Vulnerability scanning method, electronic device, storage medium and computer program product

Abstract

The invention provides a vulnerability scanning method, electronic equipment, a readable storage medium and a computer program product. The method comprises the following steps: receiving a natural language instruction input by a user; recognizing the natural language instruction through an intention recognition model to obtain an instance statement recognition result; determining a system call statement corresponding to the instance statement recognition result according to a vector database; triggering a vulnerability scanning management system to execute a corresponding scanning task according to the system call statement to obtain a scanning result; performing vulnerability risk analysis according to the scanning result to obtain a vulnerability analysis result; generating a scanning report according to the scanning result and the vulnerability analysis result; and outputting the scanning report on the interactive interface. Therefore, according to the method, efficient and flexible operation of vulnerability scanning management can be achieved according to the natural language instruction input by the user, a tedious customized development process does not need to be carried out, the universality and usability of the system are improved, and the operation and maintenance cost of the system is reduced.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a vulnerability scanning method, an electronic device, a readable storage medium, and a computer program product. Background Art

[0002] In the field of network security, vulnerability scanning management systems are core tools for ensuring the security of various devices and applications, and their functional complexity is increasing. The system not only covers basic functions such as vulnerability detection and configuration compliance checks, but also involves advanced functions such as multi-dimensional data query and report generation. However, the system operation is complex, especially in the configuration of rule templates, which requires users to have high professional knowledge. At the same time, the management requirements of asset risk data are changeable, and traditional development methods are difficult to quickly meet these changes. Customized development is required, resulting in a long delivery cycle, which seriously affects user experience and system efficiency. Summary of the invention

[0003] The purpose of this application is to provide a vulnerability scanning method, an electronic device, a readable storage medium, and a computer program product, which can realize efficient and flexible operation of vulnerability scanning management based on natural language instructions input by the user, without the need for cumbersome customized development processes, thereby improving the popularity and ease of use of the system and reducing the system operation and maintenance costs.

[0004] The first aspect of the present application provides a vulnerability scanning method, comprising:

[0005] Receiving natural language instructions input by a user;

[0006] Recognize the natural language instruction through the intention recognition model to obtain an example sentence recognition result;

[0007] Determine the system call statement corresponding to the instance statement recognition result according to the vector database;

[0008] Trigger the vulnerability scanning management system to execute corresponding scanning tasks according to the system call statement to obtain scanning results;

[0009] Perform vulnerability risk analysis according to the scanning results to obtain vulnerability analysis results;

[0010] Generate a scan report based on the scan results and the vulnerability analysis results;

[0011] The scanning report is output on the interactive interface.

[0012] In the above implementation process, this method enables non-professional users to interact with the system through natural language, thereby lowering the threshold for use and improving the convenience of user operation. At the same time, the intention recognition model can also realize accurate understanding of user intentions, effectively improve the intelligence level of the system, and ensure that subsequent operations can be based on the real needs of users. Secondly, it is also possible to quickly find system operation statements corresponding to user instructions through efficient matching of the vector database, thereby improving the response speed and accuracy of the system. Then, the system call statement triggering method can realize the automation of scanning tasks, thereby reducing manual intervention and improving scanning efficiency. After that, it is also possible to accurately identify the vulnerability risks in the system through in-depth analysis of the scanning results, providing strong support for subsequent repair work. Finally, the scanning results and vulnerability analysis results are integrated into an intuitive scanning report and the scanning report is displayed through an interactive interface, which is convenient for users to understand and consult, and improves the readability and practicality of the report.

[0013] Furthermore, the method further comprises:

[0014] Acquire an intent recognition training data set and a pre-built original recognition model; wherein the intent recognition training data set includes an intent recognition general term data set and an intent recognition scene classification data set;

[0015] The original recognition model is trained by using the training data set to obtain a trained intent recognition model and a mapping relationship between the user input natural language and the standardized instance sentence;

[0016] Performing vectorization processing on the mapping relationship to obtain a vector database;

[0017] Integrate the intent recognition model and the vector database into a vulnerability scanning management system.

[0018] In the above implementation process, this method can effectively ensure the intelligence level of the system, so that the system can more efficiently understand and respond to the user's natural language instructions, thereby optimizing the user experience and improving the efficiency and accuracy of vulnerability scanning management.

[0019] Furthermore, the acquisition of the intent recognition training data set and the pre-built original recognition model includes:

[0020] Get the intent recognition common terminology dataset;

[0021] Obtain the intent recognition scene classification dataset;

[0022] Constructing an intent recognition training dataset according to the intent recognition general term dataset and the intent recognition scene classification dataset; wherein the intent recognition training dataset includes a training set, a test set and a validation set;

[0023] Build the original recognition model based on the Transformer architecture.

[0024] In the above implementation process, this method can improve the accuracy and generalization ability of intent recognition, and ensure that the model can work effectively in different scenarios, thereby enhancing the intelligence and user experience of the vulnerability scanning management system.

[0025] Furthermore, the intention recognition general terminology data set includes system instruction type data and system parameter type data;

[0026] The system instruction data includes vulnerability detection template management instructions, scanning task instructions, asset query instructions and report generation instructions;

[0027] The system parameter data at least includes vulnerability description parameters and asset description parameters.

