Vulnerability data query method and device

Abstract

The invention discloses a vulnerability data query method and device, and relates to the technical field of computers. A specific embodiment of the method comprises the steps of performing intention recognition based on a vulnerability query instruction, generating a corresponding query cue word, querying first vulnerability data from vulnerability record data based on the cue word, and obtaining corresponding second vulnerability data through a knowledge graph, and integrating the two pieces of vulnerability data based on a preset cue word template to obtain a final query result. According to the embodiment, recognition can be performed based on the vulnerability query instruction, and then vulnerability data can be intelligently queried.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method and device for querying vulnerability data. Background Art

[0002] At present, in network security scenarios, in order to ensure network security, it is necessary to query and process existing vulnerability data in a timely manner. Before processing vulnerabilities, it is crucial to know how to query vulnerability data. When querying vulnerability data, it is often necessary to query assets at the same time. The implementation of query operations is usually bound to query statements, such as regular matching expressions, fuzzy queries supported by wildcards, and classified searches implemented through pre-labeling.

[0003] In the current query statement-based search scenario, writing a correct query statement is relatively complex, and due to the limitations of the data structure, it is difficult to adapt to the rapidly changing data environment or user needs. Statement-based search also limits the scope of the search, requiring advance knowledge of the user's search content and expression methods and reserving them in the query statement. Statement-based search also has difficulty understanding the user's context and intent, and requires extremely complex technical implementation in multi-step query scenarios. Summary of the invention

[0004] In view of this, an embodiment of the present invention provides a method and device for querying vulnerability data, which can intelligently query vulnerability data based on vulnerability query instructions, thereby improving the efficiency and flexibility of vulnerability data query.

[0005] To achieve the above object, according to one aspect of an embodiment of the present invention, a method for querying vulnerability data is provided, comprising:

[0006] Identify the intent of vulnerability query instructions and generate query prompts;

[0007] Based on the query prompt word, query the first vulnerability data from the vulnerability record data;

[0008] Acquire the associated data of the first vulnerability data through the knowledge graph to obtain the second vulnerability data;

[0009] Based on a preset prompt word template, the first vulnerability data and the second vulnerability data are integrated and processed to generate a vulnerability data query result.

[0010] Optionally, the vulnerability record data includes vulnerability work order data and asset access record data;

[0011] Based on the query prompt word, querying the first vulnerability data from the vulnerability record data includes:

[0012] Based on the query prompt word, query the first vulnerability data from the asset access record data;

[0013] In response to failure to find the first vulnerability data from the asset access record data, the first vulnerability data is found from the vulnerability work order data through text matching.

[0014] Optionally, the asset has multiple levels of domain names;

[0015] In response to failure to query access records of the asset and its parent asset from the asset access record data, and the domain name level of the parent asset of the asset is not greater than 2, it is determined that the first vulnerability data cannot be queried from the asset access record data.

[0016] Optionally, the vulnerability record data includes vulnerability work order data;

[0017] Based on the query prompt word, querying the first vulnerability data from the vulnerability record data includes:

[0018] Extract features from the query prompt words to obtain a query vector;

[0019] Determine the target work order description segment according to the similarity between the query vector and the work order description segment vector, wherein the work order description segment is generated by document segmentation of the vulnerability work order, and establish an association relationship between the work order description segment and the vulnerability work order;

[0020] Based on the association between the work order description fragment and the vulnerability work order, obtain the target vulnerability work order corresponding to the target work order description fragment;

[0021] First vulnerability data is generated based on the vulnerability description information of the target vulnerability work order.

[0022] Optionally, the ticket description fragment is generated by segmenting the vulnerability ticket based on the specified segment length without using overlapping text segmentation sections.

[0023] Optionally, before integrating the first vulnerability data and the second vulnerability data to generate the vulnerability data query result based on the preset prompt word template, the method further includes:

[0024] Acquire a corresponding first vulnerability processing strategy based on the first vulnerability data;

[0025] Acquire the associated data of the first vulnerability handling strategy through the knowledge graph to obtain the second vulnerability handling strategy;

[0026] Based on the preset prompt word template, the first vulnerability data and the second vulnerability data are integrated to generate a vulnerability data query result, including:

[0027] Based on a preset prompt word template, the first vulnerability data, the second vulnerability data, the first vulnerability processing strategy and the second vulnerability processing strategy are integrated to generate a vulnerability data query result.

