Network security vulnerability identification and repair method, system, medium and program product

Abstract

A network security vulnerability identification and repair method, system, medium and program product, in the method, the system behavior sequence is divided into several sub-sequences; a behavior dependency graph is constructed; a function similarity is calculated, and divided into node clusters; a behavior consistency score is calculated, and a potential vulnerability area is determined; call chain information is determined; a vulnerability propagation path is constructed, and a harm degree is calculated; according to the harm degree, first-level harm vulnerability, second-level harm vulnerability and third-level harm vulnerability are divided; a repair priority is determined, and a vulnerability report is generated; according to the vulnerability type, the repair priority and the propagation path information, the corresponding repair strategy is matched in turn from the preset repair template library according to the order of the repair priority; the application program code is repaired based on the matched repair strategy, the repaired code is obtained, and the repaired code is deployed to the target system. The application improves the accuracy and efficiency of identifying and repairing network security vulnerabilities.

Description

Technical Field

[0001] The present application relates to the field of network protection, and in particular to a method, system, medium and program product for identifying and repairing network security vulnerabilities. Background Art

[0002] With the rapid development of information technology, network security issues are becoming increasingly prominent, and network security vulnerabilities have become a major threat to information system security. Because network security vulnerabilities are highly hidden, highly harmful, and spread rapidly, traditional manual vulnerability identification methods are inefficient and difficult to detect and repair in a timely manner, easily exposing information systems to attacks and data leaks.

[0003] Related technologies primarily employ vulnerability scanning methods based on signature libraries. By pre-building a vulnerability signature library, the target system is scanned and matched to identify known vulnerabilities. This method can quickly identify security risks that match the vulnerabilities recorded in the signature library and provide corresponding remediation suggestions, improving the efficiency of vulnerability identification and remediation.

[0004] However, vulnerability identification methods based on signature libraries rely too heavily on known vulnerability signatures, making them less effective at identifying unknown or variant vulnerabilities. As vulnerability attack methods continue to evolve, relying solely on static signature matching is insufficient to identify new vulnerabilities, and can easily lead to missed and false positives, reducing the accuracy and efficiency of vulnerability identification and remediation. Summary of the Invention

[0005] The present application provides a network security vulnerability identification and repair method, system, medium and program product for improving the accuracy and efficiency of identifying and repairing network security vulnerabilities.

[0006] In a first aspect, the present application provides a method for identifying and repairing network security vulnerabilities, which generates a system behavior sequence based on the target system application code and divides the system behavior sequence into several subsequences based on a preset vulnerability signature library;

[0007] Construct a behavior dependency graph based on the temporal relationship of several subsequences;

[0008] Calculate the functional similarity between nodes in the behavior dependency graph, and divide nodes with functional similarity greater than a preset similarity into the same node cluster;

[0009] Calculate the behavior consistency score between nodes in each node cluster, and mark the node clusters with behavior consistency scores less than the preset consistency threshold as potential vulnerability areas;

[0010] Determine call chain information based on the function call relationship between nodes in the potential vulnerability area;

[0011] Construct the vulnerability propagation path based on the call chain information and calculate the criticality of each node in the vulnerability propagation path;

[0012] According to the criticality of each node, the corresponding node is divided into a first-level criticality vulnerability, a second-level criticality vulnerability, and a third-level criticality vulnerability. The criticality of the node in the first-level criticality vulnerability is greater than the first preset threshold, the criticality of the node in the second-level criticality vulnerability is greater than the second preset threshold and not greater than the first preset threshold, and the criticality of the node in the third-level criticality vulnerability is not greater than the second preset threshold;

[0013] Determine the repair priority based on the first-level, second-level, and third-level vulnerabilities, and generate a vulnerability report that includes vulnerability type, vulnerability location, propagation path, and repair priority;

[0014] According to the vulnerability type, repair priority and propagation path information, the corresponding repair strategies are matched in sequence from the preset repair template library in the order of repair priority;

[0015] The application code is repaired in stages based on the matched repair strategy to obtain the repair code, which is then deployed to the target system.

[0016] By adopting the above technical solution, a system behavior sequence is generated for the application code and a behavior dependency graph is constructed based on the timing relationship, which can fully express the dependency relationship between the various functional modules in the system. By calculating the functional similarity and behavior consistency scores between nodes, the code areas with abnormal behavior in the program can be accurately identified. Combined with the call chain information determined by the function call relationship, the propagation path of the vulnerability is constructed, and the vulnerabilities are divided into different levels through quantitative calculation of the degree of harm, making the location of the vulnerability more accurate and the classification more reasonable. By matching the repair strategy from the preset repair template library and performing graded repair, the systematic and targeted nature of the repair process is guaranteed, the impact of the repair process on the normal function of the system is reduced, and the accuracy and efficiency of identifying and repairing network security vulnerabilities are improved.

[0017] In conjunction with some embodiments of the first aspect, in some embodiments, generating a system behavior sequence according to the target system application code specifically includes:

[0018] Extract data flow information and control flow information from application code;

[0019] Based on data flow information and control flow information, a depth-first search algorithm is used to construct the program execution path;

[0020] Program behavior features are collected sequentially along the program execution path, and the program behavior features are organized into a system behavior sequence according to the execution order.

[0021] By employing the above technical solution, data and control flow information from the application code is extracted, and a depth-first search algorithm is used to construct the program execution path, comprehensively covering all possible execution branches within the program. By collecting and organizing program behavior features to form a system behavior sequence, the dynamic execution process of the program is fully recorded. This depth-first search-based system behavior sequence generation method overcomes the difficulty of traditional static analysis methods in handling complex program logic, improving the completeness and accuracy of the behavior sequence. The system behavior sequence accurately reflects the actual running state of the program, providing a reliable data foundation for subsequent vulnerability identification and improving the accuracy of vulnerability identification.

[0022] In conjunction with some embodiments of the first aspect, in some embodiments, calculating the functional similarity between nodes in the behavior dependency graph specifically includes:

[0023] Extract the function name, parameter type and return value type of each node and construct the function feature vector;

[0024] Analyze the code structure characteristics of each node and construct a structural feature vector based on the code structure characteristics. The code structure characteristics include control flow, call mode and exception handling method;

[0025] Count the types and frequency of system resources accessed by each node and construct resource feature vectors;

[0026] Based on the function feature vector, structure feature vector and resource feature vector, the weighted cosine similarity algorithm is used to calculate the functional similarity between nodes.

