Vulnerability detection method and device, electronic equipment and storage medium
By obtaining multiple feature information of the vulnerabilities to be detected and combining multiple models for identification, the problem of difficulty in accurately identifying new high-value vulnerabilities in the prior art is solved, achieving higher identification accuracy and reducing misjudgment.
Patent Information
- Application Number
- CN202411802176.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-09
- Publication Date
- 2025-04-08
AI Technical Summary
It is difficult for the existing technology to accurately identify new high-value vulnerabilities, especially when the model training data cannot cover multiple scenarios in the actual operating environment, it is easy to misjudgment that high-value vulnerabilities are low-value vulnerabilities.
By obtaining multiple feature information of the vulnerability to be detected, including preset feature catalogs, white hat portraits and third-party platform information, combined with preset high-value vulnerability models, anomaly detection models and clustering models, multi-level identification and screening are carried out to determine whether the vulnerability to be detected belongs to a high-value vulnerability cluster.
It improves the accurate identification of new high-value vulnerabilities, reduces misjudgment, and can identify new high-value vulnerabilities that are misjudged as low-value vulnerabilities.
Smart Images
Figure CN119783108A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the technical field of vulnerability detection, and in particular to a vulnerability detection method and device, electronic equipment, and storage medium. Background Art
[0002] High-value vulnerabilities usually refer to those that pose a greater threat to systems, data, or users, and may be exploited by malicious attackers to launch serious attacks. These vulnerabilities are often difficult to exploit and have a high degree of harm. Once successfully exploited, they may lead to serious consequences such as organizational operational interruption, data leakage, and property loss. Therefore, it is extremely important to accurately identify high-value vulnerabilities. In related technologies, a model is usually pre-trained to identify whether a vulnerability is a high-value vulnerability. However, since the training data of the model often cannot fully cover the multiple scenarios in the actual operating environment, the method of only using the model to identify whether the vulnerability is a high-value vulnerability will mistakenly identify some high-value vulnerabilities as low-value vulnerabilities. Especially when a new type of vulnerability appears, since there is no relevant data in the model's training data, it is difficult for the model to identify new high-value vulnerabilities.
[0003] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present application, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention
[0004] In order to provide a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. The summary is not an extensive review, nor is it intended to identify key / critical components or delineate the scope of protection of these embodiments, but rather serves as a prelude to the detailed description that follows.
[0005] The embodiments of the present application provide a vulnerability detection method and device, electronic device, and storage medium to identify new high-value vulnerabilities.
[0006] An embodiment of the present application provides a vulnerability detection method, including: obtaining a vulnerability to be detected and vulnerability information corresponding to the vulnerability to be detected; using a preset high-value vulnerability model to determine whether the vulnerability to be detected belongs to a high-value vulnerability according to the vulnerability information; if the vulnerability to be detected belongs to the high-value vulnerability, outputting the vulnerability to be detected as a high-value vulnerability; if the vulnerability to be detected does not belong to the high-value vulnerability, identifying the vulnerability to be detected using a preset anomaly detection model to determine whether the vulnerability to be detected belongs to a rare vulnerability; if it does not belong to a rare vulnerability, outputting the vulnerability to be detected as an ordinary vulnerability; if the vulnerability to be detected belongs to a rare vulnerability, analyzing whether the vulnerability to be detected belongs to a high-value vulnerability cluster in the clustering model using a preset clustering model; if it belongs to the high-value vulnerability cluster, outputting the vulnerability to be detected as a high-value vulnerability; if it does not belong to the high-value vulnerability cluster, outputting the vulnerability to be detected as an ordinary vulnerability.
[0007] In the above implementation, by re-identifying the low-value vulnerabilities identified by the high-value vulnerability model using the anomaly detection model, a vulnerability that is different from the common low-value vulnerabilities can be identified, and the vulnerability may be a new type of vulnerability. By determining whether the vulnerability to be detected belongs to the high-value vulnerability cluster, it is possible to accurately determine whether the vulnerability is a new type of high-value vulnerability, thereby identifying a new type of high-value vulnerability that is misjudged as a low-value vulnerability.
[0008] Furthermore, obtaining vulnerability information corresponding to the vulnerability to be detected includes: obtaining a preset feature catalog, the preset feature catalog including multiple vulnerability feature items; parsing the vulnerability to be detected to obtain first feature information corresponding to the vulnerability feature item; extracting second feature information corresponding to the vulnerability feature item from a white hat portrait of a submitter who provides the vulnerability to be detected; extracting third feature information corresponding to the vulnerability feature item from a preset third-party platform; the first feature information, the second feature information and the third feature information are used as the vulnerability information.
[0009] In the above implementation, by analyzing the vulnerability to be detected, the vulnerability items that meet the preset feature catalog are extracted from the white hat portrait of the submitter of the vulnerability to be detected and the preset third-party platform. In this way, more complete vulnerability information can be obtained through multiple channels.