[0028] In the above implementation process, this method can help the model understand user intentions more accurately, improve the application effect of the vulnerability scanning management system, and enhance the system's intelligent response capabilities and user operation convenience.

[0029] Furthermore, the step of obtaining the intention recognition scene classification dataset includes:

[0030] Determine multiple classification scenarios for system function division; wherein the classification scenario is one of a vulnerability detection template configuration scenario, a scanning task scenario, a scanning result report generation scenario, an asset risk data query statistics scenario, and other supplementary scenarios;

[0031] Obtaining a scene instance corresponding to the classification scene;

[0032] Performing scene classification and parameter labeling on the scene instance to obtain scene instance labeling data;

[0033] Performing data derivation processing based on the scene instance annotated data to obtain scene derived data;

[0034] An intent recognition scene classification dataset is constructed based on the scene instance annotation data and the scene derived data.

[0035] In the above implementation process, this method can help the intent recognition model to more deeply understand the user intentions in different scenarios, thereby improving the applicability and accuracy of the model in the vulnerability scanning management system, optimizing the user experience, and thus improving the intelligence level of the system.

[0036] Furthermore, the original recognition model is trained by the training data set to obtain a trained intent recognition model and a mapping relationship between the user input natural language and the standardized instance sentence, including:

[0037] Obtaining preset training parameters; wherein the training parameters include at least a learning rate, a number of training rounds, and a batch size;

[0038] The original recognition model is trained using the intention recognition training data set and the training parameters to obtain a trained intention recognition model;

[0039] In the process of training the original recognition model, obtaining an intent recognition result;

[0040] A mapping relationship between the user input natural language and the standardized instance sentence is established according to the intention recognition result.

[0041] In the above implementation process, this method can ensure that the model can accurately understand the user's intention, thereby improving the practicality and performance of the model in the vulnerability scanning management system, and providing strong support for the intelligent operation of the system.

[0042] Furthermore, triggering the vulnerability scanning management system to execute a corresponding scanning task according to the system call statement to obtain a scanning result includes:

[0043] Trigger the vulnerability scanning management system to configure corresponding scanning targets and scanning tasks according to the system call statement;

[0044] The vulnerability scanning management system executes the scanning task for the scanning target to obtain a scanning result.

[0045] In the above implementation process, this method can improve the pertinence and efficiency of vulnerability scanning, and provide reliable data support for subsequent vulnerability risk analysis and report generation.

[0046] Furthermore, the method further comprises:

[0047] Obtaining user feedback data for the intent recognition model and / or the vector database;

[0048] Using natural language processing technology to analyze the user feedback data to obtain key feedback data;

[0049] Generate a targeted model training plan based on the feedback key data;

[0050] Acquire targeted training samples based on the targeted model training scheme;

[0051] Performing optimization training on the intention recognition model and / or the vector database according to the targeted training samples to obtain an optimized training result;

[0052] The optimization training results are pushed to the user's vulnerability scanning management system in the form of a patch.

[0053] In the above implementation process, the method can collect user feedback data, analyze and extract key information, and then generate targeted model training programs, and obtain training samples to optimize large language recognition models. Finally, the updated model is pushed to the user's vulnerability scanning management system in the form of a patch, thereby improving the accuracy of the model and user satisfaction, and enhancing the intelligence level and user experience of the vulnerability scanning management system.

[0054] A second aspect of the present application provides a vulnerability scanning device, the vulnerability scanning device comprising:

[0055] A receiving unit, used to receive a natural language instruction input by a user;

[0056] A recognition unit, used to recognize the natural language instruction through an intention recognition model to obtain an example sentence recognition result;

[0057] A determination unit, configured to determine a system call statement corresponding to the instance statement recognition result according to a vector database;

[0058] A scanning unit, used to trigger the vulnerability scanning management system to execute a corresponding scanning task according to the system call statement to obtain a scanning result;

[0059] A first analysis unit, configured to perform vulnerability risk analysis according to the scanning result to obtain a vulnerability analysis result;

[0060] A first generating unit, configured to generate a scanning report according to the scanning result and the vulnerability analysis result;

[0061] The output unit is used to output the scanning report on the interactive interface.

[0062] Furthermore, the vulnerability scanning device also includes:

[0063] A first acquisition unit is used to acquire an intent recognition training data set and a pre-built original recognition model; wherein the intent recognition training data set includes an intent recognition general term data set and an intent recognition scene classification data set;

[0064] A training unit, used to train the original recognition model through the training data set to obtain a trained intent recognition model and a mapping relationship between the user input natural language and the standardized instance sentence;

[0065] A processing unit, used for performing vectorization processing on the mapping relationship to obtain a vector database;

[0066] An integration unit is used to integrate the intent recognition model and the vector database into a vulnerability scanning management system.