[0028] Optionally, the knowledge graph is constructed by:

[0029] Use the big model to perform entity recognition on vulnerability handling policy documents and asset content, and build the first knowledge graph based on the relationship between entities;

[0030] According to the similarity between the entity nodes in the first knowledge graph, the entity nodes in the first knowledge graph are fused to obtain a second knowledge graph;

[0031] According to the importance of the relationship between the entity nodes in the second knowledge graph, the weights of the edges between the entity nodes in the second knowledge graph are determined to obtain the knowledge graph.

[0032] According to another aspect of an embodiment of the present invention, a device for querying vulnerability data is provided, including:

[0033] The recognition module is used to identify the intent of vulnerability query instructions and generate query prompt words;

[0034] A query module, used to query first vulnerability data from vulnerability record data based on a query prompt word;

[0035] An acquisition module, used to acquire associated data of the first vulnerability data through a knowledge graph to obtain second vulnerability data;

[0036] The processing module is used to integrate the first vulnerability data and the second vulnerability data based on a preset prompt word template to generate a vulnerability data query result.

[0037] According to another aspect of an embodiment of the present invention, there is provided an electronic device, comprising: one or more processors; a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the vulnerability data query method provided by an embodiment of the present invention.

[0038] According to another aspect of an embodiment of the present invention, a computer-readable medium is provided, on which a computer program is stored. When the program is executed by a processor, the method for querying vulnerability data provided by an embodiment of the present invention is implemented.

[0039] According to another aspect of an embodiment of the present invention, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the method for querying vulnerability data provided by an embodiment of the present invention is implemented.

[0040] One embodiment of the above invention has the following advantages or beneficial effects: it can identify the query intent based on the vulnerability query instruction in the form of natural language, generate query prompt words, obtain the first vulnerability data based on the query prompt words, and identify the second vulnerability data in combination with the knowledge graph, and finally integrate the vulnerability data based on the preset prompt word template to obtain the vulnerability data query result, thereby realizing the intelligent query of vulnerability data. At the same time, the query of vulnerability data based on natural language reduces the difficulty on the user side and improves the flexibility of vulnerability data query. In addition, the generation of the final vulnerability data query result in combination with the pre-built knowledge graph can improve the efficiency and accuracy of data query.

[0041] The further effects of the above-mentioned non-conventional optional manner will be described below in conjunction with the specific implementation manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The accompanying drawings are used to better understand the present invention and do not constitute an improper limitation of the present invention.

[0043] Figure 1 is a schematic diagram of the main steps of a method for querying vulnerability data according to an embodiment of the present invention;

[0044] Figure 2 It is a schematic diagram of a vulnerability query process provided by an embodiment of the present invention;

[0045] Figure 3 It is a schematic diagram of the knowledge graph application process provided by an embodiment of the present invention;

[0046] Figure 4 is a schematic diagram of main modules of a device for querying vulnerability data according to an embodiment of the present invention;

[0047] Figure 5 is an exemplary system architecture diagram to which embodiments of the present invention may be applied;

[0048] Figure 6 It is a schematic diagram of the structure of a computer system of a terminal device or a server suitable for implementing an embodiment of the present invention. DETAILED DESCRIPTION

[0049] The following is a description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0050] It should be noted that the collection, collection, updating, analysis, processing, use, transmission, storage and other aspects of user personal information involved in the technical solution disclosed in the present invention are in compliance with the provisions of relevant laws and regulations, are used for legitimate purposes, and do not violate public order and good morals. Necessary measures are taken for user personal information to prevent illegal access to user personal information data and maintain the security of user personal information, network security and national security.

[0051] It should be noted that in the technical solution of the present invention, the collection, use, storage, sharing and transfer of user personal information involved are in compliance with the provisions of relevant laws and regulations, and it is necessary to inform the user and obtain the user's consent or authorization. When applicable, the user's personal information is de-identified and / or anonymized and / or encrypted.

[0052] Figure 1 FIG. 1 is a schematic diagram of the main process of the vulnerability data query method according to an embodiment of the present invention. Figure 1 As shown, including:

[0053] Step S101, perform intent recognition on the vulnerability query instruction and generate query prompt words.

[0054] The vulnerability query instruction is obtained. The content of the vulnerability query instruction can be a text content in natural language form, which reduces the requirements for users when querying vulnerabilities. That is, it is possible to query vulnerability data without entering a query statement in a specific format. The query text is identified according to the preset prompt word template, the query content therein is identified, and the corresponding query prompt word is obtained.

[0055] Optionally, when performing query text recognition, a large model can be used for recognition, combined with a preset prompt word template, to generate an intelligent service-oriented answer that is more in line with human reading habits.