[0027] By employing the above technical solution, function feature vectors, structure feature vectors, and resource feature vectors are constructed, comprehensively describing the characteristics of program nodes from three dimensions: function attributes, code structure, and resource access. A weighted cosine similarity algorithm is used to calculate the functional similarity between nodes. This quantifies information across multiple dimensions, including function name, parameter types, return value type, control flow, call mode, exception handling, and system resource access characteristics. This makes the similarity calculation more objective and accurate, enabling more precise identification of program modules with similar functions, thereby improving the accuracy of subsequent vulnerability identification.

[0028] In conjunction with some embodiments of the first aspect, in some embodiments, after deploying the repair code to the target system, the method further includes:

[0029] Obtain control flow information, data flow information, and resource access information of the repair code;

[0030] Construct a multi-dimensional execution dependency graph based on control flow information, data flow information and resource access information;

[0031] Perform reverse tracing analysis on the multi-dimensional execution dependency graph to obtain a set of risk path combinations;

[0032] Perform dynamic injection testing based on the risk path combination set and generate a test result set;

[0033] The repair code is recursively optimized according to the test result set until the risk path combination set is empty.

[0034] By adopting the above technical solutions, the control flow information, data flow information, and resource access information of the repaired code are obtained to construct a multi-dimensional execution dependency graph, and a comprehensive dependency analysis is performed on the repaired code. Through reverse tracing analysis, potential risk path combinations are identified, and dynamic injection testing is performed to verify the repair effect. Based on the test results, the repair code is recursively optimized until all risk paths are eliminated, ensuring the integrity and reliability of the repair. This verification method based on multi-dimensional dependency analysis and recursive optimization can promptly identify new problems introduced during the repair process, improve the correctness of the repair through continuous optimization, reduce secondary problems that arise during the repair process, and improve the quality of vulnerability repair.

[0035] In conjunction with some embodiments of the first aspect, in some embodiments, constructing a multidimensional execution dependency graph based on control flow information, data flow information, and resource access information specifically includes:

[0036] Construct a control flow graph based on the control flow information to obtain a first dependency subgraph;

[0037] Analyze the definition and usage chain of variables based on data flow information to obtain the second dependency subgraph;

[0038] Identify the mutually exclusive access sequence of resources based on the resource access information and obtain a third dependency subgraph;

[0039] Perform graph-theoretic fusion on the first dependency subgraph, the second dependency subgraph, and the third dependency subgraph to obtain an initial multi-dimensional dependency graph;

[0040] The transitive closure between nodes in the initial multidimensional dependency graph is calculated to obtain a multidimensional execution dependency graph.

[0041] By adopting the above technical solutions, control flow graph, data flow graph and resource access are constructed respectively. Figure 3 The system constructs dependency subgraphs in multiple dimensions and fuses these subgraphs through graph theory to form a complete multidimensional execution dependency graph. This graph comprehensively captures the control dependencies, data transfer relationships, and resource competition relationships within the program, enabling the system to more accurately identify potential security vulnerabilities. The construction of the multidimensional execution dependency graph incorporates different types of program behavior characteristics, enhancing the ability to identify complex vulnerability patterns and improving the accuracy and completeness of vulnerability detection.

[0042] In conjunction with some embodiments of the first aspect, in some embodiments, before performing the dynamic injection test based on the risk path combination set, the method further includes:

[0043] Construct a test vector space based on the risk path combination set, which includes input parameter combinations, execution timing combinations, and resource status combinations;

[0044] Utilize genetic algorithms to optimize the test vector space and obtain an optimized test scenario set;

[0045] Establish a causal analysis model based on the optimized set of test scenarios;

[0046] Calculate the impact weight value of each test scenario in the causal analysis model;

[0047] The paths in the risk path combination set are hierarchically sorted according to the impact weight values ​​to obtain a priority ranking table.

[0048] By adopting the above technical solution, a test vector space containing input parameter combinations, execution timing combinations, and resource status combinations is constructed, and the test scenarios are optimized using genetic algorithms, thus establishing a scientific test optimization mechanism. This test optimization method based on genetic algorithms can reduce the scale of the test space while maintaining the representativeness and coverage of the test scenarios. By establishing a causal analysis model and calculating the impact weight values ​​of the test scenarios, the system can identify the test scenarios that have the greatest impact on program security, so that test resources can be more effectively allocated to the critical path. This intelligent test scenario optimization method reduces the resource consumption of the test while improving the targetedness and efficiency of the test. By prioritizing the test scenarios, the system can more quickly discover potential security issues and improve the efficiency and reliability of vulnerability repair verification.

[0049] In conjunction with some embodiments of the first aspect, in some embodiments, recursive optimization of the repair code according to the test result set specifically includes:

[0050] Construct an optimization strategy decision tree and traverse the optimization strategy decision tree to obtain a set of optimization solutions;

[0051] Calculate the performance overhead value, implementation complexity value and maintenance cost value of each solution in the optimization solution set;

[0052] Determine the optimal solution based on performance overhead, implementation complexity, and maintenance cost;

[0053] Refactor the repair code according to the optimal solution and update the multi-dimensional execution dependency graph;

[0054] After determining that the updated multi-dimensional execution dependency graph has a risk path, the step of constructing an optimization strategy decision tree is executed.

[0055] By adopting the above technical solutions, constructing an optimization strategy decision tree and evaluating solutions based on performance overhead, implementation complexity, and maintenance cost, a comprehensive code optimization decision-making mechanism was established. This multi-dimensional optimization evaluation method balances system performance and maintainability while ensuring security. By recursively optimizing the repair code, the system can continuously improve code quality until all risk paths are eliminated, making the code repair process more systematic and controllable. By comprehensively considering multiple optimization metrics, the system can find the optimal balance between security, performance, and maintainability, improving the practicality and reliability of the repair solution. This recursive optimization method improves the quality and stability of code repairs and reduces potential side effects after repairs.

[0056] In a second aspect, an embodiment of the present application provides a network security vulnerability identification and repair system, which network security vulnerability identification and repair system includes: one or more processors and a memory; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code includes computer instructions, and the one or more processors call the computer instructions to enable the system to execute the method described in the first aspect and any possible implementation method of the first aspect.

[0057] In a third aspect, an embodiment of the present application provides a computer-readable storage medium comprising instructions, which, when executed on a system, enables the system to execute the method described in the first aspect and any possible implementation of the first aspect.

[0058] In a fourth aspect, an embodiment of the present application provides a computer program product, characterized in that when the computer program product is run on a system, the system executes the method described in any possible implementation manner in the first aspect.

