Security vulnerability detection method, device, equipment, storage medium and product

Abstract

The application discloses a security vulnerability detection method and device, equipment, a storage medium and a product, relates to the technical field of vulnerability detection, and discloses a security vulnerability detection method, comprising the following steps: acquiring to-be-detected component data; based on a preset first priority knowledge graph, performing vulnerability matching on the to-be-detected component data to obtain a first vulnerability matching result; if the vulnerability matching result is a matching failure, performing vulnerability matching on the to-be-detected component data based on a preset second priority knowledge graph to obtain a second vulnerability matching result. The application gives priority to matching the first priority knowledge graph for the to-be-detected component data, and if corresponding component and vulnerability information are matched, it is not necessary to perform matching scanning of the second priority knowledge graph; only when corresponding component and vulnerability information are not matched from the first priority knowledge graph, the second priority knowledge graph is matched, so that the efficiency of security vulnerability scanning is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of vulnerability detection, and particularly relates to a security vulnerability detection method and device, equipment, a storage medium and a product. BACKGROUND

[0002] At present, with the wide application of open source software in software development, its security problem is increasingly concerned. The open source software supply chain security vulnerability detection technology mainly focuses on identifying and repairing security vulnerabilities in open source software to ensure the security and reliability of the software supply chain. Therefore, how to improve the security vulnerability detection capability of the open source software supply chain is a technical challenge at present.

[0003] In the related art, the full amount of component data and vulnerability data is usually obtained from a component library and a vulnerability library, a supply chain knowledge graph is constructed, and then the vulnerability matching of the knowledge graph is performed on the component to be detected based on the supply chain knowledge graph, so as to obtain the corresponding security vulnerability detection result. However, there is a large amount of redundant data in the component library and the vulnerability library, and the vulnerability matching process is very time-consuming when processing such a large amount of data, resulting in low detection efficiency of the security vulnerability of the open source software supply chain.

[0004] The above content is only used to assist in understanding the technical solutions of the present application and does not represent the acknowledgement of the above content as prior art. SUMMARY

[0005] The main purpose of the present application is to provide a security vulnerability detection method, which aims to solve the technical problem of low detection efficiency of the security vulnerability of the open source software supply chain.

[0006] To achieve the above purpose, the present application provides a security vulnerability detection method, which comprises the following steps:

[0007] obtaining component data to be detected;

[0008] performing vulnerability matching on the component data to be detected based on a preset first priority knowledge graph to obtain a first vulnerability matching result;

[0009] If the vulnerability matching result is a matching failure, performing vulnerability matching on the component data to be detected based on a preset second priority knowledge graph to obtain a second vulnerability matching result, wherein the priority of the first priority knowledge graph is higher than that of the second priority knowledge graph, and the priority between the first priority knowledge graph and the second priority knowledge graph is determined according to the reference times of the component data used to construct the knowledge graph.

[0010] Optionally, before the step of obtaining the component data to be detected, the method comprises the following steps:

[0011] acquire full target component data, reference times of the target component data, and target vulnerability data;

[0012] based on the reference times, prioritize the target component data to obtain first priority component data and second priority component data;

[0013] based on the first priority component data and the target vulnerability data, determine first priority vulnerability data, and based on the second priority component data and the target vulnerability data, determine second priority vulnerability data;

[0014] based on the first priority component data and the first priority vulnerability data, construct a first priority knowledge graph, and based on the second priority component data and the second priority vulnerability data, construct a second priority knowledge graph.

[0015] Optionally, the step of prioritizing the target component data based on the reference times to obtain first priority component data and second priority component data comprises:

[0016] based on the reference times, calculate the distance between any two target component data to obtain a distance result set;

[0017] based on the distance result set, cluster the target component data to obtain the cluster number of the current iteration round clustering result;

[0018] determine whether the cluster number of the current iteration round clustering result is greater than two;

[0019] If the cluster number of the current iteration round clustering result is greater than two, return to the step of clustering the target component data based on the distance result set to obtain the cluster number of the current iteration round clustering result until the cluster number of the current iteration round clustering result reaches two, and obtain the clustered first priority component data and second priority component data.

[0020] Optionally, the steps of determining first priority vulnerability data based on the first priority component data and the target vulnerability data, and determining second priority vulnerability data based on the second priority component data and the target vulnerability data comprise:

[0021] acquire mapping relationship information between component data and vulnerability data;

[0022] based on the first priority component data and the mapping relationship information, map the first priority vulnerability data from the target vulnerability data;

[0023] Map the second priority vulnerability data from the target vulnerability data based on the second priority component data and the mapping relationship information.

[0024] Optionally, the step of constructing the first priority knowledge graph based on the first priority component data and the first priority vulnerability data, and constructing the second priority knowledge graph based on the second priority component data and the second priority vulnerability data, comprises:

[0025] knowledge extraction on the first priority component data to obtain first priority component knowledge, and matching the first priority component knowledge based on the first priority vulnerability data to obtain a first matching result, and constructing the first priority knowledge graph based on the first matching result;

[0026] knowledge extraction on the second priority component data to obtain second priority component knowledge, and matching the second priority component knowledge based on the second priority vulnerability data to obtain a second matching result, and constructing the second priority knowledge graph based on the second matching result.

[0027] Optionally, the step of obtaining the full amount of target component data comprises:

[0028] obtaining full amount of initial component data;

[0029] clustering the initial component data to obtain clustered initial component data;

[0030] mapping the clustered initial component data to a low-dimensional space based on a preset principal component analysis method to obtain reduced component data, and taking the reduced component data as the target component data.