[0010] Furthermore, before determining whether the vulnerability to be detected is a high-value vulnerability based on the vulnerability information using a preset high-value vulnerability model, it includes: determining whether the vulnerability information exists in a preset whitelist; the whitelist stores vulnerability information that is a high-value vulnerability; if the vulnerability information exists in the whitelist, outputting that the vulnerability information is a high-value vulnerability; if the vulnerability information does not exist in the whitelist, determining whether the vulnerability to be detected is a high-value vulnerability based on the vulnerability information using a preset high-value vulnerability model.
[0011] In the above implementation, by determining whether the vulnerability information of the vulnerability to be detected has certain characteristics of a high-value vulnerability, it is possible to easily and accurately distinguish whether the vulnerability to be detected is a high-value vulnerability, thereby reducing the workload of subsequently using a high-value vulnerability model to identify high-value vulnerabilities.
[0012] Furthermore, before determining whether the vulnerability to be detected is a high-value vulnerability based on the vulnerability information using a preset high-value vulnerability model, it includes: determining whether the vulnerability information exists in a preset blacklist, the blacklist storing vulnerability information belonging to low-value vulnerabilities; the utilization value of the low-value vulnerability is lower than the utilization value of the high-value vulnerability; if the vulnerability information exists in the blacklist, outputting that the vulnerability information belongs to a low-value vulnerability; if the vulnerability information does not exist in the blacklist, determining whether the vulnerability to be detected is a high-value vulnerability based on the vulnerability information using a preset high-value vulnerability model.
[0013] In the above implementation, by determining whether the vulnerability information of the vulnerability to be detected has certain characteristics of a low-value vulnerability, it is possible to easily and accurately distinguish whether the vulnerability to be detected is a low-value vulnerability, thereby reducing the workload of subsequently using a high-value vulnerability model to identify high-value vulnerabilities.
[0014] Furthermore, the high-value vulnerability model is obtained in the following manner: obtaining sample vulnerability information with a label indicating whether it is a high-value vulnerability; using the sample vulnerability information with a label indicating whether it is a high-value vulnerability to train a preset random forest model, and using a preset grid search algorithm to update the network parameters of the random forest model until the recognition accuracy of the random forest model reaches a set threshold, thereby obtaining the high-value vulnerability model.
[0015] Considering that the number of samples of high-value vulnerabilities is relatively small, the random forest model is used for training in this application. Since the random forest model constructs multiple decision trees and takes their average prediction results, it can reduce the overfitting risk caused by a single decision tree and improve the generalization ability of the model. By training the random forest model, the trained high-value vulnerability model can more accurately identify high-value vulnerabilities.
[0016] Furthermore, the clustering model includes multiple clusters of high-value vulnerability clusters; using a preset clustering model to analyze whether the vulnerability to be detected belongs to the high-value vulnerability cluster in the clustering model, including: determining whether there is a high-value vulnerability cluster in a cluster whose distance to the vulnerability to be detected is less than a preset distance; if so, determining that the vulnerability to be detected belongs to the high-value vulnerability cluster; if not, determining that the vulnerability to be detected does not belong to the high-value vulnerability cluster.
[0017] In the above implementation, if the distance between the vulnerability to be detected and a certain high-value vulnerability cluster is small, the characteristics characterizing the vulnerability to be detected are closer to the characteristics of the high-value vulnerability cluster, so the vulnerability to be detected is likely to belong to the same category as the high-value vulnerability corresponding to the high-value vulnerability cluster. In this way, determining that the vulnerability to be detected belongs to the high-value vulnerability cluster can facilitate determining the actual vulnerability type of the vulnerability to be detected.
[0018] Furthermore, the clustering model is obtained in the following manner: obtaining sample vulnerability information with high-value vulnerability labels and low-value vulnerability labels; clustering the sample vulnerability information with high-value vulnerability labels and low-value vulnerability labels using a preset clustering algorithm to obtain an alternative clustering model; and adjusting the parameters of the clustering algorithm until the silhouette coefficient of the alternative clustering model reaches a preset coefficient, and determining the alternative clustering model as the clustering model.
[0019] In the above implementation, by clustering the sample vulnerability information, vulnerabilities with similar characteristics can be clustered into a cluster, which helps to discover the common characteristics between the vulnerabilities and the correlation between the vulnerabilities, thereby facilitating the determination of the vulnerability type of the new vulnerability when a new vulnerability exists.
[0020] An embodiment of the present application provides an electronic device, including a processor and a memory, wherein the memory stores computer-executable instructions that can be executed by the processor, and the processor executes the computer-executable instructions to implement the above-mentioned vulnerability detection method.
[0021] An embodiment of the present application provides a storage medium, which stores computer-executable instructions. When the computer-executable instructions are called and executed by a processor, the computer-executable instructions enable the processor to implement the above-mentioned vulnerability detection method.