[0059] One or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages:

[0060] 1. The present application provides a method for identifying and repairing network security vulnerabilities, which generates a system behavior sequence for the application code and constructs a behavior dependency graph based on the timing relationship, which can fully express the dependency relationship between the functional modules in the system. By calculating the functional similarity and behavior consistency scores between nodes, the code areas with abnormal behavior in the program can be accurately identified. Combined with the call chain information determined by the function call relationship, the propagation path of the vulnerability is constructed, and the vulnerabilities are divided into different levels through quantitative calculation of the degree of hazard, making the location of the vulnerability more accurate and the grading more reasonable. By matching the repair strategy from the preset repair template library and performing graded repair, the systematic and targeted nature of the repair process is guaranteed, the impact of the repair process on the normal function of the system is reduced, and the accuracy and efficiency of identifying and repairing network security vulnerabilities are improved.

[0061] 2. The present application provides a method for identifying and repairing network security vulnerabilities, which obtains the control flow information, data flow information, and resource access information of the repair code to construct a multi-dimensional execution dependency graph, and performs a comprehensive dependency analysis on the repaired code. Potential risk path combinations are identified through reverse tracing analysis, and dynamic injection testing is performed to verify the repair effect. Based on the test results, the repair code is recursively optimized until all risk paths are eliminated, ensuring the integrity and reliability of the repair. This verification method based on multi-dimensional dependency analysis and recursive optimization can promptly discover new problems introduced during the repair process, and improve the correctness of the repair through continuous optimization, reducing secondary problems that arise during the repair process and improving the quality of vulnerability repair.

[0062] 3. The present application provides a method for identifying and repairing network security vulnerabilities, constructs a test vector space containing input parameter combinations, execution timing combinations, and resource status combinations, and uses genetic algorithms to optimize test scenarios, thereby establishing a scientific test optimization mechanism. This test optimization method based on genetic algorithms can reduce the scale of the test space while maintaining the representativeness and coverage of the test scenarios. By establishing a causal analysis model and calculating the impact weight values ​​of the test scenarios, the system can identify the test scenarios that have the greatest impact on program security, so that test resources can be more effectively allocated to the critical path. This intelligent test scenario optimization method reduces the resource consumption of the test while improving the pertinence and efficiency of the test. By prioritizing the test scenarios, the system can discover potential security issues more quickly and improve the efficiency and reliability of vulnerability repair verification. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 This is a flow chart of a method for identifying and repairing network security vulnerabilities in an embodiment of the present application.

[0064] Figure 2It is a flow chart of a method for verifying and optimizing a repair code in an embodiment of the present application.

[0065] Figure 3 This is a schematic diagram of the physical device structure of a network security vulnerability identification and repair system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0066] The terms used in the following examples of the present application are only for the purpose of describing specific embodiments and are not intended to limit the present application. As used in the specification and appended claims of this application, the singular expressions "a," "an," "said," "above," "the," and "this" are intended to include plural expressions as well, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used in this application refers to any or all possible combinations comprising one or more of the listed items.

[0067] In the following, the terms "first" and "second" are used for descriptive purposes only and should not be understood to imply or suggest relative importance or implicitly indicate the number of the technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of this application, unless otherwise specified, "plurality" means two or more.

[0068] The following uses an embodiment and combines Figure 1 , a network security vulnerability identification and repair method in an embodiment of the present application is described:

[0069] See also Figure 1 , which is a flow chart of a method for identifying and repairing network security vulnerabilities in an embodiment of the present application.

[0070] S101, generating a system behavior sequence according to the target system application code, and dividing the system behavior sequence into a plurality of subsequences based on a preset vulnerability signature library;

[0071] The system generates a system behavior sequence based on the target system's application code. Specifically, it extracts data flow and control flow information from the application code; uses a depth-first search algorithm to construct the program execution path based on this data flow and control flow information; collects program behavior features along the execution path and organizes them into a system behavior sequence based on the execution order. The system behavior sequence is then divided into several subsequences based on a preset vulnerability signature library.

[0072] In this step, the system first acquires the target system's application code and then analyzes and processes it, extracting the data flow and control flow information contained within. Data flow information reflects the flow and transmission of data during program execution, while control flow information describes the logical sequence and branching structure of program execution. By combining data flow and control flow information, the system can restore the complete execution process of the application.

[0073] After acquiring data and control flow information, the system can employ a depth-first search algorithm, starting from the program entry node and exploring all possible execution paths along each branch until the entire program is traversed. During this process, the system identifies and records program behavior characteristics along each execution path, such as function calls, data reads and writes, and conditional judgments. These are organized into a system behavior sequence based on the actual execution order, which is used to depict the overall operation of the entire application.

[0074] S102: constructing a behavior dependency graph based on the temporal relationship of the plurality of subsequences, calculating the functional similarity between the nodes in the behavior dependency graph, and grouping the nodes having functional similarity greater than a preset similarity into the same node cluster;

[0075] The system constructs a behavioral dependency graph based on the temporal relationships of several subsequences and calculates the functional similarity between nodes in the behavioral dependency graph. Specifically, it extracts the function name, parameter types, and return value types of each node to construct a function feature vector. It analyzes the code structure characteristics of each node and constructs a structural feature vector based on these characteristics, which include control flow, call patterns, and exception handling. It also counts the types and frequency of system resources accessed by each node to construct a resource feature vector. Based on the function feature vector, structural feature vector, and resource feature vector, it uses a weighted cosine similarity algorithm to calculate the functional similarity between nodes. The system then calculates the functional similarity between nodes in the behavioral dependency graph and groups nodes with functional similarity greater than a preset threshold into the same node cluster.

[0076] In this step, the system organizes the behavior subsequences generated in step S101 into a behavior dependency graph model that reflects the sequential dependencies between the subsequences. To construct this graph model, the system first analyzes the order of the subsequences on the timeline, determining which subsequences are executed in parallel and which subsequences have dependencies.

[0077] After clarifying the temporal relationships between subsequences, the system can choose a data structure such as a directed acyclic graph, abstracting each subsequence as a node in the graph and adding directed edges based on the dependencies between them, thus forming a complete behavioral dependency graph. To further reveal the functional semantic relevance of different subsequences, the system also needs to calculate the similarity between the nodes in the graph.

[0078] Specifically, the system can extract key information from the subsequence corresponding to each node, such as function name, parameter types, return value type, etc., and construct a multi-dimensional function feature vector based on these elements. In addition, by analyzing the code structure characteristics of each subsequence (such as control flow, call mode, exception handling method, etc.) and the access to external resources (such as file I / O, network communication, etc.), the system can further enrich the feature representation of the node. After obtaining the above three types of feature vectors, the system can use algorithms such as weighted cosine similarity to quantitatively characterize the degree of functional semantic proximity between any two nodes in the graph.

