Vulnerability exploit time prediction method and apparatus, computer device, and storage medium

Abstract

The embodiment of the application provides a vulnerability exploitation time prediction method and device, computer equipment, a storage medium and a computer program product, and relates to the technical field of network security. The method comprises the following steps: obtaining vulnerability feature data of a target vulnerability; obtaining a heterogeneous vulnerability feature map of the target vulnerability according to the vulnerability feature data; in the case that the vulnerability exploitation rate of the target vulnerability is greater than a preset exploitation threshold, using a pre-constructed vulnerability exploitation prediction model to obtain target combination features of the target vulnerability based on the heterogeneous vulnerability feature map; and using a pre-constructed vulnerability exploitation time prediction model to obtain the vulnerability exploitation time of the target vulnerability based on the target combination features. The method improves the accuracy of vulnerability exploitation prediction and improves the accuracy of vulnerability exploitation time prediction.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and in particular to a method, apparatus, computer device, storage medium, and computer program product for predicting vulnerability exploitation time. Background Technology

[0002] In the field of cybersecurity, vulnerabilities are weaknesses in software products that attackers can exploit to compromise the confidentiality, integrity, or availability of the system hosting the product, causing damage and potentially leading to incalculable serious consequences. Typically, to ensure cybersecurity, it is necessary to predict the exploitability of vulnerabilities and the timeframe for such exploitation.

[0003] Current technologies for extracting vulnerability features are not comprehensive enough, which may lead to low accuracy in predicting vulnerability exploitability and exploitation time, thus compromising network security. Summary of the Invention

[0004] Therefore, it is necessary to provide a method, apparatus, computer device, storage medium, and computer program product for predicting vulnerability exploitation time in response to the above-mentioned technical problems.

[0005] Firstly, this application provides a method for predicting vulnerability exploitation time. The method includes:

[0006] Obtain vulnerability signature data for the target vulnerability;

[0007] Based on the vulnerability feature data, obtain a heterogeneous vulnerability feature map of the target vulnerability;

[0008] If the exploitation rate of the target vulnerability is greater than a preset exploitation threshold, the target combination features of the target vulnerability are obtained based on the heterogeneous vulnerability feature map using a pre-built vulnerability exploitation prediction model.

[0009] Using a pre-built vulnerability exploitation time prediction model, the exploitation time of the target vulnerability is obtained based on the target combination characteristics.

[0010] In one embodiment, obtaining the heterogeneous vulnerability feature map of the target vulnerability based on the vulnerability feature data includes: determining multiple nodes of the target vulnerability and node information of each node; determining multiple edges of the target vulnerability based on the node information; and constructing the heterogeneous vulnerability feature map of the target vulnerability based on the multiple nodes and the multiple edges.

[0011] In one embodiment, the plurality of nodes includes word nodes and document nodes; determining the plurality of nodes for the target vulnerability includes: taking each of the plurality of documents contained in the vulnerability feature data as a document node; performing word segmentation on the document text data of each document to obtain a plurality of words for each document; taking each of the plurality of words as a word node to obtain a plurality of word nodes.

[0012] In one embodiment, the node information of the word node includes the weight value of the node weight; determining multiple edges of the target vulnerability based on the node information includes: obtaining the weight value of the node weight of any current word node among the multiple word nodes; determining the current document node corresponding to the current word node; and determining the edge between the current word node and the current document node based on the weight value of the node weight.

[0013] In one embodiment, determining multiple edges of the target vulnerability based on the node information includes: obtaining the degree of association between any current word node among the multiple word nodes and the remaining word nodes other than the current word node; and determining the edge between the current word node and the remaining word nodes based on the degree of association.

[0014] In one embodiment, the plurality of said nodes further includes feature nodes, author nodes, and vulnerability nodes;

[0015] The process of determining the multiple edges of the target vulnerability includes: determining the feature value of the feature node, and determining the edge between the document node and the feature node based on the feature value; determining the edge weight value of the edge between the vulnerability node and the document node to be 1; and determining the edge weight value of the edge between the author node and the document node to be 1.

[0016] In one embodiment, the vulnerability exploitation prediction model includes a first convolutional layer; the step of using the pre-built vulnerability exploitation prediction model to obtain the target combination features of the target vulnerability based on the heterogeneous vulnerability feature map includes: using the first convolutional layer to extract features from the heterogeneous vulnerability feature map to obtain vulnerability feature information of the target vulnerability; and obtaining the target combination features of the target vulnerability based on the vulnerability feature information and the heterogeneous vulnerability feature map.

[0017] Secondly, this application provides a vulnerability exploitation time prediction device. The device includes:

[0018] The data acquisition module is used to acquire vulnerability feature data of the target vulnerability;

[0019] The feature map construction module is used to obtain a heterogeneous vulnerability feature map of the target vulnerability based on the vulnerability feature data.

[0020] The feature extraction module is used to obtain the target combination features of the target vulnerability based on the heterogeneous vulnerability feature map by using a pre-built vulnerability exploitation prediction model when the vulnerability exploitation rate of the target vulnerability is greater than a preset exploitation threshold.

