Vulnerability data retrieval method and device, electronic equipment and storage medium
By determining the vulnerability search entities and constraints in the vulnerability data retrieval system, filtering out high-relevance vulnerability data and compressing data, the problem of inaccurate vulnerability data retrieval in the existing technology is solved, and the timeliness and security of vulnerability data is improved.
Patent Information
- Application Number
- CN202411829818.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-12
- Publication Date
- 2025-04-18
AI Technical Summary
When existing knowledge base systems deal with large amounts of vulnerable data, it is difficult to effectively remove redundant or irrelevant content, which affects the accuracy of vulnerable data retrieval results, resulting in the inability to promptly reflect the latest vulnerabilities, increasing the risk of network attacks.
By receiving the vulnerability data search content, the vulnerability search entity and constraints are determined, multiple first vulnerability data are obtained from the vulnerability database, and the search scores of each first vulnerability data are determined based on the search entity and constraints. Based on the search score, the second vulnerability data with high correlation with the search content is filtered out from the multiple first vulnerability data and is subjected to data compression processing.
Improve the accuracy of vulnerable data retrieval, reduce the impact of irrelevant data, ensure timely reflection of the latest vulnerabilities, and reduce the increased risk of cyber attacks due to failure to update or patch vulnerabilities in a timely manner.
Smart Images
Figure CN119848097A_ABST
Abstract
Description
Technical Field
[0001] Embodiments of the present invention relate to the field of data retrieval technology, and in particular to a method, device, electronic device and storage medium for vulnerability data retrieval. Background Art
[0002] In today's network security environment, massive and constantly updated security data poses a severe challenge to obtaining accurate vulnerability data. When processing large amounts of vulnerability data, existing knowledge base systems often find it difficult to effectively remove redundant or irrelevant content, affecting the accuracy of vulnerability data retrieval results. As a result, the retrieved vulnerability data cannot reflect the latest vulnerabilities in a timely manner, and there is a risk of increased network attacks if vulnerabilities are not updated or patched in a timely manner. Summary of the invention
[0003] In view of this, in order to improve the accuracy of vulnerability data retrieval and effectively alleviate the technical problem that the latest vulnerabilities cannot be reflected in a timely manner due to inaccurate vulnerability data retrieval, and the risk of network attacks is increased due to failure to update or patch vulnerabilities in a timely manner, the embodiments of the present invention provide a method, device, electronic device and storage medium for vulnerability data retrieval.
[0004] In a first aspect, an embodiment of the present invention provides a method for retrieving vulnerability data, the method comprising:
[0005] receiving vulnerability data retrieval content, and determining vulnerability retrieval entities and vulnerability retrieval constraints from the vulnerability data retrieval content;
[0006] Acquire a plurality of first vulnerability data from a vulnerability database based on the vulnerability retrieval entity and the vulnerability retrieval constraint condition;
[0007] Determine the search score of each first vulnerability data according to the vulnerability search entity and the vulnerability search constraint condition; wherein the search score is a quantitative indicator used to measure the relevance of the first vulnerability data to the vulnerability data search content;
[0008] A plurality of second vulnerability data are determined from the plurality of first vulnerability data based on the search scores; wherein the number of the second vulnerability data is less than the number of the first vulnerability data.
[0009] In one possible implementation, the method further includes:
[0010] Determining vulnerability types from the vulnerability data retrieval content;
[0011] Determine data compression parameters based on vulnerability type;
[0012] Data compression processing is performed on each second vulnerability data according to the data compression parameter to obtain compressed second vulnerability data.
[0013] In a possible implementation, the vulnerability search constraint condition includes a time window and a vulnerability threshold, and the vulnerability threshold is used to characterize the severity of the vulnerability affecting the vulnerability search entity;
[0014] Determine vulnerability retrieval entities and vulnerability retrieval constraints from vulnerability data retrieval content, including:
[0015] Obtain a vulnerability search object, a time object, and a vulnerability severity object from the vulnerability data search content;
[0016] Determine the vulnerability search object as a vulnerability search entity;
[0017] Querying a time window matching the time object from a time window query table; wherein the time window query table stores a correspondence between the time object and the time window;
[0018] A vulnerability threshold value matching the vulnerability severity object is queried from the vulnerability threshold table; wherein the vulnerability threshold query table stores a correspondence between the vulnerability severity object and the vulnerability threshold value.
