Vulnerability utilization time prediction method and device, computer equipment and storage medium

Abstract

The embodiment of the invention provides a vulnerability utilization time prediction method and device, computer equipment, a storage medium and a computer program product, and relates to the technical field of network security. The method comprises the following steps: acquiring vulnerability feature data of a target vulnerability; according to the vulnerability feature data, obtaining a heterogeneous vulnerability feature graph of the target vulnerability; under the condition that the vulnerability utilization rate of the target vulnerability is greater than a preset utilization threshold value, obtaining a target combination feature of the target vulnerability based on the heterogeneous vulnerability feature graph by utilizing a pre-constructed vulnerability utilization prediction model; and obtaining the vulnerability utilization time of the target vulnerability based on the target combination feature by using a pre-constructed vulnerability utilization time prediction model. According to the method, the accuracy of vulnerability utilization prediction is improved, and the accuracy of vulnerability utilization time prediction is improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a vulnerability exploitation time prediction method, apparatus, computer equipment, storage medium and computer program product. Background Art

[0002] In the field of network security, a vulnerability is a weakness in a software product that can be exploited by an attacker to destroy the confidentiality, integrity or availability of the system hosting the product and cause damage, which may have immeasurable and serious consequences. Usually, in order to ensure network security, it is necessary to predict the exploitability of the vulnerability and the time when the vulnerability can be exploited.

[0003] In the current related technologies, the extraction of vulnerability features is not comprehensive enough, which may lead to low accuracy in vulnerability exploitability prediction and vulnerability exploitation time prediction, which is not conducive to network security protection. Summary of the invention

[0004] Based on this, it is necessary to provide a vulnerability exploitation time prediction method, device, computer equipment, storage medium and computer program product to address the above technical problems.

[0005] In a first aspect, the present application provides a vulnerability exploitation time prediction method. The method comprises:

[0006] Obtain vulnerability feature data of the target vulnerability;

[0007] According to the vulnerability feature data, a heterogeneous vulnerability feature graph of the target vulnerability is obtained;

[0008] When the vulnerability utilization rate of the target vulnerability is greater than a preset utilization threshold, a pre-built vulnerability utilization prediction model is used to obtain a target combination feature of the target vulnerability based on the heterogeneous vulnerability feature graph;

[0009] The vulnerability exploitation time of the target vulnerability is obtained by using a pre-built vulnerability exploitation time prediction model based on the target combination features.

[0010] In one of the embodiments, obtaining a heterogeneous vulnerability feature graph of the target vulnerability based on the vulnerability feature data includes: determining multiple nodes of the target vulnerability and node information of each of the nodes; determining multiple edges of the target vulnerability based on the node information; and constructing the heterogeneous vulnerability feature graph of the target vulnerability based on the multiple nodes and the multiple edges.

[0011] In one embodiment, the multiple nodes include word nodes and document nodes; the multiple nodes for determining the target vulnerability include: taking each of the multiple documents contained in the vulnerability feature data as a document node; performing word segmentation on the document text data of each of the documents to obtain multiple words of each of the documents; taking each of the multiple words as a word node to obtain multiple word nodes.

[0012] In one of the embodiments, the node information of the word node includes a weight value of a node weight; determining multiple edges of the target vulnerability based on the node information includes: obtaining the weight value of the node weight of any current word node among the multiple word nodes; determining the current document node corresponding to the current word node; and determining the edge between the current word node and the current document node based on the weight value of the node weight.

[0013] In one of the embodiments, determining multiple edges of the target vulnerability based on the node information includes: obtaining the degree of association between any current word node among the multiple word nodes and the remaining word nodes except the current word node; and determining the edges between the current word node and the remaining word nodes based on the degree of association.

[0014] In one embodiment, the multiple nodes further include feature nodes, author nodes, and vulnerability nodes;

[0015] The determining of multiple edges of the target vulnerability includes: determining a feature value of the feature node, and determining an edge between the document node and the feature node based on the feature value; determining that an edge weight value of the edge between the vulnerability node and the document node is 1; and determining that an edge weight value of the edge between the author node and the document node is 1.

[0016] In one embodiment, the vulnerability exploitation prediction model includes a first convolutional layer; the use of a pre-built vulnerability exploitation prediction model to obtain a target combination feature of the target vulnerability based on the heterogeneous vulnerability feature map includes: using the first convolutional layer to perform feature extraction on the heterogeneous vulnerability feature map to obtain vulnerability feature information of the target vulnerability; and obtaining the target combination feature of the target vulnerability based on the vulnerability feature information and the heterogeneous vulnerability feature map.

[0017] In a second aspect, the present application provides a vulnerability exploitation time prediction device. The device comprises:

[0018] A data acquisition module, used to obtain vulnerability feature data of the target vulnerability;

[0019] A feature graph construction module, used to obtain a heterogeneous vulnerability feature graph of the target vulnerability according to the vulnerability feature data;

[0020] A feature extraction module, configured to obtain a target combination feature of the target vulnerability based on the heterogeneous vulnerability feature graph by using a pre-built vulnerability exploitation prediction model when the vulnerability exploitation rate of the target vulnerability is greater than a preset exploitation threshold;

[0021] The prediction module is used to obtain the vulnerability exploitation time of the target vulnerability based on the target combination characteristics by using a pre-built vulnerability exploitation time prediction model.