[0021] The prediction module is used to obtain the exploit time of the target vulnerability based on the target combination characteristics by utilizing a pre-built vulnerability exploitation time prediction model.

[0022] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform the following steps:

[0023] Obtain vulnerability signature data for the target vulnerability;

[0024] Based on the vulnerability feature data, obtain a heterogeneous vulnerability feature map of the target vulnerability;

[0025] If the exploitation rate of the target vulnerability is greater than a preset exploitation threshold, the target combination features of the target vulnerability are obtained based on the heterogeneous vulnerability feature map using a pre-built vulnerability exploitation prediction model.

[0026] Using a pre-built vulnerability exploitation time prediction model, the exploitation time of the target vulnerability is obtained based on the target combination characteristics.

[0027] Fourthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, performs the following steps:

[0028] Obtain vulnerability signature data for the target vulnerability;

[0029] Based on the vulnerability feature data, obtain a heterogeneous vulnerability feature map of the target vulnerability;

[0030] If the exploitation rate of the target vulnerability is greater than a preset exploitation threshold, the target combination features of the target vulnerability are obtained based on the heterogeneous vulnerability feature map using a pre-built vulnerability exploitation prediction model.

[0031] Using a pre-built vulnerability exploitation time prediction model, the exploitation time of the target vulnerability is obtained based on the target combination characteristics.

[0032] Fifthly, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, performs the following steps:

[0033] Obtain vulnerability signature data for the target vulnerability;

[0034] Based on the vulnerability feature data, obtain a heterogeneous vulnerability feature map of the target vulnerability;

[0035] If the exploitation rate of the target vulnerability is greater than a preset exploitation threshold, the target combination features of the target vulnerability are obtained based on the heterogeneous vulnerability feature map using a pre-built vulnerability exploitation prediction model.

[0036] Using a pre-built vulnerability exploitation time prediction model, the exploitation time of the target vulnerability is obtained based on the target combination characteristics.

[0037] In the aforementioned vulnerability exploitation time prediction methods, devices, computer equipment, storage media, and computer program products, vulnerability feature data of the target vulnerability is obtained; based on the vulnerability feature data, a heterogeneous vulnerability feature map of the target vulnerability is obtained; when the vulnerability exploitation rate of the target vulnerability is greater than a preset exploitation threshold, a pre-constructed vulnerability exploitation prediction model is used to obtain the target combination features of the target vulnerability based on the heterogeneous vulnerability feature map; and a pre-constructed vulnerability exploitation time prediction model is used to obtain the vulnerability exploitation time of the target vulnerability based on the target combination features. In the method provided in this application embodiment, a heterogeneous vulnerability feature map of the target vulnerability can be constructed based on vulnerability feature data. Semantic association, feature association, and vulnerability association can be considered. Furthermore, a vulnerability exploitation prediction model that integrates intra-vulnerability feature attributes and inter-vulnerability association information is introduced, improving the accuracy of vulnerability exploitation prediction. An attention mechanism is introduced to allocate model attention to more important information sources or features, further improving the accuracy of vulnerability exploitation prediction. In addition, a vulnerability exploitation time prediction model is introduced, which, based on the target combination features obtained through the vulnerability exploitation prediction model, can improve the accuracy of vulnerability exploitation time prediction. Attached Figure Description

[0038] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0039] Figure 1 A flowchart illustrating a vulnerability exploitation time prediction method provided in an embodiment of this application;

[0040] Figure 2 A flowchart illustrating another vulnerability exploitation time prediction method provided in this application embodiment;

[0041] Figure 3 A schematic diagram of the structure of a heterogeneous vulnerability feature map provided in an embodiment of this application;

[0042] Figure 4 A flowchart illustrating a vulnerability exploitation prediction model provided in an embodiment of this application;

[0043] Figure 5 A schematic diagram illustrating a process for constructing a heterogeneous vulnerability feature map of a target vulnerability, provided in an embodiment of this application;

[0044] Figure 6 A structural block diagram of a vulnerability exploitation time prediction device provided in an embodiment of this application;

[0045] Figure 7 This is an internal structural diagram of a computer device provided in an embodiment of this application. Detailed Implementation

[0046] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0047] In one exemplary embodiment, such as Figure 1 and Figure 2 As shown, a method for predicting vulnerability exploitation time is provided. This embodiment illustrates the method by applying it to a server. It is understood that this method can also be applied to a terminal, or to a system including both a terminal and a server, and is implemented through interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0048] Step 102: Obtain vulnerability feature data of the target vulnerability.