[0056] Optionally, the vulnerability query instruction may be a query instruction input by a user or a query instruction output by an asset query module. If the vulnerability query instruction is a query instruction input by a user, it may be a text content in a natural language form input by the user (for example, querying historical zero-yuan purchase orders), which includes query address information and query content information. Specifically, the query address information is IP and domain name information, and the query content information is vulnerability name information (for example, zero-yuan purchase orders, etc.), description information of the queried vulnerability (for example, the order payment amount is 0), etc.

[0057] Step S102: querying first vulnerability data from vulnerability record data based on the query prompt word.

[0058] According to the generated query prompt, the corresponding vulnerability data is queried from the vulnerability record data stored in the database. Among them, the vulnerability record data stores data recording vulnerability behaviors, such as logs recording unauthorized access behaviors, etc., as well as vulnerability work order data. Vulnerability work order data is the details of vulnerability work orders that have been manually confirmed and collected from the security operation center and the work order platform, including domain names, vulnerability titles, vulnerability descriptions, etc.

[0059] Taking the query of zero-yuan purchase orders as an example, the data of zero-yuan purchase orders is queried from the stored vulnerability work order data according to the generated query prompt words (such as including zero-yuan purchase, etc.) as the first vulnerability data. Optionally, the description information about the vulnerability in all the obtained work orders can be further integrated and summarized to obtain the total vulnerability data.

[0060] Step S103, obtaining associated data of the first vulnerability data through the knowledge graph to obtain second vulnerability data.

[0061] After obtaining the first vulnerability data, the pre-established knowledge graph is called to query the associated data to obtain the second vulnerability data associated with the first vulnerability data. Specifically, the first vulnerability data is mapped to the corresponding node in the knowledge graph, and a correlation analysis is performed based on each node, including correlation analysis of the edges (relationship importance) of each node.

[0062] Optionally, when performing the association analysis, the first vulnerability data may be searched for second vulnerability data with a stronger relationship importance, such as second vulnerability data with a relationship importance score greater than a preset threshold. The second vulnerability data represents vulnerability data that is greatly affected by the first vulnerability data, and the two have a stronger correlation.

[0063] Step S104: Based on a preset prompt word template, the first vulnerability data and the second vulnerability data are integrated to generate a vulnerability data query result.

[0064] After the first vulnerability data and the second vulnerability data are obtained, the two acquired vulnerability data are integrated by calling the large model based on the preset prompt word template to generate a data query result in a format that is easier for users to understand.

[0065] Among them, the first vulnerability data and the second vulnerability data obtained may include, in addition to the description information about the vulnerability, information such as the work order ID (identification number) where the vulnerability data is located, the time when the vulnerability data was generated, the vulnerability name, etc., which are used to improve the final data query results and provide users with more comprehensive information to facilitate users to perform subsequent statistical analysis operations.

[0066] According to the vulnerability data query method provided by the embodiment of the present invention, it is possible to identify the query intent based on the vulnerability query instruction in the form of natural language, generate query prompt words, obtain the first vulnerability data based on the query prompt words, and identify the second vulnerability data in combination with the knowledge graph, and finally integrate the vulnerability data based on the preset prompt word template to obtain the vulnerability data query result, thereby realizing the intelligent query of vulnerability data. At the same time, the query of vulnerability data based on natural language reduces the difficulty on the user side and improves the flexibility of vulnerability data query. In addition, the generation of the final vulnerability data query result in combination with the pre-built knowledge graph can improve the efficiency and accuracy of data query.

[0067] Optionally, the vulnerability record data includes vulnerability work order data and asset access record data; based on the query prompt word, querying the first vulnerability data from the vulnerability record data includes: based on the query prompt word, querying the first vulnerability data from the asset access record data; in response to failing to query the first vulnerability data from the asset access record data, querying the first vulnerability data from the vulnerability work order data through text matching. The vulnerability record data is data that records vulnerability behavior, including vulnerability work order data and asset access record data. Among them, the vulnerability work order data is the details of the statistical historical vulnerability data, and the asset access record data can be the record information of unauthorized access generated when the IP accesses. The vulnerability query instruction contains information such as IP, domain name, URL, etc., and the asset access record information is queried based on this information. If the first vulnerability data is not queried in the asset access record information, it is necessary to query through the vulnerability work order data, that is, extract the content of the IP, domain name, and URL features in the vulnerability work order data, and perform document matching to obtain the first vulnerability data.