[0067] Furthermore, the first acquiring unit includes:

[0068] A first acquisition subunit is used to acquire a general terminology dataset for intent recognition;

[0069] The first acquisition subunit is further used to acquire an intent recognition scene classification data set;

[0070] An identification subunit, configured to construct an intent recognition training dataset based on the intent recognition general term dataset and the intent recognition scene classification dataset; wherein the intent recognition training dataset includes a training set, a test set, and a validation set;

[0071] Build subunits for building original recognition models based on the Transformer architecture.

[0072] Furthermore, the intention recognition general terminology data set includes system instruction type data and system parameter type data;

[0073] The system instruction data includes vulnerability detection template management instructions, scanning task instructions, asset query instructions and report generation instructions;

[0074] The system parameter data at least includes vulnerability description parameters and asset description parameters.

[0075] Furthermore, the first acquisition subunit includes:

[0076] A determination module, used to determine multiple classification scenarios for system function division; wherein the classification scenario is one of a vulnerability detection template configuration scenario, a scanning task scenario, a scanning result report generation scenario, an asset risk data query statistics scenario, and other supplementary scenarios;

[0077] An acquisition module, used to acquire a scene instance corresponding to the classification scene;

[0078] A labeling module, used to classify the scene instance and label parameters of the scene instance to obtain the scene instance labeling data;

[0079] A processing module, used for performing data derivation processing based on the scene instance annotated data to obtain scene derived data;

[0080] A construction module is used to construct an intent recognition scene classification dataset based on the scene instance annotation data and the scene derived data.

[0081] Furthermore, the training unit comprises:

[0082] A second acquisition subunit is used to acquire preset training parameters; wherein the training parameters at least include a learning rate, a number of training rounds, and a batch size;

[0083] A training subunit, used to train the original recognition model using the intent recognition training data set and the training parameters to obtain a trained intent recognition model;

[0084] The second acquisition subunit is further used to obtain the intention recognition result during the training of the original recognition model;

[0085] A subunit is established, which is used to establish a mapping relationship between the user input natural language and the standardized instance sentence according to the intention recognition result.

[0086] Furthermore, the scanning unit comprises:

[0087] A configuration subunit, used to trigger the vulnerability scanning management system to configure corresponding scanning targets and scanning tasks according to the system call statement;

[0088] The scanning subunit is used to execute the scanning task for the scanning target through the vulnerability scanning management system to obtain the scanning result.

[0089] Furthermore, the vulnerability scanning device also includes:

[0090] A second acquisition unit, used to acquire user feedback data for the intention recognition model and / or the vector database;

[0091] A second analysis unit is used to analyze the user feedback data using natural language processing technology to obtain key feedback data;

[0092] A second generating unit, configured to generate a targeted model training solution based on the feedback key data;

[0093] A third acquisition unit, configured to acquire targeted training samples based on the targeted model training scheme;

[0094] An optimization unit, configured to perform optimization training on the intention recognition model and / or the vector database according to the targeted training samples to obtain an optimization training result;

[0095] The push unit is used to push the optimization training result to the user's vulnerability scanning management system in the form of a patch.

[0096] A third aspect of the present application provides an electronic device, which includes a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to perform the vulnerability scanning method described in any one of the first aspects of the present application.

[0097] A fourth aspect of the present application provides a readable storage medium, wherein the readable storage medium stores computer program instructions. When the computer program instructions are read and executed by a processor, the vulnerability scanning method described in any one of the first aspect of the present application is executed.

[0098] A fifth aspect of the present application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it executes the vulnerability scanning method described in any one of the first aspects of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0099] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0100] Figure 1 A flowchart of a vulnerability scanning method provided in an embodiment of the present application;

[0101] Figure 2 A schematic diagram of an example framework of a vulnerability scanning method provided in an embodiment of the present application;

[0102] Figure 3 A flowchart of a training integration method for an intent recognition model and a vector database provided in an embodiment of the present application;

[0103] Figure 4 An exemplary schematic diagram of a method for preparing training data provided in an embodiment of the present application;

[0104] Figure 5 A schematic diagram showing an example of establishing a mapping relationship provided in an embodiment of the present application;

[0105] Figure 6 A mapping example diagram of a vector database provided in an embodiment of the present application;

[0106] Figure 7 A schematic diagram of an application example of an intent recognition model and a vector database provided in an embodiment of the present application when integrated into a large language AI model;

[0107] Figure 8 A schematic diagram of an example flow of a vulnerability scanning method provided in an embodiment of the present application;

[0108] Fig. 9 A schematic diagram of the structure of a vulnerability scanning device provided in an embodiment of the present application;

[0109] Fig.10 A schematic diagram of the structure of another vulnerability scanning device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0110] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0111] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0112] Example 1

[0113] Please see Figure 1 , Figure 1 A schematic diagram of a vulnerability scanning method provided in this embodiment. The vulnerability scanning method includes:

[0114] S101: Receive a natural language instruction input by a user.

[0115] In this embodiment, the method may pre-design a friendly user interface to provide a natural language input box to facilitate the user to input instructions.

[0116] In this embodiment, the user interface may display some examples and prompts of common commands to help users better use the system. For example, a prompt message such as "For example: query new high-risk vulnerabilities added this week" is displayed next to the input box.

[0117] S102. Recognize the natural language instruction through the intention recognition model to obtain the instance sentence recognition result.

