Security vulnerability detection method and device, equipment, storage medium and product

Abstract

The invention discloses a security vulnerability detection method and device, equipment, a storage medium and a product, relates to the technical field of vulnerability detection, and discloses a security vulnerability detection method comprising the following steps: obtaining to-be-detected component data; based on a preset first priority knowledge graph, performing vulnerability matching on the to-be-detected component data to obtain a first vulnerability matching result; and if the vulnerability matching result is matching failure, performing vulnerability matching on the to-be-detected component data based on a preset second priority knowledge graph to obtain a second vulnerability matching result. According to the method and the device, for the to-be-detected component data, the first priority knowledge graph is preferentially matched, and if the corresponding component and vulnerability information are matched, matching scanning of the second priority knowledge graph does not need to be executed; only when the corresponding component and vulnerability information are not matched from the first priority knowledge graph, the second priority knowledge graph is matched, so that the security vulnerability scanning efficiency is improved.

Description

Technical Field

[0001] The present application relates to the field of vulnerability detection technology, and in particular to security vulnerability detection methods, devices, equipment, storage media and products. Background Art

[0002] At present, with the widespread application of open source software in software development, its security issues are increasingly concerned. Open source software supply chain security vulnerability detection technology mainly focuses on identifying and repairing security vulnerabilities in open source software to ensure the security and reliability of the software supply chain. Therefore, how to improve the security vulnerability detection capabilities of the open source software supply chain is a technical challenge currently faced.

[0003] In related technologies, full component data and vulnerability data are usually obtained from platforms such as component libraries and vulnerability libraries to build a supply chain knowledge graph, and then the knowledge graph is used to match the vulnerabilities of the components to be detected based on the supply chain knowledge graph to obtain the corresponding security vulnerability detection results. However, there is a large amount of redundant data in the component library and vulnerability library in this method. When processing such a large amount of data, the vulnerability matching process is very time-consuming, resulting in low efficiency in detecting security vulnerabilities in the open source software supply chain.

[0004] The above contents are only used to assist in understanding the technical solution of the present application and do not constitute an admission that the above contents are prior art. Summary of the invention

[0005] The main purpose of this application is to provide a security vulnerability detection method, aiming to solve the technical problem of low efficiency in detecting security vulnerabilities in the open source software supply chain.

[0006] To achieve the above objectives, the present application proposes a security vulnerability detection method, which includes:

[0007] Get the data of the component to be detected;

[0008] Based on a preset first priority knowledge graph, vulnerability matching is performed on the component data to be detected to obtain a first vulnerability matching result;

[0009] If the vulnerability matching result is a matching failure, vulnerability matching is performed on the component data to be detected based on the preset second priority knowledge graph to obtain a second vulnerability matching result, wherein the priority of the first priority knowledge graph is higher than that of the second priority knowledge graph, and the priority between the first priority knowledge graph and the second priority knowledge graph is determined according to the number of references of the component data for constructing the knowledge graph.

[0010] Optionally, before the step of acquiring data of the component to be detected, the method includes:

[0011] Obtaining a full amount of target component data, the number of references to the target component data, and target vulnerability data;

[0012] Based on the number of references, the target component data is prioritized to obtain first priority component data and second priority component data;

[0013] Determine first priority vulnerability data based on the first priority component data and the target vulnerability data, and determine second priority vulnerability data based on the second priority component data and the target vulnerability data;

[0014] Based on the first-priority component data and the first-priority vulnerability data, a first-priority knowledge graph is constructed, and based on the second-priority component data and the second-priority vulnerability data, a second-priority knowledge graph is constructed.

[0015] Optionally, the step of prioritizing the target component data based on the number of references to obtain first-priority component data and second-priority component data includes:

[0016] Based on the number of references, calculate the distance between any two target component data to obtain a distance result set;

[0017] Based on the distance result set, clustering the target component data to obtain the number of clusters of the clustering result of the current iteration round;

[0018] Determine whether the number of clusters in the clustering result of the current iteration round is greater than two;

[0019] If the number of clusters of the clustering result of the current iteration round is greater than two, return to the step of clustering the target component data based on the distance result set to obtain the number of clusters of the clustering result of the current iteration round, until the number of clusters of the clustering result of the current iteration round reaches two, and obtain the first priority component data and the second priority component data after clustering.

[0020] Optionally, the step of determining first priority vulnerability data based on the first priority component data and the target vulnerability data, and determining second priority vulnerability data based on the second priority component data and the target vulnerability data includes:

[0021] Obtain mapping relationship information between component data and vulnerability data;

[0022] Based on the first priority component data and the mapping relationship information, mapping from the target vulnerability data to obtain first priority vulnerability data;

[0023] Based on the second priority component data and the mapping relationship information, second priority vulnerability data is mapped from the target vulnerability data.

[0024] Optionally, the step of constructing a first priority knowledge graph based on the first priority component data and the first priority vulnerability data, and constructing a second priority knowledge graph based on the second priority component data and the second priority vulnerability data includes:

[0025] Extracting knowledge from the first-priority component data to obtain first-priority component knowledge, matching the first-priority component knowledge based on the first-priority vulnerability data to obtain a first matching result, and constructing a first-priority knowledge graph based on the first matching result;

[0026] The second-priority component data is subjected to knowledge extraction to obtain second-priority component knowledge, and the second-priority component knowledge is matched based on the second-priority vulnerability data to obtain a second matching result, and then a second-priority knowledge graph is constructed based on the second matching result.