[0031] In addition, to achieve the above-mentioned purpose, the application further provides a security vulnerability detection device, which comprises:

[0032] an acquisition module configured to acquire component data to be detected;

[0033] a first matching module configured to perform vulnerability matching on the component data to be detected based on a preset first priority knowledge graph to obtain a first vulnerability matching result;

[0034] The second matching module is configured to, if the vulnerability matching result is a matching failure, perform vulnerability matching on the to-be-detected component data based on a preset second priority knowledge graph, to obtain a second vulnerability matching result, wherein the first priority knowledge graph has a higher priority than the second priority knowledge graph, and the priority between the first priority knowledge graph and the second priority knowledge graph is determined according to the reference times of the component data used to construct the knowledge graphs.

[0035] In addition, to achieve the above object, the present application further provides a security vulnerability detection device, which comprises a memory, a processor and a computer program stored in the memory and executable on the processor, and the computer program is configured to implement the steps of the security vulnerability detection method as described above.

[0036] In addition, to achieve the above object, the present application further provides a storage medium, which is a computer readable storage medium, and the storage medium stores a computer program, and the computer program is executed by a processor to implement the steps of the security vulnerability detection method as described above.

[0037] In addition, to achieve the above object, the present application further provides a computer program product, which comprises a computer program, and the computer program is executed by a processor to implement the steps of the security vulnerability detection method as described above.

[0038] The one or more technical solutions provided by the present application have at least the following technical effects:

[0039] Compared with the related art, the full amount of component data and vulnerability data is usually obtained from a component library and a vulnerability library, a supply chain knowledge graph is constructed, and then the vulnerability matching of the knowledge graph is performed on the component to be detected based on the supply chain knowledge graph, so as to obtain the corresponding security vulnerability detection result. However, there is a large amount of redundant data in the component library and the vulnerability library in this method, and the vulnerability matching process is very time-consuming when processing such a large amount of data, resulting in low detection efficiency of the open source software supply chain security vulnerability. Compared with the prior art, the technical scheme is provided: obtaining component data to be detected; performing vulnerability matching on the component data to be detected based on a preset first priority knowledge graph to obtain a first vulnerability matching result; if the vulnerability matching result is a matching failure, performing vulnerability matching on the component data to be detected based on a preset second priority knowledge graph to obtain a second vulnerability matching result, wherein the priority of the first priority knowledge graph is higher than that of the second priority knowledge graph, and the priority between the first priority knowledge graph and the second priority knowledge graph is determined according to the reference times of the component data for constructing the knowledge graph. It can be understood that, for each component data to be detected, the first priority knowledge graph with high reference times of the component data for constructing the knowledge graph, that is, high priority, is matched first. If the corresponding component and vulnerability information are matched from the first priority knowledge graph, the matching scanning of the second priority knowledge graph is not needed, and it can be determined that the component to be matched has a vulnerability; only when the corresponding component and vulnerability information are not matched from the first priority knowledge graph, the second priority knowledge graph is matched, so as to maximize the efficiency of the security vulnerability scanning on the basis of ensuring the full amount of security vulnerability detection. BRIEF DESCRIPTION OF DRAWINGS

[0040] The accompanying drawings, which are incorporated into and form a part of the specification, illustrate an embodiment consistent with the present application and, together with the description, serve to explain the principles of the application.

[0041] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the accompanying drawings needed to be used in the embodiment or prior art description will be briefly introduced. Obviously, for those skilled in the art, other drawings can also be obtained without creative labor.

[0042] Figure 1 The flowchart provided by the first embodiment of the security vulnerability detection method of the present application;

[0043] Figure 2 The flowchart for extracting the component to be detected in the security vulnerability detection method of the present application;

[0044] Figure 3 The component data diagram of the security vulnerability detection method of the present application;

[0045] Figure 4 The security vulnerability matching process schematic diagram of the security vulnerability detection method of the present application;

[0046] Figure 5 The flow schematic diagram provided by the second embodiment of the security vulnerability detection method of the present application;

[0047] Figure 6 The complete flow schematic diagram of the security vulnerability detection method of the present application;

[0048] Figure 7 The condensed hierarchical clustering flow schematic diagram of the security vulnerability detection method of the present application;

[0049] Figure 8 The vulnerability data hierarchical flow schematic diagram of the security vulnerability detection method of the present application;

[0050] Figure 9 The knowledge graph construction flow schematic diagram of the security vulnerability detection method of the present application;

[0051] Figure 10 The flow schematic diagram provided by the third embodiment of the security vulnerability detection method of the present application;

[0052] Figure 11 The component data dimension reduction flow schematic diagram of the security vulnerability detection method of the present application;

[0053] Figure 12 The module structure schematic diagram of the security vulnerability detection device of the embodiment of the present application;

[0054] Figure 13 The device structure schematic diagram of the hardware running environment involved in the security vulnerability detection method of the embodiment of the present application.

[0055] The purpose implementation, functional features and advantages of the present application will be further explained in combination with the embodiments and with reference to the drawings. DETAILED DESCRIPTION

[0056] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application, and are not used to limit the present application.

[0057] In order to better understand the technical solutions of the present application, the following will be described in detail in combination with the drawings of the specification and specific embodiments.

[0058] The main solution of the embodiment of the application is: obtaining to-be-detected component data; performing vulnerability matching on the to-be-detected component data based on a preset first priority knowledge graph to obtain a first vulnerability matching result; if the vulnerability matching result is a matching failure, performing vulnerability matching on the to-be-detected component data based on a preset second priority knowledge graph to obtain a second vulnerability matching result, wherein the priority of the first priority knowledge graph is higher than that of the second priority knowledge graph, and the priority between the first priority knowledge graph and the second priority knowledge graph is determined according to the reference times of the component data for constructing the knowledge graph.