[0022] In a third aspect, the present application further provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0023] Obtain vulnerability feature data of the target vulnerability;

[0024] According to the vulnerability feature data, a heterogeneous vulnerability feature graph of the target vulnerability is obtained;

[0025] When the vulnerability utilization rate of the target vulnerability is greater than a preset utilization threshold, a pre-built vulnerability utilization prediction model is used to obtain a target combination feature of the target vulnerability based on the heterogeneous vulnerability feature graph;

[0026] The vulnerability exploitation time of the target vulnerability is obtained by using a pre-built vulnerability exploitation time prediction model based on the target combination features.

[0027] In a fourth aspect, the present application further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0028] Obtain vulnerability feature data of the target vulnerability;

[0029] According to the vulnerability feature data, a heterogeneous vulnerability feature graph of the target vulnerability is obtained;

[0030] When the vulnerability utilization rate of the target vulnerability is greater than a preset utilization threshold, a pre-built vulnerability utilization prediction model is used to obtain a target combination feature of the target vulnerability based on the heterogeneous vulnerability feature graph;

[0031] The vulnerability exploitation time of the target vulnerability is obtained by using a pre-built vulnerability exploitation time prediction model based on the target combination features.

[0032] In a fifth aspect, the present application further provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0033] Obtain vulnerability feature data of the target vulnerability;

[0034] According to the vulnerability feature data, a heterogeneous vulnerability feature graph of the target vulnerability is obtained;

[0035] When the vulnerability utilization rate of the target vulnerability is greater than a preset utilization threshold, a pre-built vulnerability utilization prediction model is used to obtain a target combination feature of the target vulnerability based on the heterogeneous vulnerability feature graph;

[0036] The vulnerability exploitation time of the target vulnerability is obtained by using a pre-built vulnerability exploitation time prediction model based on the target combination features.

[0037] In the above vulnerability exploitation time prediction method, device, computer equipment, storage medium and computer program product, vulnerability feature data of the target vulnerability is obtained; based on the vulnerability feature data, a heterogeneous vulnerability feature map of the target vulnerability is obtained; when the vulnerability exploitation rate of the target vulnerability is greater than a preset exploitation threshold, a pre-constructed vulnerability exploitation prediction model is used to obtain the target combination feature of the target vulnerability based on the heterogeneous vulnerability feature map; and a pre-constructed vulnerability exploitation time prediction model is used to obtain the vulnerability exploitation time of the target vulnerability based on the target combination feature. In the method provided by the embodiment of the present application, a heterogeneous vulnerability feature map of the target vulnerability can be constructed based on the vulnerability feature data, wherein semantic association, feature association and vulnerability association can be considered, and a vulnerability exploitation prediction model that integrates feature attributes within the vulnerability and association information between vulnerabilities is introduced to improve the accuracy of vulnerability exploitation prediction, wherein an attention mechanism is introduced to allocate the model's attention to more important information sources or features, further improving the accuracy of vulnerability exploitation prediction, and in addition, a vulnerability exploitation time prediction model is introduced, and based on the target combination feature obtained by the vulnerability exploitation prediction model, the accuracy of vulnerability exploitation time prediction can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0039] Figure 1 A flowchart of a vulnerability exploitation time prediction method provided in an embodiment of the present application;

[0040] Figure 2 A flowchart of another vulnerability exploitation time prediction method provided in an embodiment of the present application;

[0041] Figure 3 A schematic diagram of the structure of a heterogeneous vulnerability feature graph provided in an embodiment of the present application;

[0042] Figure 4 A schematic diagram of a process flow of a vulnerability exploitation prediction model provided in an embodiment of the present application;

[0043] Figure 5 A schematic diagram of a process for constructing a heterogeneous vulnerability feature map of a target vulnerability provided in an embodiment of the present application;

[0044] Figure 6 A structural block diagram of a vulnerability exploitation time prediction device provided in an embodiment of the present application;

[0045] Figure 7 An internal structure diagram of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0047] In an exemplary embodiment, Figure 1 and Figure 2 As shown, a vulnerability exploitation time prediction method is provided. This embodiment uses the method applied to a server as an example for illustration. It is understandable that the method can also be applied to a terminal, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0048] Step 102, obtaining vulnerability feature data of the target vulnerability.

