavior is as expected and whether there are patterns or anomalies that may lead to security vulnerabilities. For example, if the code is not adequately validated or filtered when processing user input, it may lead to security vulnerabilities such as programming language injection or cross-site scripting attacks. The extension will then record all relevant runtime data and analysis results, list all identified potential security vulnerabilities, as well as their coded content, vulnerability type, location, and severity, etc. Finally, the vulnerability management model provides relevant repair suggestions. After adjusting the in-progress code according to the repair suggestions, the updated coded content is re-scanned to ensure that the original vulnerabilities are fixed without introducing new security issues or affecting the normal function of the program. In addition, the repair effect will be evaluated to ensure that it meets security standards and business requirements.

[0060] It can be understood that dynamic code monitoring (executing code) can analyze the running data of the code in real time and identify security vulnerabilities that can only be exposed at runtime, thereby ensuring that the software maintains a high level of security at runtime.

[0061] Furthermore, the customized extension program includes but is not limited to a code scanning tool.

[0062] It should be noted that customized extensions are highly flexible and customizable, and they can be selected and configured according to the specific needs of the development team. These extensions include but are not limited to code scanning tools, and may also include code formatting tools, refactoring assistance tools, and performance analysis tools.

[0063] Exemplarily, the code scanning tool is an AI-assisted code scanning tool that uses machine learning and natural language processing to deeply analyze and understand the code and identify complex code patterns and potential security vulnerabilities. In addition, the code scanning tool can also be an application security testing tool to deeply check the application's code base to identify potential security vulnerabilities and compliance issues. At the same time, an open source code quality management platform can also be used as a code scanning tool, which can automatically detect errors, vulnerabilities, code smells, and other problems in the code and generate easy-to-understand reports.

[0064] It is understandable that code scanning tools not only provide powerful scanning capabilities, but also have a high degree of customizability and scalability. According to the specific needs of the project, you can choose the appropriate tool for configuration and use. At the same time, these tools also support integration with other development tools and processes, so as to achieve more comprehensive and efficient code quality management.

[0065] Furthermore, in response to scanning the security vulnerability, based on the in-code associated with the security vulnerability, a pre-trained vulnerability management model is used to obtain a repair suggestion for the security vulnerability, including: analyzing the context information of the in-code associated with the security vulnerability through the vulnerability management model and identifying characteristics of the security vulnerability; and obtaining the repair suggestion output by the vulnerability management model based on the context information and the characteristics of the security vulnerability.

[0066] Specifically, first, the vulnerability management model will deeply analyze the code snippets associated with the vulnerability and its contextual information, such as the structure of the code, the logical flow and the function call relationship, and how these elements are associated with the generation of the vulnerability. Then, based on the results of the context analysis, the model will further identify the specific characteristics of the vulnerability, such as missing input validation, unauthorized access and buffer overflow. Based on the characteristics and contextual information of the vulnerability, the model will generate repair suggestions in the form of code snippets, repair guides, code comments, etc.

[0067] It is understandable that by analyzing the return results of the extension program through the vulnerability management model and generating various forms of repair suggestions, it can help developers quickly complete the rectification of vulnerabilities, reduce the difficulty of security vulnerability rectification, and improve the work efficiency of developers, so as to ensure the safety of the entire development, testing and production process while completing the production and release of the application system. In addition, the vulnerability management model combined with the contextual information of the code can improve the matching and accuracy of the repair suggestions.

[0068] In an embodiment of the present disclosure, the method further includes: providing repair suggestions to the developers of the application system through a conversational interface or an intelligent question-and-answer format, and guiding the developers to repair security vulnerabilities, wherein the repair suggestions include but are not limited to examples of repair code snippets for each of the security vulnerabilities, repair steps, and the highest priority repair guidelines obtained based on risk assessment.

[0069] Specifically, through a friendly dialogue or question-and-answer interface, developers are provided with customized repair suggestions for security vulnerabilities found in their applications. Repair suggestions come in a variety of forms, including but not limited to code snippet examples of repair solutions, detailed repair steps, sample code, current best practices, that is, the highest priority repair guide based on risk assessment, or interactive guidance to guide developers to complete repair operations through a dialogue interface or question-and-answer format.

[0070] For example, the interactive dialogue will ask details about the application architecture, frameworks used, and version information based on the vulnerability type to provide a series of repair suggestions, such as priority ranking, estimated repair time, and impact on system stability.