[0027] Optionally, the step of obtaining the full amount of target component data includes:

[0028] Get the full amount of initial component data;

[0029] Clustering the initial component data to obtain clustered initial component data;

[0030] Based on a preset principal component analysis method, the clustered initial component data is mapped to a low-dimensional space to obtain component data after dimensionality reduction, and the component data after dimensionality reduction is used as target component data.

[0031] In addition, to achieve the above objectives, the present application also proposes a security vulnerability detection device, which includes:

[0032] An acquisition module is used to obtain the data of the component to be detected;

[0033] A first matching module, configured to perform vulnerability matching on the component data to be detected based on a preset first priority knowledge graph to obtain a first vulnerability matching result;

[0034] The second matching module is used to perform vulnerability matching on the component data to be detected based on a preset second priority knowledge graph to obtain a second vulnerability matching result if the vulnerability matching result is a matching failure, wherein the priority of the first priority knowledge graph is higher than that of the second priority knowledge graph, and the priority between the first priority knowledge graph and the second priority knowledge graph is determined according to the number of references of the component data for constructing the knowledge graph.

[0035] In addition, to achieve the above-mentioned purpose, the present application also proposes a security vulnerability detection device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, and the computer program is configured to implement the steps of the security vulnerability detection method described above.

[0036] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the security vulnerability detection method described above are implemented.

[0037] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps of the security vulnerability detection method described above are implemented.

[0038] One or more technical solutions proposed in this application have at least the following technical effects:

[0039] In the related art, the full amount of component data and vulnerability data is usually obtained from platforms such as component libraries and vulnerability libraries, a supply chain knowledge graph is constructed, and then the vulnerability matching of the knowledge graph of the components to be detected is performed based on the supply chain knowledge graph to obtain the corresponding security vulnerability detection results. However, in this method, there is a large amount of redundant data in the component library and vulnerability library. When processing such a large amount of data, the vulnerability matching process is very time-consuming, resulting in low efficiency in detecting security vulnerabilities in the open source software supply chain. In comparison, the present application proposes a technical solution: obtaining the component data to be detected; performing vulnerability matching on the component data to be detected based on a preset first priority knowledge graph to obtain a first vulnerability matching result; if the vulnerability matching result is a match failure, performing vulnerability matching on the component data to be detected based on a preset second priority knowledge graph to obtain a second vulnerability matching result, wherein the priority of the first priority knowledge graph is higher than that of the second priority knowledge graph, and the priority between the first priority knowledge graph and the second priority knowledge graph is determined according to the number of references to the component data for constructing the knowledge graph. It is understandable that, for each component data to be detected, the present application prioritizes matching the first-priority knowledge graph with a high number of references to the component data for constructing the knowledge graph, that is, a high priority. If the corresponding component and vulnerability information are matched from the first-priority knowledge graph, there is no need to perform a matching scan of the second-priority knowledge graph to determine that the component to be matched has a vulnerability. Only when the corresponding component and vulnerability information are not matched from the first-priority knowledge graph, the second-priority knowledge graph is matched, so as to maximize the efficiency of security vulnerability scanning while ensuring full security vulnerability detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0041] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0042] Figure 1 A schematic diagram of a process flow provided for the first embodiment of the security vulnerability detection method of the present application;

[0043] Figure 2 A schematic diagram of the process of extracting components to be detected in the security vulnerability detection method of this application;

[0044] Figure 3 A schematic diagram of component data of the security vulnerability detection method of this application;

[0045] Figure 4 A schematic diagram of the security vulnerability matching process of the security vulnerability detection method of this application;

[0046] Figure 5 A flowchart of the second embodiment of the security vulnerability detection method of the present application is provided;

[0047] Figure 6 This is a complete flow chart of the security vulnerability detection method for this application;

[0048] Figure 7 This is a schematic diagram of the agglomerative hierarchical clustering process of the security vulnerability detection method of this application;

[0049] Figure 8 A schematic diagram of the vulnerability data layering process of the security vulnerability detection method of this application;

[0050] Fig. 9 A schematic diagram of the knowledge graph construction process for the security vulnerability detection method of this application;

[0051] Fig.10 A flowchart of the third embodiment of the security vulnerability detection method of the present application is provided;

[0052] Fig.11 This is a schematic diagram of the component data dimensionality reduction process of the security vulnerability detection method of this application;

[0053] Fig.12 This is a schematic diagram of the module structure of the security vulnerability detection device according to an embodiment of the present application;

[0054] Fig.13 Schematic diagram of the device structure of the hardware operating environment involved in the security vulnerability detection method in the embodiment of the present application.

[0055] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0056] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0057] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0058] The main solution of the embodiment of the present application is: obtaining component data to be detected; performing vulnerability matching on the component data to be detected based on a preset first-priority knowledge graph to obtain a first vulnerability matching result; if the vulnerability matching result is a matching failure, performing vulnerability matching on the component data to be detected based on a preset second-priority knowledge graph to obtain a second vulnerability matching result, wherein the priority of the first-priority knowledge graph is higher than that of the second-priority knowledge graph, and the priority between the first-priority knowledge graph and the second-priority knowledge graph is determined according to the number of references of the component data for constructing the knowledge graph.