[0068] Specifically, a large number of inaccurate asset fields and vulnerability descriptions in the vulnerability ticket are extracted. Through carefully constructed regular matching expressions, all content that meets the IP, domain name, and URL (Uniform Resource Locator) features are extracted into the data structure through greedy matching, and deduplication is performed. Another regular expression is used to delete incomplete information and error information caused by feature deviation. The data structure here will consist of the ticket number, asset owner, vulnerability-related assets, and vulnerability introduction. For example, the content obtained by matching includes "Note: If the asset ownership is correct, do not reject it during processing, click Confirm, and submit it after repair. 1.1.1.1 There is unauthorized access to the docker remote api host: 1.2.3.4 Port: 1111 Description: Unauthorized access to the docker remote api interface, address: http: / / 1.2.3.4:1234 / info", and only the host IP address or domain name address needs to be extracted. Among them, careful construction refers to greedy matching, extracting all content that may be domain names or IP addresses. Rather than exact matching. Because as many matches as possible can find more relevant information when searching later, avoiding information omissions.

[0069] Optionally, the asset has multiple domain names; in response to failure to query the access records of the asset and the parent asset of the asset from the asset access record data, and the domain name level of the parent asset of the asset is not greater than 2, it is determined that the first vulnerability data cannot be queried from the asset access record data. The assets contained in the information input by the user have multiple domain names, and a judgment operation needs to be performed when querying the asset access record data. In an embodiment of the present invention, the parent asset refers to the parent domain name of the current domain name, for example, the domain name is xxxx.aabb.com, the first-level domain name is .com, the second-level domain name is aabb.com, and the third-level domain name is xxxx.aabb.com, where aabb.com is the parent domain name of xxxx.aabb.com.

[0070] Specifically, by calling the asset query platform to query the basic assets, it is determined whether the asset query platform has asset information. If the asset query platform does not include the information of the assets being queried, it will automatically initiate a query for the superior assets. There are two situations for superior assets. If the query field contains an N-level domain name (N>2), an asset query (owner, etc.) for its N-1-level domain name will be initiated. If the query field does not contain an N-level domain name (N>2), the query for the superior assets will not be initiated, but the process will be transferred to the vulnerability association query, and the asset association function of the vulnerability association query will be used to implement the asset query function. For the case where the domain name level N>2, the query operation for the superior assets will be performed on the domain name one by one until N>2 is not satisfied. For example, if N is 4, the asset query for the 4-level domain name will be performed first, and then the asset query for the 3-level domain name will be performed; for the 3-level domain name, if it cannot be queried, the asset query for the 2-level domain name will be performed, and the queries will be performed in sequence. If the attribution query of the domain name can be queried according to the query field (the query field contains an N-level domain name (N>2)), the attribution query of the queried domain name will be used as the first vulnerability data queried.

[0071] When querying assets, feedback is provided through downward fuzzy matching, that is, the function will always give priority to returning the N+1 or N-level domain name associated with the N-level domain name. If there is no match on this basis, the N-1-level domain name will be returned.

[0072] Optionally, the vulnerability record data includes vulnerability work order data; based on the query prompt word, querying the first vulnerability data from the vulnerability record data, including: extracting features from the query prompt word to obtain a query vector; determining the target work order description segment according to the similarity between the query vector and the work order description segment vector, wherein the work order description segment is generated by document segmentation of the vulnerability work order, and establishing an association relationship between the work order description segment and the vulnerability work order; obtaining the target vulnerability work order corresponding to the target work order description segment based on the association relationship between the work order description segment and the vulnerability work order; generating the first vulnerability data based on the vulnerability description information of the target vulnerability work order. If the query instruction input by the user is a data query of a specific vulnerability type, it is only necessary to query the corresponding vulnerability data from the vulnerability work order data. Feature extraction is performed based on the generated query prompt word to obtain a query vector, and similarity calculation is performed with the vector of the pre-segmented work order description segment, and the matching target work order description segment is determined based on the calculation result. Among them, the work order description segment is a plurality of text segments obtained by document segmentation based on the text content of the work order, and an association relationship is established between the segment and the vulnerability work order. After determining the matching target work order description fragment, the corresponding vulnerability work order is recalled, and the vulnerability data description information in the recalled vulnerability work order is integrated to obtain the first vulnerability data.

[0073] Optionally, the work order description fragment is generated by segmenting the vulnerability work order without using overlapping text segmentation based on the specified segmentation length. When segmenting the text information of the vulnerability work order, it can be segmented according to the preset specified segmentation length, wherein the preset specified segmentation length selects a smaller length for segmentation, and the specified segmentation length is, for example, 300 characters. At the same time, the method of not using overlapping text segmentation can better perform similarity matching based on semantics, thereby ensuring the accuracy of vulnerability data query.