[0059] In the embodiment, the security vulnerability detection device is taken as an execution subject, and for the convenience of description, the device is referred to as a device in the following.

[0060] In the related art, the full amount of component data and vulnerability data is usually obtained from a component library and a vulnerability library, a supply chain knowledge graph is constructed, and then vulnerability matching of the knowledge graph is performed on a to-be-detected component based on the supply chain knowledge graph to obtain a corresponding security vulnerability detection result. However, there is a large amount of redundant data in the component library and the vulnerability library in the method, and the vulnerability matching process is very time-consuming when processing such a large amount of data, which leads to low detection efficiency of the open source software supply chain security vulnerability.

[0061] The application provides a solution to maximize the efficiency of security vulnerability scanning while ensuring full security vulnerability detection.

[0062] As can be seen from the above embodiment, for each to-be-detected component data, the application preferentially performs matching on the first priority knowledge graph with high reference times of component data for constructing the knowledge graph, that is, with high priority. If the corresponding component and vulnerability information are matched from the first priority knowledge graph, there is no need to perform matching scanning of the second priority knowledge graph, and it can be determined that the to-be-matched component has a vulnerability. Only when the corresponding component and vulnerability information are not matched from the first priority knowledge graph, the second priority knowledge graph is matched, so as to maximize the efficiency of security vulnerability scanning while ensuring full security vulnerability detection.

[0063] It should be noted that the execution subject of the embodiment can be a computing service device with data processing, network communication, and program running functions, such as a tablet computer, a personal computer, a mobile phone, or an electronic device, a terminal system, etc. capable of realizing the above functions. The security vulnerability detection device is taken as an example to illustrate the embodiment and the following embodiments.

[0064] Based on this, the embodiment of the application provides a security vulnerability detection method, which is described with reference to Figure 1 , Figure 1A flowchart of a first embodiment of a security vulnerability detection method of the present application.

[0065] In this embodiment, the security vulnerability detection method comprises steps S100-S300:

[0066] Step S100, obtaining component data to be detected;

[0067] It should be noted that the component data to be detected refers to collecting and preparing relevant information of the software component to be checked before security detection or vulnerability analysis. These data are the basis for security analysis.

[0068] In a specific implementation, the specific scenario of the present application is software vulnerability security detection of an open source software supply chain. Specifically, the manner in which the device obtains component data to be detected specifically comprises: Figure 2 Bill of materials generation is the first stage of software supply chain security vulnerability detection. The source code or binary file is input into the SBOM generation module, and the characteristic file in the source code, such as the pom file in the java language, the jar package of the binary file, etc., is parsed to generate the SBOM file in the json or xml format, i.e., the software bill of materials, and then the component data to be detected is extracted from the list.

[0069] Further, referring to Figure 3 The component information extracted from the SBOM includes component name, component publisher, component version, CPE, PURL, etc. After the component is extracted, the knowledge graph generated by the above steps is used for vulnerability matching analysis.

[0070] Step S200, based on a preset first priority knowledge graph, performing vulnerability matching on the component data to be detected to obtain a first vulnerability matching result;

[0071] It should be noted that the first priority knowledge graph is a knowledge graph constructed in advance according to the component information of the first priority and the corresponding vulnerability information. The priority of the component information is determined according to the reference times (i.e., the popularity) of the component data, i.e., the more the reference times of the component data, the more popular the component, and the higher the priority.

[0072] In a specific implementation, the first priority knowledge graph data in the present application, i.e., the high priority knowledge graph data, accounts for about 20% of the total component and vulnerability data, and can cover 80% of the commonly used usage scenarios in actual scenarios. For details, refer to Figure 4 In the case where the high priority knowledge graph is not matched, low priority knowledge graph matching is performed. Since the high priority data is a popular component that has been fully screened, it is less disturbed by noise and redundant data, and the matching accuracy and matching efficiency are doubled.

[0073] Step S300, if the vulnerability matching result is a matching failure, based on the preset second priority knowledge graph, the vulnerability matching of the to-be-detected component data is performed to obtain a second vulnerability matching result, wherein the priority of the first priority knowledge graph is higher than that of the second priority knowledge graph, and the priority between the first priority knowledge graph and the second priority knowledge graph is determined according to the reference times of the component data for constructing the knowledge graph.

[0074] In a specific implementation, when the first priority knowledge graph is used to perform vulnerability matching on the to-be-detected component data, if no matching vulnerability is found, i.e., a matching failure occurs. After the matching failure of the first priority knowledge graph, the device will use the second priority knowledge graph for matching. This graph also contains information about components and vulnerabilities, but has a lower priority than the first priority knowledge graph. The priority between the first priority and the second priority knowledge graph is determined according to the reference times of the component data for constructing the knowledge graph. The component data with more reference times is considered to be more common or more important, so its corresponding knowledge graph is given a higher priority. This means that the reference times of the component data in the first priority knowledge graph is higher than that in the second priority knowledge graph.

[0075] Further, after using the second priority knowledge graph for matching, the obtained vulnerability matching result is called the second vulnerability matching result. This may be some less common or less serious vulnerabilities, or vulnerabilities that are not recorded in the first priority knowledge graph. The above entire process is automated, and aims to ensure that even when the most priority knowledge graph fails to match the vulnerability, the possible vulnerability can still be found through the sub-priority knowledge graph, so as to improve the coverage and accuracy of vulnerability detection.