[0059] In this embodiment, the security vulnerability detection device is used as the execution subject. For the convenience of description, it is hereinafter referred to as "device" for explanation.

[0060] In related technologies, full component data and vulnerability data are usually obtained from platforms such as component libraries and vulnerability libraries to build a supply chain knowledge graph, and then the knowledge graph is used to match the vulnerabilities of the components to be detected based on the supply chain knowledge graph to obtain the corresponding security vulnerability detection results. However, there is a large amount of redundant data in the component library and vulnerability library in this method. When processing such a large amount of data, the vulnerability matching process is very time-consuming, resulting in low efficiency in detecting security vulnerabilities in the open source software supply chain.

[0061] This application provides a solution to maximize the efficiency of security vulnerability scanning while ensuring full security vulnerability detection.

[0062] It can be seen from the above embodiments that, for each component data to be detected, the present application prioritizes matching the first-priority knowledge graph with a high number of references to the component data for constructing the knowledge graph, that is, a high priority. If the corresponding component and vulnerability information are matched from the first-priority knowledge graph, there is no need to perform a matching scan of the second-priority knowledge graph to determine that the component to be matched has a vulnerability; only when the corresponding component and vulnerability information are not matched from the first-priority knowledge graph, the second-priority knowledge graph is matched, so as to maximize the efficiency of security vulnerability scanning while ensuring full security vulnerability detection.

[0063] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, a terminal system, etc. The following takes the security vulnerability detection device as an example to illustrate this embodiment and the following embodiments.

[0064] Based on this, the present application embodiment provides a security vulnerability detection method, referring to Figure 1 , Figure 1This is a flow chart of the first embodiment of the security vulnerability detection method of the present application.

[0065] In this embodiment, the security vulnerability detection method includes steps S100 to S300:

[0066] Step S100, obtaining data of the component to be detected;

[0067] It should be noted that the component data to be checked refers to the relevant information of the software components to be checked that is collected and prepared before security testing or vulnerability analysis is performed. These data are the basis for security analysis.

[0068] In a specific implementation, the specific scenario of this application is software vulnerability security detection of the open source software supply chain. Specifically, the method for the device to obtain the data of the component to be detected specifically includes: referring to Figure 2 ,Bill of materials generation is the primary stage of software supply chain security vulnerability detection. ,The source code or binary file is input into the SBOM generation module, ,and the SBOM file in json or xml format is generated by parsing ,the feature files in the source code, such as pom files in java, jar packages of binary files, ,etc., i.e., the software bill of materials, and then the ,data of the components to be detected are extracted from the ,list.

[0069] Further, refer to Figure 3 ,The component information extracted from SBOM includes component name, component ,publisher, component version, CPE, PURL, etc. After extracting the components, the ,knowledge graph generated in the above steps is used to perform vulnerability ,matching analysis.

[0070] Step S200, based on a preset first priority knowledge graph, performing vulnerability matching on the component data to be detected to obtain a first vulnerability matching result;

[0071] It should be noted that the first-priority knowledge graph is a knowledge graph constructed in advance based on the first-priority component information and the corresponding vulnerability information. The priority of the component information is determined based on the number of references (that is, popularity) of the component data. That is, the more references the component data has, the more popular the component is and the higher the priority is set.

[0072] In the specific implementation, the first priority knowledge graph data in this application, that is, the high priority knowledge graph data, accounts for about 20% of the total component and vulnerability data, and can cover 80% of the commonly used usage scenarios in actual scenarios. Figure 4 If the high-priority knowledge graph is not matched, the low-priority knowledge graph will be matched. Since the high-priority data is a popular component that has been fully screened, it is less affected by noise and redundant data, and the matching accuracy and efficiency are doubled.

[0073] Step S300, if the vulnerability matching result is a matching failure, vulnerability matching is performed on the component data to be detected based on the preset second priority knowledge graph to obtain a second vulnerability matching result, wherein the priority of the first priority knowledge graph is higher than that of the second priority knowledge graph, and the priority between the first priority knowledge graph and the second priority knowledge graph is determined according to the number of references of the component data for constructing the knowledge graph.

[0074] In a specific implementation, when the first-priority knowledge graph is used to match vulnerabilities of the component data to be detected, if no matching vulnerability is found, a match failure occurs. After the first-priority knowledge graph fails to match, the device will switch to the second-priority knowledge graph for matching. This graph also contains information about components and vulnerabilities, but its priority is lower than the first-priority knowledge graph. The priority between the first-priority and second-priority knowledge graphs is determined based on the number of references to the component data used to construct the knowledge graph. Component data with a high number of references will be considered more common or more important, so its corresponding knowledge graph will be given a higher priority. This means that the number of references to component data in the first-priority knowledge graph is higher than the number of references to component data in the second-priority knowledge graph.

[0075] Furthermore, after matching with the second-priority knowledge graph, the vulnerability matching results obtained are called second-priority vulnerability matching results. These may be some less common or less serious vulnerabilities, or vulnerabilities that are not recorded in the first-priority knowledge graph. The above entire process is automated, aiming to ensure that even when the highest-priority knowledge graph fails to match a vulnerability, possible vulnerabilities can continue to be found through the second-priority knowledge graph to improve the coverage and accuracy of vulnerability detection.

