System security vulnerability repairing method and device and storage medium

Abstract

The invention discloses a system security vulnerability repairing method and device and a storage medium, and relates to the technical field of computers. The method comprises the steps that test information of a target object is obtained, the test information is information that the target object has security vulnerabilities in the test process, and the test information comprises type information of the security vulnerabilities, name information of components related to the security vulnerabilities and repair object information of the security vulnerabilities; and in response to a repair request for the security vulnerability, generating a repair strategy based on the test information, a preset model and a preset knowledge base. The technical problems of high technical difficulty and high time cost of repairing security vulnerabilities are solved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method, device and storage medium for repairing system security vulnerabilities. Background Art

[0002] With the acceleration of global informatization and digital transformation, the use of various technologies has introduced different types of security vulnerabilities while supporting the operation of software systems. Attackers use various means to exploit security vulnerabilities to attack software systems, and frequent network attacks have caused serious losses and impacts on companies. Security vulnerabilities not only affect the normal operation of the system, but also pose a serious threat to user privacy and data security. Software security vulnerabilities cannot be completely eliminated. In order to ensure software security, the repair of software security vulnerabilities needs to be fast and accurate, and the cost of repairing security vulnerabilities needs to be reduced as much as possible.

[0003] The traditional security vulnerability repair process, whether it is the security vulnerabilities reported in the late testing of the development stage or the security vulnerabilities discovered through the audit of security vulnerability scanning tools after the application is launched, fails to provide detailed security vulnerability descriptions and security vulnerability repair solutions. The development team needs to spend a lot of time and energy to review relevant information. Moreover, different development teams often cannot share solutions in a timely manner when faced with the same security vulnerability, and duplicate solutions are everywhere.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present invention provide a method, device and storage medium for repairing a system security vulnerability, so as to at least solve the technical problems of high technical difficulty and high time cost in repairing a security vulnerability.

[0006] According to one aspect of an embodiment of the present invention, a method for repairing a system security vulnerability is provided, comprising: obtaining test information of a target object, the test information being information about a security vulnerability existing in the target object during a test process, wherein the test information includes type information of the security vulnerability, name information of a component involved in the security vulnerability, and repair object information of the security vulnerability; in response to a request for repairing the security vulnerability, generating a repair strategy based on the test information, a preset model, and a preset knowledge base.

[0007] Optionally, generating a repair strategy based on test information, a preset model and a preset knowledge base includes the following steps: generating a repair strategy prompt word based on the test information and the preset model; generating a repair strategy based on the repair strategy prompt word and the preset knowledge base.

[0008] Optionally, before generating repair strategy prompt words for the target object based on test information and preset models, it includes: obtaining basic information of historical security vulnerabilities, the basic information including: type information of historical security vulnerabilities, name information of components involved in historical security vulnerabilities; based on the basic information, building a preset database; based on the preset database, building a preset model.

[0009] Optionally, based on a preset database, a preset model is constructed, including: structuring basic information to obtain structured processed information; generating historical restoration strategy prompt words based on the structured processed information; and constructing a preset model based on the basic information and the historical restoration strategy prompt words.

[0010] Optionally, constructing a preset model further includes: in response to a low degree of matching between the basic information and the historical repair strategy prompt words, performing supervised optimization on the preset model to obtain an optimized model; and updating the preset model based on the optimized model.

[0011] Optionally, before generating the repair strategy based on the repair strategy prompt word and the preset knowledge base, the method includes: constructing a preset knowledge base based on the historical repair strategy and the historical repair strategy prompt word.

[0012] Optionally, the method includes: determining a repair object based on repair object information of the security vulnerability; and generating repair prompt information based on a repair strategy, wherein the repair prompt information is information that prompts the repair object to use a solution to repair the security vulnerability.

