Network security vulnerability identification and repair method and system, medium and program product

Abstract

The invention discloses a network security vulnerability identification and repair method and system, a medium and a program product, and the method comprises the steps: segmenting a system behavior sequence into a plurality of subsequences; constructing a behavior dependency graph; calculating functional similarity, and dividing the functional similarity into node clusters; calculating a behavior consistency score, and determining a potential vulnerability region; determining call chain information; constructing a vulnerability propagation path, and calculating criticality; dividing first-level hazard vulnerabilities, second-level hazard vulnerabilities and third-level hazard vulnerabilities according to the criticality; determining a repair priority, and generating a vulnerability report; according to the vulnerability types, the repair priorities and the propagation path information, corresponding repair strategies are sequentially matched from a preset repair template library according to the sequence of the repair priorities; and performing hierarchical repair on the application code based on the repair strategy obtained by matching to obtain a repair code, and deploying the repair code to the target system. According to the invention, the accuracy and efficiency of identifying and repairing network security vulnerabilities are improved.

Description

Technical Field

[0001] The present application relates to the field of network protection, and in particular to a network security vulnerability identification and repair method, system, medium and program product. Background Art

[0002] With the rapid development of information technology, network security issues have become increasingly prominent, and network security vulnerabilities have become an important factor threatening the security of information systems. Since network security vulnerabilities are highly concealed, harmful, and spread quickly, traditional manual vulnerability identification methods are inefficient and difficult to detect and repair vulnerabilities in a timely manner, which can easily cause information systems to be attacked and data leaks.

[0003] In related technologies, the vulnerability scanning method based on the feature library is mainly used. By pre-building a vulnerability feature library, the target system is scanned and matched to identify known vulnerabilities in the system. This method can quickly identify security risks that match the vulnerabilities recorded in the feature library and provide corresponding repair suggestions, thereby improving the efficiency of vulnerability identification and repair.

[0004] However, the vulnerability identification method based on the feature library is too dependent on known vulnerability features and has a weak ability to identify unknown vulnerabilities or variant vulnerabilities. As vulnerability attack methods continue to evolve, it is difficult to meet the identification needs of new vulnerabilities by relying solely on static feature matching, which is prone to missed reports and false positives, reducing the accuracy and efficiency of vulnerability identification and repair. Summary of the invention

[0005] The present application provides a network security vulnerability identification and repair method, system, medium and program product for improving the accuracy and efficiency of identifying and repairing network security vulnerabilities.

[0006] In a first aspect, the present application provides a network security vulnerability identification and repair method, which generates a system behavior sequence according to the target system application code, and divides the system behavior sequence into a number of subsequences based on a preset vulnerability feature library; Construct a behavior dependency graph based on the temporal relationship of several subsequences; Calculate the functional similarity between nodes in the behavior dependency graph, and divide the nodes whose functional similarity is greater than a preset similarity into the same node cluster; Calculate the behavior consistency score between nodes in each node cluster, and mark the node clusters with behavior consistency scores less than the preset consistency threshold as potential vulnerability areas; Determine call chain information based on function call relationships between nodes in the potential vulnerability area; Construct the vulnerability propagation path based on the call chain information, and calculate the degree of harm of each node in the vulnerability propagation path; According to the degree of harm of each node, the corresponding node is divided into a first-level harm vulnerability, a second-level harm vulnerability and a third-level harm vulnerability. The harm degree corresponding to the node in the first-level harm vulnerability is greater than the first preset threshold, the harm degree corresponding to the node in the second-level harm vulnerability is greater than the second preset threshold and not greater than the first preset threshold, and the harm degree corresponding to the node in the third-level harm vulnerability is not greater than the second preset threshold; Determine the repair priority based on the first-level, second-level, and third-level vulnerabilities, and generate a vulnerability report that includes vulnerability type, vulnerability location, propagation path, and repair priority; According to the vulnerability type, repair priority and propagation path information, the corresponding repair strategies are matched in sequence from the preset repair template library in the order of repair priority; Based on the matched repair strategy, the application code is repaired in stages to obtain the repair code, and the repair code is deployed to the target system.

[0007] By adopting the above technical solution, the system behavior sequence is generated for the application code and the behavior dependency graph is constructed based on the timing relationship, which can fully express the dependency relationship between the functional modules in the system. By calculating the functional similarity and behavior consistency scores between nodes, the code area with abnormal behavior in the program can be accurately identified. Combined with the call chain information determined by the function call relationship, the propagation path of the vulnerability is constructed, and the vulnerability is divided into different levels through quantitative calculation of the degree of hazard, making the location of the vulnerability more accurate and the classification more reasonable. By matching the repair strategy from the preset repair template library and performing graded repair, the systematic and targeted nature of the repair process is guaranteed, the impact of the repair process on the normal function of the system is reduced, and the accuracy and efficiency of identifying and repairing network security vulnerabilities are improved.

[0008] In conjunction with some embodiments of the first aspect, in some embodiments, generating a system behavior sequence according to the target system application code specifically includes: Extract data flow information and control flow information from application code; Based on data flow information and control flow information, a depth-first search algorithm is used to construct the program execution path; Program behavior features are collected sequentially along the program execution path, and the program behavior features are organized into a system behavior sequence according to the execution order.

[0009] By adopting the above technical solution, extracting the data flow information and control flow information of the application code, and using the depth-first search algorithm to build the program execution path, all possible execution branches in the program can be fully covered. By collecting and organizing program behavior features to form a system behavior sequence, the dynamic execution process of the program can be fully recorded. This system behavior sequence generation method based on depth-first search solves the problem that traditional static analysis methods are difficult to handle complex program logic, and improves the integrity and accuracy of the behavior sequence. The system behavior sequence can accurately reflect the actual running status of the program, providing a reliable data basis for subsequent vulnerability identification and improving the accuracy of vulnerability identification.

[0010] In conjunction with some embodiments of the first aspect, in some embodiments, calculating the functional similarity between nodes in the behavior dependency graph specifically includes: Extract the function name, parameter type and return value type of each node and construct the function feature vector; Analyze the code structure characteristics of each node and construct a structure feature vector based on the code structure characteristics. The code structure characteristics include control flow, call mode and exception handling method; Count the types and frequency of system resources accessed by each node and construct resource feature vectors; Based on the function feature vector, structure feature vector and resource feature vector, the weighted cosine similarity algorithm is used to calculate the functional similarity between nodes.