[0049] Among them, first, the initial vulnerability data of the target vulnerability can be obtained, and then the initial vulnerability data can be preprocessed to obtain the vulnerability feature data of the target vulnerability. The vulnerability feature data includes vulnerability description text data and vulnerability inherent feature data; the data preprocessing can include sample deduplication, missing value processing, feature value normalization and vulnerability text processing. Specifically, as shown in Table 1, data crawling can be used to obtain the initial vulnerability data of the target vulnerability. Data source selection and determination: The most representative and effective data sources proved by previous work are selected for experiments, including vulnerability databases (e.g., National Vulnerability Database (NVD)), security blogs, Twitter, vulnerability exploit databases (e.g., Open Source Project Guide (Exploit Database, EDB)), vulnerability attack signature datasets, etc. These data sources cover a wealth of vulnerability-related information and reflect the characteristics and utilization of vulnerabilities from different angles. Data crawling tools and technologies crawl and organize the data published directly from their official websites for vulnerability databases, vulnerability exploit databases, vulnerability attack signature datasets, etc. Use the third-party Python library requests to send HTTP requests to obtain web page content, and then use the Beautiful Soup library to parse Hyper Text Markup Language (HTML) or Extensible Markup Language (XML) documents to extract the required vulnerability data information. For example, obtain a detailed description of the vulnerability, Common Vulnerability Scoring System (CVSS) score, affected platforms and products, and other information from the NVD official website. Security blog data comes from security blogs published by security experts or security vendors. Also use the requests library to obtain blog page content, and then use parsing technology to extract vulnerability-related article content, release time, author, and other information based on the structure and markup language (e.g., HTML) of the blog. Twitter data comes from vulnerability tweets posted on Twitter. Use the Twitter library to match the Common Vulnerabilities & Exposures (CVE) number in the tweet to filter out tweets related to the vulnerability. The Twitter library can efficiently search and obtain Twitter data, and organize and store the obtained tweet information (such as tweet content, release time, number of likes, number of retweets, number of replies, mentioned users, hash tags, tweeting users, etc.). Data format unification and storage: The data format crawled from various data sources is uniformly dumped into csv format for subsequent data processing and analysis.During the storage process, ensure the integrity and accuracy of each data field, such as retaining a unique CVE-ID identifier for each vulnerability data record to facilitate subsequent data association and processing. Next, the initial vulnerability data can be sampled for deduplication, including: Deduplication basis determination: Since the crawled data may have duplicate records, deduplication is required to avoid disrupting the model training process. The unique identifier of the vulnerability data (for example, CVE-ID) is used as the main basis, combined with other key information (such as data source, release time, etc.) to determine whether the data is duplicated. Deduplication algorithm and implementation: A variety of algorithms can be used to implement deduplication, such as using a hash table data structure to store the CVE-ID that has appeared and its related information. When traversing the crawled data, for each data record, calculate the hash value of its CVE-ID, and check whether the same hash value already exists in the hash table. If it exists, further compare other key information, such as source and release time, to determine whether it is duplicate data. If it is determined to be duplicate data, it will be deleted from the data set; if it is new data, its related information will be stored in the hash table and continue to process the next data record. In this way, duplicate vulnerability data samples can be removed efficiently to ensure the accuracy and validity of the data set. Furthermore, the missing value processing and feature numerical normalization can be performed on the vulnerability data after deduplication. In order to make different features comparable and eliminate the influence of dimension, the initial vulnerability data features are numerically normalized. For discrete features, such as Common Platform Enumeration (CPE) features such as application software and operating system, vulnerability types, etc., the one-hot encoding method is used to convert them into numerical form. One-hot encoding converts each category feature into a vector, in which only one element is 1, indicating the category to which the sample belongs, and the rest of the elements are 0. In this way, the categorical features can be converted into numerical features, which is convenient for model processing. For continuous numerical features, such as CVSS basic scores, impact scores, the number of likes, retweets, and replies on Twitter, the Z-Score normalization method is used. The calculation formula for Z-Score normalization is shown in formula (1), where is the original data value, is the mean of the data, and is the standard deviation of the data. By standardizing, the data is converted to a distribution with a mean of 0 and a standard deviation of 1, so that different features have similar numerical scales, which helps to improve the training efficiency and accuracy of the model.

[0050]

[0051] Finally, vulnerability text processing can be performed on vulnerability data, including: Normalization operation: To prevent interference from redundant information, the vulnerability text is normalized. For example, based on Python's built-in libraries urllib, re, etc., word lowercase is implemented, and all words are uniformly converted to lowercase to avoid being regarded as different words due to different capitalization. Uniform Resource Locator (URL) links are normalized to domain names, and the main domain name part in the link is extracted to reduce the impact of the diversity of link forms on text analysis. At the same time, non-standard vulnerability numbers are extracted in a regular way, and the format of vulnerability numbers is unified to facilitate subsequent data analysis and processing. Word segmentation and stop word removal are performed. For example, Python's nltk library is used for word segmentation operations, the text is segmented according to words or phrases, and the continuous text stream is converted into a word sequence. In the word segmentation process, stop words also need to be removed, that is, those words that appear frequently in the text but contribute little to semantic analysis, such as "a", "the", "and", etc. The nltk library provides a list of common stop words, which can be used directly or customized according to specific needs. By removing stop words, we can reduce the data dimension, highlight the key information in the text, and improve the model's extraction effect on vulnerability-related text features. Furthermore, we can also mark the target vulnerability data and use the vulnerability exploitation database and Symantec attack signatures to determine the vulnerability exploitation situation.

[0052]

[0053] Table 1 Vulnerability feature data of target vulnerabilities

[0054] Step 104: Obtain a heterogeneous vulnerability feature graph of the target vulnerability based on the vulnerability feature data.