[0118] S103: Determine the system call statement corresponding to the instance statement recognition result according to the vector database.

[0119] S104: Trigger the vulnerability scanning management system to configure corresponding scanning targets and scanning tasks according to the system call statement.

[0120] S105: Execute a scan task for the scan target through the vulnerability scan management system to obtain a scan result.

[0121] S106: Perform vulnerability risk analysis based on the scan results to obtain vulnerability analysis results.

[0122] S107. Generate a scan report based on the scan results and vulnerability analysis results.

[0123] S108: Output the scanning report on the interactive interface.

[0124] In this embodiment, the method can obtain a corresponding response after executing the system call statement, and then dynamically display the response result in the form of a suitable chart (such as a bar chart, line chart, pie chart, etc.), table or text through WebUI interface rendering, so as to achieve a visual interface display.

[0125] S109: Obtain user feedback data for the intent recognition model and / or vector database.

[0126] In this embodiment, the method can collect user feedback data, and organize and analyze it.

[0127] S110. Analyze user feedback data using natural language processing technology to obtain key feedback data.

[0128] In this embodiment, the method can use natural language processing technology to classify and analyze the user feedback text to extract valuable information. For example, the feedback can be classified into categories such as incorrect instruction understanding, inaccurate results, unreasonable display methods, etc., so as to be processed in a targeted manner.

[0129] S111. Generate targeted model training plans based on feedback key data.

[0130] S112. Obtain targeted training samples based on the targeted model training plan.

[0131] S113. Optimize the intention recognition model and / or vector database according to the targeted training samples to obtain optimized training results.

[0132] In this embodiment, the method can regularly and continuously train large-scale language AI models based on user feedback data.

[0133] In this embodiment, the method can specifically use the feedback data as a new training sample, add it to the training set, retrain the model, and adjust the parameters and weights of the model to improve the model's ability to understand and meet user needs.

[0134] For example: If users report multiple misunderstandings of a certain type of vulnerability detection instruction or asset risk data query instruction, increase the number of training samples for the relevant instructions in subsequent training, and adjust the model's processing logic for such instructions.

[0135] S114. Push the optimization training results to the user's vulnerability scanning management system in the form of a patch.

[0136] In this embodiment, the method can push the updated model to the user's on-site system in the form of a patch.

[0137] In this embodiment, in order to ensure the security and reliability of the patch during the push process, the method can perform strict testing and verification to avoid affecting the normal operation of the user system. At the same time, the method can also provide users with update instructions and related operation guides to let users understand the improvements and new functions of the model.

[0138] Please see Figure 2 , Figure 2 A schematic diagram of an example framework of a vulnerability scanning method is shown. Figure 2 It can be seen that this method can identify natural language through an AI model (i.e., intent recognition model) to form standardized instance sentences, and then vectorize them through a vector library (i.e., vector database), and finally obtain an API or SQL that the system can directly call. Among them, the training and optimization of the AI ​​model can be carried out locally, and after the training is completed, the static model is integrated into the vulnerability scanning management system for operation and use, thereby avoiding the vulnerability scanning management system's dependence on GPU hardware resources. Based on this, it can be seen that this method can split the training of the AI ​​model and the call of the model, and combine the AI ​​model with the system vector library, so that the vulnerability scanning management system based on CPU hardware can realize natural language recognition and function scheduling capabilities. At the same time, this method also has the ability to continuously optimize.

[0139] In this embodiment, the execution subject of the method may be a computing device such as a computer or a server, and no limitation is made in this embodiment.

[0140] In this embodiment, the execution subject of the method may also be a smart device such as a smart phone, a tablet computer, etc., which is not limited in this embodiment.

[0141] It can be seen that the implementation of the vulnerability scanning method described in this embodiment can integrate the intent recognition model and the vector database in the vulnerability scanning management system on the traditional CPU hardware, thereby solving the difficulty of realizing the intelligent operation and maintenance of the vulnerability scanning management system with the traditional large-scale language AI model, and at the same time solving the difficulty of the accuracy of natural language recognition related to vulnerability scanning.

[0142] Example 2

[0143] Please see Figure 3 , Figure 3 A flowchart of a training integration method for an intent recognition model and a vector database provided in this embodiment. The training integration method for the intent recognition model and the vector database includes:

[0144] S201. Obtain a common terminology dataset for intent recognition.

[0145] In this embodiment, the method can pre-construct a general terminology dataset for intent recognition, wherein the general terminology dataset for intent recognition includes a system instruction class (used to train the intent recognition model to recognize the function type corresponding to the natural language); and a system parameter class (used to train the intent recognition model to recognize the parameters in the natural language).

[0146] In this embodiment, the preparation content of the general term training data can be shown in the following table.

[0147]

[0148] S202: Determine multiple classification scenarios for system function division.

[0149] In this embodiment, the classification scenario is one of a vulnerability detection template configuration scenario, a scanning task scenario, a scanning result report generation scenario, an asset risk data query statistics scenario, and other supplementary scenarios.

[0150] S203: Obtain a scene instance corresponding to the classification scene.

[0151] S204: Classify the scene instance and label its parameters to obtain scene instance labeling data.