[0076] In the related art, the full amount of component data and vulnerability data is usually obtained from platforms such as component libraries and vulnerability libraries, a supply chain knowledge graph is constructed, and then the vulnerability matching of the knowledge graph of the components to be detected is performed based on the supply chain knowledge graph to obtain the corresponding security vulnerability detection results. However, in this method, there is a large amount of redundant data in the component library and vulnerability library. When processing such a large amount of data, the vulnerability matching process is very time-consuming, resulting in low efficiency in detecting security vulnerabilities in the open source software supply chain. In comparison, the present application proposes a technical solution: obtaining the component data to be detected; performing vulnerability matching on the component data to be detected based on a preset first priority knowledge graph to obtain a first vulnerability matching result; if the vulnerability matching result is a match failure, performing vulnerability matching on the component data to be detected based on a preset second priority knowledge graph to obtain a second vulnerability matching result, wherein the priority of the first priority knowledge graph is higher than that of the second priority knowledge graph, and the priority between the first priority knowledge graph and the second priority knowledge graph is determined according to the number of references to the component data for constructing the knowledge graph. It is understandable that, for each component data to be detected, the present application prioritizes matching the first-priority knowledge graph with a high number of references to the component data for constructing the knowledge graph, that is, a high priority. If the corresponding component and vulnerability information are matched from the first-priority knowledge graph, there is no need to perform a matching scan of the second-priority knowledge graph to determine that the component to be matched has a vulnerability. Only when the corresponding component and vulnerability information are not matched from the first-priority knowledge graph, the second-priority knowledge graph is matched, so as to maximize the efficiency of security vulnerability scanning while ensuring full security vulnerability detection.

[0077] Based on the above first embodiment, the present application also proposes another embodiment, referring to Figure 5 , the security vulnerability detection method comprises:

[0078] In a specific implementation, before the device acquires the data of the component to be detected, the method includes:

[0079] Step A100, obtaining a full amount of target component data, the number of references of the target component data, and target vulnerability data;

[0080] It should be noted that the target component data refers to the detailed information of all software components that require security analysis, including Figure 6 The device can obtain the full amount of target component data by directly extracting it from the central warehouse or by reducing the dimension of the component data extracted from the central warehouse.

[0081] Furthermore, the target vulnerability data refers to detailed information about known security vulnerabilities related to the target component, which is usually derived from a security vulnerability database such as CVE (Common Vulnerabilities and Exposures). The target vulnerability data includes the vulnerability identifier (such as CVE number), description, affected component version, vulnerability severity level, known exploit methods, repair suggestions and patch information, etc.

[0082] In a specific implementation, the number of citations of target component data refers to the number of times each target component is cited or used in different environments, projects, or devices. The number of citations can reflect the popularity and importance of a component, which is very important for determining which components need to be prioritized for security analysis and vulnerability detection. The data on the number of citations can be obtained in various ways, such as software asset management tools, configuration management databases, code base analysis tools, etc.

[0083] It should be emphasized that the priority division can include attribute information such as the time of introduction into the database in addition to the number of references to the target component data.

[0084] Step A200, based on the number of references, the target component data is prioritized to obtain first priority component data and second priority component data;

[0085] In a specific implementation, the device prioritizes the target component data based on the number of references. First, a standard or threshold is required to be determined for classifying components into different priorities. This standard can be based on the absolute value of the number of references (for example, components with a number of references exceeding a certain value are considered to be high priority) or a relative proportion (for example, components with the top 10% of the number of references are considered to be high priority). According to the above standards, the components with the most references are classified as first-priority component data. Since these components are widely used, once there are vulnerabilities, they may affect more systems and users, so security analysis and vulnerability detection need to be prioritized. Components with fewer references are classified as second-priority component data. Although these components are also important, their impact range may be smaller than that of the first-priority components, so they can be matched with the second-priority data.

[0086] Furthermore, the priority division may need to be dynamically adjusted according to the actual situation, that is, the priority may be updated. For example, if a component is suddenly widely adopted, or a component has a serious security vulnerability, then its priority may need to be increased.

[0087] In a specific implementation, the device prioritizes the target component data based on the number of references to obtain first-priority component data and second-priority component data, including:

[0088] Based on the number of references, the distance between any two of the target component data is calculated to obtain a distance result set; based on the distance result set, the target component data is clustered to obtain the number of clusters of the clustering result of the current iteration round; it is determined whether the number of clusters of the clustering result of the current iteration round is greater than two; if the number of clusters of the clustering result of the current iteration round is greater than two, the step of clustering the target component data based on the distance result set to obtain the number of clusters of the clustering result of the current iteration round is returned, until the number of clusters of the clustering result of the current iteration round reaches two, and the clustered first priority component data and second priority component data are obtained.

[0089] It should be noted that among the hundreds of millions of component data in the open source software supply chain, the components that are usually used account for a small proportion. However, in the process of component and vulnerability matching, all components need to be matched, and the matching efficiency and accuracy are low. In order to solve this kind of problem in vulnerability detection, a data hierarchical clustering method is introduced to prioritize the data and give priority to matching high-priority component libraries.