[0013] According to another aspect of an embodiment of the present invention, there is also provided a device for repairing a system security vulnerability, comprising: an acquisition module, the acquisition module is used to obtain test information of a target object, the test information is information that a security vulnerability exists in the target object during the test process, wherein the test information includes type information of the security vulnerability, name information of components involved in the security vulnerability, and information of a security vulnerability repair object; a generation module, the generation module is used to generate a repair strategy based on the test information, a preset model, and a preset knowledge base in response to a repair request for a security vulnerability. According to another aspect of an embodiment of the present invention, there is also provided a computer-readable storage medium, the computer-readable storage medium includes a stored executable program, wherein when the executable program is running, the device where the computer-readable storage medium is located is controlled to execute the methods in various embodiments of the present invention. According to another aspect of an embodiment of the present invention, there is also provided a computer program product, comprising a computer program, which implements the methods in various embodiments of the present invention when executed by a processor.

[0014] In an embodiment of the present invention, the test information of the target object is processed through a preset model and a preset knowledge base to generate a repair strategy, improve the repair accuracy and efficiency, and reduce the repair cost, thereby solving the technical problems of high technical difficulty and high time cost in repairing security vulnerabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0016] Figure 1 is a flow chart of an optional method for repairing a system security vulnerability according to one embodiment of the present invention;

[0017] Figure 2 is a flow chart of an optional method for repairing a system security vulnerability according to one embodiment of the present invention;

[0018] Figure 3 It is a structural block diagram of an optional system security vulnerability repairing device according to one embodiment of the present invention. DETAILED DESCRIPTION

[0019] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0020] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0021] According to an embodiment of the present invention, an embodiment of a method for repairing a system security vulnerability is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0022] The method embodiment can be executed in an electronic device or a similar computing device including a memory and a processor. Taking running on a system terminal as an example, the system terminal may include one or more processors (the processor may include but is not limited to a central processing unit (CPU), a graphics processing unit (GPU), a digital signal processing (DSP) chip, a microcontroller unit (MCU), a programmable logic device (Field Programmable Gate Array, FPGA), a neural network processor (Neural-network Processor Unit, NPU), a tensor processor (Tensor Processing Unit, TPU), an artificial intelligence (Artificial Intelligence, AI) type processor, etc.) and a memory for storing data. Optionally, the above-mentioned system terminal may also include a transmission device, an input and output device, and a display device for communication functions. It can be understood by those skilled in the art that the above-mentioned structural description is only for illustration, and it does not limit the structure of the above-mentioned system terminal. For example, the system terminal may also include more or fewer components than the above-mentioned structural description, or have a configuration different from the above-mentioned structural description.

[0023] The memory can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the method for repairing system security vulnerabilities in the embodiment of the present invention. The processor executes various functional applications and data processing by running the computer program stored in the memory, that is, the method for repairing system security vulnerabilities described above is implemented. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the mobile terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0024] The transmission device is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device can be a radio frequency (Radio Frequency, referred to as RF) module, which is used to communicate with the Internet wirelessly.

[0025] The display device may be, for example, a touch screen type liquid crystal display (LCD) and a touch display (also referred to as a "touch screen" or "touch display screen"). The liquid crystal display may enable a user to interact with a user interface of a mobile terminal. In some embodiments, the mobile terminal has a graphical user interface (GUI), and a user may interact with the GUI by finger contacts and / or gestures on a touch-sensitive surface, wherein the human-computer interaction functions here may optionally include the following interactions: creating web pages, drawing, word processing, making electronic documents, games, video conferencing, instant messaging, sending and receiving emails, call interfaces, playing digital videos, playing digital music and / or web browsing, etc. The executable instructions for executing the above human-computer interaction functions are configured / stored in a computer program product or readable storage medium executable by one or more processors.

[0026] Figure 1 is a method according to an embodiment of the present invention, such as Figure 1 As shown, the method comprises the following steps:

[0027] Step S100, obtaining test information of the target object, the test information is information about security vulnerabilities in the target object during the test process, wherein the test information includes type information of the security vulnerability, name information of the component involved in the security vulnerability, and repair object information of the security vulnerability.

[0028] In step S100, during the software development or operation and maintenance process, test information of the target object (such as a specific functional module, a third-party component, etc.) of the target software system is obtained through automated tools or manual testing. This information specifically points out the security vulnerabilities found during the test process, including but not limited to the types of security vulnerabilities (for example, SQL injection, XSS attack, buffer overflow, etc.), the names of the components involved in the security vulnerabilities, and possible security vulnerability repair objects (i.e., the development team or individual responsible for repairing the security vulnerabilities). The collection of this information is based on the scanning results of the Software Security Situation Analysis Tool (ASSA) and the reports of other security audit tools to form structured security vulnerability data, which is stored in the security vulnerability data warehouse to provide basic data for the subsequent generation of repair strategies.