[0152] S205: Perform data derivation processing based on the scene instance annotated data to obtain scene derived data.

[0153] S206. Construct an intent recognition scene classification dataset based on scene instance annotation data and scene derived data.

[0154] In this embodiment, the method can construct an intent recognition scenario classification data set, including vulnerability detection template configuration scenarios, scanning task scenarios, scanning result report generation scenarios, asset risk data query statistics scenarios and other supplementary scenarios.

[0155] In this embodiment, the method can enhance the accuracy of scene classification and parameter recognition of the intention recognition model for natural language recognition through scene analysis training. Figure 4 shown.

[0156] In this embodiment, the data set is divided into a training set, a validation set, and a test set. Among them, the training set is used for training and learning the model, the validation set is used to adjust the model parameters and evaluate the model performance during the training process, and the test set is used to finally evaluate the generalization ability and accuracy of the model. In addition, this application does not make any restrictions on the method of data derivation.

[0157] S207. Construct an intent recognition training dataset based on the intent recognition general term dataset and the intent recognition scene classification dataset.

[0158] In this embodiment, the intent recognition training data set includes a training set, a test set, and a validation set.

[0159] S208. Build an original recognition model based on the Transformer architecture.

[0160] In this embodiment, the intent recognition training data set includes an intent recognition general terminology data set and an intent recognition scene classification data set.

[0161] In this embodiment, the intent recognition general term data set includes system instruction type data and system parameter type data;

[0162] System instruction data includes vulnerability detection template management instructions, scanning task instructions, asset query instructions, and report generation instructions;

[0163] System parameter data at least includes vulnerability description parameters and asset description parameters.

[0164] In this embodiment, the method can build an intent recognition model based on the Transformer architecture. Among them, the architecture has good parallel computing capabilities and the ability to process long sequence data, and is more suitable for natural language processing tasks.

[0165] S209: Obtain pre-set training parameters.

[0166] In this embodiment, the training parameters include at least a learning rate, a number of training rounds, and a batch size.

[0167] In this embodiment, the learning rate can be initially set to a relatively large value, such as 0.001, and then gradually adjusted as training progresses. The number of training rounds is determined based on the amount of data and model complexity, and is generally between tens and hundreds of rounds. The batch size is adjusted based on hardware resources (such as GPU memory) and data characteristics, and is generally between 32 and 128.

[0168] S210. Train the original recognition model using the intent recognition training data set and training parameters to obtain a trained intent recognition model.

[0169] In this embodiment, the method can train the original recognition model using the training set in a GPU hardware environment. During the training process, the method can regularly evaluate the model using the validation set, and adjust the parameters and structure of the model according to the evaluation indicators (such as accuracy, recall rate, F1 value, etc.).

[0170] For example, if you find that the model has low accuracy for certain types of vulnerability detection instructions or specific asset risk data queries, you can increase the number of training samples of the relevant data or adjust the network structure of the model, such as increasing the number of layers or adjusting the number of neurons.

[0171] S211. In the process of training the original recognition model, the intent recognition result is obtained.

[0172] S212: Establish a mapping relationship between the user input natural language and the standardized instance sentence according to the intention recognition result.

[0173] In this embodiment, the method can establish a mapping relationship between various language semantics input by the user and standardized instance sentences by learning the intent recognition general term dataset and the intent recognition scene classification dataset during the model training process, such as Figure 5 As shown, Figure 5 A schematic diagram showing an example of establishing a mapping relationship is shown.

[0174] S213, vectorizing the mapping relationship to obtain a vector database.

[0175] In this embodiment, the method can convert the natural language input by the user into a standard example sentence through the intention recognition model.

[0176] For example, the user inputs "Please help me scan whether the 1.1.1.1 device has the CVE-2023-38408 vulnerability", and the model outputs "Create CVE-2023-38408 vulnerability detection template A; use vulnerability detection template A to scan 1.1.1.1".

[0177] However, the standardized instance statements cannot be recognized and run by the system, but the system can support the recognition and operation of API interfaces and database requests. Therefore, this method proposes a method for vectorizing the intent recognition results. The core of this vectorization method is to map the instance statements to specific API interfaces or database requests and identify and extract parameters.

[0178] Please see Figure 6 , Figure 6 A mapping example diagram of a vector database is shown. In this method, the example sentences in the intention recognition training phase can be vectorized according to the corresponding system functions to form a vector database.

[0179] S214. Integrate the intent recognition model and vector database into the vulnerability scanning management system.

[0180] In this embodiment, the method can integrate the intent recognition model and the vector database into the vulnerability scanning management system (the two can be combined), thereby realizing the function call of the vulnerability scanning management system driven by natural language.

[0181] Please see Figure 7 , Figure 7The schematic diagram shows an application example when an intent recognition model and a vector database are integrated into a large language AI model. The method can determine whether to generate an API interface request or a database query request, or both, based on the results of semantic analysis and intent recognition. For instructions involving asset risk data query statistics, it is usually necessary to generate a database query request; and for operations such as executing scanning tasks and configuring rules, it is necessary to generate an API interface request.