[0076] Compared with the related art, the full component data and vulnerability data are usually obtained from a component library and a vulnerability library, a supply chain knowledge graph is constructed, and then the vulnerability matching of the knowledge graph is performed on the component to be detected based on the supply chain knowledge graph, so as to obtain the corresponding security vulnerability detection result. However, there is a large amount of redundant data in the component library and the vulnerability library, and the vulnerability matching process is very time-consuming when processing such a large amount of data, which leads to low detection efficiency of the open source software supply chain security vulnerability. Compared with the prior art, the technical scheme is proposed: obtaining component data to be detected; performing vulnerability matching on the component data to be detected based on a preset first priority knowledge graph to obtain a first vulnerability matching result; if the vulnerability matching result is a matching failure, performing vulnerability matching on the component data to be detected based on a preset second priority knowledge graph to obtain a second vulnerability matching result, wherein the priority of the first priority knowledge graph is higher than that of the second priority knowledge graph, and the priority between the first priority knowledge graph and the second priority knowledge graph is determined according to the reference times of the component data for constructing the knowledge graph. It can be understood that, for each component data to be detected, the first priority knowledge graph with high reference times of the component data for constructing the knowledge graph, that is, high priority, is matched first. If the corresponding component and vulnerability information are matched from the first priority knowledge graph, the matching scanning of the second priority knowledge graph is not needed, and it can be determined that the component to be matched has a vulnerability; only when the corresponding component and vulnerability information are not matched from the first priority knowledge graph, the second priority knowledge graph is matched, so as to maximize the efficiency of the security vulnerability scanning on the basis of ensuring the full security vulnerability detection.

[0077] Based on the above first embodiment, another embodiment is further proposed in the application, referring to Figure 5 The security vulnerability detection method comprises:

[0078] In a specific implementation, before the step of obtaining the component data to be detected, the method comprises:

[0079] Step A100, obtaining full target component data, reference times of the target component data, and target vulnerability data;

[0080] It should be noted that the target component data refers to detailed information of all software components that need to be analyzed for security, and referring to Figure 6 The device can obtain the full target component data directly from the central warehouse, or obtain the full target component data after dimension reduction of the component data obtained from the central warehouse.

[0081] Further, the target vulnerability data refers to detailed information of known security vulnerabilities related to the target components, which are usually sourced from security vulnerability databases such as CVE (Common Vulnerabilities and Exposures). The target vulnerability data includes identifiers of vulnerabilities (such as CVE numbers), descriptions, affected component versions, severity levels of vulnerabilities, known exploitation methods, repair recommendations and patch information, etc.

[0082] In a specific implementation, the reference times of the target component data refer to the number of times each target component is referenced or used in different environments, projects or devices. The reference times can reflect the popularity and importance of a component, which is very important for determining which components need to be prioritized for security analysis and vulnerability detection. The reference times data can be obtained in various ways, such as software asset management tools, configuration management databases, code library analysis tools, etc.

[0083] It should be emphasized that the priority division, in addition to the reference times of the target component data, can also include attribute information such as the time of introduction into the database.

[0084] Step A200, based on the reference times, prioritizing the target component data to obtain first priority component data and second priority component data;

[0085] In a specific implementation, the way the device prioritizes the target component data based on the reference times first needs to determine a standard or threshold value for dividing the components into different priorities. This standard can be based on the absolute value of the reference times (for example, components with reference times exceeding a certain specific value are considered high priority), or it can be a relative proportion (for example, components with reference times ranking in the top 10% are considered high priority). According to the above standard, the components with the most reference times are divided into the first priority component data. These components are widely used and, once there is a vulnerability, they can affect more systems and users, so they need to be prioritized for security analysis and vulnerability detection. The components with fewer reference times are divided into the second priority component data. These components are also important, but compared to the first priority components, their impact range may be smaller, so they can be placed in the second priority data matching.

[0086] Further, the priority division can need to be dynamically adjusted according to the actual situation, that is, the priority update. For example, if a component is suddenly widely adopted, or a component has a serious security vulnerability, its priority may need to be raised.

[0087] In a specific implementation, the step of dividing the target component data into first priority component data and second priority component data based on the reference times comprises:

[0088] Based on the reference times, the distance between any two target component data is calculated to obtain a distance result set; based on the distance result set, the target component data is clustered to obtain a cluster number of the current iteration round clustering result; it is judged whether the cluster number of the current iteration round clustering result is greater than two; if the cluster number of the current iteration round clustering result is greater than two, the step of clustering the target component data based on the distance result set to obtain the cluster number of the current iteration round clustering result is returned until the cluster number of the current iteration round clustering result reaches two, and the first priority component data and the second priority component data after clustering are obtained.

[0089] It should be noted that in the open source software supply chain, the proportion of components that are actually used in the hundreds of millions of component data is very small, but in the component and vulnerability matching process, all components need to be matched, which is low in matching efficiency and low in accuracy. In order to solve this problem in vulnerability detection, a data hierarchical clustering method is introduced to classify data by priority and prioritize matching of high-priority component libraries.

[0090] In a specific implementation, in the data hierarchical clustering stage, the data after cleaning and dimension reduction is used for hierarchical clustering training according to the processing result of the data preprocessing stage. The hierarchical clustering algorithm is divided into top-down hierarchical clustering and bottom-up hierarchical clustering, the former splits the data under the same cluster into multiple clusters, and the latter combines multiple single entities into n clusters. The present application adopts the agglomerative hierarchical clustering algorithm based on the latter to combine multiple component entities into two clusters of high and low priorities.

[0091] Further, the agglomerative hierarchical clustering algorithm first needs to calculate the distance between objects. Here, the present application adopts the method of calculating similarity, which can use the Minkowski distance measurement criterion. The distance calculation formula between two objects is as follows:

[0092] Wherein, x i1 , x i2 …x ip and x j1 , x j2 …x jpThe p attribute values of two objects respectively, representing the reference times respectively. On the basis of calculating the distance between two objects, the distance between two clusters is further calculated, and the common average distance method is used to measure the distance between clusters, and the calculation formula is as follows:

[0093]

[0094] Wherein, |q-q'| represents the distance d(i,j) between two objects calculated in the last step, c i , c j respectively represent different two clusters, n i , n j represent the number of objects in two clusters respectively.