[0029] Step S102, in response to a request to repair a security vulnerability, a repair strategy is generated based on test information, a preset model and a preset knowledge base.

[0030] In step S102, a request to repair a security vulnerability is received, and test information related to the request is retrieved from the security vulnerability data warehouse. A preset security vulnerability repair solution prompt word generation model is used, combined with the security vulnerability repair solution knowledge base built with RAG technology, to generate a targeted repair strategy. The preset model here is fine-tuned in a supervised manner, and can understand the specific characteristics of the security vulnerability and generate a corresponding repair solution description. The preset knowledge base contains detailed repair solutions and practical guidance, aiming to provide comprehensive and accurate solutions.

[0031] In a specific embodiment of the present application, through the combined use of the model and the knowledge base, a repair strategy including repair steps, expected effects and related code modification suggestions can be generated to accelerate the repair process and reduce repair costs.

[0032] Based on steps S100 to S102, it is possible to achieve rapid response and efficient repair of security vulnerabilities, improve the security of the software system, and at the same time reduce the time and technical investment of the development team in repairing security vulnerabilities, thereby achieving optimal allocation of resources.

[0033] Based on the above steps S100 to S102, in an embodiment of the present invention, a repair strategy is generated based on test information, a preset model and a preset knowledge base, thereby achieving the purpose of generating a more accurate repair strategy, thereby achieving the technical effect of improving the efficiency and accuracy of software security vulnerability repair, and further solving the technical problems of high technical difficulty and high time cost in repairing security vulnerabilities.

[0034] As an optional implementation, generating a repair strategy based on test information, a preset model and a preset knowledge base includes the following steps:

[0035] Step S201: Generate repair strategy prompt words based on test information and a preset model.

[0036] In step S201, firstly, security vulnerability information found during the software testing process is received. This information may include the type of security vulnerability, the affected components, the severity of the security vulnerability, etc. The preset model, that is, the trained machine learning model, is used to process this test information and generate prompt words for the repair strategy. The prompt words serve as keywords for querying or generating repair solutions, helping the system to more accurately locate relevant repair information in the knowledge base. This process involves refining the model to ensure that it can understand the context of the security vulnerability and generate repair prompt words that match it.

[0037] Step S202: Generate a repair strategy based on the repair strategy prompt word and a preset knowledge base.

[0038] In step S202, the knowledge base is queried according to the prompt word to find a repair solution that matches the prompt word. Through RAG (retrieval enhanced generation) technology, combined with the model generation capability and the authoritative information of the knowledge base, a detailed, accurate, and specific vulnerability repair strategy set is generated. The repair strategy set includes multiple versions of repair strategies, and finally the latest version of the repair strategy is selected as the output. This strategy will include repair steps, related code modification suggestions, test cases, and possible follow-up actions, such as monitoring and auditing, to ensure the comprehensiveness and effectiveness of vulnerability repair. Among them, the preset knowledge base contains a large amount of vulnerability descriptions, repair steps, case analysis and other information.

[0039] Based on steps S201 to 202, it is possible to quickly respond to new security vulnerabilities and generate repair strategies in an automated manner, thereby improving the efficiency and accuracy of repairs. At the same time, it can also help the development team avoid duplication of work and achieve collaboration and knowledge accumulation among teams by sharing repair solutions in the knowledge base.

[0040] Optionally, before generating the repair strategy prompt word of the target object based on the test information and the preset model, the following steps are included:

[0041] Step S211, obtaining basic information of historical security vulnerabilities, the basic information including: type information of historical security vulnerabilities, and name information of components involved in the historical security vulnerabilities.