[0074] Specifically, after receiving the input, the vulnerability query module will point to the vulnerability association query and similar vulnerability query. In the scheme, similar vulnerabilities and vulnerability association queries that provide support for asset queries will be constructed based on historical vulnerability tickets. By extracting the vulnerability description details in the vulnerability ticket, using the preset prompt word template, the vulnerability attack method is extracted and the attack summary is summarized. Due to the mixed corpus in the vulnerability ticket description, the description usually contains "description of attack method", "attack payload", "HTTP request and response package", etc., which does not conform to the document segmentation method of semantic segmentation and specific character segmentation. In this scheme, the characteristics of the vulnerability ticket description will be fully utilized to segment the long text into the smallest possible segments. In the case of conventional text segmentation, the appropriate length (usually 1000 characters) will be selected as much as possible while retaining the semantics and using overlapping text segmentation partitions. In this scheme, the segmentation segment length (300 characters) is set and the overlapping text segmentation partition is not used. Due to the mixed corpus of the vulnerability ticket description, the context is semantically incoherent, and the query of similar vulnerabilities is based on feature description. Feature descriptions are usually hidden in semantics, and semantics cannot be directly obtained through rule matching. After being stored through text vectorization based on a large model, feature-based semantic queries can be realized through similarity matching containing semantic vectors. For example, to query the vulnerability features of "zero-yuan shopping", you should look for related vulnerabilities such as "payment value bypass", "payment logic bypass", etc., and semantic vectorization based on a large model can achieve this.

[0075] Optionally, before integrating the first vulnerability data and the second vulnerability data to generate the vulnerability data query result based on the preset prompt word template, it also includes: obtaining the corresponding first vulnerability processing strategy based on the first vulnerability data; obtaining the associated data of the first vulnerability processing strategy through the knowledge graph to obtain the second vulnerability processing strategy; integrating the first vulnerability data and the second vulnerability data based on the preset prompt word template to generate the vulnerability data query result, including: integrating the first vulnerability data, the second vulnerability data, the first vulnerability processing strategy and the second vulnerability processing strategy based on the preset prompt word template to generate the vulnerability data query result. Before generating the final vulnerability data query result, it is also necessary to obtain the corresponding security knowledge information based on the queried vulnerability data, that is, the vulnerability data processing strategy. Specifically, the first vulnerability data processing strategy corresponding to the first vulnerability data can be obtained according to the pre-set security knowledge information document. Among them, the pre-set security knowledge information document stores the processing strategy of historical vulnerability data, the processing strategy of vulnerability data configured by the user and other data, and matching is performed based on the document, and the matched data is integrated to obtain the processing strategy corresponding to the first vulnerability data.

[0076] Optionally, after determining the first vulnerability data processing strategy, it is also necessary to obtain the second vulnerability processing strategy associated with the first vulnerability processing strategy based on the pre-built knowledge graph, integrate the first vulnerability data, the second vulnerability data, the first vulnerability processing strategy and the second vulnerability processing strategy through the large model and the preset prompt word template, and obtain an intelligent answer that conforms to human reading habits as the vulnerability data query result. For example, the query instruction for input is: find historical zero-yuan purchase orders, and the query result obtained is: Order 1; ID: xxxx; Time: xxxx; Vulnerability Name: Skip Payment; Vulnerability Description: xxxxx; Processing Strategy: xxx.

[0077] Optionally, the knowledge graph is constructed in the following manner: using a large model to perform entity recognition on vulnerability handling policy documents and asset content, and constructing a first knowledge graph based on the relationship between entities; performing node fusion on the entity nodes in the first knowledge graph based on the similarity between the entity nodes in the first knowledge graph to obtain a second knowledge graph; determining the weights of the edges between the entity nodes in the second knowledge graph based on the importance of the relationship between the entity nodes in the second knowledge graph to obtain a knowledge graph.

[0078] By introducing the text segmentation method, the document content to be imported is divided into multiple text blocks of predetermined sizes. The large model's ability to understand tasks and follow instructions is used to identify key entities in each paragraph or sentence, and to construct an entity and edge relationship with a "[{"node1":"","node2":"","edge":""}]" structure. It should be noted that in this solution, when it comes to security knowledge scenarios, the scope of entities (events, concepts, places, objects, files, organizations, conditions or others) is not restricted. When building asset relationships, it is necessary to restrict the scope of entities (IP, domain name, owner), and the relationship between entities refers to the connectivity between assets, which will be defined as whether there are special circumstances that hinder asset connectivity, such as firewall barriers. After completing the construction of entities and entity relationships, due to the preset prompt word template, the large model will try to find as many relationships between nodes as possible, and realize node fusion through context proximity calculation. In the implementation of context proximity calculation, the node data structure in a single segmented text is adjusted to delete the self-looping part. Node1 and node2 with multiple connections will be calculated as "adjacent", and the edge will be overwritten with a specific string to indicate that there are multiple connections between the two.