[0055] First, we can determine the various nodes of the target vulnerability and the node information of the various nodes; then, we can determine the multiple edges of the target vulnerability based on the node information; finally, we can construct a heterogeneous vulnerability feature graph of the target vulnerability based on the various nodes and multiple edges. Figure 3 As shown in , the heterogeneous vulnerability feature graph to be constructed for the target vulnerability can have multiple types of nodes, such as vulnerability nodes (identified by the unique number of the vulnerability), document nodes (corresponding to various vulnerability-related documents), feature nodes (corresponding to processed discrete and continuous features), description word nodes, i.e., word nodes (vulnerability-related words extracted from the text) and author nodes (if the data contains author information, for example, Twitter authors), as shown in Figure 3As shown, the multiple nodes may include vulnerability 1, vulnerability 2, document 1, document 2, document 3, word 1, word 2, word 3, word 4, feature 1, feature 2, feature 3, author 1 and author 2. Furthermore, multiple edges of the heterogeneous vulnerability feature graph to be constructed can be determined based on the node information of each node. For the edges between word nodes and document nodes, the following may be included: The first step is to obtain the term frequency-inverse document frequency (TF-IDF) value of any current word node among the multiple word nodes of the target vulnerability, as shown in formula (2):

[0056]

[0057] in, For the words; For the documents; For the The words in The frequency of words in the document; For the The inverse document frequency of the term; For the The words in in the document The TF-IDF value takes into account the frequency of a word in a document and its rarity in the entire document collection. The higher the TF-IDF value, the more important the word is in a specific document.

[0058] No. The words in word frequency in documents The calculation of can refer to formula (3):

[0059]

[0060] in, For the words; For the documents; For the The words in The number of times it appears in a document; document The sum of the number of occurrences of all words in a document. Term Frequency (TE) reflects the relative importance of a word in a document. If a word appears more times in a document, it is generally considered to be more important in expressing the content of the document.

[0061] No. The calculation of the inverse document frequency of a word can be found in formula (4):

[0062]

[0063] Where N is the total number of documents in the document collection; To contain words The number of documents in a document. To avoid the situation where the denominator is 0, 1 is usually added to the denominator. The function of Inverse Document Frequency (IDF) is to adjust the word frequency, reduce the weight of common words that appear frequently in most documents, and increase the weight of words that appear in a few documents.

[0064] Furthermore, in a possible implementation, N-gram can be introduced to optimize the TF-IDF model. For each document, an N-gram sequence is generated according to the selected N value. The generated N-gram sequence is regarded as a new "word" in the document, and its TF-IDF value is calculated in the same way as an ordinary word. That is, the term frequency (TF) of each N-gram in the document and the inverse document frequency (IDF) in the entire document collection are calculated, and then its TF-IDF value is obtained. In addition, for each word, it can be decomposed at the character level to generate character-level N-grams. For example, for the word "exploit", if character-level bigram (i.e., 2-gram) is selected, character combinations such as "ex", "xp", "pl", "lo", "oi", and "it" can be generated. By globally sharing these character-level N-gram information, fine-grained feature extraction of words such as rare words or spliced ​​words is achieved, and the character-level N-gram feature vector is involved in the construction of a multi-level heterogeneous vulnerability graph together with other features (such as TF-IDF features of ordinary words, discrete and continuous vulnerability features, etc.).

[0065] In the second step, the edge between the current word node and the current document node can be constructed based on the TF-IDF value of the current word node as the edge weight.

[0066] For the edge between words, the degree of association between the current word node and the other word nodes except the current word node can be obtained, and according to the degree of association, the edge between the current word node and the other word nodes can be determined. In a possible implementation, the pointwise mutual information (PMI) between the current word node and the other word nodes can be calculated, and the degree of association between the current word node and the other word nodes can be measured by the PMI value. The calculation formula of the PMI value is as shown in formula (5):

[0067]

[0068] in, It's a word and words Probability of simultaneous occurrence; For words Probability of single occurrence; For words The probability of a single occurrence, For words and words PMI value.

[0069] In addition, the document node is connected to the word node with the TF-IDF value as the edge weight, connected to the digitized feature node with the feature value as the weight, and connected to the author node with a weight of 1 (the author node is identified by the digitized unique author ID, and the weight between the author node and the document node is 1). The edge weight between the vulnerability node and the document node is 1, and a vulnerability node may be connected to one or more document nodes, reflecting the association between the vulnerability and related documents.

[0070] According to the node types and connection rules defined above, all nodes are connected through edges with corresponding weights to form a heterogeneous vulnerability graph containing multiple levels (such as vulnerability semantic layer, vulnerability feature aggregation layer, vulnerability node layer, etc.). In this heterogeneous vulnerability feature graph, nodes of different types are interconnected through edges to represent and aggregate vulnerability feature information from multiple perspectives.

[0071] Step 106, when the exploit probability value of the target vulnerability is greater than a preset exploit threshold, a pre-built vulnerability exploitation prediction model is used to obtain a target combination feature of the target vulnerability based on the heterogeneous vulnerability feature graph.