[0022] The above general description and the following description are exemplary and explanatory only and are not intended to limit the present application. BRIEF DESCRIPTION OF THE DRAWINGS
[0023] One or more embodiments are exemplarily described by corresponding drawings, and these exemplary descriptions and drawings do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings are considered similar elements, and the drawings do not constitute a scale limitation, and wherein:
[0024] Figure 1 is a schematic diagram of a vulnerability detection method provided by an embodiment of the present application;
[0025] Figure 2 is a schematic diagram of a vulnerability detection device provided in an embodiment of the present application;
[0026] Figure 3 It is a schematic diagram of an electronic device provided in an embodiment of the present application.
[0027] Reference numerals:
[0028] 1: Acquisition module; 2: First high value determination module; 3: Rare vulnerability determination module; 4: Second high value determination module; 5: Bus; 6: Processor; 7: Memory; 8: Communication interface. DETAILED DESCRIPTION
[0029] In order to be able to understand the features and technical contents of the embodiments of the present application in more detail, the implementation of the embodiments of the present application is described in detail below in conjunction with the accompanying drawings. The attached drawings are for reference only and are not used to limit the embodiments of the present application. In the following technical description, for the convenience of explanation, a full understanding of the disclosed embodiments is provided through multiple details. However, one or more embodiments can still be implemented without these details. In other cases, to simplify the drawings, well-known structures and devices can be simplified for display.
[0030] The terms "first", "second", etc. in the specification and claims of the embodiments of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the embodiments of the present application described here. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions.
[0031] Unless otherwise stated, the term "plurality" means two or more.
[0032] The term "correspondence" may refer to an association relationship or a binding relationship. The correspondence between A and B means that there is an association relationship or a binding relationship between A and B.
[0033] Embodiment 1
[0034] The present application provides a vulnerability detection method. Figure 1 As shown, Figure 1 A schematic diagram of a vulnerability detection method provided in an embodiment of the present application includes:
[0035] Step S101, obtaining a vulnerability to be detected and vulnerability information corresponding to the vulnerability to be detected.
[0036] In some embodiments, obtaining vulnerability information corresponding to the vulnerability to be detected includes: obtaining a preset feature catalog, the preset feature catalog including multiple vulnerability feature items; parsing the vulnerability to be detected, and obtaining first feature information corresponding to the vulnerability feature item; extracting second feature information corresponding to the vulnerability feature item from a white hat portrait of a submitter of the vulnerability to be detected; extracting third feature information corresponding to the vulnerability feature item from a preset third-party platform; the first feature information, the second feature information, and the third feature information are used as vulnerability information.
[0037] In the above embodiment, the first characteristic information may be the characteristics of the vulnerability itself, such as: the company to which the vulnerability belongs, the domain name to which the vulnerability belongs, the components used, the person who submitted the vulnerability, the type of vulnerability, the level of the vulnerability, the time when the vulnerability was submitted, the location where the vulnerability occurred, etc. Among them, the location where the vulnerability occurs, for example: APP (application), applet, website, hardware, linux (operating system kernel), etc.
[0038] In the above embodiment, the second characteristic information, for example: the number of vulnerabilities submitted by the vulnerability submitter, the proportion of valid vulnerabilities submitted by the vulnerability submitter in history, the proportion of high-risk vulnerabilities submitted by the vulnerability submitter, the proportion of high-value vulnerabilities submitted by the vulnerability submitter, the proportion of various types of vulnerabilities submitted by the vulnerability submitter, the proportion of various types of vulnerabilities ignored by the vulnerability submitter, etc.
[0039] In the above embodiment, the third characteristic information, for example: the Baidu index of the company to which the vulnerability to be detected belongs, the number of stars of the component of the vulnerability to be detected on GitHub (a software project hosting platform), the number of downloads of the component of the vulnerability to be detected on GitHub, etc.
[0040] Among them, the above examples of the first characteristic information, the second characteristic information and the third characteristic information are only exemplary, and the corresponding content can be obtained according to the vulnerability characteristic items set in the preset characteristic directory. Exemplarily, assuming that the vulnerability characteristic item only has the Baidu index of the company to which the vulnerability to be detected belongs, then the third characteristic information can only obtain the Baidu index of the company to which the vulnerability to be detected belongs. Assuming that the vulnerability characteristic item has the Baidu index of the company to which the vulnerability to be detected belongs and the number of downloads of the component of the vulnerability to be detected on github, then the third characteristic information needs to obtain the Baidu index of the company to which the vulnerability to be detected belongs and the number of downloads of the component of the vulnerability to be detected on github.
[0041] For example, as shown in Table 1, Table 1 is an example table of the preset feature catalog. As shown in Table 1, the feature catalog includes multiple vulnerability feature items, such as submit_num, submit_effect_ratio, etc. Among them, the vulnerability feature item "submit_num" means the number of vulnerabilities submitted by white hats. The vulnerability feature item "submit_effect_ratio" means the proportion of valid vulnerabilities submitted by white hats in history.
[0042]
[0043]
[0044] Table 1
[0045] Optionally, engineers may select features that may affect whether the vulnerability to be detected is a high-value vulnerability as vulnerability feature items in the feature catalog.