[0011] By adopting the above technical solution, function feature vectors, structure feature vectors and resource feature vectors are constructed, and the characteristics of program nodes are comprehensively described from three dimensions: function attributes, code structure and resource access. The weighted cosine similarity algorithm is used to calculate the functional similarity between nodes, and the information of multiple dimensions such as function name, parameter type, return value type, control flow, call mode, exception handling method and system resource access characteristics is quantified and calculated, making the similarity calculation results more objective and accurate, and being able to more accurately identify program modules with similar functions, thereby improving the accuracy of subsequent vulnerability identification.

[0012] In combination with some embodiments of the first aspect, in some embodiments, after deploying the repair code to the target system, the method further includes: Obtain control flow information, data flow information, and resource access information of the repair code; Construct a multi-dimensional execution dependency graph based on control flow information, data flow information and resource access information; Perform reverse tracing analysis on the multi-dimensional execution dependency graph to obtain a set of risk path combinations; Perform dynamic injection testing based on risk path combination sets and generate test result sets; The repair code is recursively optimized according to the test result set until the risk path combination set is an empty set.

[0013] By adopting the above technical solutions, the control flow information, data flow information and resource access information of the repair code are obtained to build a multi-dimensional execution dependency graph, and a comprehensive dependency analysis is performed on the repaired code. Potential risk path combinations are identified through reverse tracing analysis, and dynamic injection tests are performed to verify the repair effect. Based on the test results, the repair code is recursively optimized until all risk paths are eliminated, ensuring the integrity and reliability of the repair. This verification method based on multi-dimensional dependency analysis and recursive optimization can promptly discover new problems introduced during the repair process, and improve the correctness of the repair through continuous optimization, reducing secondary problems that occur during the repair process and improving the quality of vulnerability repair.

[0014] In conjunction with some embodiments of the first aspect, in some embodiments, constructing a multidimensional execution dependency graph based on control flow information, data flow information, and resource access information specifically includes: Construct a control flow graph based on the control flow information to obtain a first dependency subgraph; Analyze the definition and use chain of variables based on data flow information to obtain the second dependency subgraph; Identify the mutually exclusive access sequence of resources based on the resource access information, and obtain a third dependency subgraph; Perform graph-theoretic fusion on the first dependency subgraph, the second dependency subgraph, and the third dependency subgraph to obtain an initial multi-dimensional dependency graph; The transitive closure between nodes in the initial multidimensional dependency graph is calculated to obtain a multidimensional execution dependency graph.

[0015] By adopting the above technical solutions, control flow graph, data flow graph and resource access are constructed respectively. Figure 3 The multi-dimensional execution dependency graph is constructed by combining the sub-graphs of different dimensions and fusing them with graph theory to form a complete multi-dimensional execution dependency graph, which can fully capture the control dependency, data transfer relationship and resource competition relationship in the program, so that the system can more accurately identify potential security vulnerabilities. The construction process of the multi-dimensional execution dependency graph integrates different types of program behavior characteristics, enhances the ability to identify complex vulnerability patterns, and improves the accuracy and completeness of vulnerability detection.

[0016] In conjunction with some embodiments of the first aspect, in some embodiments, before performing a dynamic injection test based on the risk path combination set, the method further includes: Construct a test vector space according to the risk path combination set, the test vector space includes input parameter combination, execution timing combination and resource status combination; The test vector space is optimized using a genetic algorithm to obtain an optimized test scenario set; Establish a causal analysis model based on the optimized set of test scenarios; Calculate the impact weight value of each test scenario in the causal analysis model; The paths in the risk path combination set are hierarchically sorted according to the impact weight values ​​to obtain a priority sorting table.

[0017] By adopting the above technical solution, a test vector space containing input parameter combinations, execution timing combinations and resource status combinations is constructed, and the test scenarios are optimized using genetic algorithms, thus establishing a scientific test optimization mechanism. This test optimization method based on genetic algorithms can reduce the scale of the test space while maintaining the representativeness and coverage of the test scenarios. By establishing a causal analysis model and calculating the impact weight values ​​of the test scenarios, the system can identify the test scenarios that have the greatest impact on program security, so that test resources can be more effectively allocated to the critical path. This intelligent test scenario optimization method reduces the resource consumption of the test while improving the pertinence and efficiency of the test. By prioritizing the test scenarios, the system can discover potential security issues more quickly and improve the efficiency and reliability of vulnerability repair verification.

[0018] In conjunction with some embodiments of the first aspect, in some embodiments, recursive optimization of the repair code according to the test result set specifically includes: Construct an optimization strategy decision tree, and traverse the optimization strategy decision tree to obtain a set of optimization solutions; Calculate the performance overhead value, implementation complexity value and maintenance cost value of each solution in the set of optimization solutions; Determine the optimal solution based on performance overhead, implementation complexity, and maintenance cost; Refactor the repair code according to the optimal solution and update the multi-dimensional execution dependency graph; When it is determined that the updated multi-dimensional execution dependency graph has a risk path, the step of constructing an optimization strategy decision tree is executed.

[0019] By adopting the above technical solutions, constructing an optimization strategy decision tree and evaluating the solution by combining performance overhead value, implementation complexity value and maintenance cost value, a comprehensive code optimization decision mechanism is established. This multi-dimensional optimization evaluation method can take into account the performance and maintainability of the system while ensuring security. By optimizing the repair code in a recursive manner, the system can continuously improve the code quality until all risk paths are eliminated, making the code repair process more systematic and controllable. By comprehensively considering multiple optimization indicators, the system can find the best balance between security, performance and maintainability, improving the practicality and reliability of the repair solution. This recursive optimization method improves the quality and stability of code repair and reduces the side effects that may occur after repair.

[0020] In a second aspect, an embodiment of the present application provides a network security vulnerability identification and repair system, which network security vulnerability identification and repair system includes: one or more processors and a memory; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code includes computer instructions, and one or more processors call the computer instructions to enable the system to execute the method described in the first aspect and any possible implementation method of the first aspect.

[0021] In a third aspect, an embodiment of the present application provides a computer-readable storage medium, comprising instructions, which, when executed on a system, causes the system to execute the method described in the first aspect and any possible implementation of the first aspect.

[0022] In a fourth aspect, an embodiment of the present application provides a computer program product, characterized in that when the computer program product runs on a system, the system executes the method described in any possible implementation manner in the first aspect.