[0042] Step S211, the basic information mainly includes the type information of historical security vulnerabilities and the name information of components involved in historical security vulnerabilities. The type information of historical security vulnerabilities is a specific type of security vulnerability, including but not limited to SQL injection, XSS attack, buffer overflow, privilege escalation, etc. These type information helps the system to classify and understand the vulnerabilities. The name information of components involved in historical security vulnerabilities is specific to the names of software components, libraries or modules that cause the vulnerabilities, such as a certain version of Apache Struts, a third-party package in Node.js, etc. The data in the historical vulnerability report is extracted through automated tools or manual sorting to form a structured data set to provide a data basis for subsequent steps.

[0043] Step S212: construct a preset database based on the basic information.

[0044] In step S212, the database contains the following contents:

[0045] Vulnerability Type Index: Used to quickly find and categorize specific types of vulnerabilities.

[0046] Component Name Association: Records which components are associated with which types of security vulnerabilities.

[0047] Repair plan record: Each security vulnerability type and component name combination should be associated with a detailed repair plan, operation steps, case analysis, etc.

[0048] Detailed description of the vulnerability: including the time when the vulnerability was discovered, the scope of impact, the severity, and other information.

[0049] When building a preset database, data cleaning is required to ensure the accuracy and completeness of the data, and standardization is performed to make the database data structure convenient for subsequent query and analysis. The design of the database should take into account efficient retrieval and secure storage of data.

[0050] Step S213: construct a preset model based on the preset database.

[0051] In step S213, a preset model is constructed based on the information in the preset database. This model can be a machine learning model, such as a deep neural network (such as BERT, GPT, etc.), which is used to generate text or predict tasks. The process of building a model includes the following steps:

[0052] Data preprocessing: Convert text information in the database into a numerical form that the model can process, such as word embeddings.

[0053] Model selection and initialization: Select a suitable generative model architecture and initialize the model parameters using a pre-trained model.

[0054] Model training: Use the vulnerability descriptions and fix solutions in the database as training data to perform supervised training on the model. This process usually involves taking the vulnerability description as input and the fix solution as output, allowing the model to learn how to generate effective fix strategies.

[0055] Model evaluation and optimization: During the training process, the model's performance on the validation dataset is evaluated, and model parameters or optimization strategies are adjusted to ensure that the model can accurately generate repair solutions.

[0056] Based on steps S211 to S213, the preset model is constructed to enable the model to understand the context of the security vulnerability and generate new repair strategy prompts based on the historical vulnerability repair experience. This model will be further fine-tuned to adapt to specific software systems or application scenarios, so that repair solutions can be generated more accurately, improving the efficiency and accuracy of software security vulnerability repair.

[0057] Optionally, based on a preset database, a preset model is constructed, including:

[0058] Step S221, perform structured processing on the basic information to obtain structured processed information.

[0059] In step S221, the structuring process includes but is not limited to the following steps:

[0060] Data cleaning: remove duplicates, correct errors, and delete irrelevant or incomplete information. Data classification: classify data according to vulnerability type and component name to facilitate subsequent query and analysis.

[0061] Data encoding: Encoding text information into digital vectors so that machine learning models can process it. For example, using word embedding technology to convert component names and vulnerability descriptions into vector form.

[0062] Indexing: Create an index for each record to ensure fast retrieval and efficient data access.

[0063] Through structured processing, the consistency and availability of data can be ensured, laying a solid foundation for subsequent model training.

[0064] Step S222: Generate historical repair strategy prompt words based on the structured processing information.

[0065] In step S222, the prompt words are keywords or phrases for specific security vulnerabilities and components, which are used to guide the preset model to generate a repair solution. This process includes the following steps:

[0066] Text analysis: Use natural language processing technology to analyze the text of vulnerability descriptions and repair solutions to extract key features.

[0067] Keyword extraction: Extract keywords and phrases related to vulnerability repair based on text analysis results.

[0068] Template construction: Based on keywords, construct question templates or prompt word templates for generating repair strategies.

[0069] The generation of historical repair strategy prompts enables the model to generate specific repair suggestions based on keywords, thereby improving the pertinence and accuracy of the repair solutions generated by the model.

[0070] Step S223: construct a preset model based on the basic information and historical repair strategy prompt words.

[0071] In step S223, constructing a preset model includes the following steps:

[0072] Model initialization: Use a pre-trained model as a starting point, such as a Transformer-based model.