[0182] In this embodiment, the method can integrate the trained intent recognition model and vector database into the vulnerability scanning management system in the CPU hardware environment. At the same time, a special interface module is developed to realize the communication and interaction between the system and the intent recognition model and vector database. Among them, the interface module is responsible for receiving the natural language instructions input by the user, passing it to the intent recognition model and vector database for processing, and making a system call to the API interface request or SQL statement returned by the model.

[0183] In this embodiment, the execution subject of the method may be a computing device such as a computer or a server, and no limitation is made in this embodiment.

[0184] In this embodiment, the execution subject of the method may also be a smart device such as a smart phone, a tablet computer, etc., which is not limited in this embodiment.

[0185] It can be seen that implementing the vulnerability scanning method described in this embodiment can effectively ensure the intelligence level of the system, enabling the system to more efficiently understand and respond to the user's natural language instructions, thereby optimizing the user experience and improving the efficiency and accuracy of vulnerability scanning management.

[0186] Example 3

[0187] Please see Figure 8 , Figure 8 The following is a flow chart of an example of a vulnerability scanning method provided in this embodiment. The vulnerability scanning method includes:

[0188] S1. User input: Enter natural language commands in the AI ​​interface of the vulnerability scanning management system, such as "Scan the 192.168.1.10 device for the CVE-2024-12345 vulnerability."

[0189] S2. Respond through the intent recognition model and vector database:

[0190] a) The system calls the AI ​​model interface through the business interface layer and inputs natural language instructions;

[0191] b) The intent recognition model parses the natural language and converts it into a standard instance statement: [Create CVE-2024-12345 vulnerability detection template B; Use vulnerability detection template B to scan 192.168.1.10];

[0192] c) Combined with the vector database, the instance statement is converted into an API:

[0193] API1: Create vulnerability template B;

[0194] API2: Use vulnerability template B to issue a scan task with the scan target being 192.168.1.10;

[0195] d) Execute scanning: The system automatically executes the scanning task by calling the API interface generated by the AI ​​model.

[0196] S3. Execute scan: The system automatically executes the scanning task by calling the API interface generated by the AI ​​model, and displays the scanning results in the form of charts and text on the AI ​​interactive output interface to help users quickly understand and assess risks.

[0197] Based on this, it can be seen that this application focuses on optimizing the development and operation and maintenance process of the vulnerability scanning management system based on the intent recognition model and vector database. The key points involved include:

[0198] (1) Based on the integration of traditional CPU hardware, AI model technology is used to optimize the vulnerability scanning management system; thus, task scheduling, result query, system operation and maintenance and other operations are completed through AI communication, making vulnerability scanning behavior more convenient and intelligent;

[0199] (2) By using vectorization, the output of the intent recognition model is deeply integrated with the API service and database service of the vulnerability scanning management system, realizing the intelligent conversion from natural language to system operation. This allows users to easily operate the vulnerability scanning management system through natural language without having to master complex professional knowledge and system operation skills, significantly reducing the learning cost and usage threshold, improving the popularity and ease of use of the system, and reducing the pressure on the system's technical support and after-sales support.

[0200] (3) A complete closed-loop mechanism for user feedback collection and continuous model training has been established. By continuously absorbing user feedback, continuously optimizing and improving large-scale language AI models, the system can dynamically adapt to changes in user needs and continuously improve system performance and user satisfaction. This can reduce the pressure on developers to cope with system usability requirements and query statistics requirements, allowing developers to focus on improving model accuracy and enriching basic API interfaces and database query interfaces, reducing repetitive code development work and improving system development efficiency and operation and maintenance quality.

[0201] It can be seen that the implementation of the vulnerability scanning method described in this embodiment can integrate a large-scale language AI model into the vulnerability scanning management system, realize the communication and interaction between the system and the AI ​​model through the business interface layer, and finally convert the natural language requirements into an API that can be used for system calls, automatically issue scanning tasks and present scanning results.

[0202] Example 4

[0203] Please see Fig. 9 , Fig. 9 This is a schematic diagram of the structure of a vulnerability scanning device provided in this embodiment. Fig. 9 As shown, the vulnerability scanning device includes:

[0204] The receiving unit 310 is used to receive a natural language instruction input by a user;

[0205] The recognition unit 320 is used to recognize the natural language instruction through the intention recognition model to obtain the instance sentence recognition result;

[0206] A determination unit 330, configured to determine a system call statement corresponding to the instance statement recognition result according to the vector database;

[0207] Scanning unit 340, used to trigger the vulnerability scanning management system to execute corresponding scanning tasks according to the system call statement and obtain scanning results;

[0208] A first analysis unit 350 is used to perform vulnerability risk analysis according to the scanning result to obtain a vulnerability analysis result;

[0209] A first generating unit 360, configured to generate a scanning report according to the scanning result and the vulnerability analysis result;

[0210] The output unit 370 is used to output the scanning report on the interactive interface.

[0211] In this embodiment, the explanation of the vulnerability scanning device can refer to the description in Embodiment 1 or Embodiment 2, and will not be further elaborated in this embodiment.