[0090] In the specific implementation, in the data hierarchical clustering stage, according to the processing results of the data preprocessing stage, the cleaned and dimension-reduced data is used for hierarchical clustering training. Hierarchical clustering algorithms are divided into top-down hierarchical clustering and bottom-up hierarchical clustering. The former splits the data under the same cluster into multiple clusters, and the latter merges multiple single entities into n clusters. This application uses an agglomerative hierarchical clustering algorithm based on the latter to merge multiple component entities into clusters of high and low priorities.

[0091] Furthermore, the agglomerative hierarchical clustering algorithm first needs to calculate the distance between objects. Here, the present application adopts a method of finding similarity, and the Minkowski distance metric criterion can be used. The distance calculation formula between two objects is as follows:

[0092] Among them, x i1 , x i2 …x ip and x j1 , x j2 …x jpare the p attribute values ​​of the two objects, representing the number of references. Based on the distance between the two objects, we further calculate the distance between the two clusters. Here we use the common average distance method to measure the distance between clusters. The calculation formula is as follows:

[0093]

[0094] Among them, |qq′| represents the distance d(i,j) between the two objects calculated in the previous step, c i , c j Represents two different clusters, n i , n j Represents the number of objects in the two clusters respectively.

[0095] In the specific implementation, the similarity between any two points is calculated, and the two most similar data nodes in the data are combined, and this process is iterated repeatedly. Finally, a clustering tree is generated. The clustering process is as follows Figure 7 As shown, the present application can control the threshold here to ensure that a two-level clustering tree is finally generated.

[0096] Step A300, determining first priority vulnerability data based on the first priority component data and the target vulnerability data, and determining second priority vulnerability data based on the second priority component data and the target vulnerability data;

[0097] In a specific implementation, the device selects vulnerability data corresponding to the first-priority component data from the full amount of target vulnerability data as first-priority vulnerability data based on the divided first-priority component data. Correspondingly, the device selects vulnerability data corresponding to the second-priority component data from the full amount of target vulnerability data as second-priority vulnerability data based on the divided second-priority component data.

[0098] In a specific implementation, the device determines the first priority vulnerability data based on the first priority component data and the target vulnerability data, and determines the second priority vulnerability data based on the second priority component data and the target vulnerability data, including:

[0099] Obtain mapping relationship information between component data and vulnerability data; based on the first priority component data and the mapping relationship information, map the first priority vulnerability data from the target vulnerability data; based on the second priority component data and the mapping relationship information, map the second priority vulnerability data from the target vulnerability data.

[0100] In the specific implementation, the device maps the vulnerability information crawled from NVD / CNVD to different levels according to the results of component agglomeration hierarchical clustering and the mapping relationship between the components and the vulnerabilities. For high-priority vulnerabilities, the specific mapping method is to obtain the vulnerability information (CVEID) in the high-priority component and match it to the vulnerability library through CVEID. The overall process of high-priority vulnerabilities is as follows: Figure 8 As shown, low priority vulnerability data can be obtained in the same way.

[0101] Step A400, constructing a first priority knowledge graph based on the first priority component data and the first priority vulnerability data, and constructing a second priority knowledge graph based on the second priority component data and the second priority vulnerability data.

[0102] In the specific implementation, the device uses the first-priority component data and the first-priority vulnerability data to build a knowledge graph. This graph will contain entities (such as components, vulnerabilities) and the relationships between them (such as the vulnerabilities affected by the components). The construction process of this graph includes the following steps:

[0103] Knowledge modeling: defining entity types (such as operating systems, software, attacks, etc.) and the relationships between them;

[0104] Knowledge storage: Choose a suitable graph database to store the knowledge graph, such as Neo4j;

[0105] Knowledge extraction: extracting entity and relationship information from data sources;

[0106] Knowledge fusion: Integrate the extracted information to solve entity recognition and data alignment problems;

[0107] Knowledge computing: Identify high-risk points and impact areas through graph analysis methods;

[0108] Knowledge application: Use knowledge graphs to identify risks, make high-risk recommendations, analyze impact scope, and make decisions on mitigation measures;

[0109] Furthermore, using the second-priority component data and the second-priority vulnerability data, another knowledge graph is constructed. The construction process of this graph is similar to that of the first-priority knowledge graph, but it focuses on components and vulnerabilities with fewer citations or lower risks.

[0110] In a specific implementation, the device constructs a first priority knowledge graph based on the first priority component data and the first priority vulnerability data, and constructs a second priority knowledge graph based on the second priority component data and the second priority vulnerability data, including:

[0111] The first-priority component data is subjected to knowledge extraction to obtain first-priority component knowledge, and the first-priority component knowledge is matched based on the first-priority vulnerability data to obtain a first matching result, and then a first-priority knowledge graph is constructed based on the first matching result; the second-priority component data is subjected to knowledge extraction to obtain second-priority component knowledge, and the second-priority component knowledge is matched based on the second-priority vulnerability data to obtain a second matching result, and then a second-priority knowledge graph is constructed based on the second matching result.