[0071] For example, in the form of intelligent question-answering, developers can query for repair suggestions by entering natural language questions such as "How to fix a programming language injection vulnerability?" The system then parses the question, matches the answer template in the knowledge base, and dynamically adjusts it according to the current project context. In addition to direct answers, the system can also provide relevant background knowledge, step-by-step guidance for repair steps, and answers to common problems that may be encountered.

[0072] Understandably, providing targeted repair suggestions can reduce the time developers spend looking for solutions, allowing them to locate problems and start repairing them more quickly, thereby significantly improving the efficiency of repair work.

[0073] In an embodiment of the present disclosure, the method also includes: in response to completing the repair of the security vulnerability of the code in progress, obtaining an application system to be put into production; performing a security scan on the entire code of the application system to be put into production to determine whether there is a security vulnerability; and when the application system to be put into production has a security vulnerability, analyzing and rectifying the security vulnerability, and putting the repaired application system into production and releasing it.

[0074] Specifically, continue to refer to Figure 3 After the business demand development is completed, the application system will enter the security testing phase. Security scanning and other tools will be used to perform security scans on the entire code to determine whether there are security vulnerabilities. If security vulnerabilities still exist, the vulnerability impact analysis will be conducted on the discovered security vulnerabilities, and the vulnerability rectification process will be carried out for the security vulnerabilities that need to be rectified. If no rectification is required after analysis, the production release operation can be carried out, that is, the application system with no security vulnerabilities found will be put into production.

[0075] Figure 4 The flowchart of the production release of the application system according to the embodiment of the present disclosure is schematically shown.

[0076] like Figure 4As shown, the repaired code is integrated into the application system, the version to be put into production is built, and the same or more comprehensive security scanning tool is used to perform security scans on the entire code of the application system to ensure that there are no missed security vulnerabilities. At the same time, the scan report is analyzed to confirm whether there are still security vulnerabilities. If new security vulnerabilities are found, return to repair and evaluate the security vulnerabilities again. Then, the remaining security vulnerabilities are analyzed in depth to understand their causes, scope of impact, and possible attack scenarios. According to the analysis results, a specific rectification plan is formulated, including technical measures and management measures, and the application system is modified or configured accordingly according to the rectification plan to ensure that all security vulnerabilities are thoroughly repaired. After the rectification is completed, retest to verify whether the security vulnerabilities have been effectively repaired. Finally, configure and check the production environment to ensure that it is consistent or compatible with the production environment, and deploy the repaired and verified application system to the production environment, and perform integration testing, performance testing, etc. in the production environment to ensure that the application system runs stably and meets business needs. After all tests are completed and confirmed to be correct, the application system is officially released to the production environment, and necessary monitoring and maintenance are performed. In addition, monitor the operation of the application system and collect user feedback to promptly identify and resolve potential security issues or business problems.

[0077] It is understandable that after adjusting the code in progress, through security scanning of the entire code before production, it is possible to further discover and eliminate potential security threats, improve the security of the entire application system, and thus reduce the risk of malicious attacks, data leakage or service interruptions to the application system in production.

[0078] The method for optimizing system security vulnerability management based on extension programs provided in the disclosed embodiment optimizes the management of application system security vulnerabilities from two dimensions: the time of discovering security vulnerabilities and the vulnerability rectification and repair solutions, that is, from two dimensions: time and repair suggestions. Specifically, on the one hand, through the customized extension program, the code content is scanned in advance in the integrated development environment, problems are discovered early, and the possibility of early resolution of security vulnerabilities is provided. On the other hand, the vulnerability management model is combined with the scanning tool results to provide repair suggestions, which reduces the difficulty of security vulnerability rectification related work without interrupting the development ideas of developers, improves the work efficiency and ability of developers, and thus promotes the "virtuous cycle" of application system security rectification related work, discovers problems early, solves problems steadily, improves personnel capabilities, and reduces the appearance of code that may cause security vulnerability problems.

[0079] Based on the above method for optimizing system security vulnerability management based on extension programs, the present disclosure also provides a device for optimizing system security vulnerability management based on extension programs. Figure 5 The device is described in detail.

[0080] Figure 5 The structural block diagram of the device for optimizing system security vulnerability management based on an extension program according to an embodiment of the present disclosure is schematically shown.