[0046] Step S102, using a preset high-value vulnerability model to determine whether the vulnerability to be detected is a high-value vulnerability based on vulnerability information. If the vulnerability to be detected is a high-value vulnerability, step S103 is executed; if the vulnerability to be detected is not a high-value vulnerability, step S104 is executed.
[0047] In some embodiments, step S102 may include: inputting vulnerability information into a preset high-value vulnerability model to obtain whether the vulnerability to be detected corresponding to the vulnerability information is a high-value vulnerability.
[0048] Exemplarily, vulnerability information that matches the vulnerability feature items in Table 1 is constructed into a 24-dimensional feature vector, and the 24-dimensional feature vector is input into a preset high-value vulnerability model to obtain whether the vulnerability to be detected corresponding to the vulnerability information is a high-value vulnerability.
[0049] In some embodiments, a high-value vulnerability model is obtained by: obtaining sample vulnerability information with a label indicating whether it is a high-value vulnerability; training a preset random forest model using the sample vulnerability information with a label indicating whether it is a high-value vulnerability, and updating the network parameters of the random forest model using a preset grid search algorithm until the recognition accuracy of the random forest model reaches a set threshold, thereby obtaining a high-value vulnerability model.
[0050] In the above embodiment, the sample vulnerability information with a label of whether it is a high-value vulnerability can be obtained in the following manner: obtain the sample vulnerability information from the vulnerability crowd testing platform, send the sample vulnerability information to the preset first annotation platform, and obtain the sample vulnerability information with a label of whether it is a high-value vulnerability fed back from the first annotation platform. Among them, the first annotation platform responds to the user's instructions to mark whether the sample vulnerability information is a high-value vulnerability label. Exemplarily, a high-value vulnerability is marked as 1, and a non-high-value vulnerability is marked as 0. Vulnerability crowd testing platform, for example: Wuyun crowd testing, vulnerability box, etc.
[0051] Optionally, the content of the sample vulnerability information may correspond to the vulnerability feature items in the feature catalog.
[0052] Optionally, engineers can set thresholds based on accuracy requirements.
[0053] In some embodiments, before determining whether the vulnerability to be detected is a high-value vulnerability based on vulnerability information using a preset high-value vulnerability model, the process includes: determining whether the vulnerability information exists in a preset whitelist; if the vulnerability information exists in the whitelist, outputting that the vulnerability information is a high-value vulnerability; if the vulnerability information does not exist in the whitelist, determining whether the vulnerability to be detected is a high-value vulnerability based on the vulnerability information using a preset high-value vulnerability model.
[0054] Optionally, the whitelist may store vulnerability information that is a high-value vulnerability. For example, if the vulnerability level is high risk, then if there is information in the vulnerability information that is the same as part or all of the vulnerability information stored in the whitelist, then the vulnerability information is considered to exist in the whitelist.
[0055] Optionally, the whitelist may store vulnerability information rules that belong to high-value vulnerabilities. At this time, if the vulnerability information satisfies one of the vulnerability information rules in the whitelist, the vulnerability information is considered to exist in the whitelist.
[0056] Exemplarily, in combination with Table 2, Table 2 is an example table of rules in the whitelist. As shown in Table 2, the rule is, for example: a high-risk vulnerability. Exemplarily, according to the vulnerability information of the vulnerability to be detected, it is determined that the vulnerability to be detected is a high-risk vulnerability, and the vulnerability to be detected is a high-value vulnerability. Among them, it can be directly determined whether the vulnerability to be detected is a high-risk vulnerability by the vulnerability level in the vulnerability information.
[0057] Serial number rule 1 Vulnerable design unit is on the list of critical infrastructure 2 Core assets 3 High-risk vulnerability 4 Alexa ranks SQL injection vulnerabilities in the top 50,000 5 Existing in enterprise APP
[0058] Table 2
[0059] In some embodiments, before determining whether the vulnerability to be detected is a high-value vulnerability based on vulnerability information using a preset high-value vulnerability model, it includes: determining whether the vulnerability information satisfies a preset blacklist rule; if the vulnerability information exists in the blacklist, outputting that the vulnerability information is a low-value vulnerability; if the vulnerability information does not exist in the blacklist, determining whether the vulnerability to be detected is a high-value vulnerability based on the vulnerability information using a preset high-value vulnerability model.
[0060] Among them, the exploitation value of low-value vulnerabilities is lower than that of high-value vulnerabilities.
[0061] Optionally, the blacklist stores vulnerability information belonging to low-value vulnerabilities, such as Alexa (a website that specializes in publishing the world ranking of websites) ranking 2 million.
[0062] Optionally, the blacklist stores vulnerability information rules belonging to low-value vulnerabilities.