[0112] In the specific implementation, based on the component and vulnerability hierarchical data constructed in the previous step, the device constructs a hierarchical knowledge graph. First, a high-priority knowledge graph is constructed to obtain all high-priority components and related vulnerabilities in the clustering tree, and the high-priority component knowledge is traversed. According to the vulnerability list attributes in the component knowledge, the vulnerability details are matched in the vulnerability library. Similarly, according to the low-priority components and related vulnerabilities in the clustering tree, the vulnerability details are matched. Knowledge extraction and relationship modeling are performed, and high-priority knowledge graphs and low-priority knowledge graphs are constructed at the same time. The constructed knowledge graph is as follows Fig. 9 shown.

[0113] Furthermore, the relationship between component knowledge entities and vulnerability entities is associated through CVEID. CVEID has the uniqueness characteristic and can strengthen the association relationship between entities, which is conducive to knowledge graph reasoning and inference.

[0114] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the security vulnerability detection method of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0115] Based on the above first and second embodiments, the present application also proposes another embodiment, referring to Fig.10 , the security vulnerability detection method comprises:

[0116] In a specific implementation, the step of the device obtaining the full amount of target component data includes:

[0117] Step B100, obtaining full amount of initial component data;

[0118] It should be noted that, in view of the complex features of the full components and vulnerability data, dimensionality reduction processing is usually required. Common dimensionality reduction operations only retain some features of the full data, which can easily cause information loss in the process of dimensionality reduction. This application adopts a dimensionality reduction method based on clustering and PCA, which can ensure that the data retains its original full features while reducing the dimensionality, improve the efficiency of data stratification and knowledge graph construction, and improve the accuracy of vulnerability detection.

[0119] In a specific implementation, the device collects the original data of all components that need to be analyzed. The initial component data includes the name, version, release date, developer, license information, configuration details, etc. of the software component. These data form the basis for subsequent analysis.

[0120] It can be understood that the initial component data is initial unprocessed component data extracted from the central warehouse.

[0121] Step B200, clustering the initial component data to obtain clustered initial component data;

[0122] It should be noted that clustering is an unsupervised learning algorithm that is used to divide samples in a data set into several clusters, so that the samples in the same cluster have high similarity and the samples in different clusters have low similarity. In this step, the initial component data is grouped into different clusters, and each cluster represents a group of similar components. Clustering can help identify components with common characteristics, thereby simplifying subsequent analysis.

[0123] In the specific implementation, we first cluster the high-dimensional data and define Z∈D nxd It is the data matrix to be projected from high-dimensional data to low-dimensional space, where n represents the number of data points and d represents the dimension of high-dimensional space. Clustering algorithm is used to cluster the data matrix Z. The cluster center A of high-dimensional space is obtained. H ∈D kxd , where k is the number of clusters. In high-dimensional space, the membership values ​​of data nodes and cluster centers are calculated as follows:

[0124] in, Represents data node x i Belonging to the cluster center in high-dimensional space d ij is a high-dimensional data node z i and cluster centers The Euclidean distance between is the average distance between the data node and the cluster center in the high-dimensional space. Form the member matrix M H ∈D nxk .

[0125] Step B300, based on a preset principal component analysis method, the clustered initial component data is mapped to a low-dimensional space to obtain component data after dimensionality reduction, and the component data after dimensionality reduction is used as target component data.

[0126] It should be noted that principal component analysis (PCA) is a statistical method used to transform a set of potentially correlated variables into a set of linearly uncorrelated variables, called principal components, through an orthogonal transformation. The purpose of this step is to reduce the dimensionality of the data while retaining as much information from the original data as possible. Through PCA, high-dimensional data can be mapped into a low-dimensional space, which helps reduce computational complexity and improve analysis efficiency. In this step, the initial component data after clustering is mapped into a low-dimensional space, which means the dimensionality of the data is reduced, but the most important features and information are still retained.

[0127] In a specific implementation, after PCA processing, the obtained data is called the dimensionality-reduced component data. These data retain the most important features in the original dataset but are represented in a lower dimension, thus simplifying subsequent analysis and processing. These dimensionality-reduced component data are used as the target component data, that is, the object of subsequent analysis and processing. This makes it more efficient to process large-scale datasets while still being able to capture key information and patterns.

[0128] Specifically, the high-dimensional space clustering center A H ∈D kxd is mapped into a low-dimensional space through the PCA method to obtain the clustering center A L ∈D kxm in the low-dimensional space, where m < d, and the Frobenius norm formula of the high- and low-dimensional member matrices is as follows:

[0129]

[0130] Among them, can be calculated by the following formula:

[0131]

[0132] Among them, d ij is the Euclidean distance between the low-dimensional data node x i and the clustering center , and represents the average value of the distances between data nodes and the clustering center in the low-dimensional space. Each data node p i ∈P, i = 1, 2, …, n in the low-dimensional space is optimized and embedded around the low-dimensional clustering center. The chain rule is applied to calculate the derivative of F with respect to each dimension to find the loss function used in the optimization process. The derivative formula is as follows:

[0133]

[0134] Among them, the first term of the chain can be calculated by the following formula:

[0135]

[0136] The second term of the chain can be calculated as follows:

[0137]

[0138] The third term of the chain can be calculated as follows:

[0139]

[0140] The final derivative formula is as follows:

[0141]

[0142] Using the above loss function and adaptive gradient descent algorithm, we can find the optimal solution P∈D in low-dimensional space. nxm The overall flow chart of data dimensionality reduction is as follows: Fig.11 .