[0079] S103: Calculate the behavior consistency score between nodes in each node cluster, and mark the node clusters with behavior consistency scores less than a preset consistency threshold as potential vulnerability areas;

[0080] For each node cluster generated in step S102, the system further examines the behavioral consistency of its internal nodes, specifically the degree of functional semantic consistency across different behavioral segments within the cluster. Intuitively, if a node cluster contains a large number of logically contradictory or confusing code segments, it is more likely to harbor vulnerabilities or defects.

[0081] In order to quantitatively characterize the behavioral consistency within a node cluster, the system can adopt a technical approach based on frequent subsequence mining. Specifically, for each node cluster, the system first constructs the behavioral fragments corresponding to its internal nodes into a subsequence database, and then uses classic algorithms such as Apriori and PrefixSpan to mine common subsequence patterns whose frequency exceeds the preset support threshold. Intuitively speaking, these frequent subsequences represent recurring behavioral patterns within the node cluster. The higher the frequency, the more nodes repeat the pattern, and the stronger the behavioral consistency. Therefore, the system can use indicators such as the average frequency of frequent subsequences and the proportion of the maximum frequent subsequence length as a score to measure the overall consistency of the node cluster. When the consistency score is lower than the pre-set threshold, the system can preliminarily determine that the cluster is a suspicious potential vulnerability area and mark it for subsequent in-depth analysis.

[0082] It should be noted that simply relying on preset thresholds for judgment may lead to inaccurate delineation of potential vulnerability areas. The system can also attempt to introduce strategies such as cross-validation and adaptive threshold adjustment to dynamically optimize threshold selection and improve the precision and recall of potential vulnerability area identification. Furthermore, for the delineated potential vulnerability areas, the system can combine known vulnerability patterns in the vulnerability knowledge base to make preliminary inferences about vulnerability types, such as injection attacks, privilege escalation, and denial of service, providing powerful clues for subsequent vulnerability location and remediation.

[0083] S104, determining call chain information based on the function call relationship between nodes in the potential vulnerability area;

[0084] After identifying a potential vulnerability area, the system needs to analyze the code implementation logic and data dependencies of the nodes within that area to further pinpoint the vulnerability's specific location and impact. Function call relationships are the most intuitive and important form of dependency. By analyzing the call chains between functions within the vulnerable area, the complete path of vulnerability formation and spread can be restored.

[0085] Specifically, for each potential vulnerability area, the system can traverse its internal nodes and, with each node as the root, use symbolic execution, taint analysis, and other technologies to track all possible call paths of the function corresponding to that node. In this process, the system must not only consider explicit direct function calls, but also explore implicit indirect call relationships, such as dynamically determining the called function through mechanisms such as function pointers and virtual functions. By integrating call fragments scattered across different nodes and functions, a complete call chain is eventually formed, starting with the vulnerable function and covering the entire vulnerable area. This call chain reflects both the static structure of the vulnerable code and the control flow transfer path during actual runtime, serving as an important basis for subsequent vulnerability analysis and tracing.

[0086] S105: Construct a vulnerability propagation path based on the call chain information and calculate the criticality of each node in the vulnerability propagation path;

[0087] After identifying the call chain of functions within the potential vulnerability area, the system further analyzes the specific path the vulnerability propagates through this call chain and assesses the degree of harm different nodes and functions contribute to the vulnerability's propagation. This is crucial for prioritizing vulnerability remediation and developing the optimal remediation plan.

[0088] Specifically, the system can splice all vulnerability-related call chains found in step S104 in the order of actual execution, thereby constructing a complete path sequence that reflects the vulnerability propagation process. On this basis, the system needs to design a set of scientific hazard assessment methods to quantitatively characterize the risk level of each node in the path. An intuitive idea is to assign different hazard weights based on factors such as the criticality of each node in the vulnerability propagation and the degree of data flow aggregation. For example, for nodes that directly access or modify sensitive data and propagate to the outside, their hazard coefficient should be significantly higher than that of intermediate nodes that simply transmit data flows. The system can design a node importance assessment algorithm based on graph centrality, characterize the key role of nodes in vulnerability propagation from multiple dimensions (such as betweenness centrality, connection centrality, etc.), and calculate its final hazard score.

[0089] S106: Classify the corresponding nodes into first-level vulnerability, second-level vulnerability, and third-level vulnerability according to the vulnerability level of each node;

[0090] The system divides the corresponding nodes into first-level hazard vulnerabilities, second-level hazard vulnerabilities and third-level hazard vulnerabilities according to the hazard level of each node. The hazard level corresponding to the nodes in the first-level hazard vulnerabilities is greater than the first preset threshold, the hazard level corresponding to the nodes in the second-level hazard vulnerabilities is greater than the second preset threshold and not greater than the first preset threshold, and the hazard level corresponding to the nodes in the third-level hazard vulnerabilities is not greater than the second preset threshold.

[0091] After obtaining a quantitative score for each node's severity, the system needs to further map the nodes to vulnerabilities of varying severity levels to facilitate the development of differentiated remediation strategies and response plans. Generally speaking, the industry's commonly used vulnerability severity classification standard has three levels: high, medium, and low.

[0092] The system can refer to the above standards and set two criticality thresholds, denoted as Threshold 1 (higher) and Threshold 2 (lower). For each node in the vulnerability propagation path, if its criticality score is higher than Threshold 1, the node is judged as a Level 1 criticality vulnerability (high risk); if the node criticality is between Threshold 1 and Threshold 2, it is judged as a Level 2 criticality vulnerability (medium risk); if the node criticality is lower than Threshold 2, it is judged as a Level 3 criticality vulnerability (low risk). This results in a hierarchical sequence of criticality vulnerability nodes along the entire vulnerability propagation path.

[0093] It should be noted that threshold 1 and threshold 2 can be dynamically set and adjusted by the system with reference to factors such as vulnerability hazard tolerance, patch development, and vulnerability repair costs in actual scenarios. In practice, cross-validation, grid search, and other strategies can also be used to quantitatively examine the overall response effects (such as average response time, unfixed vulnerability retention rate, etc.) under different threshold combinations to find the optimal threshold settings, thereby guiding the best vulnerability classification scheme. In addition, since different industries and systems have different hazard tolerances for the same vulnerability, the system can also support users to customize and fine-tune the hazard thresholds to meet personalized and domain-adaptive classification requirements. This will help to flexibly adapt to the grading detection requirements of different application scenarios on the basis of the general vulnerability hazard classification framework, and improve the overall vulnerability management and control level.

[0094] S107. Determine the repair priority based on the first-level, second-level, and third-level vulnerabilities, and generate a vulnerability report including the vulnerability type, vulnerability location, propagation path, and repair priority.