[0063] Exemplarily, combined with Table 3, Table 3 is an example table of rules in the blacklist. As shown in Table 3, the rule is, for example: Alexa ranking is outside 1 million. Exemplarily, the Alexa ranking in the vulnerability information of the vulnerability to be detected is obtained. If the Alexa ranking of the vulnerability to be detected is outside 1 million, then the vulnerability to be detected is a low-value vulnerability.
[0064] Serial number rule 1 IP belongs to the intranet 2 Alexa ranks outside the 1 million 3 The validity of the vulnerability is False (error)
[0065] Table 3
[0066] Optionally, before using a preset high-value vulnerability model to determine whether the vulnerability to be detected is a high-value vulnerability based on vulnerability information, the vulnerability information can be screened using a whitelist and a blacklist.
[0067] Step S103: outputting the vulnerability to be detected as a high-value vulnerability.
[0068] Step S104, using a preset anomaly detection model to identify the vulnerability to be detected, and determine whether the vulnerability to be detected is a rare vulnerability. If the vulnerability to be detected is not a rare vulnerability, then execute step S105; if the vulnerability to be detected is a rare vulnerability, then execute step S106.
[0069] In some embodiments, vulnerability information of the vulnerability to be detected is input into a preset anomaly detection model to obtain whether the vulnerability to be detected corresponding to the vulnerability information is a rare vulnerability.
[0070] In some embodiments, the anomaly detection model can be obtained in the following manner: sample vulnerability information with labels of whether it is a rare vulnerability is input into a preset isolation forest model for training to obtain an anomaly detection model.
[0071] In some embodiments, sample vulnerability information with a label of whether it is a rare vulnerability can be obtained in the following manner: obtain sample vulnerability information from a vulnerability crowd testing platform, send the sample vulnerability information to a preset second annotation platform, and obtain sample vulnerability information with a label of whether it is a rare vulnerability fed back from the second annotation platform. The second annotation platform annotates the sample vulnerability information with a label of whether it is a rare vulnerability in response to a user's instruction.
[0072] Step S105: output that the vulnerability to be detected is a common vulnerability.
[0073] Step S106, using the preset clustering model to analyze whether the vulnerability to be detected belongs to the high-value vulnerability cluster in the clustering model. If it belongs to the high-value vulnerability cluster, execute step S107; if it does not belong to the high-value vulnerability cluster, execute step S108.
[0074] In some embodiments, the clustering model is obtained in the following manner: obtaining sample vulnerability information with high-value vulnerability and low-value vulnerability labels; clustering the sample vulnerability information with high-value vulnerability and low-value vulnerability labels using a preset clustering algorithm to obtain an alternative clustering model; and adjusting the parameters of the clustering algorithm until the silhouette coefficient of the alternative clustering model reaches a preset coefficient, and determining the alternative clustering model as the clustering model.
[0075] In the above embodiments, the clustering algorithm is, for example, a hierarchical clustering algorithm, a K-Means clustering algorithm (K-means clustering algorithm), a DBSCAN clustering algorithm (density-based clustering algorithm), and the like.
[0076] Exemplarily, assuming that the clustering algorithm is a hierarchical clustering algorithm, the parameters of the clustering algorithm can be adjusted by adjusting metric, linkage, and n_clusters (the number of clusters generated). Among them, metric can choose Euclidean distance, Manhattan distance, cosine similarity, precomputed, etc. linkage can choose ward, complete, average, single, etc. Among them, ward is to minimize the variance of the clusters to be merged. Complete is the farthest neighbor, and the farthest distance between classes is taken as the class distance. Average is the average distance, and the average distance of all distances between classes is taken as the class distance. Single is the nearest neighbor, and the closest distance between classes is taken as the class distance.
[0077] Exemplarily, the vulnerability information that matches the vulnerability feature items in Table 1 above is normalized, and after normalization, a hierarchical clustering algorithm is used for clustering, and the parameters of metric, linkage, and n_clusters in the hierarchical clustering algorithm are adjusted until the silhouette coefficient reaches a preset coefficient to obtain a clustering model. Among them, the preset coefficient can be 1. In this way, the silhouette coefficient is used to reflect the compactness and separation of the clustering evaluation. After clustering using the clustering algorithm, the silhouette coefficient is equal to 1 when each cluster contains high-value vulnerabilities or low-value vulnerabilities. If there are more high-value vulnerabilities and low-value vulnerabilities in a cluster, the lower the silhouette coefficient. Engineers can set the preset coefficient according to actual accuracy requirements.
[0078] In some embodiments, a preset clustering model is used to analyze whether the vulnerability to be detected belongs to a high-value vulnerability cluster in the clustering model, including: determining whether there is a high-value vulnerability cluster in a cluster whose distance to the vulnerability to be detected is less than a preset distance; if so, determining that the vulnerability to be detected belongs to the high-value vulnerability cluster; if not, determining that the vulnerability to be detected does not belong to the high-value vulnerability cluster.