[0212] It can be seen that the vulnerability scanning device described in this embodiment can realize efficient and flexible operation of vulnerability scanning management based on natural language instructions input by the user, without the need for cumbersome customized development processes, thereby improving the popularity and ease of use of the system and reducing the system operation and maintenance costs.

[0213] Example 5

[0214] Please see Fig.10 , Fig.10 This is a schematic diagram of the structure of a vulnerability scanning device provided in this embodiment. Fig.10As shown, the vulnerability scanning device includes:

[0215] The receiving unit 310 is used to receive a natural language instruction input by a user;

[0216] The recognition unit 320 is used to recognize the natural language instruction through the intention recognition model to obtain the instance sentence recognition result;

[0217] A determination unit 330, configured to determine a system call statement corresponding to the instance statement recognition result according to the vector database;

[0218] Scanning unit 340, used to trigger the vulnerability scanning management system to execute corresponding scanning tasks according to the system call statement and obtain scanning results;

[0219] A first analysis unit 350 is used to perform vulnerability risk analysis according to the scanning result to obtain a vulnerability analysis result;

[0220] A first generating unit 360, configured to generate a scanning report according to the scanning result and the vulnerability analysis result;

[0221] The output unit 370 is used to output the scanning report on the interactive interface.

[0222] As an optional implementation, the vulnerability scanning device further includes:

[0223] A first acquisition unit 380 is used to acquire an intent recognition training data set and a pre-built original recognition model; wherein the intent recognition training data set includes an intent recognition general term data set and an intent recognition scene classification data set;

[0224] A training unit 390 is used to train the original recognition model through a training data set to obtain a trained intent recognition model and a mapping relationship between the user input natural language and the standardized instance sentence;

[0225] The processing unit 400 is used to perform vectorization processing on the mapping relationship to obtain a vector database;

[0226] The integration unit 410 is used to integrate the intent recognition model and the vector database into the vulnerability scanning management system.

[0227] As an optional implementation, the first acquiring unit 380 includes:

[0228] A first acquisition subunit 381 is used to acquire a general term dataset for intent recognition;

[0229] The first acquisition subunit 381 is further used to acquire an intention recognition scene classification data set;

[0230] The recognition subunit 382 is used to construct an intent recognition training dataset based on the intent recognition general term dataset and the intent recognition scene classification dataset; wherein the intent recognition training dataset includes a training set, a test set, and a validation set;

[0231] The subunit 383 is constructed to construct the original recognition model based on the Transformer architecture.

[0232] In this embodiment, the intent recognition general term data set includes system instruction data and system parameter data;

[0233] System instruction data includes vulnerability detection template management instructions, scanning task instructions, asset query instructions, and report generation instructions;

[0234] System parameter data at least includes vulnerability description parameters and asset description parameters.

[0235] As an optional implementation, the first acquisition subunit 381 includes:

[0236] A determination module is used to determine multiple classification scenarios for system function division; wherein the classification scenario is one of a vulnerability detection template configuration scenario, a scanning task scenario, a scanning result report generation scenario, an asset risk data query statistics scenario, and other supplementary scenarios;

[0237] An acquisition module is used to acquire a scene instance corresponding to a classification scene;

[0238] A labeling module is used to classify and label the scene instances and obtain the scene instance labeling data;

[0239] A processing module, used for performing data derivation processing based on the scene instance annotation data to obtain scene derived data;

[0240] A building module is used to construct an intent recognition scene classification dataset based on scene instance annotation data and scene-derived data.

[0241] As an optional implementation, the training unit 390 includes:

[0242] The second acquisition subunit 391 is used to acquire preset training parameters; wherein the training parameters at least include a learning rate, a number of training rounds, and a batch size;

[0243] A training subunit 392 is used to train the original recognition model using the intent recognition training data set and training parameters to obtain a trained intent recognition model;

[0244] The second acquisition subunit 391 is also used to obtain the intention recognition result during the training of the original recognition model;

[0245] A subunit 393 is established to establish a mapping relationship between the user input natural language and the standardized instance sentence according to the intention recognition result.

[0246] As an optional implementation, the scanning unit 340 includes:

[0247] Configuration subunit 341, used to trigger the vulnerability scanning management system to configure corresponding scanning targets and scanning tasks according to the system call statement;

[0248] The scanning subunit 342 is used to execute the scanning task for the scanning target through the vulnerability scanning management system to obtain the scanning result.

[0249] As an optional implementation, the vulnerability scanning device further includes:

[0250] A second acquisition unit 420 is used to acquire user feedback data for the intent recognition model and / or the vector database;

[0251] The second analysis unit 430 is used to analyze the user feedback data using natural language processing technology to obtain key feedback data;

[0252] The second generating unit 440 is used to generate a targeted model training solution based on the feedback key data;

[0253] A third acquisition unit 450 is used to acquire targeted training samples based on the targeted model training scheme;

[0254] The optimization unit 460 is used to optimize the intention recognition model and / or the vector database according to the targeted training samples to obtain an optimized training result;

[0255] The push unit 470 is used to push the optimization training result to the user's vulnerability scanning management system in the form of a patch.

[0256] In this embodiment, the explanation of the vulnerability scanning device can refer to the description in Embodiment 1 or Embodiment 2, and will not be further elaborated in this embodiment.