[0023] One or more technical solutions provided in the embodiments of the present application have at least the following technical effects or advantages: 1. The present application provides a method for identifying and repairing network security vulnerabilities, which generates a system behavior sequence for application code and constructs a behavior dependency graph based on the timing relationship, which can fully express the dependency relationship between the functional modules in the system. By calculating the functional similarity and behavior consistency scores between nodes, the code area with abnormal behavior in the program can be accurately identified. Combined with the call chain information determined by the function call relationship, the propagation path of the vulnerability is constructed, and the vulnerabilities are divided into different levels through quantitative calculation of the degree of hazard, so that the location of the vulnerability is more accurate and the classification is more reasonable. By matching the repair strategy from the preset repair template library and performing graded repair, the systematic and targeted nature of the repair process is guaranteed, the impact of the repair process on the normal function of the system is reduced, and the accuracy and efficiency of identifying and repairing network security vulnerabilities are improved.

[0024] 2. The present application provides a method for identifying and repairing network security vulnerabilities, which obtains the control flow information, data flow information, and resource access information of the repair code to construct a multi-dimensional execution dependency graph, and performs a comprehensive dependency analysis on the repaired code. Potential risk path combinations are identified through reverse tracing analysis, and dynamic injection tests are performed to verify the repair effect. Based on the test results, the repair code is recursively optimized until all risk paths are eliminated, ensuring the integrity and reliability of the repair. This verification method based on multi-dimensional dependency analysis and recursive optimization can promptly discover new problems introduced during the repair process, and improve the correctness of the repair through continuous optimization, reducing secondary problems that occur during the repair process and improving the quality of vulnerability repair.

[0025] 3. The present application provides a method for identifying and repairing network security vulnerabilities, constructs a test vector space including input parameter combinations, execution timing combinations, and resource state combinations, and optimizes the test scenarios using genetic algorithms to establish a scientific test optimization mechanism. This test optimization method based on genetic algorithms can reduce the scale of the test space while maintaining the representativeness and coverage of the test scenarios. By establishing a causal analysis model and calculating the impact weight values ​​of the test scenarios, the system can identify the test scenarios that have the greatest impact on program security, so that test resources can be more effectively allocated to the critical path. This intelligent test scenario optimization method reduces the resource consumption of the test while improving the pertinence and efficiency of the test. By prioritizing the test scenarios, the system can discover potential security issues more quickly and improve the efficiency and reliability of vulnerability repair verification. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 It is a flow chart of a method for identifying and repairing network security vulnerabilities in an embodiment of the present application.

[0027] Figure 2 It is a flow chart of a method for verifying and optimizing a repair code in an embodiment of the present application.

[0028] Figure 3 It is a schematic diagram of the physical device structure of a network security vulnerability identification and repair system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0029] The terms used in the following embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to be used as limitations to the present application. As used in the specification and appended claims of the present application, the singular expressions "one", "a kind of", "said", "above", "the" and "this" are intended to also include plural expressions, unless there is a clear indication to the contrary in the context. It should also be understood that the term "and / or" used in the present application refers to any or all possible combinations comprising one or more listed items.

[0030] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as suggesting or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features, and in the description of the embodiments of the present application, unless otherwise specified, "plurality" means two or more.

[0031] The following uses an embodiment and combines Figure 1 , a network security vulnerability identification and repair method in an embodiment of the present application is described: See also Figure 1 , which is a flow chart of a method for identifying and repairing network security vulnerabilities in an embodiment of the present application.

[0032] S101, generating a system behavior sequence according to the target system application code, and dividing the system behavior sequence into a plurality of subsequences based on a preset vulnerability feature library; The system generates a system behavior sequence based on the target system application code. Specifically: extract the data flow information and control flow information in the application code; use the depth-first search algorithm to build the program execution path based on the data flow information and control flow information; collect program behavior features along the program execution path, and organize the program behavior features into a system behavior sequence according to the execution order. And divide the system behavior sequence into several subsequences based on the preset vulnerability feature library.

[0033] In this step, the system first needs to obtain the application code of the target system, and then analyze and process the code to extract the data flow information and control flow information contained therein. The data flow information reflects the flow and transmission of data during the execution of the program, while the control flow information describes the logical order and branch structure of the program execution. By comprehensively utilizing the data flow and control flow information, the system can restore the complete execution process of the application.

[0034] After obtaining the data flow and control flow information, the system can use the depth-first search algorithm to start from the program entry node and explore all possible execution paths along each branch in turn until the entire program is traversed. In this process, the system will identify and record the program behavior characteristics on each execution path, such as function calls, data reading and writing, conditional judgments, etc., and organize them into a system behavior sequence according to the actual execution order to describe the overall operation of the entire application.

[0035] S102, constructing a behavior dependency graph according to the temporal relationship of the plurality of subsequences, calculating the functional similarity between the nodes in the behavior dependency graph, and dividing the nodes whose functional similarity is greater than a preset similarity into the same node cluster; The system constructs a behavior dependency graph based on the temporal relationship of several subsequences and calculates the functional similarity between each node in the behavior dependency graph. Specifically: extract the function name, parameter type and return value type of each node to construct a function feature vector; analyze the code structure characteristics of each node, and construct a structure feature vector based on the code structure characteristics. The code structure characteristics include control flow, call mode and exception handling method; count the system resource types and access frequencies accessed by each node to construct a resource feature vector; based on the function feature vector, structure feature vector and resource feature vector, use the weighted cosine similarity algorithm to calculate the functional similarity between each node. Then, the system calculates the functional similarity between each node in the behavior dependency graph, and divides the nodes with functional similarity greater than the preset similarity into the same node cluster.

[0036] In this step, the system needs to organize the several behavior subsequences obtained in step S101 into a behavior dependency graph model that can reflect the chronological dependency relationship between the subsequences. In order to construct the graph model, the system must first analyze the chronological order of the subsequences on the time axis, determine which subsequences are executed in parallel, and which subsequences have dependency constraints.

[0037] After clarifying the temporal relationship of each subsequence, the system can choose a data structure such as a directed acyclic graph, abstract each subsequence as a node in the graph, and add directed edges based on the dependency relationship between them, thus forming a complete behavior dependency graph. In order to further reveal the functional semantic relevance of different subsequences, the system also needs to calculate the similarity between the nodes in the graph.