[0095] Once vulnerability nodes are graded, the system can prioritize their remediation. Generally speaking, vulnerabilities with higher severity levels should be assigned a higher remediation priority, allowing for early repair and resolution to mitigate security risks. Furthermore, vulnerability remediation priorities should also take into account factors such as actual business continuity and resource constraints.

[0096] An intuitive solution for determining repair priorities is to mark first-level vulnerabilities (high-risk vulnerabilities) as the highest priority P1, second-level vulnerabilities (medium-risk vulnerabilities) as the second-highest priority P2, and third-level vulnerabilities (low-risk vulnerabilities) as the general priority P3. The system will set corresponding repair deadlines for vulnerabilities of different priorities based on the vulnerability repair time requirements of specific scenarios. For example, for P1-level vulnerabilities, the system may require repairs to be completed within 1-2 working days; for P2-level vulnerabilities, this can be relaxed to 1-2 weeks; and for P3-level vulnerabilities, they can be repaired within 1-2 months. This hierarchical response mechanism takes into account both the degree of risk and the rational allocation of repair resources.

[0097] Furthermore, the system must generate a comprehensive analysis report for each discovered vulnerability. This report should include basic vulnerability information, such as its type (determined through semantic analysis combined with a vulnerability knowledge base), its precise location (file, function, line number, etc. within the code), and its complete propagation path, enabling remediation personnel to quickly locate and reproduce the vulnerability. The report should also clearly state the vulnerability's ultimate risk level and remediation priority, guiding the development of appropriate remediation and response plans.

[0098] S108: According to the vulnerability type, repair priority, and propagation path information, corresponding repair strategies are matched in sequence from a preset repair template library in the order of repair priority;

[0099] After completing vulnerability risk grading and remediation priority determination, the system needs to further match appropriate remediation solutions for each vulnerability. The development of remediation solutions must fully consider factors such as the vulnerability type, impact scope, and propagation path, while also taking into account the actual remediation difficulty and resource constraints.

[0100] In order to quickly and efficiently respond to the repair needs of different types of vulnerabilities, the system can pre-establish a universal vulnerability repair template library, which reserves various types of verified and effective vulnerability repair codes and configuration templates. These templates should cover mainstream vulnerability types, such as injection, XSS cross-site scripting, access control gaps, sensitive information leakage, etc., and be organized into multiple sub-libraries based on different languages ​​and application scenarios. When a vulnerability is actually detected, the system can quickly retrieve and locate the matching repair template based on its type attributes, and make appropriate adjustments based on the specific context (such as code style, data structure, etc.), thereby greatly simplifying and accelerating the process of writing repair code.

[0101] Based on the repair template library, the system can design a set of targeted policy matching and scheduling mechanisms. For vulnerabilities detected in batches, the system should comprehensively weigh their risk levels and repair priorities, and allocate more repair resources to high-priority vulnerabilities. When specifically matching repair strategies, the system should also fully consider the vulnerability propagation path information. For vulnerabilities that span multiple modules and have complex call chains, priority should be given to defense-in-depth strategies that can be globally managed to block them at the source; for vulnerabilities with strong localization, lightweight endpoint protection solutions can be selected. The system can also combine technologies such as code static analysis to evaluate the actual coverage of different repair solutions and dynamically score and select strategy solutions. This helps to tailor the optimal vulnerability repair combination within the constraints of limited repair resources to maximize the overall risk mitigation effect.

[0102] S109: Perform hierarchical repair on the application code based on the matched repair strategy to obtain repair code, and deploy the repair code to the target system.

[0103] After selecting the optimal remediation strategy for each vulnerability, the system needs to further implement these strategies into the actual application code, ultimately completing the generation and deployment of the remediation code. Due to the varying risk levels and impacts of different vulnerability nodes, the system must adopt a hierarchical remediation approach, rationally allocating resources, and carrying out remediation work in a phased and focused manner.

[0104] For high-priority P1-level vulnerabilities, the system should initiate the repair process immediately, mobilizing elite development and testing resources to complete the writing, review, testing, and deployment of the repair code in the shortest possible time. For P2-level medium-risk vulnerabilities, the system can allocate resources relatively evenly, steadily advancing the development and testing of the repair code while meeting the repair deadline, and completing the release as soon as possible. For P3-level low-risk vulnerabilities, if they do not affect key business functions, the system can integrate them with the regular code iteration and update process, introduce additional security measures such as manual review when necessary, and carefully carry out code merging and deployment.

[0105] During the code repair process, the system should focus on the effectiveness of policy implementation. Penetration testing, fuzz testing, and other techniques can be used to evaluate the effectiveness of the repaired code in protecting against similar vulnerabilities. For vulnerabilities with wide-ranging impact across modules, the system can also introduce regression testing to focus on the side effects of the repaired code. Once new issues are discovered, they should be promptly corrected, or the matching logic should be adjusted based on feedback from the policy library. After completing the necessary code review and security testing, the system can initiate the recovery and full deployment process, applying the repaired code to the production system.

[0106] In the above embodiment, a system behavior sequence is generated for the application code and a behavior dependency graph is constructed based on the timing relationship, which can fully express the dependency relationship between the functional modules in the system. By calculating the functional similarity and behavior consistency scores between nodes, the code area with abnormal behavior in the program can be accurately identified. Combined with the call chain information determined by the function call relationship, the propagation path of the vulnerability is constructed, and the vulnerabilities are divided into different levels through quantitative calculation of the degree of hazard, making the location of the vulnerability more accurate and the grading more reasonable. By matching the repair strategy from the preset repair template library and performing graded repair, the systematic and targeted nature of the repair process is guaranteed, the impact of the repair process on the normal function of the system is reduced, and the accuracy and efficiency of identifying and repairing network security vulnerabilities are improved.

[0107] After the identification and preliminary repair of the vulnerability are completed, in order to ensure the effectiveness and reliability of the repair, the embodiment of the present application also provides a method for verifying and optimizing the repair code. This method further improves the repair effect by performing comprehensive security analysis and testing on the repaired code. By constructing a multi-dimensional execution dependency graph, performing reverse tracing analysis and dynamic injection testing, it is possible to systematically evaluate the potential security risks in the repair code, and continuously improve the repair solution through recursive optimization. This post-repair verification and optimization mechanism forms a closed-loop security assurance system that can better guarantee the quality of the repair. The following is combined with Figure 2 , a method for verifying and optimizing a repair code in an embodiment of the present application is described:

[0108] See also Figure 2 Fig. 1 is a flowchart of a method for verifying and optimizing a repair code according to an embodiment of the present application.