[0072] Among them, Figure 4As shown, the vulnerability exploitation prediction model can be a heterogeneous graph convolution model, which can include an input layer, a graph convolution layer, a graph attention layer, a multi-layer stacking structure and an output layer. The vulnerability exploitation prediction model can be used to predict the vulnerability exploitation rate of the target vulnerability. When the vulnerability exploitation rate is greater than the preset exploitation threshold, the target combination feature of the target vulnerability is obtained based on the heterogeneous vulnerability feature graph; when the vulnerability exploitation rate is greater than the preset exploitation threshold, the vulnerability repair priority can be reduced. Using the vulnerability exploitation prediction model to predict the vulnerability exploitation rate of the target vulnerability can include: Specifically, in the first step, the heterogeneous vulnerability feature graph can be input as input data to the pre-built vulnerability exploitation prediction model, and the feature vector of each node is represented in a previously designed manner (such as segmentation by feature type, and the vector segmentation dimension value that is not related to the current node type is set to 0). The model transmits and aggregates information between nodes of different types according to the connection relationship (edge ​​weight) between nodes and the defined information propagation method. In the process of constructing a heterogeneous vulnerability feature graph, different types of features (e.g., text features, vulnerability attribute features, etc.) can be associated with corresponding nodes, and the weight of the edge can be used to represent the relationship between features, thus achieving the initial fusion of features in the graph structure. Furthermore, the input feature matrix can be limited to a unit matrix in the input layer of the vulnerability exploitation prediction model, further unifying the feature vectors of different types of nodes in structure, laying the foundation for calculation and information propagation in the same feature space. The feature vector of each node represents its own key features and the features of other types of nodes in a unified framework according to the designed segmentation method. The second step is the forward propagation of the heterogeneous graph convolution model. (1) Information propagation and aggregation (convolutional layer operation): In the heterogeneous graph convolution model, the convolutional layer operates according to the predefined information propagation rules. For each node, its information propagation is based on the features of neighboring nodes and the weight of the edges. For example, a document node receives information from a vulnerability node, a word node, a feature node, and an author node, and the calculation method is to multiply the features of adjacent nodes by the corresponding edge weights and then sum them. As shown in formula (6):

[0073]

[0074] in, is the feature vector of node i, is the set of neighbor nodes; is the edge weight, is a learnable parameter matrix. In this way, each node gradually aggregates information from its neighbors to achieve local information fusion. At the same time, nonlinear factors are introduced through linear transformation (multiplication) and activation function (ReLU) to enhance the model's ability to learn complex feature relationships.

[0075] (2) In a possible implementation, a node-level graph attention mechanism can be introduced into the vulnerability exploitation prediction model. The node-level graph attention mechanism can be used before or after the graph convolution layer, and the attention coefficient will be calculated during the information propagation process. For each node, the attention score is calculated by linearly transforming the features of the adjacent nodes, and then the attention coefficient is normalized by the softmax function. Then, the information transmitted by the adjacent nodes is weighted and summed according to the attention coefficient, so that the model can pay more attention to the neighboring node information that is important to the current node, and further optimize the information aggregation process. (3) Multi-layer convolution and feature extraction: By stacking multiple convolution layers, the model can extract vulnerability features at different levels. Each layer of convolution further aggregates and transforms information based on the previous layer, gradually expanding the receptive field and capturing the relationship between nodes at a longer distance, thereby learning a more abstract and advanced vulnerability feature representation. As the number of layers increases, the model has a deeper understanding of the vulnerability features, which helps to improve the accuracy of the prediction. In the third step, the last layer of the vulnerability exploitation prediction model, that is, the output layer, outputs the prediction result of the target vulnerability, that is, the predicted vulnerability exploitation rate. The prediction result can be in different forms. In one possible implementation, for a binary classification task (whether the vulnerability will be exploited), an output neuron combined with a sigmoid activation function can be used to map the output to between 0 and 1, indicating the probability of the vulnerability being exploited; in another possible implementation, for a multi-classification task (such as predicting the type or degree of vulnerability exploitation), the corresponding number of output neurons can be set according to the number of categories, and normalized by a softmax function to obtain the probability distribution of each category. If the predicted vulnerability utilization rate is greater than the preset exploitation threshold, the target combination features of the target vulnerability can be obtained based on the heterogeneous vulnerability feature map. Specifically, the first convolutional layer included in the vulnerability exploitation prediction model can be used to extract features from the heterogeneous vulnerability feature map to obtain vulnerability feature information of the target vulnerability; based on the vulnerability feature information and the heterogeneous vulnerability feature map, the target combination features of the target vulnerability are obtained.

[0076] Step 108, using the pre-built vulnerability exploitation time prediction model, based on the target combination features, obtain the vulnerability exploitation time of the target vulnerability.

[0077] Among them, the vulnerability exploitation time prediction model can be a machine learning algorithm based on the gradient boosting decision tree (LightGradient Boosting Decision Tree, GBDT), and the Light GBM regression model can be trained on the basis of the vulnerability utilization prediction model. The Light GBM regression model can predict the exploitation time of the target vulnerability, and the exploitation time can be the time when the attack behavior of the attacker exploits the vulnerability. In the training process of the Light GBM regression model, for the vulnerabilities that will actually be exploited by attackers, the difference between the vulnerability exploitation time point and the official disclosure time of the vulnerability or the issuance time of the vulnerability number is used as the target value for model training, thereby iteratively training the supervised regression prediction model. In this step, the target combination feature can be input into the pre-built vulnerability exploitation time prediction model to determine and output the vulnerability exploitation time of the target vulnerability.