[0038] Specifically, the system can extract key information from the subsequence corresponding to each node, such as function name, parameter type, return value type, etc., and construct a multi-dimensional function feature vector based on these elements. In addition, by analyzing the code structure characteristics of each subsequence (such as control flow, call mode, exception handling method, etc.) and the access to external resources (such as file I / O, network communication, etc.), the system can further enrich the feature representation of the node. After obtaining the above three types of feature vectors, the system can use algorithms such as weighted cosine similarity to quantitatively characterize the degree of functional semantic proximity between any two nodes in the graph.

[0039] S103, calculating the behavior consistency score between the nodes in each node cluster, and marking the node clusters whose behavior consistency score is less than a preset consistency threshold as potential vulnerability areas; For each node cluster obtained by clustering in step S102, the system needs to further examine the behavioral consistency of its internal nodes, that is, the degree of consistency in the functional semantics of different behavioral fragments within the cluster. Intuitively, if a node cluster contains a large number of logically contradictory or confusing code fragments, it is more likely to hide vulnerabilities or defects.

[0040] In order to quantitatively characterize the behavioral consistency within the node cluster, the system can adopt a technical route based on frequent subsequence mining. Specifically, for each node cluster, the system first constructs the behavioral fragments corresponding to its internal nodes into a subsequence database, and then uses classic algorithms such as Apriori and PrefixSpan to mine common subsequence patterns whose frequency exceeds the preset support threshold. Intuitively, these frequent subsequences represent recurring behavioral patterns within the node cluster. The higher the frequency, the more nodes repeat the pattern, and the stronger the behavioral consistency. Therefore, the system can use indicators such as the average frequency of frequent subsequences and the proportion of the maximum frequent subsequence length as a score to measure the overall consistency of the node cluster. When the consistency score is lower than the pre-set threshold, the system can preliminarily determine that the cluster is a suspicious potential vulnerability area and mark it for subsequent in-depth analysis.

[0041] It should be noted that simply relying on preset thresholds for judgment may lead to inaccurate division of potential vulnerability areas. The system can also try to introduce strategies such as cross-validation and adaptive threshold adjustment to dynamically optimize threshold selection and improve the precision and recall of potential vulnerability area identification. In addition, for the potential vulnerability areas obtained by division, the system can also combine the known vulnerability patterns in the vulnerability knowledge base to make preliminary inferences on the vulnerability types, such as injection attacks, privilege escalation, denial of service, etc., to provide strong clues for subsequent vulnerability location and repair.

[0042] S104, determining call chain information based on the function call relationship between nodes in the potential vulnerability area; After identifying the potential vulnerability area, in order to further locate the specific location and impact range of the vulnerability, the system needs to deeply analyze the code implementation logic and data dependency of the nodes within the area. Among them, the function call relationship is the most intuitive and important form of dependency. By combing the call chain between functions in the vulnerability area, the complete path of vulnerability formation and spread can be restored.

[0043] Specifically, for each potential vulnerability area, the system can traverse its internal nodes, and take each node as the root, using symbolic execution, taint analysis and other technologies to track all possible call paths of the function corresponding to the node. In this process, the system must not only consider explicit direct function calls, but also explore implicit indirect call relationships, such as dynamically determining the called function through mechanisms such as function pointers and virtual functions. By integrating the call fragments scattered in different nodes and functions, a complete call chain is eventually formed that starts with the vulnerable function and covers the entire vulnerable area. This call chain not only reflects the static structure of the vulnerability code, but also depicts the control flow transfer path of the vulnerability during actual runtime. It is an important basis for subsequent vulnerability analysis and tracing.

[0044] S105, constructing a vulnerability propagation path according to the call chain information, and calculating the degree of harm of each node in the vulnerability propagation path; After determining the call chain information of the internal functions of the potential vulnerability area, the system needs to further analyze the specific path of the vulnerability through the call chain and evaluate the degree of harm of different nodes and functions in the vulnerability propagation. This is crucial for determining the priority of vulnerability repair and formulating the best repair plan.

[0045] Specifically, the system can splice all vulnerability-related call chains found in step S104 in the order of actual execution, thereby constructing a complete path sequence that reflects the vulnerability propagation process. On this basis, the system needs to design a set of scientific hazard assessment methods to quantitatively characterize the risk level of each node in the path. An intuitive idea is to assign different hazard weights according to factors such as the criticality of each node in the propagation of vulnerabilities and the degree of data flow aggregation. For example, for nodes that directly access or modify sensitive data and propagate to the outside, their hazard coefficient should be significantly higher than that of intermediate nodes that simply transmit data flows. The system can design a node importance assessment algorithm based on graph centrality, characterize the key role of nodes in vulnerability propagation from multiple dimensions (such as betweenness centrality, connection centrality, etc.), and calculate its final hazard score.

[0046] S106, classifying the corresponding nodes into first-level hazard vulnerabilities, second-level hazard vulnerabilities, and third-level hazard vulnerabilities according to the hazard degree of each node; The system divides the corresponding nodes into first-level hazard vulnerabilities, second-level hazard vulnerabilities and third-level hazard vulnerabilities according to the degree of hazard of each node. The hazard degree corresponding to the nodes in the first-level hazard vulnerabilities is greater than the first preset threshold, the hazard degree corresponding to the nodes in the second-level hazard vulnerabilities is greater than the second preset threshold and not greater than the first preset threshold, and the hazard degree corresponding to the nodes in the third-level hazard vulnerabilities is not greater than the second preset threshold.

[0047] After obtaining the quantitative score of the severity of each node, the system needs to further map the nodes to vulnerabilities of different severity levels to facilitate the formulation of differentiated repair strategies and response plans. Generally speaking, the industry's commonly used vulnerability severity classification standards have three levels, namely high risk, medium risk, and low risk.

[0048] The system can refer to the above standards and set two hazard thresholds, which are recorded as threshold 1 (higher) and threshold 2 (lower). For each node in the vulnerability propagation path, if its hazard score is higher than threshold 1, the node is judged as a first-level hazard vulnerability (high risk); if the node hazard is between threshold 1 and threshold 2, it is judged as a second-level hazard vulnerability (medium risk); if the node hazard is lower than threshold 2, it is judged as a third-level hazard vulnerability (low risk). In this way, a hierarchical hazard vulnerability node sequence on the entire vulnerability propagation path is obtained.