[0109] S201, obtaining control flow information, data flow information and resource access information of the repair code;

[0110] In this step, the system needs to obtain various information of the repair code, including control flow information, data flow information and resource access information. The control flow information reflects the execution path and logical structure of the code, which can be obtained by statically analyzing the branch, loop and other structures of the code. The data flow information reflects the definition and use of variables in the code, which can be obtained by tracking the assignment and reference of variables. The resource access information records the access operation sequence of the code to various system resources such as files, databases, etc.

[0111] S202, constructing a multi-dimensional execution dependency graph based on the control flow information, the data flow information and the resource access information;

[0112] The system constructs a multi-dimensional execution dependency graph based on the control flow information, the data flow information and the resource access information. Specifically, a control flow graph is constructed based on the control flow information to obtain a first dependency subgraph; a variable definition and use chain is analyzed based on the data flow information to obtain a second dependency subgraph; a resource mutual exclusion access sequence is identified based on the resource access information to obtain a third dependency subgraph; the first dependency subgraph, the second dependency subgraph and the third dependency subgraph are fused by graph theory to obtain an initial multi-dimensional dependency graph; and the transitive closure between nodes in the initial multi-dimensional dependency graph is calculated to obtain the multi-dimensional execution dependency graph.

[0113] The purpose of this step is to comprehensively utilize the control flow, data flow and resource access information obtained in the previous step to construct a multi-dimensional dependency graph that comprehensively reflects the execution characteristics of the repair code. This graph not only reflects the logical structure of the code, but also reveals the data dependency relationship between variables and the access dependency relationship to resources, so it is called a multi-dimensional dependency graph. In the construction process, the system first generates dependency subgraphs based on different information, and then fuses these subgraphs to obtain a complete dependency graph.

[0114] Specifically, the system can use a graph construction algorithm to realize the generation of the dependency graph. For the control flow graph, the code blocks can be taken as nodes and the control flow transitions as directed edges to generate a directed graph. For the data flow graph, the variables can be taken as nodes and the definition-use relationship as directed edges. In the resource access graph, the resources are nodes and the access dependencies are edges. After obtaining the three types of subgraphs, the system needs to fuse the graphs, i.e. identify the correspondence between nodes in different subgraphs, establish a unified node, and merge the directed edges to form a multi-dimensional comprehensive dependency graph. It is worth noting that the direction of the edges may change during the fusion process, so the transitive closure of the graph needs to be recalculated to reveal the indirect dependency relationship between nodes.

[0115] S203, performing reverse tracing analysis on the multi-dimensional execution dependency graph to obtain a risk path combination set;

[0116] Based on the multi-dimensional execution dependency graph, this step uses back-tracing analysis to identify potential risky path combinations within the repaired code. A risky path refers to a specific execution path during code execution that could lead to security vulnerabilities, failures, and other issues. Because repaired code can introduce new defects or miss existing ones, comprehensive identification of these risky paths is crucial for improving repair quality. Back-tracing analysis is an analytical technique that works backward from a result to all possible causes of that result. By performing back-tracing on the dependency graph, it can exhaust all possible combinations of paths that could lead to risk.

[0117] In specific implementations, the system can employ symbolic execution technology, starting from a risk node in the dependency graph (such as a resource access node) and traversing the graph in reverse, while recording the nodes and edges traversed during the traversal to form a risk path. By exhaustively enumerating all risk nodes and traversing each node in reverse, a complete set of risk paths is ultimately obtained. During this traversal process, the system can also incorporate constraint solving technology to solve conditional nodes on the path, deriving the input conditions that could trigger the path, thereby forming a complete risk path combination (including the execution path and triggering conditions).

[0118] Before executing S204, in another embodiment, the system may further construct a test vector space according to the risk path combination set, the test vector space including input parameter combinations, execution timing combinations, and resource status combinations;

[0119] Utilize genetic algorithms to optimize the test vector space and obtain an optimized test scenario set;

[0120] Establish a causal analysis model based on the optimized set of test scenarios;

[0121] Calculate the impact weight value of each test scenario in the causal analysis model;

[0122] The paths in the risk path combination set are hierarchically sorted according to the impact weight values ​​to obtain a priority ranking table.

[0123] First, the system constructs a test vector space based on the set of risk path combinations. This space consists of three dimensions: input parameter combinations, execution sequence combinations, and resource state combinations. Input parameter combinations represent all possible combinations of input data for the risk path; execution sequence combinations represent the possible execution order combinations of each code block in the risk path; and resource state combinations represent the possible state combinations of related resources (such as memory and files) during the execution of the risk path. Each point in the test vector space represents a unique test scenario, consisting of specific inputs, execution sequences, and resource states.

[0124] However, due to the complexity of risk paths, the test vector space can be extremely large, making it impractical to exhaustively enumerate all possible test scenarios. Therefore, the system utilizes a genetic algorithm to intelligently optimize the test vector space. By simulating the process of biological evolution, the genetic algorithm continuously eliminates inferior individuals while retaining and reproducing high-quality ones, ultimately generating an optimal set of test scenarios. Each test scenario is treated as an individual, and its fitness function is designed based on metrics such as the scenario's code coverage and the uniqueness of its execution paths. Through iterative operations such as selection, crossover, and mutation, the algorithm ultimately produces a set of optimized test scenarios with high coverage, diverse paths, and strong targeting.

[0125] After obtaining the optimized set of test scenarios, the system also needs to evaluate the risk level of each scenario in order to reasonably arrange test resources and priorities. To this end, the system establishes a causal analysis model based on the optimized set of test scenarios. This model uses a data-driven approach to explore the causal relationship between test scenarios and risk results such as code defects and attack events. Specifically, the system collects historical test data and related risk event data, trains the causal analysis model through machine learning algorithms (such as Bayesian networks, association rules, etc.), and establishes a mapping relationship between test scenario characteristics and risk results. After the model is established, the system calculates the impact weight value of each test scenario, that is, the possibility of the scenario leading to a risk event. The larger the impact weight value, the more likely the risk path combination corresponding to the scenario is to contain defects or vulnerabilities, and should be tested first.

[0126] Finally, the system reorders the original set of risk path combinations based on the impact weights of the test scenarios, generating a priority table. The high-priority portion of the table contains paths with significant impact and high risk potential, while the low-priority portion corresponds to paths with less impact and lower risk. This allows the system to rationally allocate testing resources and time based on the priority table, prioritizing testing and remediation of high-risk paths, thereby improving testing efficiency and effectiveness.