[0257] It can be seen that the vulnerability scanning device described in this embodiment can realize efficient and flexible operation of vulnerability scanning management based on natural language instructions input by the user, without the need for cumbersome customized development processes, thereby improving the popularity and ease of use of the system and reducing the system operation and maintenance costs.

[0258] An embodiment of the present application provides an electronic device, including a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the vulnerability scanning method in embodiment 1 or embodiment 2 of the present application.

[0259] An embodiment of the present application provides a computer-readable storage medium storing computer program instructions. When the computer program instructions are read and executed by a processor, the vulnerability scanning method in Embodiment 1 or Embodiment 2 of the present application is executed.

[0260] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0261] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0262] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0263] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0264] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0265] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A vulnerability scanning method, characterized in that: include: Receiving natural language instructions input by a user; Recognize the natural language instruction through the intention recognition model to obtain an example sentence recognition result; Determine the system call statement corresponding to the instance statement recognition result according to the vector database; Trigger the vulnerability scanning management system to execute corresponding scanning tasks according to the system call statement to obtain scanning results; Perform vulnerability risk analysis according to the scanning results to obtain vulnerability analysis results; Generate a scan report based on the scan results and the vulnerability analysis results; The scanning report is output on the interactive interface.

2. The vulnerability scanning method according to claim 1, characterized in that: The method further comprises: Acquire an intent recognition training data set and a pre-built original recognition model; wherein the intent recognition training data set includes an intent recognition general term data set and an intent recognition scene classification data set; The original recognition model is trained by using the training data set to obtain a trained intent recognition model and a mapping relationship between the user input natural language and the standardized instance sentence; Performing vectorization processing on the mapping relationship to obtain a vector database; Integrate the intent recognition model and the vector database into a vulnerability scanning management system.

3. The vulnerability scanning method according to claim 2, characterized in that: The step of obtaining the intent recognition training data set and the pre-built original recognition model includes: Get the intent recognition common terminology dataset; Obtain the intent recognition scene classification dataset; Constructing an intent recognition training dataset according to the intent recognition general term dataset and the intent recognition scene classification dataset; wherein the intent recognition training dataset includes a training set, a test set and a validation set; Build the original recognition model based on the Transformer architecture.

4. The vulnerability scanning method according to claim 3, characterized in that: The intention recognition general terminology data set includes system instruction data and system parameter data; The system instruction data includes vulnerability detection template management instructions, scanning task instructions, asset query instructions and report generation instructions; The system parameter data at least includes vulnerability description parameters and asset description parameters.

5. The vulnerability scanning method according to claim 3, characterized in that: The step of obtaining the intent recognition scene classification dataset includes: Determine multiple classification scenarios for system function division; wherein the classification scenario is one of a vulnerability detection template configuration scenario, a scanning task scenario, a scanning result report generation scenario, an asset risk data query statistics scenario, and other supplementary scenarios; Obtaining a scene instance corresponding to the classification scene; Performing scene classification and parameter labeling on the scene instance to obtain scene instance labeling data; Performing data derivation processing based on the scene instance annotated data to obtain scene derived data; An intent recognition scene classification dataset is constructed based on the scene instance annotation data and the scene derived data.

6. The vulnerability scanning method according to claim 2, characterized in that: The original recognition model is trained by the training data set to obtain a trained intent recognition model and a mapping relationship between a user input natural language and a standardized instance sentence, including: Obtaining preset training parameters; wherein the training parameters include at least a learning rate, a number of training rounds, and a batch size; The original recognition model is trained using the intention recognition training data set and the training parameters to obtain a trained intention recognition model; In the process of training the original recognition model, obtaining an intent recognition result; A mapping relationship between the user input natural language and the standardized instance sentence is established according to the intention recognition result.

7. The vulnerability scanning method according to claim 1, characterized in that: The triggering of the vulnerability scanning management system to execute a corresponding scanning task according to the system call statement to obtain a scanning result includes: Trigger the vulnerability scanning management system to configure corresponding scanning targets and scanning tasks according to the system call statement; The vulnerability scanning management system executes the scanning task for the scanning target to obtain a scanning result.

8. The vulnerability scanning method according to claim 2, characterized in that: The method further comprises: Obtaining user feedback data for the intent recognition model and / or the vector database; Using natural language processing technology to analyze the user feedback data to obtain key feedback data; Generate a targeted model training plan based on the feedback key data; Acquire targeted training samples based on the targeted model training scheme; Performing optimization training on the intention recognition model and / or the vector database according to the targeted training samples to obtain an optimized training result; The optimization training results are pushed to the user's vulnerability scanning management system in the form of a patch.

9. An electronic device, characterized in that: The electronic device comprises a memory and a processor, the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to perform the vulnerability scanning method according to any one of claims 1 to 8.

10. A readable storage medium, characterized in that: The readable storage medium stores computer program instructions, and when the computer program instructions are read and executed by a processor, the vulnerability scanning method according to any one of claims 1 to 8 is executed.

11. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the vulnerability scanning method according to any one of claims 1 to 8 is executed.

Images