[0073] Model training: Use structured processing information and historical repair strategy prompts as training data for supervised training. The goal of the model is to learn the mapping relationship between input (vulnerability type and component name) and output (repair strategy prompts).

[0074] Model optimization: Improve the generation quality and prediction accuracy of the model by adjusting model parameters, optimizing algorithms, or increasing training rounds.

[0075] Based on steps S221 to S223, the construction of the preset model enables the system to generate repair suggestions for the current vulnerability based on the input security vulnerability information and historical repair strategies, so that when facing new security threats, it can quickly provide effective solutions. The implementation of these three steps provides sufficient data and model preparation for subsequent supervised fine-tuning, ensuring that the final generated repair strategy is both accurate and practical.

[0076] Optionally, building a preset model also includes:

[0077] Step S224, in response to the low matching degree between the basic information and the historical repair strategy prompt words, the preset model is optimized in a supervised manner to obtain an optimized model.

[0078] In step S224, the supervised optimization process includes:

[0079] Data augmentation: Collect more security vulnerability examples associated with low matches, especially those with novelty or complexity, to enrich the model’s training dataset.

[0080] Label adjustment: For training data, ensure that each instance has a clear label or expected output, such as an accurate description of the repair solution. This helps the model learn a more direct input-output relationship.

[0081] Model fine-tuning: Retraining the preset model with the newly added data set, focusing on improving the model's performance on low-matching cases. This process may involve adjusting the model's architecture, hyperparameters, or optimization algorithms to better fit the new training data.

[0082] Performance evaluation: During the fine-tuning process, continuously evaluate the performance of the model, using indicators such as cross-validation, accuracy, and recall to ensure that the model optimization is effective and can achieve the expected accuracy and generalization ability.

[0083] Step S225: updating the preset model based on the optimized model.

[0084] In step S225, the parameters and structure of the optimized model are updated to the preset model to replace the original model, so as to improve the overall repair efficiency and safety of the system.

[0085] Through steps S224 and S225, it is possible to continuously learn and adapt to newly emerging or previously less understood security vulnerabilities, and continuously optimize the preset model to ensure that it can quickly and accurately generate repair strategies when facing various security threats, thereby improving the accuracy and efficiency of generating and pushing software security vulnerability repair solutions. This adaptive optimization mechanism is the key to ensuring the long-term effectiveness and practicality of the model.

[0086] Optionally, before generating a repair strategy based on the repair strategy prompt word and the preset knowledge base, the following steps are included:

[0087] Step S231, constructing a preset knowledge base based on historical repair strategies and historical repair strategy prompt words.

[0088] In step S231, all effective repair solutions are extracted from the historical security vulnerability repair records. These repair strategies should include detailed steps, required technologies, implementation difficulties and successful repair cases. The accuracy and completeness of these strategies are ensured by combining manual review and automated extraction. Based on the historical repair strategies, a set of prompt words is constructed. These prompt words can summarize the characteristics of the vulnerabilities, the key points or technical points of the repair solutions. The generation of prompt words needs to consider their high matching degree with the historical repair strategies so that the model can accurately reference the information in the knowledge base when generating the repair strategies. The historical repair strategies and corresponding prompt words are integrated into a structured preset knowledge base. The RAG (Retrieval-Augmented Generat ion) technology is used to vectorize the text information in the knowledge base and convert each repair strategy into a vector representation that can be understood and retrieved by the machine.

[0089] Through step S231, the system not only accumulates a wealth of historical repair strategies, but also builds a structured, searchable preset knowledge base, providing a powerful information source for the preset model. This enables the model to refer to actual cases when generating repair strategies, improving the accuracy and practicality of the generated strategies. Building a preset knowledge base is a basic task in the entire system design, and is of great significance for improving the performance of the automatic generation and push device of software security vulnerability repair solutions.

[0090] Optionally, the method comprises:

[0091] Step S241, determining a repair object based on the repair object information of the security vulnerability.

[0092] Step S242: Generate repair prompt information based on the repair strategy. The repair prompt information is information that prompts the repair object to use a solution to repair the security vulnerability.