[0049] First, initial vulnerability data for the target vulnerability can be obtained. Then, this initial vulnerability data can be preprocessed to obtain vulnerability feature data, which includes vulnerability description text data and inherent vulnerability characteristics. This preprocessing can include sample deduplication, missing value handling, feature value normalization, and vulnerability text processing. Specifically, as shown in Table 1, initial vulnerability data for the target vulnerability can be obtained through data crawling. Data source selection and determination: Experiments are conducted using the most representative and effective data sources proven in previous work, including vulnerability databases (e.g., the National Vulnerability Database (NVD)), security blogs, Twitter, exploit databases (e.g., the Exploit Database (EDB)), and vulnerability attack signature datasets. These data sources cover a wealth of vulnerability-related information, reflecting the characteristics and exploitation of vulnerabilities from different perspectives. Data crawling tools and technologies directly crawl and organize data published on the official websites of vulnerability databases, exploit databases, and vulnerability attack signature datasets. The Python third-party library `requests` is used to send HTTP requests to retrieve webpage content. Then, the `Beautiful Soup` library is used to parse the Hypertext Markup Language (HTML) or Extensible Markup Language (XML) documents to extract the required vulnerability data. For example, detailed descriptions of vulnerabilities, Common Vulnerability Scoring System (CVSS) scores, affected platforms, and products can be obtained from the NVD website. Security blog data comes from security blogs published by security experts or vendors. The `requests` library is also used to retrieve blog page content, and then, based on the blog's structure and markup language (e.g., HTML), parsing techniques are used to extract vulnerability-related article content, publication time, author, and other information. Twitter data comes from vulnerability tweets posted on Twitter. A Twitter library is used to match Common Vulnerabilities & Exposures (CVE) numbers in the tweets to filter out tweets related to the vulnerabilities. The Twitter database efficiently searches and retrieves Twitter data, organizing and storing the acquired tweet information (such as tweet content, posting time, number of likes, number of retweets, number of replies, mentioned users, hash tags, and the user who posted the tweet). Data format standardization and storage: Data crawled from various data sources is uniformly converted to CSV format for subsequent data processing and analysis.During storage, ensure the integrity and accuracy of each data field. For example, retain a unique CVE-ID for each vulnerability data record to facilitate subsequent data association and processing. Next, deduplication can be performed on the initial vulnerability data, including: Determining the deduplication criteria: Since the crawled data may contain duplicate records, deduplication is necessary to avoid disrupting the model training process. The unique identifier of the vulnerability data (e.g., CVE-ID) is used as the primary basis, combined with other key information (such as data source, publication time, etc.) to determine if the data is duplicated. Deduplication algorithms and implementation: Various algorithms can be used to implement deduplication, such as using a hash table data structure to store existing CVE-IDs and their related information. When traversing the crawled data, for each data record, calculate its CVE-ID hash value and check if the same hash value already exists in the hash table. If it exists, further compare other key information, such as source and publication time, to determine if it is duplicate data. If it is determined to be duplicate data, delete it from the dataset; if it is new data, store its related information in the hash table and continue processing the next data record. This can efficiently remove duplicate vulnerability data samples, ensuring the accuracy and effectiveness of the dataset. Furthermore, the deduplicated vulnerability data can be processed for missing values ​​and feature numerical normalization. In order to make different features comparable and eliminate the influence of units, the initial vulnerability data features are numerically normalized. For discrete features, such as Common Platform Enumeration (CPE) features of application software, operating systems, etc., vulnerability types, etc., one-hot encoding is used to convert them into numerical form. One-hot encoding converts each category feature into a vector, in which only one element is 1, representing the category to which the sample belongs, and the rest are 0. This converts categorical features into numerical features, which is convenient for model processing. For continuous numerical features, such as CVSS base score, influence score, number of likes, number of retweets, number of replies, etc. in tweets, Z-Score standardization is used. The calculation formula of Z-Score standardization is shown in formula (1), where is the original data value, is the mean of the data, and is the standard deviation of the data. Standardization transforms data into a distribution with a mean of 0 and a standard deviation of 1, making different features numerically similar in scale, which helps improve the training efficiency and accuracy of the model.

[0050]

[0051] Finally, vulnerability data can be processed into vulnerability text, including: Normalization: To prevent interference from redundant information, vulnerability text is normalized. For example, using Python's built-in libraries urllib and re, words are converted to lowercase, avoiding the misclassification of words based on case. Uniform Resource Locators (URLs) are normalized to domain names, extracting the main domain name portion of the links to reduce the impact of diverse link formats on text analysis. Simultaneously, irregular vulnerability numbers are extracted using regular expressions, standardizing the format of vulnerability numbers for easier subsequent data analysis and processing. Tokenization and stop word removal are also performed. For example, Python's nltk library is used for tokenization, splitting the text into words or phrases, converting a continuous text stream into a word sequence. During tokenization, stop words need to be removed—words that appear frequently in the text but contribute little to semantic analysis, such as "a," "the," and "and." The nltk library provides a list of common stop words that can be used directly or customized according to specific needs. By removing stop words, we can reduce data dimensionality, highlight key information in the text, and improve the model's ability to extract vulnerability-related text features. Furthermore, we can also tag the target vulnerability and comprehensively use vulnerability exploitation databases and Symantec attack signatures to determine vulnerability exploitation status.

[0052]

[0053] Table 1. Vulnerability Feature Data of the Target Vulnerability

[0054] Step 104: Obtain the heterogeneous vulnerability feature map of the target vulnerability based on the vulnerability feature data.