[0078] In the method of this embodiment, vulnerability feature data of the target vulnerability can be obtained; based on the vulnerability feature data, a heterogeneous vulnerability feature map of the target vulnerability can be obtained; when the vulnerability utilization rate of the target vulnerability is greater than a preset utilization threshold, a pre-constructed vulnerability utilization prediction model is used to obtain the target combination feature of the target vulnerability based on the heterogeneous vulnerability feature map; and a pre-constructed vulnerability utilization time prediction model is used to obtain the vulnerability utilization time of the target vulnerability based on the target combination feature. In the method provided by the embodiment of the present application, a heterogeneous vulnerability feature map of the target vulnerability can be constructed based on the vulnerability feature data, wherein semantic association, feature association and vulnerability association can be considered, and a vulnerability utilization prediction model that integrates feature attributes within the vulnerability and correlation information between vulnerabilities is introduced to improve the accuracy of vulnerability utilization prediction, wherein an attention mechanism is introduced to allocate the model's attention to more important information sources or features, further improving the accuracy of vulnerability utilization prediction, and in addition, a vulnerability utilization time prediction model is introduced, and based on the target combination feature obtained by the vulnerability utilization prediction model, the accuracy of vulnerability utilization time prediction can be improved.

[0079] In an exemplary embodiment, Figure 5 As shown, step 104 may include steps 502 to 506. Among them:

[0080] Step 502, determining various nodes of the target vulnerability and node information of various nodes.

[0081] Step 504: determine multiple edges of the target vulnerability based on the node information.

[0082] Step 506: construct a heterogeneous vulnerability feature graph of the target vulnerability based on the multiple nodes and the multiple edges.

[0083] In an exemplary embodiment, the various nodes for determining the target vulnerability in step 502 may include:

[0084] Each of the multiple documents included in the vulnerability feature data is regarded as a document node; the document text data of each document is segmented to obtain multiple words of each document; each of the multiple words is regarded as a word node to obtain multiple word nodes.

[0085] The heterogeneous vulnerability feature graph to be constructed for the target vulnerability may have multiple types of nodes, for example, vulnerability nodes (identified by the unique CVE number of the vulnerability), document nodes (corresponding to various vulnerability-related documents), feature nodes (corresponding to processed discrete and continuous features), description word nodes, i.e., word nodes (vulnerability-related words extracted from the text), and author nodes (if the data contains author information, for example, Twitter authors), such as Figure 3 As shown, the multiple nodes may include vulnerability 1, vulnerability 2, document 1, document 2, document 3, word 1, word 2, word 3, word 4, feature 1, feature 2, feature 3, author 1 and author 2.

[0086] In an exemplary embodiment, step 504 may include:

[0087] Obtain a weight value of a node weight of any current word node among multiple word nodes; determine a current document node corresponding to the current word node; and determine an edge between the current word node and the current document node according to the weight value of the node weight.

[0088] Among them, for the edge between the word node and the document node, it can include: the first step, for any current word node among the multiple word nodes of the target vulnerability, the term frequency-inverse document frequency (Term Frequency-Inverse Document Frequency, TF-IDF) value of the current word node is obtained; the second step, the edge between the current word node and the current document node can be constructed according to the TF-IDF value of the current word node as the edge weight.

[0089] In another exemplary embodiment, step 504 may include:

[0090] Obtain the degree of association between any current word node among multiple word nodes and the remaining word nodes except the current word node; and determine the edges between the current word node and the remaining word nodes according to the degree of association.

[0091] Among them, for the edge between words, the degree of association between the current word node and the remaining word nodes except the current word node can be obtained, and according to the degree of association, the edge between the current word node and the remaining word nodes can be determined. In a possible implementation, the pointwise mutual information (PMI) between the current word node and the remaining word nodes can be calculated, and the degree of association between the current word node and the remaining word nodes can be measured by the PMI value. The calculation formula of the PMI value is as shown in formula (5).

[0092] In addition, the document node is connected to the word node with the TF-IDF value as the edge weight, connected to the digitized feature node with the feature value as the weight, and connected to the author node with a weight of 1 (the author node is identified by a digitized unique author ID, and the weight between the author node and the document node is 1). The edge weight between the vulnerability node and the document node is 1. A vulnerability node may be connected to one or more document nodes, reflecting the association between the vulnerability and related documents. According to the node types and connection rules defined above, all nodes are connected through edges with corresponding weights to form a heterogeneous vulnerability graph containing multiple levels (such as vulnerability semantic layer, vulnerability feature aggregation layer, vulnerability node layer, etc.). In this heterogeneous vulnerability feature graph, nodes of different types are interconnected through edges to represent and aggregate vulnerability feature information from multiple perspectives.