[0079] After the calculation of the proximity between entities is completed, the importance of the relationship will be judged. The importance of the relationship is divided into 5 levels, with level 1 being only related and level 5 being strongly related. When the edge is covered by a specific string, the importance of the relationship will be directly defined as the highest level. The importance of the relationship is reflected in the association of security knowledge as "the importance level of security risks" and "the closeness of the association of security risks". In addition, in the asset dimension, this solution does not introduce relationships, and the importance between fixed assets is the highest level.

[0080] After completing the entity importance judgment, the knowledge graph can be represented by graph data, such as "node1|node2|edge|importance" can be used to represent the knowledge graph.

[0081] According to the query method for vulnerability data provided by the embodiment of the present invention, it is possible to obtain query prompt words through recognition based on the natural language input by the user, intelligently query the first vulnerability data based on the query prompt words, and query the associated vulnerability data through the knowledge graph. Further, the corresponding vulnerability handling strategy is queried, and the query results of vulnerability data are intelligently generated through the large model, thereby improving the flexibility and efficiency of vulnerability data query. At the same time, when matching vulnerability work order data, the accuracy of segmentation matching can be improved by using non-overlapping partitions of shorter lengths, thereby improving the efficiency of work order recall. In addition, the definition of entities and entity relationships is described in a natural language, so that the large model can understand the task and output structured data that can be used for knowledge graph construction, and entity extraction and entity relationships are split into two steps, and the construction of the knowledge graph is completed in an automated manner based on the large model.

[0082] like Figure 2 The figure shows a schematic diagram of the vulnerability query process provided by an embodiment of the present invention. After the user input / instruction is input, a function judgment is performed, and the vulnerability association query and similar vulnerability query are pointed to. The association query performs downward fuzzy matching on the data after deduplication with the features extracted from the work order assets, and points the matched data to the vulnerability association large model instruction. The similar vulnerability query will extract the features of the vulnerability, and recall it through the document slice similarity to obtain a work order list, and point to the vulnerability association large model instruction as the data obtained by the vulnerability query. Among them, the document slice is the data extracted, summarized and sliced ​​from the work order description.

[0083] like Figure 3 The figure shows a schematic diagram of the knowledge graph application process provided by an embodiment of the present invention. After the document is loaded and segmented, an association relationship is generated in combination with the import of the asset description, and the relationship weight is calculated through the context forest. A graph is generated based on the association relationship and the relationship weight result for subsequent query results obtained based on vulnerability queries.

[0084] Figure 4 4 is a schematic diagram of a vulnerability data query device 400 provided by an embodiment of the present invention. Figure 4 As shown, including:

[0085] Identification module 401, used to identify the intent of vulnerability query instructions and generate query prompt words;

[0086] A query module 402, configured to query first vulnerability data from vulnerability record data based on a query prompt word;

[0087] An acquisition module 403 is used to acquire associated data of the first vulnerability data through a knowledge graph to obtain second vulnerability data;

[0088] The processing module 404 is used to integrate the first vulnerability data and the second vulnerability data based on a preset prompt word template to generate a vulnerability data query result.

[0089] According to the vulnerability data query device provided by the embodiment of the present invention, it is possible to identify the query intent based on the vulnerability query instruction in the form of natural language, generate query prompt words, obtain the first vulnerability data based on the query prompt words, and identify the second vulnerability data in combination with the knowledge graph, and finally integrate the vulnerability data based on the preset prompt word template to obtain the vulnerability data query result, thereby realizing the intelligent query of vulnerability data. At the same time, the query of vulnerability data based on natural language reduces the difficulty on the user side and improves the flexibility of vulnerability data query. In addition, the generation of the final vulnerability data query result in combination with the pre-built knowledge graph can improve the efficiency and accuracy of data query.

[0090] Optionally, the vulnerability record data includes vulnerability work order data and asset access record data; the query module 402 is also used to: based on the query prompt word, query the first vulnerability data from the asset access record data; in response to failing to query the first vulnerability data from the asset access record data, query the first vulnerability data from the vulnerability work order data through text matching.