[0055] First, the various nodes of the target vulnerability and their information can be identified. Then, based on the node information, multiple edges of the target vulnerability can be determined. Finally, a heterogeneous vulnerability feature map of the target vulnerability can be constructed based on the various nodes and edges. For example... Figure 3 As shown, the heterogeneous vulnerability feature map to be constructed for this target vulnerability can contain various types of nodes, such as vulnerability nodes (identified by a unique vulnerability number), document nodes (corresponding to various vulnerability-related documents), feature nodes (corresponding to processed discrete and continuous features), descriptive word nodes, i.e., word nodes (words related to the vulnerability extracted from the text), and author nodes (if the data contains author information, such as Twitter authors), as... Figure 3As shown, multiple nodes can include vulnerability 1, vulnerability 2, document 1, document 2, document 3, word 1, word 2, word 3, word 4, feature 1, feature 2, feature 3, author 1, and author 2. Furthermore, based on the node information of each node, multiple edges of the heterogeneous vulnerability feature graph to be constructed can be determined. For the edge between word nodes and document nodes, it can include: First, for any current word node among the multiple word nodes of the target vulnerability, obtain the term frequency-inverse document frequency (TF-IDF) value of the current word node, as shown in formula (2):

[0056]

[0057] in, For the first One word; For the first One document; For the first The word in the first Word frequencies in a document; For the first Inverse document frequency of each word; For the first The word in the first In the document The TF-IDF value takes into account both the frequency of a word's occurrence in a document and its rarity within the entire document collection. A higher TF-IDF value indicates that the word is more important in a specific document.

[0058] No. The word in the first Word frequency in a document The calculation can be found in formula (3):

[0059]

[0060] in, For the first One word; For the first One document; For the first The word in the first The number of times it appears in a document; document The term frequency (TE) is the sum of the occurrences of all words in a document. TE reflects the relative importance of a word in a document. Generally, the more frequently a word appears in a document, the more important it is to the document's content.

[0061] No. The inverse document frequency of a word can be calculated using formula (4):

[0062]

[0063] Where N is the total number of documents in the document collection; For words containing The number of documents. To avoid a denominator of 0, 1 is usually added to the denominator. Inverse Document Frequency (IDF) is used to adjust word frequencies, reducing the weight of common words that appear frequently in most documents and increasing the weight of words that appear in a few documents.

[0064] Furthermore, in one possible implementation, N-grams can be introduced to optimize the TF-IDF model. For each document, an N-gram sequence is generated according to a selected N value. The generated N-gram sequence is treated as a new "word" in the document, and its TF-IDF value is calculated in the same way as ordinary words. That is, the term frequency (TF) of each N-gram in the document and its inverse document frequency (IDF) in the entire document set are calculated, and then its TF-IDF value is obtained. In addition, for each word, it can be decomposed at the character level to generate character-level N-grams. For example, for the word "exploit", if character-level bigrams (i.e., 2-grams) are selected, character combinations such as "ex", "xp", "pl", "lo", "oi", and "it" can be generated. By globally sharing this character-level N-gram information, fine-grained feature extraction of rare words or concatenated words can be achieved. The character-level N-gram feature vectors are then used together with other features (such as the TF-IDF features of ordinary words, discrete and continuous vulnerability features, etc.) to participate in the construction of a multi-level heterogeneous vulnerability graph.

[0065] The second step is to construct an edge between the current word node and the current document node based on the TF-IDF value of the current word node as the edge weight.

[0066] For the edges between words, the degree of association between the current word node and the other word nodes can be obtained, and the edges between the current word node and the other word nodes can be determined based on the degree of association. In one possible implementation, the pointwise mutual information (PMI) between the current word node and the other word nodes can be calculated, and the degree of association between the current word node and the other word nodes can be measured by the PMI value. The formula for calculating the PMI value is as shown in formula (5):

[0067]

[0068] in, It is a word and words The probability of them occurring simultaneously; For words The probability of it appearing alone; For words The probability of it appearing alone For words and words The PMI value.

[0069] In addition, document nodes are connected to word nodes with edge weights of TF-IDF values, to numerical feature nodes with weights of feature values, and to author nodes with a weight of 1 (author nodes are identified by a unique numerical author ID, and the weight between author nodes and document nodes is 1). The edge weight between vulnerability nodes and document nodes is 1. A vulnerability node may connect to one or more document nodes, reflecting the association between the vulnerability and related documents.

[0070] Based on the node types and connection rules defined above, all nodes are connected by edges with corresponding weights to form a heterogeneous vulnerability graph containing multiple layers (such as a vulnerability semantic layer, a vulnerability feature aggregation layer, and a vulnerability node layer). In this heterogeneous vulnerability feature graph, different types of nodes are interconnected through edges, representing and aggregating vulnerability feature information from multiple perspectives.

[0071] Step 106: When the exploit probability value of the target vulnerability is greater than the preset exploit threshold, the target combination features of the target vulnerability are obtained based on the heterogeneous vulnerability feature map using the pre-built vulnerability exploitation prediction model.