[0095] In the specific implementation, the similarity between any two points is calculated, the most similar two data nodes in the data are combined, and the process is iterated repeatedly. Finally, a clustering tree is generated, and the clustering process is as follows Figure 7 As shown in the figure, the threshold can be controlled in the application to ensure that a two-level clustering tree is finally generated.

[0096] Step A300, determining first priority vulnerability data based on the first priority component data and the target vulnerability data, and determining second priority vulnerability data based on the second priority component data and the target vulnerability data;

[0097] In the specific implementation, the device selects the vulnerability data corresponding to the first priority component data from the full target vulnerability data as the first priority vulnerability data according to the divided first priority component data. Correspondingly, the device selects the vulnerability data corresponding to the second priority component data from the full target vulnerability data as the second priority vulnerability data according to the divided second priority component data.

[0098] In the specific implementation, the device determines the first priority vulnerability data based on the first priority component data and the target vulnerability data, and determines the second priority vulnerability data based on the second priority component data and the target vulnerability data. The steps include:

[0099] Obtaining mapping relationship information between component data and vulnerability data; mapping the first priority vulnerability data from the target vulnerability data based on the first priority component data and the mapping relationship information; and mapping the second priority vulnerability data from the target vulnerability data based on the second priority component data and the mapping relationship information.

[0100] In a specific implementation, the device maps the vulnerability information crawled from the NVD / CNVD to different levels according to the clustering results of the component agglomeration hierarchy and the mapping relationship between the components and the vulnerabilities. For high-priority vulnerabilities, the specific mapping method is to obtain the vulnerability information (CVEID) in the high-priority component, and then match the CVEID in the vulnerability library. The overall process of high-priority vulnerabilities is as follows Figure 8 As shown, the low-priority vulnerability data can be obtained in the same way.

[0101] Step A400, based on the first priority component data and the first priority vulnerability data, a first priority knowledge graph is constructed, and based on the second priority component data and the second priority vulnerability data, a second priority knowledge graph is constructed.

[0102] In a specific implementation, the device uses the first priority component data and the first priority vulnerability data to construct a knowledge graph. This graph contains entities (such as components, vulnerabilities) and their relationships (such as components affected by vulnerabilities). The construction process of this graph includes the following steps:

[0103] Knowledge modeling: define entity types (such as operating systems, software, attacks, etc.) and their relationships;

[0104] Knowledge storage: choose a suitable graph database to store the knowledge graph, such as Neo4j;

[0105] Knowledge extraction: extract entity and relationship information from data sources;

[0106] Knowledge fusion: integrate the extracted information to solve entity recognition and data alignment problems;

[0107] Knowledge calculation: identify high-risk points and impact ranges through graph analysis methods;

[0108] Knowledge application: use the knowledge graph for risk identification, high-risk recommendation, impact range analysis, and mitigation measures decision-making, etc.

[0109] Further, another knowledge graph is constructed using the second priority component data and the second priority vulnerability data. The construction process of this graph is similar to the first priority knowledge graph, but it focuses on components and vulnerabilities with fewer citations or lower risks.

[0110] In a specific implementation, the device constructs a first priority knowledge graph based on the first priority component data and the first priority vulnerability data, and constructs a second priority knowledge graph based on the second priority component data and the second priority vulnerability data. The steps include:

[0111] The first priority component data is subjected to knowledge extraction to obtain first priority component knowledge, and based on the first priority vulnerability data, the first priority component knowledge is matched to obtain a first matching result, and based on the first matching result, a first priority knowledge graph is constructed; the second priority component data is subjected to knowledge extraction to obtain second priority component knowledge, and based on the second priority vulnerability data, the second priority component knowledge is matched to obtain a second matching result, and based on the second matching result, a second priority knowledge graph is constructed.

[0112] In a specific implementation, based on the component and vulnerability hierarchical data constructed in the previous step, the device performs hierarchical knowledge graph construction. First, high-priority knowledge graph construction is performed to obtain all high-priority components and related vulnerabilities in the clustering tree. The high-priority component knowledge is traversed, and based on the vulnerability list attribute in the component knowledge, the detailed information of the vulnerability is matched from the vulnerability library. Similarly, based on the low-priority components and related vulnerabilities in the clustering tree, the detailed information of the vulnerability is matched. Knowledge extraction and relationship modeling are performed, and high-priority knowledge graph and low-priority knowledge graph are constructed. The constructed knowledge graph is as shown in the following table. Figure 9

[0113] Further, the relationship between the component knowledge entity and the vulnerability entity is associated through the CVEID. The CVEID has the characteristics of uniqueness, which can strengthen the association between entities and is beneficial to knowledge graph reasoning and inference.

[0114] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the security vulnerability detection method of the present application. Further simple transformations based on this technical concept are within the scope of protection of the present application.

[0115] Based on the above first embodiment and second embodiment, the present application further proposes another embodiment. Referring to Figure 10 , the security vulnerability detection method comprises:

[0116] In a specific implementation, the step of obtaining the full amount of target component data by the device comprises:

[0117] Step B100, obtaining full amount of initial component data;

[0118] It should be noted that, due to the complex characteristics of the full amount of component and vulnerability data, dimension reduction processing is usually required. Common dimension reduction operations only retain part of the features of the full amount of data, and information loss is easily caused in the dimension reduction process. The dimension reduction method based on clustering and PCA adopted by the present application can ensure that the data retains the original full amount of features while reducing the dimension, thereby improving the data hierarchical and knowledge graph construction efficiency and improving the vulnerability detection accuracy.