[0127] S204. Perform dynamic injection testing based on the risk path combination set to generate a test result set;

[0128] This step uses the risk path combinations obtained in the previous step to perform dynamic injection testing on the repaired code to verify whether these risk paths actually contain security vulnerabilities or faults. Compared to static analysis, dynamic testing, by actually executing the code, can reveal more issues that only arise at runtime. Injection testing is a testing method that constructs specific input data to cause the code to execute along a specified path and observe whether its behavior conforms to expectations. By targeting risk paths and injecting the appropriate data, the security and reliability of these paths can be tested.

[0129] During specific implementation, the system first needs to generate test cases based on the risk path combination. Each test case consists of two parts: input data and expected results. The input data can be constructed based on the trigger conditions in the path combination, and the abstract conditions are converted into specific inputs through symbolic execution, constraint solving and other technologies. The expected results are defined according to the semantics and specifications of the path, such as normal execution, throwing exceptions, etc. After generating the test case, the system inserts the repair code and inserts breakpoints or log statements at key nodes of the risk path to record the actual execution status. The system then injects the test case into the code for execution, monitors the execution of the instrumentation points, and compares the actual results with the expected results to generate a test report. The test report needs to include the execution status of the test case (such as whether the path is triggered, whether it meets expectations, etc.), as well as information such as code coverage and performance overhead.

[0130] S205: Recursively optimize the repair code according to the test result set until the risk path combination set is an empty set.

[0131] The system recursively optimizes the repair code based on the test result set until the risk path combination set is empty. Specifically, it constructs an optimization strategy decision tree and traverses the optimization strategy decision tree to obtain a set of optimization solutions.

[0132] Calculate the performance overhead value, implementation complexity value and maintenance cost value of each solution in the optimization solution set;

[0133] Determine the optimal solution based on performance overhead, implementation complexity, and maintenance cost.

[0134] Refactor the repair code according to the optimal solution and update the multi-dimensional execution dependency graph;

[0135] After determining that the updated multi-dimensional execution dependency graph has a risk path, the step of constructing an optimization strategy decision tree is executed.

[0136] After obtaining dynamic test results, this step requires further optimization of the existing fix code based on the issues revealed by the tests. Because the previous fix may have missed certain vulnerabilities or introduced new defects, it is necessary to recursively execute the closed-loop analysis-fix-test process, continuously improving the fix code until all risk paths are eliminated and the fix reaches a stable and reliable state.

[0137] In order to improve the repair efficiency, the system can adopt a repair strategy optimization mechanism based on a decision tree. First, the system constructs a repair strategy decision tree based on the characteristics of the risk path and test feedback. Each node of the decision tree represents a repair strategy (such as data inspection, boundary processing, exception capture, etc.), and each branch represents the applicable conditions of the strategy (such as risk type, context, etc.). The system traverses the decision tree, matches the characteristics of the current risk path, and obtains a set of applicable repair strategies. Then, the system evaluates these strategies, considering factors such as their effectiveness, performance overhead, and implementation difficulty, and selects the optimal strategy to guide code repair. After the repair is completed, the system regenerates the risk path combination and enters the next round of testing. The optimization is recursively optimized until the risk path set is empty and the repair is completed.

[0138] In the above embodiment, the control flow information, data flow information and resource access information of the repair code are obtained to construct a multi-dimensional execution dependency graph, and a comprehensive dependency analysis is performed on the repaired code. Potential risk path combinations are identified through reverse tracing analysis, and dynamic injection testing is performed to verify the repair effect. Based on the test results, the repair code is recursively optimized until all risk paths are eliminated, ensuring the integrity and reliability of the repair. This verification method based on multi-dimensional dependency analysis and recursive optimization can promptly discover new problems introduced during the repair process, and improve the correctness of the repair through continuous optimization, reducing secondary problems that arise during the repair process and improving the quality of vulnerability repair.

[0139] The following describes the system in the embodiment of the present invention from the perspective of hardware processing. Figure 3 , which is a schematic diagram of the physical device structure of a network security vulnerability identification and repair system provided in an embodiment of the present application.

[0140] It should be noted that Figure 3 The structure of the system shown is only an example and should not limit the functions and scope of use of the embodiments of the present invention.

[0141] like Figure 3As shown, the system includes a central processing unit (CPU) 301, which can perform various appropriate actions and processes, such as the methods described in the above embodiments, based on programs stored in a read-only memory (ROM) 302 or programs loaded from a storage unit 308 into a random access memory (RAM) 303. RAM 303 also stores various programs and data required for system operation. CPU 301, ROM 302, and RAM 303 are interconnected via a bus 304. An input / output (I / O) interface 305 is also connected to bus 304.

[0142] The following components are connected to the I / O interface 305: an input section 306 including a camera, infrared sensor, and the like; an output section 307 including a liquid crystal display (LCD) and speakers; a storage section 308 including a hard disk and the like; and a communication section 309 including a network interface card such as a LAN (Local Area Network) card or a modem. The communication section 309 performs communication processing via a network such as the Internet. A drive 310 is also connected to the I / O interface 305 as needed. Removable media 311, such as a magnetic disk, optical disk, magneto-optical disk, or semiconductor memory, is installed in the drive 310 as needed, so that computer programs read from the media can be installed in the storage section 308 as needed.

[0143] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program including a computer program for executing the methods illustrated in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via the communication section 309 and / or installed from removable media 311. When executed by the central processing unit (CPU) 301, the computer program performs the various functions defined in the present invention.

[0144] It should be noted that the computer-readable medium in the embodiments of the present application can be a computer-readable signal medium or a computer-readable storage medium or any combination of the two. The computer-readable storage medium may, for example, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or apparatus, or any combination of the above. More specific examples of the computer-readable storage medium can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (Compact Disc Read-Only Memory, CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device or apparatus. In the present application, the computer-readable signal medium can include a data signal carried in a baseband or as a part of a carrier wave, which carries computer-readable computer programs. Such a propagated data signal can take many forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above.

[0145] The flowcharts and block diagrams in the drawings illustrate the possible implementation architectures, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. Each block in the flowcharts or block diagrams can represent a module, a program segment, or a part of code containing one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur in different orders than that shown in the drawings. For example, two blocks that are shown in succession can actually be executed substantially in parallel, and sometimes in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams or flowcharts, and the combination of blocks in the block diagrams or flowcharts, can be implemented by a dedicated hardware-based system that performs the specified functions or operations, or can be implemented by a combination of dedicated hardware and computer instructions.

[0146] As another aspect, the present application also provides a computer readable storage medium, which can be included in the system described in the above embodiments, or can exist independently without being assembled into the system. The above storage medium carries one or more computer programs, which, when executed by a processor of a system, enable the system to implement the method provided in the above embodiments.