[0072] Among them, such as Figure 4As shown, the vulnerability exploitation prediction model can be a heterogeneous graph convolutional model, which may include an input layer, a graph convolutional layer, a graph attention layer, a multi-layer stacked structure, and an output layer. This vulnerability exploitation prediction model can be used to predict the exploitation rate of the target vulnerability. If the exploitation rate exceeds a preset exploitation threshold, the target combination features of the target vulnerability are obtained based on the heterogeneous vulnerability feature map; if the exploitation rate exceeds the preset exploitation threshold, the vulnerability remediation priority can be reduced. Predicting the exploitation rate of the target vulnerability using this vulnerability exploitation prediction model can include: Specifically, in the first step, the heterogeneous vulnerability feature map can be input as input data to the pre-built vulnerability exploitation prediction model. The feature vector of each node is represented according to the previously designed method (e.g., segmented by feature type, with the dimension value of vector segments unrelated to the current node type set to 0). The model transmits and aggregates information between different types of nodes based on the connection relationships (edge ​​weights) between nodes and the defined information propagation method. In the process of constructing a heterogeneous vulnerability feature map, different types of features (e.g., text features, vulnerability attribute features, etc.) can be associated with corresponding nodes, and the relationship between features can be represented by the weight of the edges, thus realizing the initial fusion of features in the graph structure. Furthermore, the input feature matrix can be limited to an identity matrix in the input layer of the vulnerability prediction model, further unifying the feature vectors of different types of nodes in structure, laying the foundation for computation and information propagation in the same feature space. The feature vector of each node represents its own key features and the features of other types of nodes in a unified framework according to the designed segmentation method. The second step is the forward propagation of the heterogeneous graph convolution model, (1) Information propagation and aggregation (convolution layer operation): In the heterogeneous graph convolution model, the convolution layer operates according to the predefined information propagation rules. For each node, its information propagation is based on the features of neighboring nodes and the weight of the edges. For example, the document node will receive information from the vulnerability node, word node, feature node and author node, and the calculation method is to multiply the features of the adjacent nodes by the corresponding edge weights and then sum them. As shown in formula (6):

[0073]

[0074] in, Let i be the feature vector of node i. For the set of neighboring nodes; For edge weights, This is a learnable parameter matrix. In this way, each node gradually aggregates information from its neighbors, achieving the fusion of local information. At the same time, nonlinear factors are introduced through linear transformation (multiplication) and activation function (ReLU) to enhance the model's ability to learn complex feature relationships.

[0075] (2) In one possible implementation, a node-level graph attention mechanism can be introduced into the vulnerability exploitation prediction model. This node-level graph attention mechanism can be used before or after the graph convolutional layer, and the attention coefficient will be calculated during the information propagation process. For each node, the attention score is calculated by linearly transforming the features of adjacent nodes, and then normalized by the softmax function to obtain the attention coefficient. Then, the information transmitted by adjacent nodes is weighted and summed according to the attention coefficient, so that the model can pay more attention to the neighboring node information that is important to the current node, and further optimize the information aggregation process. (3) Multi-layer convolution and feature extraction: By stacking multiple convolutional layers, the model can extract vulnerability features at different levels. Each convolutional layer further aggregates and transforms information on the basis of the previous layer, gradually expanding the receptive field, capturing the relationship between nodes at greater distances, and thus learning a more abstract and higher-level vulnerability feature representation. As the number of layers increases, the model's understanding of vulnerability features becomes deeper, which helps to improve the accuracy of prediction. The third step is to output the prediction result of the target vulnerability, i.e., the predicted vulnerability exploitation rate, from the last layer of the vulnerability exploitation prediction model, i.e., the output layer. The prediction result can take different forms. In one possible implementation, for a binary classification task (whether a vulnerability will be exploited), an output neuron combined with a sigmoid activation function can map the output to between 0 and 1, representing the probability of vulnerability exploitation. In another possible implementation, for a multi-class classification task (such as predicting the type or severity level of vulnerability exploitation), the number of output neurons can be set according to the number of categories, and normalized using a softmax function to obtain the probability distribution of each category. If the predicted vulnerability exploitation rate is greater than a preset exploitation threshold, the target combination features of the target vulnerability can be obtained based on the heterogeneous vulnerability feature map. Specifically, the first convolutional layer included in the vulnerability exploitation prediction model can be used to extract features from the heterogeneous vulnerability feature map to obtain the vulnerability feature information of the target vulnerability; based on the vulnerability feature information and the heterogeneous vulnerability feature map, the target combination features of the target vulnerability can be obtained.

[0076] Step 108: Using a pre-built vulnerability exploitation time prediction model, based on the target combination characteristics, obtain the vulnerability exploitation time of the target vulnerability.

[0077] The vulnerability exploitation time prediction model can be a machine learning algorithm based on LightGradient Boosting Decision Tree (GBDT). This Light GBM regression model can be trained on top of the vulnerability exploitation prediction model. The Light GBM regression model can predict the exploitation time of the target vulnerability, which can be the time when the attacker's exploitation behavior occurs. During the training process of the Light GBM regression model, for vulnerabilities that will actually be exploited by attackers, the difference between the vulnerability exploitation time and the official vulnerability disclosure time or vulnerability ID issuance time is used as the target value for model training. This is used to iteratively train the supervised regression prediction model. In this step, the target combined features can be input into the pre-built vulnerability exploitation time prediction model to determine and output the vulnerability exploitation time of the target vulnerability.