[0143] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the security vulnerability detection method of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0144] This application also provides a security vulnerability detection device, please refer to Fig.12 , the security vulnerability detection device comprises:

[0145] An acquisition module 10 is used to acquire data of components to be detected;

[0146] A first matching module 20 is used to perform vulnerability matching on the component data to be detected based on a preset first priority knowledge graph to obtain a first vulnerability matching result;

[0147] The second matching module 30 is used to perform vulnerability matching on the component data to be detected based on a preset second priority knowledge graph to obtain a second vulnerability matching result if the vulnerability matching result is a matching failure, wherein the priority of the first priority knowledge graph is higher than that of the second priority knowledge graph, and the priority between the first priority knowledge graph and the second priority knowledge graph is determined according to the number of references of the component data for constructing the knowledge graph.

[0148] Optionally, the security vulnerability detection device further includes:

[0149] A data acquisition module, used to acquire the full amount of target component data, the number of references of the target component data, and target vulnerability data;

[0150] A partitioning module, configured to perform priority partitioning on the target component data based on the number of references to obtain first priority component data and second priority component data;

[0151] a determination module, configured to determine first priority vulnerability data based on the first priority component data and the target vulnerability data, and to determine second priority vulnerability data based on the second priority component data and the target vulnerability data;

[0152] A construction module is used to construct a first priority knowledge graph based on the first priority component data and the first priority vulnerability data, and to construct a second priority knowledge graph based on the second priority component data and the second priority vulnerability data.

[0153] Optionally, the division module includes:

[0154] A calculation module, used for calculating the distance between any two target component data based on the number of references to obtain a distance result set;

[0155] A clustering module, used to cluster the target component data based on the distance result set to obtain the number of clusters of the clustering result of the current iteration round;

[0156] A judgment module, used to judge whether the number of clusters in the clustering result of the current iteration round is greater than two;

[0157] An iterative clustering module is used to return to the step of clustering the target component data based on the distance result set to obtain the number of clusters of the current iterative round clustering result if the number of clusters of the current iterative round clustering result is greater than two, until the number of clusters of the current iterative round clustering result reaches two, thereby obtaining the first priority component data and the second priority component data after clustering.

[0158] Optionally, the determining module includes:

[0159] A mapping relationship information acquisition module is used to obtain mapping relationship information between component data and vulnerability data;

[0160] A first mapping module, configured to map the target vulnerability data to obtain first priority vulnerability data based on the first priority component data and the mapping relationship information;

[0161] The second-first mapping module is used to map the target vulnerability data to obtain second-priority vulnerability data based on the second-priority component data and the mapping relationship information.

[0162] Optionally, the building block includes:

[0163] A first knowledge graph construction module, configured to extract knowledge from the first-priority component data to obtain first-priority component knowledge, match the first-priority component knowledge based on the first-priority vulnerability data to obtain a first matching result, and then construct a first-priority knowledge graph based on the first matching result;

[0164] The second knowledge graph construction module is used to extract knowledge from the second-priority component data to obtain second-priority component knowledge, and match the second-priority component knowledge based on the second-priority vulnerability data to obtain a second matching result, and then construct a second priority knowledge graph based on the second matching result.

[0165] Optionally, the data acquisition module includes:

[0166] An initial component data acquisition module is used to acquire the full amount of initial component data;

[0167] A component clustering module, used for clustering the initial component data to obtain clustered initial component data;

[0168] The dimensionality reduction module is used to map the clustered initial component data to a low-dimensional space based on a preset principal component analysis method to obtain component data after dimensionality reduction, and use the component data after dimensionality reduction as target component data.

[0169] The security vulnerability detection device provided by the present application adopts the security vulnerability detection method in the above embodiment, which can solve the technical problem of security vulnerability detection. Compared with the prior art, the beneficial effects of the security vulnerability detection device provided by the present application are the same as the beneficial effects of the security vulnerability detection method provided by the above embodiment, and other technical features in the security vulnerability detection device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0170] The present application provides a security vulnerability detection device, which includes: at least one processor; and a memory that is communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the security vulnerability detection method in the above-mentioned embodiment one.

[0171] Reference below Fig.13, which shows a schematic diagram of the structure of a security vulnerability detection device suitable for implementing the embodiments of the present application. The security vulnerability detection device in the embodiments of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Fig.13 The security vulnerability detection device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0172] like Fig.13 As shown, the security vulnerability detection device may include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the security vulnerability detection device are also stored. The processing device 1001, ROM1002, and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the security vulnerability detection device to communicate with other devices wirelessly or by wire to exchange data. Although the figure shows a security vulnerability detection device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or provided instead.

[0173] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0174] The security vulnerability detection device provided by the present application adopts the security vulnerability detection method in the above embodiment to solve the technical problem of security vulnerability detection. Compared with the prior art, the beneficial effects of the security vulnerability detection device provided by the present application are the same as the beneficial effects of the security vulnerability detection method provided by the above embodiment, and other technical features in the security vulnerability detection device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0175] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0176] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0177] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, wherein the computer-readable program instructions are used to execute the security vulnerability detection method in the above-mentioned embodiment.

[0178] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0179] The computer-readable storage medium may be included in the security vulnerability detection device; or may exist independently without being assembled into the security vulnerability detection device.