[0079] In the above embodiment, a first feature vector representing vulnerability information of a vulnerability to be detected and a second feature vector representing a high-value vulnerability cluster can be obtained; for each second feature vector: the distance between the second feature vector and the first feature vector is calculated, and the distance is used as the distance between the high-value vulnerability cluster corresponding to the second feature vector and the vulnerability to be detected.
[0080] Step S107: outputting the vulnerability to be detected as a high-value vulnerability.
[0081] Step S108: output that the vulnerability to be detected is a common vulnerability.
[0082] Exemplarily, the vulnerability to be detected and the vulnerability information corresponding to the vulnerability to be detected are obtained, and the vulnerability information is judged by using the whitelist to determine whether the vulnerability to be detected belongs to a high-value vulnerability. If the vulnerability to be detected is not a high-value vulnerability, the vulnerability information is judged by using the blacklist to determine whether the vulnerability to be detected belongs to a low-value vulnerability. If the vulnerability to be detected is not a low-value vulnerability, the preset high-value vulnerability model is used to determine whether the vulnerability to be detected belongs to a high-value vulnerability according to the vulnerability information. If the vulnerability to be detected is not a high-value vulnerability, the vulnerability to be detected is identified by using the preset anomaly detection model to determine whether the vulnerability to be detected belongs to a rare vulnerability. If the vulnerability to be detected belongs to a rare vulnerability, a clustering model including multiple clusters of high-value vulnerability clusters is obtained to determine whether there is a high-value vulnerability cluster in the cluster whose distance to the vulnerability to be detected is less than the preset distance; if so, it is determined that the vulnerability to be detected belongs to the high-value vulnerability cluster. In this way, considering that the whitelist cannot fully record the information belonging to the high-value vulnerability, and the blacklist cannot fully record the information belonging to the low-value vulnerability, after screening by the whitelist and the blacklist, the high-value vulnerability model can be used to screen out the unidentified high-value vulnerabilities. Afterwards, using anomaly detection models and clustering models, new types of high-value vulnerabilities can be further screened out, thereby improving the accuracy of identifying high-value vulnerabilities.
[0083] Embodiment 2
[0084] Based on the same inventive concept, the present application embodiment provides a vulnerability detection device, such as Figure 2 As shown, the vulnerability detection device includes: an acquisition module 1, a first high-value determination module 2, a rare vulnerability determination module 3 and a second high-value determination module 4. Among them, the acquisition module 1 is used to obtain the vulnerability to be detected and the vulnerability information corresponding to the vulnerability to be detected; the first high-value determination module 2 is used to use a preset high-value vulnerability model to determine whether the vulnerability to be detected belongs to a high-value vulnerability according to the vulnerability information; if the vulnerability to be detected belongs to a high-value vulnerability, then the vulnerability to be detected is output as a high-value vulnerability; the rare vulnerability determination module 3 is used to use a preset abnormal detection model to identify the vulnerability to be detected if the vulnerability to be detected does not belong to a high-value vulnerability, and determine whether the vulnerability to be detected belongs to a rare vulnerability; if it does not belong to a rare vulnerability, then the vulnerability to be detected is output as a common vulnerability; the second high-value determination module 4, if the vulnerability to be detected belongs to a rare vulnerability, uses a preset clustering model to analyze whether the vulnerability to be detected belongs to a high-value vulnerability cluster in the clustering model; if it belongs to a high-value vulnerability cluster, then the vulnerability to be detected is output as a high-value vulnerability; if it does not belong to a high-value vulnerability cluster, then the vulnerability to be detected is output as a common vulnerability.
[0085] In some embodiments, the acquisition module 1 is used to obtain vulnerability information corresponding to the vulnerability to be detected in the following manner: obtain a preset feature directory, the preset feature directory includes multiple vulnerability feature items; parse the vulnerability to be detected, and obtain first feature information corresponding to the vulnerability feature item; extract second feature information corresponding to the vulnerability feature item from the white hat portrait of the submitter of the vulnerability to be detected; extract third feature information corresponding to the vulnerability feature item from a preset third-party platform; the first feature information, the second feature information, and the third feature information are used as vulnerability information.
[0086] In some embodiments, the first high-value determination module 2 is also used to use a preset high-value vulnerability model to determine whether the vulnerability to be detected belongs to a high-value vulnerability based on the vulnerability information: determine whether the vulnerability information exists in a preset whitelist; the whitelist stores vulnerability information belonging to high-value vulnerabilities; if the vulnerability information exists in the whitelist, output that the vulnerability information belongs to a high-value vulnerability; if the vulnerability information does not exist in the whitelist, use the preset high-value vulnerability model to determine whether the vulnerability to be detected belongs to a high-value vulnerability based on the vulnerability information.
[0087] In some embodiments, the first high-value determination module 2 is also used to use a preset high-value vulnerability model to determine whether the vulnerability to be detected belongs to a high-value vulnerability based on the vulnerability information: determine whether the vulnerability information exists in a preset blacklist; the blacklist stores vulnerability information belonging to low-value vulnerabilities; the utilization value of low-value vulnerabilities is lower than the utilization value of high-value vulnerabilities; if the vulnerability information exists in the blacklist, output that the vulnerability information belongs to a low-value vulnerability; if the vulnerability information does not exist in the blacklist, use the preset high-value vulnerability model to determine whether the vulnerability to be detected belongs to a high-value vulnerability based on the vulnerability information.