[0078] In this embodiment, the method can acquire vulnerability feature data of the target vulnerability; based on the vulnerability feature data, acquire a heterogeneous vulnerability feature map of the target vulnerability; when the vulnerability exploitation rate of the target vulnerability is greater than a preset exploitation threshold, use a pre-built vulnerability exploitation prediction model to acquire the target combination features of the target vulnerability based on the heterogeneous vulnerability feature map; and use a pre-built vulnerability exploitation time prediction model to acquire the vulnerability exploitation time of the target vulnerability based on the target combination features. The method provided in this application embodiment can construct a heterogeneous vulnerability feature map of the target vulnerability based on vulnerability feature data, which can consider semantic association, feature association, and vulnerability association. Furthermore, a vulnerability exploitation prediction model that integrates intra-vulnerability feature attributes and inter-vulnerability association information is introduced, improving the accuracy of vulnerability exploitation prediction. An attention mechanism is introduced to allocate model attention to more important information sources or features, further improving the accuracy of vulnerability exploitation prediction. In addition, a vulnerability exploitation time prediction model is introduced; based on the target combination features obtained through the vulnerability exploitation prediction model, the accuracy of vulnerability exploitation time prediction can be improved.

[0079] In one exemplary embodiment, such as Figure 5 As shown, step 104 may include steps 502 to 506. Wherein:

[0080] Step 502: Identify the various nodes of the target vulnerability, as well as the node information of each node.

[0081] Step 504: Based on the node information, determine the multiple edges of the target vulnerability.

[0082] Step 506: Construct a heterogeneous vulnerability feature map of the target vulnerability based on multiple nodes and multiple edges.

[0083] In one exemplary embodiment, the multiple nodes for determining the target vulnerability in step 502 may include:

[0084] Each document in the vulnerability feature data is treated as a document node; the document text data of each document is segmented to obtain multiple words in each document; each word in the multiple words is treated as a word node to obtain multiple word nodes.

[0085] The heterogeneous vulnerability feature map to be constructed for this target vulnerability can contain various types of nodes, such as vulnerability nodes (identified by the vulnerability's unique CVE number), document nodes (corresponding to various vulnerability-related documents), feature nodes (corresponding to processed discrete and continuous features), descriptive word nodes, i.e., word nodes (words related to the vulnerability extracted from the text), and author nodes (if the data includes author information, such as Twitter authors). Figure 3 As shown, multiple nodes can include vulnerability 1, vulnerability 2, document 1, document 2, document 3, word 1, word 2, word 3, word 4, feature 1, feature 2, feature 3, author 1, and author 2.

[0086] In one exemplary embodiment, step 504 may include:

[0087] Get the weight value of any current word node among multiple word nodes; determine the current document node corresponding to the current word node; determine the edge between the current word node and the current document node based on the weight value of the node weight.

[0088] Specifically, the edge between a word node and a document node can include: First, for any current word node among the multiple word nodes of the target vulnerability, obtain the Term Frequency-Inverse Document Frequency (TF-IDF) value of the current word node; Second, construct the edge between the current word node and the current document node based on the TF-IDF value of the current word node as the edge weight.

[0089] In another exemplary embodiment, step 504 may include:

[0090] Obtain the degree of association between any current word node and all other word nodes except the current word node; determine the edges between the current word node and the other word nodes based on the degree of association.

[0091] Specifically, for the edges between words, the degree of association between the current word node and the other word nodes can be obtained, and the edges between the current word node and the other word nodes can be determined based on the degree of association. In one possible implementation, the pointwise mutual information (PMI) between the current word node and the other word nodes can be calculated, and the degree of association between the current word node and the other word nodes can be measured by the PMI value. The formula for calculating the PMI value is shown in formula (5).

[0092] Furthermore, document nodes are connected to word nodes with edge weights based on TF-IDF values, to numerical feature nodes with weights based on feature values, and to author nodes with a weight of 1 (author nodes are identified by a unique numerical author ID, and the weight between author nodes and document nodes is 1). Vulnerability nodes have an edge weight of 1 with document nodes. A vulnerability node may connect to one or more document nodes, reflecting the association between the vulnerability and related documents. Following the defined node types and connection rules, all nodes are connected by edges with corresponding weights, forming a heterogeneous vulnerability graph containing multiple layers (such as a vulnerability semantic layer, a vulnerability feature aggregation layer, and a vulnerability node layer). In this heterogeneous vulnerability feature graph, different types of nodes are interconnected through edges, representing and aggregating vulnerability feature information from multiple perspectives.

[0093] In the method of this embodiment, a heterogeneous vulnerability feature map of the target vulnerability can be constructed based on vulnerability feature data. Semantic association, feature association and vulnerability association can be considered, and multi-dimensional features are incorporated, which can improve the accuracy of vulnerability exploitation prediction and the accuracy of vulnerability exploitation time prediction.

[0094] In one exemplary embodiment, the multiple edges for determining the target vulnerability in step 504 may include:

[0095] Determine the feature value of the feature node, and determine the edge between the document node and the feature node based on the feature value; determine the edge weight value of the edge between the vulnerability node and the document node to be 1; determine the edge weight value of the edge between the author node and the document node to be 1.