[0147] The above embodiments are only used to illustrate the technical solutions of the present application, but not limit the present application; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: they can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacements to some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

[0148] In the above embodiments, according to the context, the term "when" can be interpreted as meaning "if" or "after" or "in response to determining" or "in response to detecting". Similarly, according to the context, the phrase "upon determining" or "if detecting (the stated condition or event)" can be interpreted as meaning "if determining" or "in response to determining" or "upon detecting (the stated condition or event)" or "in response to detecting (the stated condition or event)".

[0149] In the above embodiments, all or part of the embodiments can be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line) or wireless (such as infrared, wireless, microwave, etc.) mode. The computer readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. integrated with one or more available media. The available media can be magnetic media (for example, floppy disk, hard disk, magnetic tape), optical media (for example, DVD), or semiconductor media (for example, solid state disk) and the like.

[0150] Those skilled in the art can understand that all or part of the processes in the above-mentioned method embodiments can be implemented by a computer program instructing relevant hardware to complete, the program can be stored in a computer readable storage medium, and the program can include the processes of the above-mentioned method embodiments when executed. The aforementioned storage medium includes ROM or random storage memory RAM, magnetic disc or optical disc and various storage code medium.

Claims

1. A method for identifying and repairing network security vulnerabilities, characterized in that: include: Generate a system behavior sequence based on the target system application code, and divide the system behavior sequence into several subsequences based on a preset vulnerability signature library; Constructing a behavior dependency graph according to the temporal relationship of the plurality of subsequences; Calculating the functional similarity between the nodes in the behavior dependency graph, and dividing the nodes whose functional similarity is greater than a preset similarity into the same node cluster; Calculating a behavior consistency score between nodes within each node cluster, and marking a node cluster with a behavior consistency score less than a preset consistency threshold as a potential vulnerability area; Determining call chain information based on function call relationships between nodes in the potential vulnerability area; Constructing a vulnerability propagation path according to the call chain information, and calculating the criticality of each node in the vulnerability propagation path; Classifying the corresponding nodes into first-level vulnerability, second-level vulnerability, and third-level vulnerability according to the criticality of each node, wherein the criticality of the nodes in the first-level vulnerability is greater than a first preset threshold, the criticality of the nodes in the second-level vulnerability is greater than a second preset threshold and not greater than the first preset threshold, and the criticality of the nodes in the third-level vulnerability is not greater than the second preset threshold; Determine a repair priority based on the first-level hazard vulnerabilities, the second-level hazard vulnerabilities, and the third-level hazard vulnerabilities, and generate a vulnerability report including vulnerability type, vulnerability location, propagation path, and the repair priority; According to the vulnerability type, the repair priority and the propagation path information, corresponding repair strategies are matched in sequence from a preset repair template library in the order of the repair priority; The application code is repaired in stages based on the matched repair strategy to obtain repair code, and the repair code is deployed to the target system.

2. The method according to claim 1, characterized in that The generating of the system behavior sequence according to the target system application code specifically includes: Extracting data flow information and control flow information from the application code; Based on the data flow information and the control flow information, a depth-first search algorithm is used to construct a program execution path; Program behavior features are collected in sequence along the program execution path, and the program behavior features are organized into a system behavior sequence according to the execution order.

3. The method according to claim 1, characterized in that The calculating the functional similarity between the nodes in the behavior dependency graph specifically includes: Extract the function name, parameter type and return value type of each node and construct the function feature vector; Analyzing the code structure features of each node and constructing a structure feature vector based on the code structure features, wherein the code structure features include control flow, call mode, and exception handling method; Counting the types and frequencies of system resources accessed by each node, and constructing a resource feature vector; Based on the function feature vector, the structure feature vector and the resource feature vector, a weighted cosine similarity algorithm is used to calculate the functional similarity between the nodes.

4. The method according to claim 1, wherein After deploying the repair code to the target system, the method further includes: Obtaining control flow information, data flow information, and resource access information of the repair code; constructing a multidimensional execution dependency graph based on the control flow information, the data flow information, and the resource access information; Performing reverse tracing analysis on the multi-dimensional execution dependency graph to obtain a risk path combination set; Performing a dynamic injection test based on the risk path combination set to generate a test result set; The repair code is recursively optimized according to the test result set until the risk path combination set is an empty set.

5. The method according to claim 4, characterized in that The constructing of a multi-dimensional execution dependency graph based on the control flow information, the data flow information, and the resource access information specifically includes: Constructing a control flow graph based on the control flow information to obtain a first dependency subgraph; Analyze the definition and usage chain of the variables based on the data flow information to obtain a second dependency subgraph; Identify a mutually exclusive resource access sequence based on the resource access information to obtain a third dependency subgraph; Performing graph-theoretic fusion on the first dependency subgraph, the second dependency subgraph, and the third dependency subgraph to obtain an initial multi-dimensional dependency graph; The transitive closure between the nodes in the initial multidimensional dependency graph is calculated to obtain a multidimensional execution dependency graph.

6. The method according to claim 4 or 5, characterized in that Before performing the dynamic injection test based on the risk path combination set, the method further includes: Constructing a test vector space according to the risk path combination set, wherein the test vector space includes input parameter combinations, execution timing combinations, and resource status combinations; Optimizing the test vector space using a genetic algorithm to obtain an optimized test scenario set; Establishing a causal analysis model based on the optimized test scenario set; Calculating the impact weight value of each test scenario in the causal analysis model; The paths in the risk path combination set are hierarchically sorted according to the impact weight values ​​to obtain a priority sorting table.

7. The method according to claim 4, characterized in that The recursive optimization of the repair code according to the test result set specifically includes: Constructing an optimization strategy decision tree, and traversing the optimization strategy decision tree to obtain an optimization solution set; Calculating the performance overhead value, implementation complexity value and maintenance cost value of each solution in the set of optimization solutions; Determining an optimal solution based on the performance overhead value, the implementation complexity value, and the maintenance cost value; Reconstructing the repair code according to the optimal solution and updating the multi-dimensional execution dependency graph; If it is determined that there is a risk path in the updated multi-dimensional execution dependency graph, the step of constructing the optimization strategy decision tree is performed.

8. A network security vulnerability identification and repair system, characterized in that: The system comprises: One or more processors and a memory; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code includes computer instructions, and the one or more processors call the computer instructions to cause the system to execute the method according to any one of claims 1 to 7.

9. A computer-readable storage medium comprising instructions, characterized in that: When the instructions are executed on a system, the system is caused to perform the method according to any one of claims 1 to 7.

10. A computer program product, characterized in that When the computer program product is run on a system, the system is caused to perform the method according to any one of claims 1 to 7.

Images