[0093] Through steps S241 and S242, the system can not only determine the repair object of the security vulnerability, but also provide a targeted repair plan for the repair object, thereby improving the repair efficiency and success rate, and reducing the technical difficulty and time cost of repairing the security vulnerability.

[0094] Figure 2 FIG. 1 is a flowchart of another method for repairing a system security vulnerability according to one embodiment of the present invention. Figure 2 As shown, the method comprises the following steps:

[0095] Step S201: Generate repair strategy prompt words based on test information and a preset model.

[0096] Step S202: Generate a repair strategy based on the repair strategy prompt word and a preset knowledge base.

[0097] Step S211, obtaining basic information of historical security vulnerabilities, the basic information including: type information of historical security vulnerabilities, and name information of components involved in the historical security vulnerabilities.

[0098] Step S212: construct a preset database based on the basic information.

[0099] Step S213: construct a preset model based on the preset database.

[0100] Step S221, perform structured processing on the basic information to obtain structured processed information.

[0101] Step S222: Generate historical repair strategy prompt words based on the structured processing information.

[0102] Step S223: construct a preset model based on the basic information and historical repair strategy prompt words.

[0103] Step S224, in response to the low matching degree between the basic information and the historical repair strategy prompt words, the preset model is optimized in a supervised manner to obtain an optimized model.

[0104] Step S225: updating the preset model based on the optimized model.

[0105] Step S231, constructing a preset knowledge base based on historical repair strategies and historical repair strategy prompt words.

[0106] Step S241, determining a repair object based on the repair object information of the security vulnerability.

[0107] Step S242: Generate repair prompt information based on the repair strategy. The repair prompt information is information that prompts the repair object to use a solution to repair the security vulnerability.

[0108] Based on the above steps S201 to S242, in an embodiment of the present invention, repair strategy prompt words are generated based on test information and preset models, and repair strategies are generated based on repair strategy prompt words and preset knowledge bases, thereby achieving the purpose of generating more accurate repair strategies, thereby achieving the technical effect of improving the efficiency and accuracy of software security vulnerability repair, and further solving the technical problems of high technical difficulty and high time cost in repairing security vulnerabilities.

[0109] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0110] In the embodiments of the present invention, a device for repairing system security vulnerabilities is also provided, which is used to implement the above embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0111] Figure 3 FIG. 1 is a structural block diagram of a system security vulnerability repair device according to one embodiment of the present invention. Figure 3 As shown, the device comprises:

[0112] The acquisition module 301 is used to acquire the test information of the target object, where the test information is information about the security vulnerability of the target object during the test process, wherein the test information includes the type information of the security vulnerability, the name information of the component involved in the security vulnerability, and the security vulnerability repair object information;

[0113] The generation module 302 is used to generate a repair strategy based on the test information, the preset model and the preset knowledge base in response to the repair request for the security vulnerability.

[0114] Optionally, the generating module 302 is further configured to generate a repair strategy prompt word based on the test information and a preset model; and generate a repair strategy based on the repair strategy prompt word and a preset knowledge base.

[0115] Optionally, the acquisition module 301 is also used to obtain basic information of historical security vulnerabilities, the basic information including: type information of historical security vulnerabilities, component name information involved in historical security vulnerabilities; based on the basic information, a preset database is constructed; the generation module 302 is also used to construct a preset model based on the preset database.

[0116] Optionally, the generation module 302 is further used to perform structured processing on the basic information to obtain structured processing information; generate historical restoration strategy prompt words based on the structured processing information; and construct a preset model based on the basic information and the historical restoration strategy prompt words.

[0117] Optionally, the system security vulnerability repair device also includes an optimization module 303, which is used to perform supervised optimization on the preset model in response to the low matching degree between the basic information and the historical repair strategy prompt words to obtain an optimized model; based on the optimized model, the preset model is updated.

[0118] Optionally, the generation module 302 is also used in step S231 to construct a preset knowledge base based on the historical repair strategies and the historical repair strategy prompt words.

[0119] Optionally, the device for repairing a system security vulnerability further includes a determination module 304, which is used to determine a repair object based on the repair object information of the security vulnerability.