[0096] In this system, document nodes are connected to word nodes with edge weights based on their TF-IDF values, to numerically quantified feature nodes with weights based on their feature values, and to author nodes with a weight of 1 (author nodes are identified by a unique numerical author ID, and the weight between author nodes and document nodes is 1). Vulnerability nodes have an edge weight of 1 with document nodes. A vulnerability node may connect to one or more document nodes, reflecting the association between the vulnerability and related documents. Following the defined node types and connection rules, all nodes are connected by edges with corresponding weights, forming a heterogeneous vulnerability graph containing multiple layers (such as a vulnerability semantic layer, a vulnerability feature aggregation layer, and a vulnerability node layer). In this heterogeneous vulnerability feature graph, different types of nodes are interconnected through edges, representing and aggregating vulnerability feature information from multiple perspectives.

[0097] In an exemplary embodiment, step 106, which utilizes a pre-built vulnerability exploitation prediction model to obtain the target combination features of the target vulnerability based on a heterogeneous vulnerability feature map, may include:

[0098] The first convolutional layer is used to extract features from the heterogeneous vulnerability feature map to obtain the vulnerability feature information of the target vulnerability; based on the vulnerability feature information and the heterogeneous vulnerability feature map, the target combination feature of the target vulnerability is obtained.

[0099] The vulnerability exploitation prediction model can extract features from the heterogeneous vulnerability feature map using its first convolutional layer to obtain the vulnerability feature information of the target vulnerability. Based on the vulnerability feature information and the heterogeneous vulnerability feature map, the target combined feature of the target vulnerability is obtained. The output of its first layer is extracted as the embedding representation of the vulnerability document or vulnerability node. The output of this layer contains the vulnerability feature information after preliminary convolution and information fusion, which can reflect the relevant attributes and contextual information of the vulnerability to a certain extent, and serves as one of the input features of the subsequent LightGBM model. The heterogeneous vulnerability feature map includes basic vulnerability features, which can include discrete or continuous features related to the vulnerability obtained from the dataset, such as CVE-ID related information, some inherent attributes of the vulnerability (e.g., access vector AV, attack complexity AC, etc. in CVSS), and relevant statistical features of the vulnerability text (e.g., the number of likes, retweets, and replies in Twitter). Furthermore, the embedding representation obtained from the first layer of the graph convolutional network can be combined with these basic features to form a complete feature vector, i.e., the target combined feature. For example, the embedding representation can be added as a new feature dimension to the basic feature vector, or the two can be concatenated or fused in some way to ensure that the feature representation of each sample contains information from both the graph convolutional network and the original basic features, providing a more comprehensive input to the LightGBM regression model.

[0100] In this embodiment, a vulnerability exploitation prediction model that integrates the characteristic attributes within a vulnerability and the correlation information between vulnerabilities is introduced, which improves the accuracy of vulnerability exploitation prediction. The introduction of an attention mechanism allocates the model's attention to more important information sources or features, further improving the accuracy of vulnerability exploitation prediction.

[0101] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0102] Based on the same inventive concept, this application also provides a vulnerability exploitation time prediction device for implementing the vulnerability exploitation time prediction method described above. The solution provided by this device is similar to the solution described in the above method; therefore, the specific limitations in one or more vulnerability exploitation time prediction device embodiments provided below can be found in the limitations of the vulnerability exploitation time prediction method described above, and will not be repeated here.

[0103] In one embodiment, such as Figure 6 As shown, a vulnerability exploitation time prediction device is provided, including: a data acquisition module 602, a feature map construction module 604, a feature extraction module 606, and a prediction module 608, wherein:

[0104] The data acquisition module 602 is used to acquire vulnerability feature data of the target vulnerability;

[0105] The feature map construction module 604 is used to obtain a heterogeneous vulnerability feature map of the target vulnerability based on the vulnerability feature data.

[0106] The feature extraction module 606 is used to obtain the target combination features of the target vulnerability based on the heterogeneous vulnerability feature map by using a pre-built vulnerability exploitation prediction model when the vulnerability exploitation rate of the target vulnerability is greater than a preset exploitation threshold.

[0107] The prediction module 608 is used to obtain the exploit time of the target vulnerability based on the target combination characteristics by utilizing a pre-built vulnerability exploitation time prediction model.

[0108] In one embodiment, the feature graph construction module 604 is further configured to: determine multiple nodes of the target vulnerability and node information of each node; determine multiple edges of the target vulnerability based on the node information; and construct the heterogeneous vulnerability feature graph of the target vulnerability based on the multiple nodes and the multiple edges.

[0109] In one embodiment, the plurality of nodes includes word nodes and document nodes; the feature graph construction module 604 is further configured to: treat each of the plurality of documents contained in the vulnerability feature data as a document node; perform word segmentation on the document text data of each document to obtain a plurality of words of each document; and treat each of the plurality of words as a word node to obtain a plurality of word nodes.