[0093] In the method of this embodiment, a heterogeneous vulnerability feature graph of the target vulnerability can be constructed based on the vulnerability feature data, wherein semantic association, feature association and vulnerability association can be considered, and multi-dimensional features are incorporated, which can improve the accuracy of vulnerability exploitation prediction and the accuracy of vulnerability exploitation time prediction.

[0094] In an exemplary embodiment, determining multiple edges of the target vulnerability in step 504 may include:

[0095] Determine a feature value of the feature node, and determine an edge between the document node and the feature node based on the feature value; determine an edge weight value of the edge between the vulnerability node and the document node to be 1; determine an edge weight value of the edge between the author node and the document node to be 1.

[0096] Among them, the document node is connected to the word node with the TF-IDF value as the edge weight, connected to the numerical feature node with the feature value as the weight, and connected to the author node with a weight of 1 (the author node is identified by a numerical unique author ID, and the weight between the author node and the document node is 1). The edge weight between the vulnerability node and the document node is 1. A vulnerability node may be connected to one or more document nodes, reflecting the association between the vulnerability and related documents. According to the node types and connection rules defined above, all nodes are connected through edges with corresponding weights to form a heterogeneous vulnerability graph containing multiple levels (such as vulnerability semantic layer, vulnerability feature aggregation layer, vulnerability node layer, etc.). In this heterogeneous vulnerability feature graph, nodes of different types are interconnected through edges to represent and aggregate vulnerability feature information from multiple perspectives.

[0097] In an exemplary embodiment, the step 106 of using a pre-built vulnerability exploitation prediction model to obtain a target combination feature of a target vulnerability based on a heterogeneous vulnerability feature graph may include:

[0098] The first convolutional layer is used to extract features from the heterogeneous vulnerability feature map to obtain vulnerability feature information of the target vulnerability; based on the vulnerability feature information and the heterogeneous vulnerability feature map, the target combination feature of the target vulnerability is obtained.

[0099] Among them, the first convolution layer included in the vulnerability exploitation prediction model can be used to extract features from the heterogeneous vulnerability feature graph to obtain vulnerability feature information of the target vulnerability; according to the vulnerability feature information and the heterogeneous vulnerability feature graph, the target combination feature of the target vulnerability is obtained. The output of the first layer is extracted as the embedded representation of the vulnerability document or vulnerability node. The output of this layer contains the vulnerability feature information after preliminary convolution and information fusion, which can reflect the relevant attributes and contextual information of the vulnerability to a certain extent, and serve as one of the input features of the subsequent LightGBM model. The heterogeneous vulnerability feature graph includes basic vulnerability features, which can include discrete or continuous features related to the vulnerability obtained from the data set, such as CVE-ID related information, some inherent attributes of the vulnerability (such as access vector AV in CVSS, attack complexity AC, etc.), and relevant statistical features of the vulnerability text (such as the number of likes, retweets, and replies in Twitter). Furthermore, the embedded representation obtained from the first layer of the graph convolutional network can be combined with these basic features to form a complete feature vector, namely the target combination feature. For example, the embedded representation can be added to the basic feature vector as a new feature dimension, or the two can be concatenated or fused in some way to ensure that the feature representation of each sample contains information from both the graph convolutional network and the original basic features, providing a more comprehensive input for the LightGBM regression model.

[0100] In the method of this embodiment, a vulnerability exploitation prediction model is introduced that integrates the characteristic attributes within the vulnerability and the correlation information between vulnerabilities, thereby improving the accuracy of vulnerability exploitation prediction. An attention mechanism is introduced to allocate the model's attention to more important information sources or features, further improving the accuracy of vulnerability exploitation prediction.

[0101] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0102] Based on the same inventive concept, the embodiment of the present application also provides a vulnerability exploitation time prediction device for implementing the vulnerability exploitation time prediction method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more vulnerability exploitation time prediction device embodiments provided below can refer to the limitations of the vulnerability exploitation time prediction method above, and will not be repeated here.

[0103] In one embodiment, Figure 6 As shown, a vulnerability exploitation time prediction device is provided, including: a data acquisition module 602, a feature graph construction module 604, a feature extraction module 606 and a prediction module 608, wherein:

[0104] The data acquisition module 602 is used to acquire vulnerability feature data of the target vulnerability;

[0105] A feature graph construction module 604 is used to obtain a heterogeneous vulnerability feature graph of the target vulnerability according to the vulnerability feature data;

[0106] A feature extraction module 606 is used to obtain a target combination feature of the target vulnerability based on the heterogeneous vulnerability feature graph by using a pre-built vulnerability exploitation prediction model when the vulnerability exploitation rate of the target vulnerability is greater than a preset exploitation threshold;

[0107] The prediction module 608 is used to obtain the vulnerability exploitation time of the target vulnerability based on the target combination features by using a pre-built vulnerability exploitation time prediction model.

[0108] In one embodiment, the feature graph construction module 604 is also used to: determine multiple nodes of the target vulnerability and node information of various nodes; determine multiple edges of the target vulnerability based on the node information; and construct the heterogeneous vulnerability feature graph of the target vulnerability based on the multiple nodes and the multiple edges.