[0119] ​In a specific implementation, the device collects raw data of all components that need to be analyzed. The initial component data includes the name, version, release date, developer, license information, configuration details, etc. of the software component. These data form the basis for subsequent analysis.

[0120] It can be understood that the initial component data is the initial and unprocessed component data extracted from the central repository.

[0121] Step B200, clustering the initial component data to obtain clustered initial component data;

[0122] It should be noted that clustering is an unsupervised learning algorithm that divides samples in a data set into several clusters, so that the similarity of samples in the same cluster is high, and the similarity of samples between different clusters is low. In this step, the initial component data is grouped into different clusters, and each cluster represents a group of similar components. Clustering can help identify components with common characteristics, thereby simplifying subsequent analysis.

[0123] In a specific implementation, clustering is first performed on high-dimensional data, and Z is defined as D nxd is a data matrix to be projected from high-dimensional data to low-dimensional space, where n represents the number of data points, and d represents the dimension of the high-dimensional space. The data matrix Z is clustered using a clustering algorithm. The high-dimensional space clustering center A H ∈D kxd , where k is the number of clusters. In the high-dimensional space, the membership value of the data node and the cluster center is calculated, and the formula is as follows:

[0124] Wherein, represents the data node x i belongs to the cluster center d ij in the high-dimensional space, i the Euclidean distance between the high-dimensional data node z and the cluster center , and is the average distance between the data node and the cluster center in the high-dimensional space, and the membership matrix M H ∈D nxk is formed.

[0125] Step B300, based on a predetermined principal component analysis method, mapping the clustered initial component data to a low-dimensional space to obtain reduced component data, and taking the reduced component data as target component data.

[0126] It should be noted that principal component analysis (PCA) is a statistical method used to transform a set of potentially correlated variables into a set of linearly uncorrelated variables, called principal components, through orthogonal transformation. The purpose of this step is to reduce the dimensionality of the data while retaining as much information as possible from the original data. Through PCA, high-dimensional data can be mapped into a low-dimensional space, which helps to reduce computational complexity and improve analysis efficiency. In this step, the initial component data after clustering is mapped into a low-dimensional space, which means that the dimensionality of the data is reduced, but the most important features and information are still retained.

[0127] In a specific implementation, after PCA processing, the obtained data is called the dimensionality-reduced component data. These data retain the most important features in the original dataset but are represented in a lower dimension, thus simplifying subsequent analysis and processing. These dimensionality-reduced component data are used as the target component data, that is, the object of subsequent analysis and processing. This makes it more efficient to process large-scale datasets while still being able to capture key information and patterns.

[0128] Specifically, the high-dimensional space clustering center A H ∈D kxd is mapped into a low-dimensional space by the PCA method to obtain the clustering center A <000​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​

[0136] The second term of the chain can be calculated by the following formula:

[0137]

[0138] The third term of the chain can be calculated by the following formula:

[0139]

[0140] The final derivative formula is as follows:

[0141]

[0142] Using the above loss function and adaptive gradient descent algorithm, the low-dimensional space optimal solution P e D is obtained nxm The overall flowchart of data dimension reduction is as follows Figure 11 .

[0143] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the security vulnerability detection method of the present application. More forms of simple transformation based on this technical concept are within the protection scope of the present application.

[0144] The present application also provides a security vulnerability detection device, please refer to Figure 12 The security vulnerability detection device comprises:

[0145] The acquisition module 10 is configured to acquire component data to be detected.

[0146] The first matching module 20 is configured to perform vulnerability matching on the component data to be detected based on a preset first priority knowledge graph, to obtain a first vulnerability matching result.

[0147] The second matching module 30 is configured to perform vulnerability matching on the component data to be detected based on a preset second priority knowledge graph if the vulnerability matching result is a matching failure, to obtain a second vulnerability matching result, wherein the first priority knowledge graph has a higher priority than the second priority knowledge graph, and the priority between the first priority knowledge graph and the second priority knowledge graph is determined according to the reference times of the component data for constructing the knowledge graph.

[0148] Optionally, the security vulnerability detection device further comprises:

[0149] The data acquisition module is configured to acquire full target component data, reference times of the target component data, and target vulnerability data.

[0150] The division module is configured to perform priority division on the target component data based on the reference times, to obtain first priority component data and second priority component data.

[0151] determining a first priority vulnerability data based on the first priority component data and the target vulnerability data, and determining a second priority vulnerability data based on the second priority component data and the target vulnerability data;

[0152] constructing a first priority knowledge graph based on the first priority component data and the first priority vulnerability data, and constructing a second priority knowledge graph based on the second priority component data and the second priority vulnerability data.

[0153] Optionally, the dividing module comprises:

[0154] calculating a distance between any two of the target component data based on the reference times, to obtain a distance result set;

[0155] clustering the target component data based on the distance result set, to obtain a clustering number of a current iteration round clustering result;

[0156] judging whether the clustering number of the current iteration round clustering result is greater than two;

[0157] iterative clustering module, if the clustering number of the current iteration round clustering result is greater than two, returning the step of clustering the target component data based on the distance result set, to obtain the clustering number of the current iteration round clustering result, until the clustering number of the current iteration round clustering result reaches two, to obtain the clustered first priority component data and the second priority component data.

[0158] Optionally, the determining module comprises:

[0159] mapping relationship information acquisition module, configured to acquire mapping relationship information between component data and vulnerability data;

[0160] a first mapping module, configured to map the first priority component data and the mapping relationship information to obtain first priority vulnerability data from the target vulnerability data;

[0161] a second mapping module, configured to map the second priority component data and the mapping relationship information to obtain second priority vulnerability data from the target vulnerability data.