[0180] The computer-readable storage medium carries one or more programs. When the one or more programs are executed by the security vulnerability detection device, the security vulnerability detection device performs security vulnerability detection.

[0181] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0182] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0183] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0184] The readable storage medium provided by the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned security vulnerability detection method, and can solve the technical problem of security vulnerability detection. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present application are the same as the beneficial effects of the security vulnerability detection method provided by the above-mentioned embodiment, and will not be repeated here.

[0185] The present application also provides a computer program product, including a computer program, which implements the steps of the security vulnerability detection method as described above when executed by a processor.

[0186] The computer program product provided by this application can solve the technical problem of security vulnerability detection. Compared with the prior art, the beneficial effects of the computer program product provided by this application are the same as the beneficial effects of the security vulnerability detection method provided by the above embodiment, which will not be repeated here.

[0187] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A security vulnerability detection method, characterized in that: The method for detecting security vulnerabilities comprises: Get the data of the component to be detected; Based on a preset first priority knowledge graph, vulnerability matching is performed on the component data to be detected to obtain a first vulnerability matching result; If the vulnerability matching result is a matching failure, vulnerability matching is performed on the component data to be detected based on the preset second priority knowledge graph to obtain a second vulnerability matching result, wherein the priority of the first priority knowledge graph is higher than that of the second priority knowledge graph, and the priority between the first priority knowledge graph and the second priority knowledge graph is determined according to the number of references of the component data for constructing the knowledge graph.

2. The security vulnerability detection method according to claim 1, characterized in that: Before the step of obtaining the data of the component to be detected, the method includes: Obtaining a full amount of target component data, the number of references to the target component data, and target vulnerability data; Based on the number of references, the target component data is prioritized to obtain first priority component data and second priority component data; Determine first priority vulnerability data based on the first priority component data and the target vulnerability data, and determine second priority vulnerability data based on the second priority component data and the target vulnerability data; Based on the first-priority component data and the first-priority vulnerability data, a first-priority knowledge graph is constructed, and based on the second-priority component data and the second-priority vulnerability data, a second-priority knowledge graph is constructed.

3. The security vulnerability detection method according to claim 2, characterized in that: The step of prioritizing the target component data based on the number of references to obtain first priority component data and second priority component data includes: Based on the number of references, calculate the distance between any two target component data to obtain a distance result set; Based on the distance result set, clustering the target component data to obtain the number of clusters of the clustering result of the current iteration round; Determine whether the number of clusters in the clustering result of the current iteration round is greater than two; If the number of clusters of the clustering result of the current iteration round is greater than two, return to the step of clustering the target component data based on the distance result set to obtain the number of clusters of the clustering result of the current iteration round, until the number of clusters of the clustering result of the current iteration round reaches two, and obtain the first priority component data and the second priority component data after clustering.

4. The security vulnerability detection method according to claim 2, characterized in that: The step of determining first priority vulnerability data based on the first priority component data and the target vulnerability data, and determining second priority vulnerability data based on the second priority component data and the target vulnerability data comprises: Obtain mapping relationship information between component data and vulnerability data; Based on the first priority component data and the mapping relationship information, mapping from the target vulnerability data to obtain first priority vulnerability data; Based on the second priority component data and the mapping relationship information, second priority vulnerability data is mapped from the target vulnerability data.

5. The security vulnerability detection method according to claim 2, characterized in that: The step of constructing a first priority knowledge graph based on the first priority component data and the first priority vulnerability data, and constructing a second priority knowledge graph based on the second priority component data and the second priority vulnerability data includes: Extracting knowledge from the first-priority component data to obtain first-priority component knowledge, matching the first-priority component knowledge based on the first-priority vulnerability data to obtain a first matching result, and constructing a first-priority knowledge graph based on the first matching result; The second-priority component data is subjected to knowledge extraction to obtain second-priority component knowledge, and the second-priority component knowledge is matched based on the second-priority vulnerability data to obtain a second matching result, and then a second-priority knowledge graph is constructed based on the second matching result.

6. The security vulnerability detection method according to claim 2, characterized in that: The step of obtaining the full amount of target component data includes: Get the full amount of initial component data; Clustering the initial component data to obtain clustered initial component data; Based on a preset principal component analysis method, the clustered initial component data is mapped to a low-dimensional space to obtain component data after dimensionality reduction, and the component data after dimensionality reduction is used as target component data.

7. A security vulnerability detection device, characterized in that: The device comprises: An acquisition module is used to obtain the data of the component to be detected; A first matching module, configured to perform vulnerability matching on the component data to be detected based on a preset first priority knowledge graph to obtain a first vulnerability matching result; The second matching module is used to perform vulnerability matching on the component data to be detected based on a preset second priority knowledge graph to obtain a second vulnerability matching result if the vulnerability matching result is a matching failure, wherein the priority of the first priority knowledge graph is higher than that of the second priority knowledge graph, and the priority between the first priority knowledge graph and the second priority knowledge graph is determined according to the number of references of the component data for constructing the knowledge graph.

8. A security vulnerability detection device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the security vulnerability detection method according to any one of claims 1 to 6.

9. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the security vulnerability detection method according to any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the security vulnerability detection method according to any one of claims 1 to 6 are implemented.

Images