[0049] It should be noted that threshold 1 and threshold 2 can be dynamically set and adjusted by the system with reference to factors such as vulnerability hazard tolerance, patch development, and vulnerability repair costs in actual scenarios. In practice, cross-validation, grid search and other strategies can also be used to quantitatively examine the overall response effect under different threshold combinations (such as average response time, unfixed vulnerability legacy rate, etc.) to find the optimal threshold setting, thereby guiding the best vulnerability classification scheme. In addition, since different industries and systems have different hazard tolerances for the same vulnerability, the system can also support users to customize and fine-tune hazard thresholds to meet personalized and domain-adaptive classification requirements. This will help to flexibly adapt to the hierarchical detection requirements of different application scenarios on the basis of the general vulnerability hazard classification framework, and improve the overall vulnerability management level.

[0050] S107, determine the repair priority according to the first-level hazard vulnerabilities, the second-level hazard vulnerabilities, and the third-level hazard vulnerabilities, and generate a vulnerability report including the vulnerability type, vulnerability location, propagation path, and repair priority; After the vulnerability nodes are graded, the system can determine the priority of each vulnerability repair. Generally speaking, vulnerabilities with high hazard levels should be given a higher priority for repair, and repair and disposal should be arranged as early as possible to reduce security risks. At the same time, the priority of vulnerability repair should also take into account factors such as actual business continuity and resource constraints.

[0051] An intuitive solution for determining repair priorities is to mark the first-level hazardous vulnerabilities (high-risk vulnerabilities) as the highest priority P1, the second-level hazardous vulnerabilities (medium-risk vulnerabilities) as the second-highest priority P2, and the third-level hazardous vulnerabilities (low-risk vulnerabilities) as the general priority P3. The system will set corresponding repair deadlines for vulnerabilities of different priorities based on the vulnerability repair time requirements of specific scenarios. For example, for P1-level vulnerabilities, the system may require repairs to be completed within 1-2 working days; for P2-level vulnerabilities, it can be relaxed to 1-2 weeks; and for P3-level vulnerabilities, they can be repaired within 1-2 months. This hierarchical response mechanism takes into account both the degree of risk and the reasonable allocation of repair resources.

[0052] In addition, the system needs to generate a complete analysis report for each vulnerability node found. The report should contain basic information about the vulnerability, such as its type (determined through semantic analysis combined with the vulnerability knowledge base), accurate location (file, function, line number, etc. of the vulnerability node in the code), complete propagation path, etc., to facilitate repair personnel to quickly locate and reproduce. At the same time, the report should also clearly state the final hazard level and repair priority of the vulnerability to guide the formulation of appropriate repair plans and response plans.

[0053] S108, matching corresponding repair strategies from a preset repair template library in order of repair priority according to vulnerability type, repair priority and propagation path information; After completing the risk classification and repair priority determination of the vulnerabilities, the system needs to further match the appropriate repair plan for each vulnerability. The formulation of the repair plan needs to fully consider the type characteristics, impact scope, propagation path and other factors of the vulnerability itself, while also taking into account the actual repair difficulty and resource constraints.

[0054] In order to respond quickly and efficiently to the needs of fixing different types of vulnerabilities, the system can pre-establish a general vulnerability repair template library to store various types of proven effective vulnerability repair codes and configuration templates. These templates should cover mainstream vulnerability types, such as injection, XSS cross-site scripting, lack of access control, sensitive information leakage, etc., and be organized into multiple sub-libraries according to different languages ​​and application scenarios. When a vulnerability is actually detected, the system can quickly retrieve and locate the matching repair template based on its type attributes, and make appropriate adjustments based on the specific context (such as code style, data structure, etc.), thereby greatly simplifying and accelerating the process of writing repair code.

[0055] Based on the repair template library, the system can design a set of targeted policy matching and scheduling mechanisms. For batch-detected vulnerabilities, the system should comprehensively weigh their risk levels and repair priorities, and give more repair resources to high-priority vulnerabilities. When matching specific repair strategies, the system should also fully consider the propagation path information of the vulnerability. For vulnerabilities that span multiple modules and have complex call chains, priority should be given to defense-in-depth strategies that can be managed globally to block them at the source; for vulnerabilities with strong locality, lightweight endpoint protection solutions can be selected. The system can also combine technologies such as code static analysis to evaluate the actual coverage of different repair solutions and dynamically score and optimize strategy solutions. This helps to tailor the optimal vulnerability repair combination under the constraints of limited repair resources to maximize the overall risk mitigation effect.

[0056] S109: Perform hierarchical repair on the application code based on the matched repair strategy to obtain repair code, and deploy the repair code to the target system.

[0057] After selecting the optimal repair strategy for each vulnerability, the system needs to further implement these strategies into the actual application code and finally complete the generation and deployment of the repair code. Due to the different risk levels and impact ranges of different vulnerability nodes, the system needs to adopt a hierarchical repair approach, reasonably allocate resources, and carry out repair work in stages and with focus.

[0058] For high-priority P1-level vulnerabilities, the system should initiate the repair process as soon as possible, mobilize elite development and testing resources, and complete the writing, review, testing, and deployment of the repair code in the shortest possible time. For P2-level medium-risk vulnerabilities, the system can allocate resources relatively evenly, steadily advance the development and testing of the repair code while meeting the repair deadline, and complete the launch as soon as possible. For P3-level low-risk vulnerabilities, if they do not affect the main business functions, the system can combine them with the regular code iteration and update process, introduce additional security links such as manual review when necessary, and carefully carry out code merge and deployment.

[0059] During the code repair process, the system should focus on the effectiveness of the policy implementation, and can use a variety of technical means such as penetration testing and fuzz testing to evaluate the effectiveness of the repaired code in resisting the same type of vulnerabilities. For large-scale cross-module-level vulnerabilities, the system can also introduce regression testing, focusing on the side effects of the repair code. Once new problems are found, they should be corrected in a timely manner, or the matching logic should be adjusted according to the feedback from the policy library. After completing the necessary code review and security testing, the system can start the recovery and full deployment process to apply the repaired code to the production system.

[0060] In the above embodiment, a system behavior sequence is generated for the application code and a behavior dependency graph is constructed based on the timing relationship, which can fully express the dependency relationship between the functional modules in the system. By calculating the functional similarity and behavior consistency scores between nodes, the code area with abnormal behavior in the program can be accurately identified. Combined with the call chain information determined by the function call relationship, the propagation path of the vulnerability is constructed, and the vulnerability is divided into different levels through quantitative calculation of the degree of hazard, so that the location of the vulnerability is more accurate and the classification is more reasonable. By matching the repair strategy from the preset repair template library and performing graded repair, the systematic and targeted nature of the repair process is guaranteed, the impact of the repair process on the normal function of the system is reduced, and the accuracy and efficiency of identifying and repairing network security vulnerabilities are improved.