[0088] In some embodiments, the vulnerability detection device also includes: a model training module, used to obtain sample vulnerability information with a label of whether it is a high-value vulnerability; use the sample vulnerability information with a label of whether it is a high-value vulnerability to train a preset random forest model, and use a preset grid search algorithm to update the network parameters of the random forest model until the recognition accuracy of the random forest model reaches a set threshold, thereby obtaining a high-value vulnerability model.
[0089] In some embodiments, the second high-value determination module 4 is used to analyze whether the vulnerability to be detected belongs to the high-value vulnerability cluster in the clustering model using a preset clustering model in the following manner: determine whether there is a high-value vulnerability cluster in the cluster whose distance to the vulnerability to be detected is less than a preset distance; if so, determine that the vulnerability to be detected belongs to the high-value vulnerability cluster; if not, determine that the vulnerability to be detected does not belong to the high-value vulnerability cluster.
[0090] In some embodiments, the vulnerability detection device also includes: a clustering module, which is used to obtain sample vulnerability information with high-value vulnerability and low-value vulnerability labels; clustering the sample vulnerability information with high-value vulnerability and low-value vulnerability labels using a preset clustering algorithm to obtain an alternative clustering model; and adjusting the parameters of the clustering algorithm until the silhouette coefficient of the alternative clustering model reaches a preset coefficient, and determining the alternative clustering model as the clustering model.
[0091] It can be understood that the various embodiments described in the first embodiment are also applicable to the second embodiment if there is no conflict. Based on the consideration of brevity of description, they will not be repeated here.
[0092] Embodiment 3
[0093] Combination Figure 3 As shown, an embodiment of the present application provides an electronic device, including a processor 6 and a memory 7. Optionally, the device may also include a communication interface 8 and a bus 5. The processor 6, the communication interface 8, and the memory 7 may communicate with each other through the bus 5. The communication interface 8 may be used for information transmission. The processor 6 may call the logic instructions in the memory 7 to execute the above-mentioned vulnerability detection method.
[0094] In addition, the logic instructions in the above-mentioned memory 7 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product.
[0095] The memory 7 is a computer-readable storage medium that can be used to store software programs and computer executable programs, such as program instructions / modules corresponding to the method in the embodiment of the present application. The processor 6 executes the program instructions / modules stored in the memory 7 to execute functional applications and data processing, that is, to implement the vulnerability detection method in the above embodiment.
[0096] The memory 7 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required for at least one function; the data storage area may store data created according to the use of the terminal device, etc. In addition, the memory 7 may include a high-speed random access memory and may also include a non-volatile memory.
[0097] The electronic device may be a computer or a server, etc.
[0098] An embodiment of the present application provides a storage medium storing computer executable instructions, wherein the computer executable instructions are configured to execute the above-mentioned vulnerability detection method.
[0099] An embodiment of the present application provides a computer program product, which includes a computer program stored on a storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the above-mentioned vulnerability detection method.
[0100] The computer-readable storage medium mentioned above may be a transient computer-readable storage medium or a non-transitory computer-readable storage medium.
[0101] The technical solution of the embodiment of the present application can be embodied in the form of a software product, which is stored in a storage medium and includes one or more instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in the embodiment of the present application. The aforementioned storage medium can be a non-transient storage medium, including: a USB flash drive, a mobile hard disk, a read-only memory, a random access memory, a magnetic disk or an optical disk, etc., which can store program codes, or a transient storage medium.
[0102] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.
[0103] The above description is only an embodiment of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application. At the same time, the above embodiments can be combined with each other to form new embodiments without conflict.
Claims
1. A vulnerability detection method, characterized in that: include: Obtaining a vulnerability to be detected and vulnerability information corresponding to the vulnerability to be detected; Determine whether the vulnerability to be detected is a high-value vulnerability according to the vulnerability information by using a preset high-value vulnerability model; If the vulnerability to be detected belongs to the high-value vulnerability, outputting that the vulnerability to be detected is a high-value vulnerability; If the vulnerability to be detected does not belong to the high-value vulnerability, the vulnerability to be detected is identified by using a preset anomaly detection model to determine whether the vulnerability to be detected is a rare vulnerability; If it does not belong to the rare vulnerability, output the vulnerability to be detected as a common vulnerability; If the vulnerability to be detected belongs to the rare vulnerability, a preset clustering model is used to analyze whether the vulnerability to be detected belongs to a high-value vulnerability cluster in the clustering model; If it belongs to the high-value vulnerability cluster, outputting the vulnerability to be detected as a high-value vulnerability; If it does not belong to the high-value vulnerability cluster, the vulnerability to be detected is output as a common vulnerability.