[0109] In one embodiment, the multiple nodes include word nodes and document nodes; the feature graph construction module 604 is also used to: take each of the multiple documents contained in the vulnerability feature data as a document node; perform word segmentation on the document text data of each of the documents to obtain multiple words of each of the documents; take each of the multiple words as a word node to obtain multiple word nodes.

[0110] In one embodiment, the node information of the word node includes a weight value of the node weight; the feature graph construction module 604 is also used to: obtain the weight value of the node weight of any current word node among the multiple word nodes; determine the current document node corresponding to the current word node; and determine the edge between the current word node and the current document node based on the weight value of the node weight.

[0111] In one embodiment, the feature graph construction module 604 is also used to: obtain the degree of association between any current word node among the multiple word nodes and the remaining word nodes except the current word node; and determine the edge between the current word node and the remaining word nodes based on the degree of association.

[0112] In one embodiment, the vulnerability exploitation prediction model includes a first convolutional layer; the feature extraction module 606 is further used to: use the first convolutional layer to perform feature extraction on the heterogeneous vulnerability feature map to obtain vulnerability feature information of the target vulnerability; and obtain the target combination feature of the target vulnerability based on the vulnerability feature information and the heterogeneous vulnerability feature map.

[0113] Each module in the above vulnerability exploitation time prediction device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each module.

[0114] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 7As shown. The computer device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store vulnerability exploitation time prediction related data. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a vulnerability exploitation time prediction method is implemented.

[0115] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0116] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0117] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0118] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0119] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0120] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0121] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0122] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A vulnerability exploitation time prediction method, characterized in that: The method comprises: Obtain vulnerability feature data of the target vulnerability; the vulnerability feature data includes vulnerability description text data and vulnerability inherent feature data; According to the vulnerability feature data, a heterogeneous vulnerability feature graph of the target vulnerability is obtained; When the vulnerability utilization rate of the target vulnerability is greater than a preset utilization threshold, a pre-built vulnerability utilization prediction model is used to obtain a target combination feature of the target vulnerability based on the heterogeneous vulnerability feature graph; The vulnerability exploitation time of the target vulnerability is obtained by using a pre-built vulnerability exploitation time prediction model based on the target combination features.

2. The method according to claim 1, characterized in that The step of obtaining a heterogeneous vulnerability feature graph of the target vulnerability according to the vulnerability feature data includes: Determine various nodes of the target vulnerability and node information of various nodes; Determine multiple edges of the target vulnerability according to the node information; The heterogeneous vulnerability feature graph of the target vulnerability is constructed according to the multiple nodes and the multiple edges.

3. The method according to claim 2, characterized in that The multiple nodes include term nodes and document nodes; The multiple nodes for determining the target vulnerability include: Taking each of the multiple documents included in the vulnerability feature data as a document node; Performing word segmentation processing on the document text data of each of the documents to obtain a plurality of words of each of the documents; Each of the multiple words is taken as a word node to obtain multiple word nodes.

4. The method according to claim 3, characterized in that The node information of the word node includes a weight value of the node weight; The step of determining the multiple edges of the target vulnerability according to the node information includes: Obtaining the weight value of the node weight of any current word node among the plurality of word nodes; Determine a current document node corresponding to the current word node; An edge between the current word node and the current document node is determined according to the weight value of the node weight.

5. The method according to claim 3, characterized in that: The step of determining the multiple edges of the target vulnerability according to the node information includes: Obtaining the degree of association between any current word node among the plurality of word nodes and the remaining word nodes except the current word node; According to the association degree, edges between the current word node and the remaining word nodes are determined.

6. The method according to claim 3, characterized in that The various nodes also include feature nodes, author nodes, and vulnerability nodes; The determining of the multiple edges of the target vulnerability includes: Determine a feature value of the feature node, and determine an edge between the document node and the feature node according to the feature value; Determine that the edge weight value of the edge between the vulnerability node and the document node is 1; The edge weight value of the edge between the author node and the document node is determined to be 1.

7. The method according to claim 1, characterized in that The vulnerability exploit prediction model comprises a first convolutional layer; The method of using a pre-built vulnerability exploitation prediction model to obtain target combination features of the target vulnerability based on the heterogeneous vulnerability feature graph includes: Using the first convolutional layer to perform feature extraction on the heterogeneous vulnerability feature graph to obtain vulnerability feature information of the target vulnerability; The target combination feature of the target vulnerability is obtained according to the vulnerability feature information and the heterogeneous vulnerability feature graph.

8. A vulnerability exploitation time prediction device, characterized in that: The device comprises: A data acquisition module, used to obtain vulnerability feature data of the target vulnerability; A feature graph construction module, used to obtain a heterogeneous vulnerability feature graph of the target vulnerability according to the vulnerability feature data; A feature extraction module, configured to obtain a target combination feature of the target vulnerability based on the heterogeneous vulnerability feature graph by using a pre-built vulnerability exploitation prediction model when the vulnerability exploitation rate of the target vulnerability is greater than a preset exploitation threshold; The prediction module is used to obtain the vulnerability exploitation time of the target vulnerability based on the target combination characteristics by using a pre-built vulnerability exploitation time prediction model.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images