[0120] Optionally, the generating module 302 is further configured to generate repair prompt information based on the repair strategy, where the repair prompt information is information that prompts the repair object to use a solution to repair the security vulnerability.

[0121] It should be noted that the above modules can be implemented by software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above modules are all located in the same processor; or the above modules are located in different processors in any combination.

[0122] According to one embodiment of the present invention, a system security vulnerability repair device is provided, and the system security vulnerability repair device includes the following modules:

[0123] The security vulnerability data processing module is used to save various security vulnerabilities found during the test to the preset database after structured processing according to the specified processing interface, mainly including the type of security vulnerability, the name of the component involved in the security vulnerability, the organization and individual from which the vulnerability originated (the target of security vulnerability repair), etc. At the same time, it provides a security vulnerability repair plan request interface to initiate requests to the repair plan prompt word generation module and the repair plan push module respectively.

[0124] The security vulnerability repair solution prompt word generation module is used to generate security vulnerability repair solution prompt words based on the component names involved in the security vulnerability through a large model (preset model). Through supervised fine-tuning, the repair solution descriptions corresponding to the component names involved in the security vulnerability are trained to return prompt words that can generate detailed solutions.

[0125] The security vulnerability repair solution details generation module is used to generate a detailed security vulnerability repair solution based on the prompt words returned by the security vulnerability repair solution prompt word generation module. First, the security vulnerability repair solution knowledge base and application are built through RAG technology, and then a detailed repair solution is generated based on the solution prompt words.

[0126] The security vulnerability repair solution push module is used to automatically analyze and identify the organization or individual involved in the security vulnerability, and push the repair solution to the corresponding person in charge through messages. By building a security vulnerability analysis agent through AI Agent (intelligent body), it can automatically query the data related to the vulnerability in the vulnerability data warehouse according to the type and name of the security vulnerability, and automatically analyze the corresponding person in charge (security vulnerability repair object), and finally push the generated detailed solution.

[0127] In this embodiment, by calling the security vulnerability scanning result interface, the software security vulnerability data information is obtained and structured processing and storage are performed to form a security vulnerability data warehouse. At the same time, a security vulnerability detailed repair solution knowledge base is constructed through RAG technology. Then, on the basis of obtaining a comprehensive data set, a generative model describing security vulnerabilities and repair solutions is constructed through supervised fine-tuning training, and repair solution prompts are generated through the model, and the final security vulnerability repair solution is generated in combination with the knowledge base. Finally, the development team and person in charge involved in the vulnerability are automatically identified through the AI ​​Agent (intelligent body) and the solution is pushed. Through this device, the automatic generation and accurate push of software security vulnerability repair solutions are realized, and the security of the software is timely and effectively guaranteed in a low-cost, high-quality and efficient manner.

[0128] According to one embodiment of the present invention, there is also provided an electronic device, comprising: a memory storing an executable program; and a processor for running the program, wherein the method for repairing the system security vulnerability is executed when the program is running.

[0129] Optionally, in this embodiment, the processor may be configured to perform the following steps through a computer program:

[0130] Step S100, obtaining test information of the target object, the test information is information about security vulnerabilities in the target object during the test process, wherein the test information includes type information of the security vulnerability, name information of the component involved in the security vulnerability, and repair object information of the security vulnerability.

[0131] Step S102, in response to a request to repair a security vulnerability, a repair strategy is generated based on test information, a preset model and a preset knowledge base.

[0132] According to one embodiment of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored executable program, wherein when the executable program is running, the device where the storage medium is located is controlled to execute the above-mentioned method for repairing system security vulnerabilities.

[0133] Optionally, in this embodiment, the storage medium may be configured to store a computer program for performing the following steps:

[0134] Step S100, obtaining test information of the target object, the test information is information about security vulnerabilities in the target object during the test process, wherein the test information includes type information of the security vulnerability, name information of the component involved in the security vulnerability, and repair object information of the security vulnerability.

[0135] Step S102, in response to a request to repair a security vulnerability, a repair strategy is generated based on test information, a preset model and a preset knowledge base.