[0081] like Figure 5 As shown, the device 500 for optimizing system security vulnerability management based on extended programs in this embodiment includes a collection module 510 , a scanning module 520 , a suggestion module 530 and a repair module 540 .

[0082] The acquisition module 510 is used to respond to the business requirements of developing the application system and to collect the code in progress in the integrated development environment in real time. In one embodiment, the acquisition module 510 can be used to perform the operation S210 described above, which will not be described in detail here.

[0083] The scanning module 520 is used to scan the in-process code for security vulnerabilities through a customized extension program, and parse and compare the in-process code according to the rules in the rule base to identify potential security vulnerabilities, wherein the customized extension program is integrated into the integrated development environment, and the rule base is built into the customized extension program. In one embodiment, the scanning module 520 can be used to perform the operation S220 described above, which will not be repeated here.

[0084] The suggestion module 530 is used to obtain a repair suggestion for the security vulnerability in response to scanning the security vulnerability, based on the in-progress code associated with the security vulnerability and using a pre-trained vulnerability management model. In one embodiment, the suggestion module 530 can be used to perform the operation S230 described above, which will not be described in detail here.

[0085] The repair module 540 is used to adjust the code in progress based on the repair suggestion to repair the security vulnerability. In one embodiment, the repair module 540 can be used to perform the operation S240 described above, which will not be described in detail here.

[0086] According to an embodiment of the present disclosure, the suggestion module 530 may also be used to: in response to scanning the security vulnerability, highlight the in-progress code associated with the security vulnerability in the window of the integrated development environment.

[0087] According to an embodiment of the present disclosure, the scanning module 520 is specifically used for: in response to executing the in-progress code, monitoring the running data of the in-progress code through the customized extension program, and identifying the potential security vulnerability based on the running data.

[0088] According to an embodiment of the present disclosure, the suggestion module 530 is specifically used to: analyze the context information of the in-code code associated with the security vulnerability through the vulnerability management model, and identify the characteristics of the security vulnerability; and obtain the repair suggestions output by the vulnerability management model based on the context information and the characteristics of the security vulnerability.

[0089] According to an embodiment of the present disclosure, the repair module 540 can also be used to: provide repair suggestions to the developers of the application system through a conversational interface or an intelligent question-and-answer format, and guide the developers to repair security vulnerabilities, wherein the repair suggestions include but are not limited to examples of repair code snippets for each of the security vulnerabilities, repair steps, and the highest priority repair guidelines obtained based on risk assessment.

[0090] According to an embodiment of the present disclosure, the repair module 540 can also be used to: obtain an application system to be put into production in response to completing the repair of the security vulnerability of the code in progress; perform a security scan on the entire code of the application system to be put into production to determine whether there is a security vulnerability; and when the application system to be put into production has a security vulnerability, analyze and rectify the security vulnerability, and put the repaired application system into production and release it.

[0091] According to an embodiment of the present disclosure, the customized extension program includes but is not limited to a code scanning tool.

[0092] According to an embodiment of the present disclosure, any multiple modules of the acquisition module 510, the scanning module 520, the suggestion module 530 and the repair module 540 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the acquisition module 510, the scanning module 520, the suggestion module 530 and the repair module 540 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation modes of software, hardware and firmware or in any appropriate combination of any of them. Alternatively, at least one of the acquisition module 510, the scanning module 520, the suggestion module 530 and the repair module 540 can be at least partially implemented as a computer program module, and when the computer program module is run, the corresponding function can be performed.

[0093] Figure 6A block diagram of an electronic device suitable for implementing a method for optimizing system security vulnerability management based on an extension program according to an embodiment of the present disclosure is schematically shown.

[0094] like Figure 6 As shown, the electronic device 600 according to an embodiment of the present disclosure includes a processor 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 to a random access memory (RAM) 603. The processor 601 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 601 may also include an onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0095] In RAM 603, various programs and data required for the operation of electronic device 600 are stored. Processor 601, ROM 602 and RAM 603 are connected to each other via bus 604. Processor 601 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 602 and / or RAM 603. It should be noted that the program can also be stored in one or more memories other than ROM 602 and RAM 603. Processor 601 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0096] According to an embodiment of the present disclosure, the electronic device 600 may further include an input / output (I / O) interface 605, which is also connected to the bus 604. The electronic device 600 may further include one or more of the following components connected to the input / output (I / O) interface 605: an input portion 606 including a keyboard, a mouse, etc.; an output portion 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 608 including a hard disk, etc.; and a communication portion 609 including a network interface card such as a LAN card, a modem, etc. The communication portion 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the input / output (I / O) interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed into the storage portion 608 as needed.