[0162] Optionally, the constructing module comprises:

[0163] The first knowledge graph construction module is configured to perform knowledge extraction on the first priority component data to obtain first priority component knowledge, perform matching on the first priority component knowledge based on the first priority vulnerability data to obtain a first matching result, and construct a first priority knowledge graph based on the first matching result.

[0164] The second knowledge graph construction module is configured to perform knowledge extraction on the second priority component data to obtain second priority component knowledge, perform matching on the second priority component knowledge based on the second priority vulnerability data to obtain a second matching result, and construct a second priority knowledge graph based on the second matching result.

[0165] Optionally, the data acquisition module comprises:

[0166] The initial component data acquisition module is configured to acquire full initial component data.

[0167] The component clustering module is configured to cluster the initial component data to obtain clustered initial component data.

[0168] The dimension reduction module is configured to map the clustered initial component data to a low-dimensional space based on a preset principal component analysis method to obtain reduced component data, and take the reduced component data as target component data.

[0169] The security vulnerability detection device provided in the present application adopts the security vulnerability detection method in the above embodiments, and can solve the technical problem of security vulnerability detection. Compared with the prior art, the security vulnerability detection device provided in the present application has the same beneficial effects as the security vulnerability detection method provided in the above embodiments, and other technical features in the security vulnerability detection device are the same as the features disclosed in the above embodiments, which will not be repeated here.

[0170] The present application provides a security vulnerability detection device, which comprises at least one processor and a memory connected with the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the security vulnerability detection method in the above embodiment one.

[0171] The following refers to Figure 13The diagram illustrates a structural schematic suitable for implementing a security vulnerability detection device according to embodiments of this application. The security vulnerability detection device in embodiments of this application may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 13 The security vulnerability detection device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0172] like Figure 13 As shown, the security vulnerability detection device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage device 1003 into a random access memory (RAM) 1004. The RAM 1004 also stores various programs and data required for the operation of the security vulnerability detection device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touchscreen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; storage devices 1003 including, for example, magnetic tape, hard disk, etc.; and communication devices 1009. Communication device 1009 allows the security vulnerability detection device to communicate wirelessly or wiredly with other devices to exchange data. While the figure shows security vulnerability detection devices with various systems, it should be understood that implementing or having all of the systems shown is not required. More or fewer systems may be implemented alternatively.

[0173] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product comprising a computer program carried on a computer readable medium, the computer program containing program codes for executing the method shown in the flowchart. In such embodiments, the computer program can be downloaded and installed from a network through a communication device, or installed from the storage device 1003, or installed from the ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiments disclosed in the present application are executed.

[0174] The security vulnerability detection device provided by the present application adopts the security vulnerability detection method in the above-mentioned embodiments, and can solve the technical problem of security vulnerability detection. Compared with the prior art, the security vulnerability detection device provided by the present application has the same beneficial effects as the security vulnerability detection method provided by the above-mentioned embodiments, and other technical features in the security vulnerability detection device are the same as the features disclosed in the previous embodiment method, which will not be repeated here.

[0175] It should be understood that parts of the present application can be realized by hardware, software, firmware or a combination thereof. In the description of the above-mentioned embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0176] The above is merely specific implementation of the present application, but the protection scope of the present application is not limited thereto, any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

[0177] The present application provides a computer readable storage medium having stored thereon computer readable program instructions (i.e. computer program) for executing the security vulnerability detection method in the above-mentioned embodiments.

[0178] The computer readable storage medium provided in the present application may, for example, be a U disk, but is not limited to an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, system, or device, or any combination of the above. More specific examples of the computer readable storage medium can include, but are not limited to, an electrical connection having one or more conductive wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present embodiment, the computer readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer readable storage medium can be transmitted in any suitable medium, including but not limited to electrical wires, optical cables, RF (Radio Frequency), and the like, or any suitable combination of the above.

[0179] The above computer readable storage medium can be included in the security vulnerability detection device, or can exist separately without being assembled into the security vulnerability detection device.

[0180] The above computer readable storage medium carries one or more programs, which, when executed by the security vulnerability detection device, cause the security vulnerability detection device to: security vulnerability detection.

[0181] Computer program code for carrying out operations of the present application can be written in one or more programming languages or combinations of languages including object oriented programming languages such as Java, Smalltalk, C++ or conventional procedural programming languages such as "C" or similar programming languages. Program code can be executed entirely on a user computer, partially on a user computer, as a separate software package, partially on a user computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user computer through any kind of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, through the Internet using an Internet service provider).

[0182] The flow diagrams and the block diagrams in the drawings are illustrations of architectures, functionalities, and operations of possible implementations of systems, methods, and computer program products according to various embodiments of present application. In this regard, each block in the flow diagrams or block diagrams can represent a module, a segment, or a portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that in some alternative implementations, the functions noted in the block can occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and / or flow diagrams, and combinations thereof, can be implemented by special purpose hardware-based systems that perform the specified functions or operations, or combinations of special purpose hardware and computer instructions.

[0183] The modules involved in the embodiments of the present application can be implemented in the form of software or in the form of hardware. In some cases, the name of the module does not constitute a limitation on the unit itself.

[0184] The readable storage medium provided by the present application is a computer readable storage medium, which stores computer readable program instructions (i.e. computer program) for executing the above-mentioned security vulnerability detection method, and can solve the technical problem of security vulnerability detection. Compared with the prior art, the computer readable storage medium provided by the present application has the same beneficial effects as the security vulnerability detection method provided by the above-mentioned embodiments, which will not be repeated here.

[0185] The present application also provides a computer program product, comprising a computer program, which is executed by a processor to implement the steps of the security vulnerability detection method as described above.