[0136] Optionally, in this embodiment, the above-mentioned storage medium may include but is not limited to: a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and other media that can store computer programs.

[0137] According to one embodiment of the present invention, a computer program product is also provided, including a computer program, and the computer program implements the above-mentioned method for repairing system security vulnerabilities when executed by a processor.

[0138] Optionally, in this embodiment, the computer program product may be configured as a computer program for executing the following steps:

[0139] Step S100, obtaining test information of the target object, the test information is information about security vulnerabilities in the target object during the test process, wherein the test information includes type information of the security vulnerability, name information of the component involved in the security vulnerability, and repair object information of the security vulnerability.

[0140] Step S102, in response to a request to repair a security vulnerability, a repair strategy is generated based on test information, a preset model and a preset knowledge base.

[0141] The technical solution of this application has the following technical effects:

[0142] Analyze security vulnerabilities based on test information, preset models and preset knowledge bases, generate detailed solutions and accurately push solutions, thereby effectively reducing the cost and technical difficulty of the development team to repair security vulnerabilities. Through supervised fine-tuning of the description of vulnerabilities and repair solutions and the construction of a knowledge base for repair strategies, accurately provide solutions to security vulnerabilities, accurately locate the organizations and individuals that are the source of vulnerabilities, and push relevant solutions in a timely manner, achieving the goal of repairing software security vulnerabilities at a low cost and with high quality and efficiency in the early stages of development.

[0143] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0144] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0145] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0146] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0147] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0148] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for repairing a system security vulnerability, characterized in that: include: Acquire test information of the target object, wherein the test information is information about security vulnerabilities in the target object during the test process, wherein the test information includes type information of the security vulnerability, name information of the component involved in the security vulnerability, and repair object information of the security vulnerability; In response to a repair request for the security vulnerability, a repair strategy is generated based on the test information, the preset model and the preset knowledge base.

2. The method according to claim 1, characterized in that: Generating the repair strategy based on the test information, the preset model and the preset knowledge base includes the following steps: Based on the test information and the preset model, generating a repair strategy prompt word; The repair strategy is generated based on the repair strategy prompt word and the preset knowledge base.

3. The method according to claim 2, characterized in that Before generating the repair strategy prompt word of the target object based on the test information and the preset model, the method includes: Obtaining basic information of historical security vulnerabilities, the basic information including: type information of the historical security vulnerabilities and name information of components involved in the historical security vulnerabilities; Based on the basic information, a preset database is constructed; Based on the preset database, the preset model is constructed.

4. The method according to claim 3, characterized in that Based on the preset database, constructing the preset model includes: Performing structured processing on the basic information to obtain structured processed information; Based on the structured processing information, generate historical repair strategy prompt words; The preset model is constructed based on the basic information and the historical repair strategy prompt words.

5. The method according to claim 4, characterized in that Constructing the preset model also includes: In response to a low matching degree between the basic information and the historical repair strategy prompt word, performing supervised optimization on the preset model to obtain an optimized model; Based on the optimization model, the preset model is updated.

6. The method according to claim 4, characterized in that Before generating the repair strategy based on the repair strategy prompt word and the preset knowledge base, the method includes: The preset knowledge base is constructed based on the historical repair strategy and the historical repair strategy prompt words.

7. The method according to claim 1, characterized in that The method includes: Determine a repair object based on the repair object information of the security vulnerability; The repair prompt information is generated based on the repair strategy, and the repair prompt information is information that prompts the repair object to use a solution to repair the security vulnerability.

8. A device for repairing a system security vulnerability, characterized in that: include: An acquisition module, the acquisition module is used to acquire test information of a target object, the test information being information about security vulnerabilities in the target object during the test, wherein the test information includes type information of the security vulnerability, name information of a component involved in the security vulnerability, and information about a security vulnerability repair object; A generation module is used to generate a repair strategy based on the test information, a preset model and a preset knowledge base in response to a repair request for the security vulnerability.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored executable program, wherein when the executable program is executed, the device where the storage medium is located is controlled to execute the method according to any one of claims 1 to 7.

10. A computer program product, characterized in that The invention comprises a computer program which, when executed by a processor, implements the method according to any one of claims 1 to 7.

Images