[0061] After the identification and preliminary repair of the vulnerability are completed, in order to ensure the effectiveness and reliability of the repair, the embodiment of the present application also provides a method for verifying and optimizing the repair code. This method further improves the repair effect by performing comprehensive security analysis and testing on the repaired code. By constructing a multi-dimensional execution dependency graph, performing reverse tracing analysis, and dynamic injection testing, it is possible to systematically evaluate the potential security risks in the repair code, and continuously improve the repair solution through recursive optimization. This post-repair verification and optimization mechanism forms a closed-loop security assurance system that can better ensure the quality of the repair. The following is combined with Figure 2 , a method for verifying and optimizing a repair code in an embodiment of the present application is described: See also Figure 2 , which is a flow chart of a method for verifying and optimizing a repair code in an embodiment of the present application.

[0062] S201, obtaining control flow information, data flow information and resource access information of the repair code; In this step, the system needs to obtain various information about the repair code, including control flow information, data flow information, and resource access information. Control flow information reflects the execution path and logical structure of the code, which can be obtained by statically analyzing the code's branches, loops, and other structures. Data flow information reflects the definition and use of variables in the code, which is obtained by tracking the assignment and reference of variables. Resource access information records the sequence of code access operations on various system resources such as files and databases.

[0063] S202, constructing a multi-dimensional execution dependency graph based on control flow information, data flow information and resource access information; The system constructs a multi-dimensional execution dependency graph based on control flow information, data flow information and resource access information. Specifically: a control flow graph is constructed based on the control flow information to obtain a first dependency subgraph; a definition and usage chain of variables is analyzed based on the data flow information to obtain a second dependency subgraph; a mutually exclusive resource access sequence is identified based on the resource access information to obtain a third dependency subgraph; the first dependency subgraph, the second dependency subgraph and the third dependency subgraph are fused by graph theory to obtain an initial multi-dimensional dependency graph; and the transitive closure between the nodes in the initial multi-dimensional dependency graph is calculated to obtain a multi-dimensional execution dependency graph.

[0064] The purpose of this step is to comprehensively utilize the control flow, data flow, and resource access information obtained in the previous step to build a multidimensional dependency graph that fully reflects the execution characteristics of the repaired code. This graph not only reflects the logical structure of the code, but also needs to reveal the data dependencies between variables and the access dependencies to resources, so it is called a multidimensional dependency graph. During the construction process, the system first generates dependency subgraphs based on different information, and then merges these subgraphs to obtain a complete dependency graph.

[0065] Specifically, the system can use a graph construction algorithm to realize the generation of dependency graphs. For control flow graphs, code blocks can be used as nodes and control flow transfers as directed edges to generate directed graphs. For data flow graphs, variables are used as nodes and definition-use relationships are used as directed edges. In resource access graphs, resources are nodes and access dependencies are edges. After obtaining these three types of subgraphs, the system needs to fuse the graphs, that is, identify the node correspondence between different subgraphs, establish unified nodes, merge directed edges, and form a multi-dimensional comprehensive dependency graph. It is worth noting that during the fusion process, the direction of the edge may change, so the transitive closure of the graph needs to be recalculated to reveal the indirect dependencies between nodes.

[0066] S203, performing reverse tracing analysis on the multi-dimensional execution dependency graph to obtain a risk path combination set; Based on the multi-dimensional execution dependency graph, this step identifies potential risk path combinations in the repair code through reverse tracing analysis. The so-called risk path refers to a specific execution path that may cause security vulnerabilities, failures and other problems during code execution. Since the repair code may introduce new defects or miss existing vulnerabilities, comprehensive identification of these risk paths is crucial to improving the quality of repair. Reverse tracing analysis is an analysis technique that infers all possible causes of the result from the result. Performing reverse tracing on the dependency graph can exhaust all path combinations that may cause risks.

[0067] In specific implementation, the system can use symbolic execution technology to start from the risk node (such as resource access node) of the dependency graph, traverse the graph in reverse, and record the nodes and edges passed during the traversal process to form a risk path. By exhaustively enumerating all risk nodes and traversing each node in reverse, a complete set of risk paths is finally obtained. During the traversal process, the system can also introduce constraint solving technology to solve the conditional nodes on the path and obtain the input conditions that may trigger the path, thereby forming a complete risk path combination (including execution path and triggering conditions).

[0068] Before executing S204, in another embodiment, the system may also construct a test vector space according to the risk path combination set, the test vector space including an input parameter combination, an execution timing combination, and a resource state combination; The test vector space is optimized using a genetic algorithm to obtain an optimized test scenario set; Establish a causal analysis model based on the optimized set of test scenarios; Calculate the impact weight value of each test scenario in the causal analysis model; The paths in the risk path combination set are hierarchically sorted according to the impact weight values ​​to obtain a priority sorting table.

[0069] First, the system constructs a test vector space based on the risk path combination set. This space consists of three dimensions: input parameter combination, execution timing combination, and resource status combination. The input parameter combination represents all possible combinations of input data of the risk path; the execution timing combination represents the combination of possible execution orders of each code block in the risk path; the resource status combination represents the possible state combination of related resources (such as memory, files, etc.) during the execution of the risk path. Each point in the test vector space represents a unique test scenario, which contains specific inputs, execution sequences, and resource states.

[0070] However, due to the complexity of risk paths, the scale of the test vector space may be very large, and it is unrealistic to exhaustively enumerate all possible test scenarios. Therefore, the system uses genetic algorithms to intelligently optimize the test vector space. Genetic algorithms simulate the process of biological evolution, continuously eliminate inferior individuals, retain and reproduce high-quality individuals, and finally obtain a set of optimal test scenario sets. Here, each test scenario is regarded as an individual, and its fitness function can be designed based on indicators such as the code coverage of the scenario and the uniqueness of the execution path. Through iterative selection, crossover, mutation and other operations, the algorithm finally obtains a set of optimized test scenario sets with high coverage, diverse paths and strong pertinence.