[0091] Optionally, the asset has multiple domain names; in response to failing to query access records of the asset and its parent asset from the asset access record data, and the domain name level of the asset's parent asset is not greater than 2, it is determined that the first vulnerability data cannot be queried from the asset access record data.

[0092] Optionally, the vulnerability record data includes vulnerability work order data; the query module 402 is also used to: perform feature extraction on the query prompt word to obtain a query vector; determine the target work order description segment based on the similarity between the query vector and the work order description segment vector, wherein the work order description segment is generated by document segmentation of the vulnerability work order, and establish an association relationship between the work order description segment and the vulnerability work order; based on the association relationship between the work order description segment and the vulnerability work order, obtain the target vulnerability work order corresponding to the target work order description segment; generate the first vulnerability data based on the vulnerability description information of the target vulnerability work order.

[0093] Optionally, the ticket description fragment is generated by segmenting the vulnerability ticket based on the specified segment length without using overlapping text segmentation sections.

[0094] Optionally, the device also includes: an acquisition module 403, which is also used to acquire the corresponding first vulnerability handling strategy based on the first vulnerability data; obtain the related data of the first vulnerability handling strategy through the knowledge graph to obtain the second vulnerability handling strategy; the processing module 404 is also used to: based on a preset prompt word template, integrate the first vulnerability data, the second vulnerability data, the first vulnerability handling strategy and the second vulnerability handling strategy to generate a vulnerability data query result.

[0095] Optionally, the knowledge graph is constructed in the following manner: using a large model to perform entity recognition on vulnerability handling policy documents and asset content, and constructing a first knowledge graph based on the relationship between entities; performing node fusion on the entity nodes in the first knowledge graph based on the similarity between the entity nodes in the first knowledge graph to obtain a second knowledge graph; determining the weights of the edges between the entity nodes in the second knowledge graph based on the importance of the relationship between the entity nodes in the second knowledge graph to obtain a knowledge graph.

[0096] According to the query device for vulnerability data provided by the embodiment of the present invention, it is possible to obtain query prompt words through recognition based on the natural language input by the user, intelligently query the first vulnerability data based on the query prompt words, and query the associated vulnerability data through the knowledge graph. Further, the corresponding vulnerability handling strategy is queried, and the query results of vulnerability data are intelligently generated through the big model, thereby improving the flexibility and efficiency of vulnerability data query. At the same time, when matching vulnerability work order data, the accuracy of segmentation matching can be improved by using non-overlapping partitions of shorter lengths, thereby improving the efficiency of work order recall. In addition, the definition of entities and entity relationships is described in a natural language, so that the big model can understand the task and output structured data that can be used for knowledge graph construction, and entity extraction and entity relationships are split into two steps, and the construction of the knowledge graph is completed in an automated manner based on the big model.

[0097] Figure 5 An exemplary system architecture 500 is shown to which the vulnerability data query method or vulnerability data query device according to the embodiment of the present invention can be applied.

[0098] like Figure 5 As shown, system architecture 500 may include terminal devices 501, 502, 503, a network 504 and a server 505. Network 504 is used to provide a medium for communication links between terminal devices 501, 502, 503 and server 505. Network 504 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0099] Users can use terminal devices 501, 502, 503 to interact with server 505 through network 504 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 501, 502, 503, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0100] The terminal devices 501 , 502 , and 503 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0101] The server 505 may be a server that provides various services, such as a backend management server (only an example) that provides support for shopping websites browsed by users using the terminal devices 501, 502, and 503. The backend management server may analyze and process the received query request and other data, and feed back the processing results (such as vulnerability data - only an example) to the terminal device.

[0102] It should be noted that the vulnerability data query method provided in the embodiment of the present invention is generally executed by the server 505 , and accordingly, the vulnerability data query device is generally set in the server 505 .

[0103] It should be understood that Figure 5 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0104] Reference below Figure 6 , which shows a schematic diagram of the structure of a computer system 600 of a terminal device or a server suitable for implementing an embodiment of the present invention. Figure 6 The terminal device or server shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0105] like Figure 6 As shown, the computer system 600 includes a central processing unit (CPU) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the system 600 are also stored. The CPU 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0106] The following components are connected to the I / O interface 605: an input section 606 including a keyboard, a mouse, etc.; an output section 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, a modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed into the storage section 608 as needed.

[0107] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the central processing unit (CPU) 601, the above-mentioned functions defined in the system of the present invention are executed.

[0108] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0109] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0110] The units or modules involved in the embodiments of the present invention may be implemented in software or hardware. The units or modules described may also be provided in a processor. For example, they may be described as follows: a processor includes an identification module, a query module, an acquisition module, and a processing module. The names of these modules do not, in some cases, constitute limitations on the units or modules themselves. For example, the identification module may also be described as a "module for identifying the intent of vulnerability query instructions and generating query prompt words."