[0110] In one embodiment, the node information of the word node includes the weight value of the node weight; the feature graph construction module 604 is further configured to: obtain the weight value of the node weight of any current word node among the plurality of word nodes; determine the current document node corresponding to the current word node; and determine the edge between the current word node and the current document node according to the weight value of the node weight.

[0111] In one embodiment, the feature map construction module 604 is further configured to: obtain the degree of association between any current word node among the plurality of word nodes and the remaining word nodes other than the current word node; and determine the edge between the current word node and the remaining word nodes based on the degree of association.

[0112] In one embodiment, the vulnerability exploitation prediction model includes a first convolutional layer; the feature extraction module 606 is further configured to: extract features from the heterogeneous vulnerability feature map using the first convolutional layer to obtain vulnerability feature information of the target vulnerability; and obtain the target combined feature of the target vulnerability based on the vulnerability feature information and the heterogeneous vulnerability feature map.

[0113] The modules in the aforementioned vulnerability exploitation time prediction device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0114] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 7As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The database stores data related to vulnerability exploitation timing prediction. The network interface communicates with external terminals via a network connection. When executed by the processor, the computer program implements a vulnerability exploitation timing prediction method.

[0115] Those skilled in the art will understand that Figure 7 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0116] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0117] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0118] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0119] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0120] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0121] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0122] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for predicting vulnerability exploitation time, characterized in that, The method includes: Obtain vulnerability feature data of the target vulnerability; the vulnerability feature data includes vulnerability description text data and inherent vulnerability feature data; Identify multiple nodes of the target vulnerability, as well as node information for each node; the multiple nodes include word nodes, document nodes, feature nodes, author nodes, and vulnerability nodes; Based on the node information, determine multiple edges of the target vulnerability; The determination of multiple edges of the target vulnerability includes: for any one of the multiple word nodes of the target vulnerability, constructing an edge between the current word node and the current document node based on the word frequency-inverse document frequency value of the current word node as the edge weight; and determining the edge between the current word node and the remaining word nodes based on the degree of association between any one of the multiple word nodes and the remaining word nodes other than the current word node. Based on the various nodes and edges, a heterogeneous vulnerability feature map of the target vulnerability is constructed; When the exploit probability value of the target vulnerability is greater than the preset exploit threshold, the first convolutional layer contained in the pre-built vulnerability exploitation prediction model is used to extract features from the heterogeneous vulnerability feature map to obtain the vulnerability feature information of the target vulnerability. Based on the vulnerability feature information and the heterogeneous vulnerability feature map, the target combination feature of the target vulnerability is obtained. Using a pre-built regression model based on gradient boosting decision trees, the exploit time of the target vulnerability is obtained based on the target combination features.

2. The method according to claim 1, characterized in that, The various types of nodes include word nodes and document nodes; The multiple nodes used to determine the target vulnerability include: Each of the multiple documents contained in the vulnerability feature data is treated as a document node; The document text data of each document is segmented into words to obtain multiple words for each document; Each of the given words is treated as a word node, resulting in multiple word nodes.

3. The method according to claim 2, characterized in that, The node information of the word node includes the weight value of the node weight; The step of determining multiple edges of the target vulnerability based on the node information includes: Obtain the weight value of the node weight of any current word node among the plurality of word nodes; Determine the current document node corresponding to the current word node; The edge between the current word node and the current document node is determined based on the weight value of the node weight.

4. The method according to claim 2, characterized in that, The various types of nodes also include feature nodes, author nodes, and vulnerability nodes; The multiple edges used to determine the target vulnerability include: Determine the feature value of the feature node, and determine the edge between the document node and the feature node based on the feature value; The edge weight of the edge between the vulnerability node and the document node is determined to be 1; The edge weight of the edge between the author node and the document node is determined to be 1.

5. A vulnerability exploitation time prediction device, characterized in that, The device includes: The data acquisition module is used to acquire vulnerability feature data of the target vulnerability; A feature graph construction module is used to determine multiple nodes of the target vulnerability and node information of each node; the multiple nodes include word nodes, document nodes, feature nodes, author nodes, and vulnerability nodes; based on the node information, multiple edges of the target vulnerability are determined; wherein, determining the multiple edges of the target vulnerability includes: for any one of the multiple word nodes of the target vulnerability, constructing an edge between the current word node and the current document node based on the word frequency-inverse document frequency value of the current word node as the edge weight; and determining the edge between the current word node and the remaining word nodes based on the degree of association between any one of the multiple word nodes and the remaining word nodes excluding the current word node; constructing a heterogeneous vulnerability feature graph of the target vulnerability based on the multiple nodes and the multiple edges; The feature extraction module is used to extract features from the heterogeneous vulnerability feature map using the first convolutional layer of a pre-built vulnerability exploitation prediction model when the exploitation probability value of the target vulnerability is greater than a preset exploitation threshold, so as to obtain the vulnerability feature information of the target vulnerability, and obtain the target combination feature of the target vulnerability based on the vulnerability feature information and the heterogeneous vulnerability feature map. The prediction module is used to obtain the exploit time of the target vulnerability based on the target combination features by utilizing a pre-built regression model based on gradient boosting decision trees.

6. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1-4.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method described in any one of claims 1-4.

Images