[0071] After obtaining the optimized set of test scenarios, the system also needs to evaluate the risk level of each scenario in order to arrange test resources and priorities reasonably. To this end, the system establishes a causal analysis model based on the optimized set of test scenarios. This model uses a data-driven approach to explore the causal relationship between test scenarios and risk results such as code defects and attack events. Specifically, the system collects historical test data and related risk event data, trains the causal analysis model through machine learning algorithms (such as Bayesian networks, association rules, etc.), and establishes a mapping relationship between test scenario characteristics and risk results. After the model is established, the system calculates the impact weight value of each test scenario, that is, the probability of the scenario causing a risk event. The larger the impact weight value, the more likely the risk path combination corresponding to the scenario is to contain defects or vulnerabilities, and should be tested first.

[0072] Finally, the system reorders the original risk path combination set according to the impact weight value of the test scenario and generates a priority ranking table. The high priority part of the ranking table contains path combinations with high impact weight and high risk possibility; while the low priority part corresponds to path combinations with small impact and low risk. In this way, the system can reasonably allocate test resources and time according to the priority ranking table, give priority to testing and repairing high-risk paths, and improve the efficiency and effectiveness of testing.

[0073] S204, performing dynamic injection testing based on the risk path combination set to generate a test result set; This step uses the risk path combination set obtained in the previous step to perform dynamic injection testing on the repair code to verify whether these risk paths actually have security vulnerabilities or faults. Compared with static analysis, dynamic testing can reveal more problems that only appear at runtime by actually executing the code. Injection testing is a testing method that constructs specific input data to make the code execute to a specified path and observe whether its behavior meets expectations. By taking the risk path as the test target and injecting the corresponding data, the security and reliability of these paths can be tested.

[0074] In specific implementation, the system first needs to generate test cases based on the risk path combination. Each test case consists of two parts: input data and expected results. The input data can be constructed according to the trigger conditions in the path combination, and the abstract conditions are converted into specific inputs through symbolic execution, constraint solving and other technologies. The expected results are defined according to the semantics and specifications of the path, such as normal execution, throwing exceptions, etc. After generating the test case, the system inserts the repair code and inserts breakpoints or log statements at the key nodes of the risk path to record the actual execution. Then, the system injects the test case into the code to run, monitors the execution of the insertion point, compares the actual result with the expected result, and generates a test report. The test report needs to include the execution status of the test case (such as whether the path is triggered, whether it meets expectations, etc.), as well as information such as code coverage and performance overhead.

[0075] S205. Recursively optimize the repair code according to the test result set until the risk path combination set is an empty set.

[0076] The system recursively optimizes the repair code according to the test result set until the risk path combination set is an empty set. Specifically: construct an optimization strategy decision tree, and traverse the optimization strategy decision tree to obtain an optimization solution set; Calculate the performance overhead value, implementation complexity value and maintenance cost value of each solution in the set of optimization solutions; Determine the optimal solution based on performance overhead, implementation complexity, and maintenance cost; Refactor the repair code according to the optimal solution and update the multi-dimensional execution dependency graph; When it is determined that the updated multi-dimensional execution dependency graph has a risk path, the step of constructing an optimization strategy decision tree is executed.

[0077] After obtaining the dynamic test results, this step requires further optimization of the original repair code based on the problems revealed by the test. Since the previous repair may have missed some vulnerabilities or introduced new defects, it is necessary to recursively execute the closed-loop process of analysis-repair-test and continuously improve the repair code until all risk paths are eliminated and the repair reaches a stable and reliable state.

[0078] In order to improve the repair efficiency, the system can adopt a repair strategy optimization mechanism based on a decision tree. First, the system constructs a repair strategy decision tree based on the characteristics of the risk path and test feedback. Each node of the decision tree represents a repair strategy (such as data inspection, boundary processing, exception capture, etc.), and each branch represents the applicable conditions of the strategy (such as risk type, context environment, etc.). The system traverses the decision tree, matches the characteristics of the current risk path, and obtains a set of applicable repair strategies. Then, the system evaluates these strategies, considers factors such as their effectiveness, performance overhead, and implementation difficulty, and selects the optimal strategy to guide code repair. After the repair is completed, the system regenerates the risk path combination and enters the next round of testing, and recursively optimizes until the risk path set is empty and the repair is completed.

[0079] In the above embodiment, the control flow information, data flow information and resource access information of the repair code are obtained to construct a multi-dimensional execution dependency graph, and a comprehensive dependency analysis is performed on the repaired code. Potential risk path combinations are identified through reverse tracing analysis, and dynamic injection testing is performed to verify the repair effect. Based on the test results, the repair code is recursively optimized until all risk paths are eliminated, thereby ensuring the integrity and reliability of the repair. This verification method based on multi-dimensional dependency analysis and recursive optimization can promptly discover new problems introduced during the repair process, and improve the correctness of the repair through continuous optimization, reducing secondary problems that occur during the repair process and improving the quality of vulnerability repair.

[0080] The following describes the system in the embodiment of the present invention from the perspective of hardware processing. Figure 3 , which is a schematic diagram of the physical device structure of a network security vulnerability identification and repair system provided in an embodiment of the present application.

[0081] It should be noted that Figure 3 The structure of the system shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0082] like Figure 3As shown, the system includes a central processing unit (CPU) 301, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 302 or the program loaded from the storage part 308 to the random access memory (RAM) 303, such as executing the method in the above embodiment. In RAM 303, various programs and data required for system operation are also stored. CPU 301, ROM 302 and RAM 303 are connected to each other through a bus 304. Input / output (I / O) interface 305 is also connected to bus 304.

[0083] The following components are connected to the I / O interface 305: an input section 306 including a camera, an infrared sensor, etc.; an output section 307 including a liquid crystal display (LCD) and a speaker, etc.; a storage section 308 including a hard disk, etc.; and a communication section 309 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 309 performs communication processing via a network such as the Internet. A drive 310 is also connected to the I / O interface 305 as needed. A removable medium 311, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 310 as needed so that a computer program read therefrom is installed into the storage section 308 as needed.

[0084] In particular, according to an embodiment of the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present invention includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a computer program for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through the communication part 309, and / or installed from a removable medium 311. When the computer program is executed by the central processing unit (CPU) 301, various functions defined in the present invention are performed.

[0085] It should be noted that the computer-readable medium shown in the embodiment of the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable computer program. Such a propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing.

[0086] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present invention. Among them, each box in the flowchart or block diagram can represent a module, a program segment, or a part of the code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0087] As another aspect, the present invention further provides a computer-readable storage medium, which may be included in the system described in the above embodiment; or may exist independently without being assembled into the system. The above storage medium carries one or more computer programs, and when the above one or more computer programs are executed by a processor of a system, the system implements the method provided in the above embodiment.