2. The method according to claim 1, characterized in that Get vulnerability information corresponding to the vulnerability to be detected, including: Obtain a preset feature catalog, wherein the preset feature catalog includes multiple vulnerability feature items; Analyze the vulnerability to be detected and obtain first feature information corresponding to the feature item of the vulnerability; Extracting second feature information corresponding to the vulnerability feature item from the white hat portrait of the submitter who provides the vulnerability to be detected; The third feature information corresponding to the vulnerability feature item is extracted from a preset third-party platform; the first feature information, the second feature information and the third feature information are used as the vulnerability information.
3. The method according to claim 1, characterized in that Before determining whether the vulnerability to be detected is a high-value vulnerability according to the vulnerability information using a preset high-value vulnerability model, the following steps are included: Determine whether the vulnerability information exists in a preset whitelist; the whitelist stores vulnerability information belonging to high-value vulnerabilities; If the vulnerability information exists in the whitelist, outputting that the vulnerability information belongs to a high-value vulnerability; If the vulnerability information does not exist in the whitelist, a preset high-value vulnerability model is used to determine whether the vulnerability to be detected is a high-value vulnerability according to the vulnerability information.
4. The method according to claim 1, characterized in that: Before determining whether the vulnerability to be detected is a high-value vulnerability according to the vulnerability information using a preset high-value vulnerability model, the following steps are included: Determine whether the vulnerability information exists in a preset blacklist; the blacklist stores vulnerability information belonging to low-value vulnerabilities; the utilization value of the low-value vulnerabilities is lower than the utilization value of the high-value vulnerabilities; If the vulnerability information exists in the blacklist, outputting that the vulnerability information belongs to a low-value vulnerability; If the vulnerability information does not exist in the blacklist, a preset high-value vulnerability model is used to determine whether the vulnerability to be detected is a high-value vulnerability according to the vulnerability information.
5. The method according to claim 1, characterized in that The high-value vulnerability model is obtained in the following way: Obtain sample vulnerability information with labels of whether it is a high-value vulnerability; The preset random forest model is trained using the sample vulnerability information with whether it is a high-value vulnerability label, and the network parameters of the random forest model are updated using a preset grid search algorithm until the recognition accuracy of the random forest model reaches a set threshold, thereby obtaining the high-value vulnerability model.
6. The method according to any one of claims 1 to 5, characterized in that: The clustering model includes multiple high-value vulnerability clusters; using the preset clustering model to analyze whether the vulnerability to be detected belongs to the high-value vulnerability cluster in the clustering model, including: Determine whether there is a high-value vulnerability cluster in the cluster whose distance to the vulnerability to be detected is less than a preset distance; if so, determine that the vulnerability to be detected belongs to the high-value vulnerability cluster; if not, determine that the vulnerability to be detected does not belong to the high-value vulnerability cluster.
7. The method according to any one of claims 1 to 5, characterized in that: The clustering model is obtained in the following way: Get sample vulnerability information with high-value vulnerability and low-value vulnerability labels; The sample vulnerability information with high-value vulnerability and low-value vulnerability labels is clustered using a preset clustering algorithm to obtain an alternative clustering model; and the parameters of the clustering algorithm are adjusted until the silhouette coefficient of the alternative clustering model reaches a preset coefficient, and the alternative clustering model is determined as the clustering model.
8. A vulnerability detection device, characterized in that: include: An acquisition module, used to acquire a vulnerability to be detected and vulnerability information corresponding to the vulnerability to be detected; A first high-value determination module is used to determine whether the vulnerability to be detected belongs to a high-value vulnerability according to the vulnerability information by using a preset high-value vulnerability model; if the vulnerability to be detected belongs to the high-value vulnerability, output that the vulnerability to be detected is a high-value vulnerability; A rare vulnerability determination module is used to identify the vulnerability to be detected by using a preset anomaly detection model if the vulnerability to be detected does not belong to the high-value vulnerability, and determine whether the vulnerability to be detected belongs to a rare vulnerability; if it does not belong to the rare vulnerability, output that the vulnerability to be detected is a common vulnerability; The second high-value determination module, if the vulnerability to be detected belongs to the rare vulnerability, uses a preset clustering model to analyze whether the vulnerability to be detected belongs to the high-value vulnerability cluster in the clustering model; if it belongs to the high-value vulnerability cluster, outputs the vulnerability to be detected as a high-value vulnerability; if it does not belong to the high-value vulnerability cluster, outputs the vulnerability to be detected as a common vulnerability.
9. An electronic device, characterized in that: The invention comprises a processor and a memory, wherein the memory stores computer executable instructions that can be executed by the processor, and the processor executes the computer executable instructions to implement the vulnerability detection method according to any one of claims 1 to 7.
10. A storage medium, characterized in that: The storage medium stores computer executable instructions, and when the computer executable instructions are called and executed by the processor, the computer executable instructions enable the processor to implement the vulnerability detection method described in any one of claims 1 to 7.