[0186] The computer program product provided by the present application can solve the technical problem of security vulnerability detection. Compared with the prior art, the computer program product provided by the present application has the same beneficial effects as the security vulnerability detection method provided by the above-mentioned embodiments, which will not be repeated here.

[0187] The above only describes some embodiments of the present application, and does not limit the patent scope of the present application. Any equivalent structural transformation made by using the content of the present application specification and drawings, or direct / indirect application in other related technical fields is included in the patent protection scope of the present application.

Claims

1. A security vulnerability detection method characterized by, The method for detecting the security vulnerability comprises: obtaining component data to be detected; based on a preset first priority knowledge graph, performing vulnerability matching on the component data to be detected to obtain a first vulnerability matching result; if the vulnerability matching result is a matching failure, based on a preset second priority knowledge graph, performing vulnerability matching on the component data to be detected to obtain a second vulnerability matching result, wherein the priority of the first priority knowledge graph is higher than that of the second priority knowledge graph, and the priority between the first priority knowledge graph and the second priority knowledge graph is determined according to the reference times of the component data for constructing the knowledge graph; Before the step of obtaining the component data to be detected, the method comprises: obtaining target component data, reference times of the target component data, and target vulnerability data; based on the reference times, using a condensed hierarchical clustering algorithm to calculate the distance between the target components for priority division, to obtain first priority component data and second priority component data; based on the first priority component data and the target vulnerability data, determining first priority vulnerability data, and based on the second priority component data and the target vulnerability data, determining second priority vulnerability data; based on the first priority component data and the first priority vulnerability data, constructing a first priority knowledge graph, and based on the second priority component data and the second priority vulnerability data, constructing a second priority knowledge graph.

2. The security vulnerability detection method of claim 1, wherein, The step of dividing the priority of the target component data based on the reference times to obtain first priority component data and second priority component data comprises: based on the reference times, calculating the distance between any two target component data to obtain a distance result set; based on the distance result set, clustering the target component data to obtain the clustering number of the current iteration round clustering result; determining whether the clustering number of the current iteration round clustering result is greater than two; if the clustering number of the current iteration round clustering result is greater than two, returning to the step of clustering the target component data based on the distance result set to obtain the clustering number of the current iteration round clustering result, until the clustering number of the current iteration round clustering result reaches two, to obtain clustered first priority component data and second priority component data.

3. The security vulnerability detection method of claim 1, wherein, The step of determining first priority vulnerability data based on the first priority component data and the target vulnerability data, and determining second priority vulnerability data based on the second priority component data and the target vulnerability data comprises: obtaining mapping relationship information between component data and vulnerability data; based on the first priority component data and the mapping relationship information, mapping the first priority vulnerability data from the target vulnerability data; based on the second priority component data and the mapping relationship information, mapping the second priority vulnerability data from the target vulnerability data.

4. The security vulnerability detection method of claim 1, wherein, The step of constructing the first priority knowledge graph based on the first priority component data and the first priority vulnerability data, and constructing the second priority knowledge graph based on the second priority component data and the second priority vulnerability data, comprises: knowledge extraction is performed on the first priority component data to obtain first priority component knowledge, and matching is performed on the first priority component knowledge based on the first priority vulnerability data to obtain a first matching result, and then a first priority knowledge graph is constructed based on the first matching result; knowledge extraction is performed on the second priority component data to obtain second priority component knowledge, and matching is performed on the second priority component knowledge based on the second priority vulnerability data to obtain a second matching result, and then a second priority knowledge graph is constructed based on the second matching result.

5. The security vulnerability detection method of claim 1, wherein, The step of obtaining the full-amount target component data comprises: obtaining full-amount initial component data; performing clustering on the initial component data to obtain clustered initial component data; mapping the clustered initial component data to a low-dimensional space based on a preset principal component analysis method to obtain reduced component data, and taking the reduced component data as the target component data.

6. A security vulnerability detection apparatus characterized by comprising: The device comprises: an acquisition module configured to acquire component data to be detected; a first matching module configured to perform vulnerability matching on the component data to be detected based on a preset first priority knowledge graph to obtain a first vulnerability matching result; a second matching module configured to, if the vulnerability matching result is a matching failure, perform vulnerability matching on the component data to be detected based on a preset second priority knowledge graph to obtain a second vulnerability matching result, wherein the priority of the first priority knowledge graph is higher than that of the second priority knowledge graph, and the priority between the first priority knowledge graph and the second priority knowledge graph is determined according to the reference times of the component data used to construct the knowledge graphs. The security vulnerability detection device is further configured to: obtain full-amount target component data, reference times of the target component data, and target vulnerability data; based on the reference times, calculate the distances between the target components using a condensed hierarchical clustering algorithm to perform priority division, to obtain first priority component data and second priority component data; determine first priority vulnerability data based on the first priority component data and the target vulnerability data, and determine second priority vulnerability data based on the second priority component data and the target vulnerability data; construct a first priority knowledge graph based on the first priority component data and the first priority vulnerability data, and construct a second priority knowledge graph based on the second priority component data and the second priority vulnerability data.

7. A security vulnerability detection device, characterized by, The device comprises a memory, a processor, and a computer program stored on the memory and executable on the processor, and the computer program is configured to implement the steps of the security vulnerability detection method according to any one of claims 1 to 5.

8. A storage medium, characterized by The storage medium is a computer readable storage medium, and the storage medium stores a computer program. The computer program is executed by a processor to implement the steps of the security vulnerability detection method in any one of claims 1 to 5.

9. A computer program product, characterised in that, The computer program product comprises a computer program. The computer program is executed by a processor to implement the steps of the security vulnerability detection method in any one of claims 1 to 5.

Images