[0088] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

[0089] As used in the above embodiments, the term "when..." may be interpreted to mean "if..." or "after..." or "in response to determining..." or "in response to detecting...", depending on the context. Similarly, the phrases "upon determining..." or "if (the stated condition or event) is detected" may be interpreted to mean "if determining..." or "in response to determining..." or "upon detecting (the stated condition or event)" or "in response to detecting (the stated condition or event)", depending on the context.

[0090] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk), etc.

[0091] Those skilled in the art can understand that to implement all or part of the processes in the above-mentioned embodiments, the processes can be completed by computer programs to instruct related hardware, and the programs can be stored in computer-readable storage media. When the programs are executed, they can include the processes of the above-mentioned method embodiments. The aforementioned storage media include: ROM or random access memory RAM, magnetic disk or optical disk and other media that can store program codes.

Claims

1. A method for identifying and repairing network security vulnerabilities, characterized in that: include: Generate a system behavior sequence according to the target system application code, and divide the system behavior sequence into a plurality of subsequences based on a preset vulnerability feature library; Constructing a behavior dependency graph according to the temporal relationship of the plurality of subsequences; Calculating the functional similarity between the nodes in the behavior dependency graph, and dividing the nodes whose functional similarity is greater than a preset similarity into the same node cluster; Calculating the behavior consistency score between the nodes within each node cluster, and marking the node cluster whose behavior consistency score is less than a preset consistency threshold as a potential vulnerability area; Determine call chain information based on the function call relationship between nodes in the potential vulnerability area; Constructing a vulnerability propagation path according to the call chain information, and calculating the degree of harm of each node in the vulnerability propagation path; According to the harm degree of each node, the corresponding node is divided into a first-level harm vulnerability, a second-level harm vulnerability and a third-level harm vulnerability, the harm degree corresponding to the node in the first-level harm vulnerability is greater than a first preset threshold, the harm degree corresponding to the node in the second-level harm vulnerability is greater than the second preset threshold and not greater than the first preset threshold, and the harm degree corresponding to the node in the third-level harm vulnerability is not greater than the second preset threshold; Determine the repair priority according to the first-level hazard vulnerability, the second-level hazard vulnerability, and the third-level hazard vulnerability, and generate a vulnerability report including the vulnerability type, vulnerability location, propagation path, and the repair priority; According to the vulnerability type, the repair priority and the propagation path information, corresponding repair strategies are matched in sequence from a preset repair template library in the order of the repair priority; The application code is repaired in stages based on the matched repair strategy to obtain repair code, and the repair code is deployed to the target system.

2. The method according to claim 1, characterized in that The generating of the system behavior sequence according to the target system application code specifically includes: Extracting data flow information and control flow information from the application code; Based on the data flow information and the control flow information, a depth-first search algorithm is used to construct a program execution path; Program behavior features are collected in sequence along the program execution path, and the program behavior features are organized into a system behavior sequence according to the execution order.

3. The method according to claim 1, characterized in that The calculating the functional similarity between the nodes in the behavior dependency graph specifically includes: Extract the function name, parameter type and return value type of each node and construct the function feature vector; Analyze the code structure features of each node, and construct a structure feature vector based on the code structure features, wherein the code structure features include control flow, call mode, and exception handling method; Counting the types of system resources accessed by each node and the access frequency, and constructing a resource feature vector; Based on the function feature vector, the structure feature vector and the resource feature vector, a weighted cosine similarity algorithm is used to calculate the functional similarity between the nodes.

4. The method according to claim 1, characterized in that: After deploying the repair code to the target system, the method further includes: Obtaining control flow information, data flow information, and resource access information of the repair code; Constructing a multi-dimensional execution dependency graph based on the control flow information, the data flow information and the resource access information; Performing reverse tracing analysis on the multi-dimensional execution dependency graph to obtain a risk path combination set; Perform a dynamic injection test based on the risk path combination set to generate a test result set; The repair code is recursively optimized according to the test result set until the risk path combination set is an empty set.

5. The method according to claim 4, characterized in that The constructing of a multidimensional execution dependency graph based on the control flow information, the data flow information and the resource access information specifically includes: Construct a control flow graph based on the control flow information to obtain a first dependency subgraph; Analyze the definition and use chain of variables based on the data flow information to obtain a second dependency subgraph; Identify a mutually exclusive resource access sequence based on the resource access information to obtain a third dependency subgraph; Performing graph-theoretic fusion on the first dependency subgraph, the second dependency subgraph, and the third dependency subgraph to obtain an initial multi-dimensional dependency graph; The transitive closure between the nodes in the initial multi-dimensional dependency graph is calculated to obtain a multi-dimensional execution dependency graph.

6. The method according to claim 4 or 5, characterized in that: Before performing the dynamic injection test based on the risk path combination set, the method further includes: Constructing a test vector space according to the risk path combination set, wherein the test vector space includes an input parameter combination, an execution timing combination, and a resource state combination; Optimizing the test vector space using a genetic algorithm to obtain an optimized test scenario set; Establishing a causal analysis model based on the optimized test scenario set; Calculating the impact weight value of each test scenario in the causal analysis model; The paths in the risk path combination set are hierarchically sorted according to the impact weight values ​​to obtain a priority sorting table.

7. The method according to claim 4, characterized in that The recursive optimization of the repair code according to the test result set specifically includes: Constructing an optimization strategy decision tree, and traversing the optimization strategy decision tree to obtain an optimization solution set; Calculate the performance cost, implementation complexity and maintenance cost of each solution in the set of optimization solutions; Determining an optimal solution based on the performance overhead value, the implementation complexity value, and the maintenance cost value; Reconstructing the repair code according to the optimal solution and updating the multi-dimensional execution dependency graph; When it is determined that the updated multi-dimensional execution dependency graph has a risk path, the step of constructing an optimization strategy decision tree is performed.

8. A network security vulnerability identification and repair system, characterized in that: The system comprises: One or more processors and a memory; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code includes computer instructions, and the one or more processors call the computer instructions to cause the system to execute the method as described in any one of claims 1-7.

9. A computer-readable storage medium comprising instructions, characterized in that: When the instructions are executed on a system, the system is caused to execute the method according to any one of claims 1 to 7.

10. A computer program product, characterized in that When the computer program product is run on a system, the system is caused to execute the method according to any one of claims 1 to 7.

Images