[0097] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0098] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the ROM 602 and / or RAM 603 described above and / or one or more memories other than ROM 602 and RAM 603.

[0099] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program includes a program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the method for optimizing system security vulnerability management based on an extension program provided by the embodiment of the present disclosure.

[0100] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 601. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0101] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 609, and / or installed from a removable medium 611. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0102] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the processor 601, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, apparatus, module, unit, etc. described above can be implemented by a computer program module.

[0103] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0104] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0105] It will be appreciated by those skilled in the art that the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations or combinations are not explicitly described in the present disclosure. In particular, without departing from the spirit and teachings of the present disclosure, the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0106] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A method for optimizing system security vulnerability management based on an extension program, characterized in that: The method comprises: Respond to the business needs of developing application systems and collect the code in progress in the integrated development environment in real time; Scanning the code in progress for security vulnerabilities through a customized extension program, parsing and comparing the code in progress according to the rules in a rule base, and identifying potential security vulnerabilities, wherein the customized extension program is integrated into the integrated development environment, and the rule base is built into the customized extension program; In response to scanning the security vulnerability, obtaining a repair suggestion for the security vulnerability based on the in-progress code associated with the security vulnerability and using a pre-trained vulnerability management model; and Based on the repair suggestion, the code in progress is adjusted to repair the security vulnerability.

2. The method according to claim 1, characterized in that The method further comprises: In response to scanning the security vulnerability, the in-progress code associated with the security vulnerability is highlighted in the window of the integrated development environment.

3. The method according to claim 1 or 2, characterized in that: Scanning the code in progress for security vulnerabilities through the customized extension program includes: In response to executing the code in progress, the running data of the code in progress is monitored through the customized extension program, and the potential security vulnerability is identified based on the running data.

4. The method according to claim 1, characterized in that In response to scanning the security vulnerability, obtaining a repair suggestion for the security vulnerability based on the in-progress code associated with the security vulnerability and using a pre-trained vulnerability management model includes: Analyzing context information of the in-progress code associated with the security vulnerability through the vulnerability management model, and identifying features of the security vulnerability; and Based on the context information and the characteristics of the security vulnerability, a repair suggestion output by the vulnerability management model is obtained.

5. The method according to claim 1 or 4, characterized in that: The method further comprises: Through a conversational interface or intelligent question-and-answer format, repair suggestions are provided to the developers of the application system, and the developers are guided to repair security vulnerabilities, wherein the repair suggestions include but are not limited to examples of repair code snippets for each of the security vulnerabilities, repair steps, and the highest priority repair guidelines obtained based on risk assessment.

6. The method according to claim 1, characterized in that The method further comprises: In response to completing the repair of the security vulnerability of the code under compilation, an application system to be put into production is obtained; Perform security scans on the entire code of the application system to be put into production to determine whether there are security vulnerabilities; and When the application system to be put into production has security holes, the security holes are analyzed and rectified, and the repaired application system is put into production and released.

7. The method according to claim 1, characterized in that The customized extension program includes but is not limited to a code scanning tool.

8. A device for optimizing system security vulnerability management based on an extension program, characterized in that: The device comprises: The collection module is used to respond to the business needs of the application system development and collect the code in progress in the integrated development environment in real time; A scanning module, used to scan the code in progress for security vulnerabilities through a customized extension program, and parse and compare the code in progress according to the rules in the rule base to identify potential security vulnerabilities, wherein the customized extension program is integrated into the integrated development environment, and the rule base is built into the customized extension program; a suggestion module, configured to obtain a repair suggestion for the security vulnerability in response to scanning the security vulnerability and using a pre-trained vulnerability management model according to the in-progress code associated with the security vulnerability; and A repair module is used to adjust the code in progress based on the repair suggestion to repair the security vulnerability.

9. An electronic device, comprising: one or more processors; a memory for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program or instruction stored thereon, characterized in that: When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

11. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images