[0111] As another aspect, the present invention further provides a computer-readable medium, which may be included in the device described in the above embodiment; or may exist independently without being assembled into the device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by a device, the device includes:

[0112] Identify the intent of vulnerability query instructions and generate query prompts;

[0113] Based on the query prompt word, query the first vulnerability data from the vulnerability record data;

[0114] Acquire the associated data of the first vulnerability data through the knowledge graph to obtain the second vulnerability data;

[0115] Based on a preset prompt word template, the first vulnerability data and the second vulnerability data are integrated and processed to generate a vulnerability data query result.

[0116] According to the technical solution of the embodiment of the present invention, it is possible to generate vulnerability query instructions based on the natural language query content input by the user, complete the query of vulnerability data, improve the efficiency of vulnerability data query, reduce the query requirements on users, and improve the flexibility of vulnerability data query.

[0117] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for querying vulnerability data, characterized in that: include: Identify the intent of vulnerability query instructions and generate query prompts; Based on the query prompt word, query first vulnerability data from the vulnerability record data; Acquire related data of the first vulnerability data through the knowledge graph to obtain second vulnerability data; Based on a preset prompt word template, the first vulnerability data and the second vulnerability data are integrated and processed to generate a vulnerability data query result.

2. The method according to claim 1, characterized in that The vulnerability record data includes vulnerability work order data and asset access record data; Based on the query prompt word, querying first vulnerability data from vulnerability record data includes: Based on the query prompt word, query the first vulnerability data from the asset access record data; In response to failing to find the first vulnerability data from the asset access record data, searching the vulnerability work order data for the first vulnerability data through text matching.

3. The method according to claim 2, characterized in that The asset has multiple levels of domain names; In response to failure to query access records of the asset and its parent asset from the asset access record data, and the domain name level of the parent asset of the asset is not greater than 2, it is determined that first vulnerability data cannot be queried from the asset access record data.

4. The method according to claim 1, characterized in that: The vulnerability record data includes vulnerability work order data; Based on the query prompt word, querying first vulnerability data from vulnerability record data includes: Extracting features from the query prompt word to obtain a query vector; Determine a target work order description segment according to the similarity between the query vector and the work order description segment vector, wherein the work order description segment is generated by document segmentation of the vulnerability work order, and establish an association relationship between the work order description segment and the vulnerability work order; Based on the association relationship between the work order description fragment and the vulnerability work order, obtaining the target vulnerability work order corresponding to the target work order description fragment; The first vulnerability data is generated based on the vulnerability description information of the target vulnerability work order.

5. The method according to claim 4, characterized in that The work order description segment is generated by segmenting the vulnerability work order based on the specified segmentation length without using overlapping text segmentation areas.

6. The method according to claim 1, characterized in that Before integrating the first vulnerability data and the second vulnerability data to generate a vulnerability data query result based on a preset prompt word template, the method further includes: Acquire a corresponding first vulnerability processing strategy based on the first vulnerability data; Acquire the associated data of the first vulnerability handling strategy through the knowledge graph to obtain a second vulnerability handling strategy; Based on a preset prompt word template, the first vulnerability data and the second vulnerability data are integrated to generate a vulnerability data query result, including: Based on a preset prompt word template, the first vulnerability data, the second vulnerability data, the first vulnerability processing strategy and the second vulnerability processing strategy are integrated to generate a vulnerability data query result.

7. The method according to claim 1, characterized in that The knowledge graph is constructed in the following way: Use the big model to perform entity recognition on vulnerability handling policy documents and asset content, and build the first knowledge graph based on the relationship between entities; According to the similarity between the entity nodes in the first knowledge graph, node fusion is performed on the entity nodes in the first knowledge graph to obtain a second knowledge graph; According to the importance of the relationship between the entity nodes in the second knowledge graph, the weights of the edges between the entity nodes in the second knowledge graph are determined to obtain the knowledge graph.

8. A device for querying vulnerability data, characterized in that: include: The recognition module is used to identify the intent of vulnerability query instructions and generate query prompt words; A query module, used to query first vulnerability data from vulnerability record data based on the query prompt word; An acquisition module, used to acquire associated data of the first vulnerability data through a knowledge graph to obtain second vulnerability data; The processing module is used to integrate the first vulnerability data and the second vulnerability data based on a preset prompt word template to generate a vulnerability data query result.

9. An electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 7.

10. A computer readable medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images