[0019] In a possible implementation, obtaining a plurality of first vulnerability data from a vulnerability database based on the vulnerability search entity and the vulnerability search constraint condition includes:
[0020] Determine the similarity with each vulnerability retrieval data in the vulnerability database based on the vulnerability retrieval entity;
[0021] Acquire a plurality of third vulnerability data having similarities exceeding a preset similarity from a vulnerability database;
[0022] Obtain the vulnerability score and data upload time of each third vulnerability data;
[0023] A plurality of first vulnerability data whose data upload time is within the time window and whose vulnerability scores reach the vulnerability threshold are obtained from the plurality of third vulnerability data.
[0024] In a possible implementation, determining the search score of each first vulnerability data according to the vulnerability search entity and the vulnerability search constraint condition includes:
[0025] For each first vulnerability data: determining a relevance score of the first vulnerability data based on the vulnerability retrieval entity;
[0026] Determine a security score of the first vulnerability data according to the vulnerability threshold;
[0027] Determine a timeliness score for the first vulnerability data based on the vulnerability threshold and the data upload time;
[0028] The retrieval score of the first vulnerability data is determined according to the relevance score, the security score and the timeliness score.
[0029] In a possible implementation, determining a relevance score of the first vulnerability data based on the vulnerability retrieval entity includes:
[0030] Obtaining the total number of features related to the vulnerability search entity and the number of features related to the first vulnerability data and the vulnerability search entity;
[0031] A relevance score of the first vulnerability data is determined based on the number of relevant features and the total number of relevant features.
[0032] In a possible implementation, determining the security score of the first vulnerability data according to the vulnerability threshold includes:
[0033] Querying the vulnerability threshold weight corresponding to the vulnerability threshold from the vulnerability threshold weight query table; wherein the vulnerability threshold weight query table stores the corresponding relationship between the vulnerability threshold and the vulnerability threshold weight;
[0034] A security score of the first vulnerability data is determined based on the vulnerability threshold and the vulnerability threshold weight.
[0035] In a possible implementation, determining the timeliness score of the first vulnerability data based on the vulnerability threshold and the data upload time includes:
[0036] Determine the duration based on the data upload time and current time;
[0037] The timeliness score of the first vulnerability data is determined based on the duration, the vulnerability threshold and the preset time decay factor.
[0038] In a possible implementation, determining the retrieval score of the first vulnerability data according to the relevance score, the security score, and the timeliness score includes:
[0039] The retrieval score of the first vulnerability data is determined based on the relevance score, the preset relevance weight corresponding to the relevance score, the security score, the preset security weight corresponding to the security score, the timeliness score, and the preset timeliness weight corresponding to the timeliness score.
[0040] In one possible implementation, determining a plurality of second vulnerability data from a plurality of first vulnerability data based on the search scores includes:
[0041] Sorting the plurality of first vulnerability data in order according to the numerical values of the search scores;
[0042] A preset number of first vulnerability data are selected from the plurality of first vulnerability data in order and determined as a plurality of second vulnerability data.
[0043] In a possible implementation, performing data compression processing on each second vulnerability data according to a data compression parameter to obtain compressed second vulnerability data includes:
[0044] For each second vulnerability data: extracting a compressed reserved field from the second vulnerability data based on the vulnerability retrieval entity and the vulnerability retrieval constraint condition;
[0045] The second vulnerability data is subjected to data compression processing based on the data compression parameter and the compression reserved field to obtain compressed second vulnerability data.
[0046] In a second aspect, an embodiment of the present invention provides a device for retrieving vulnerability data, the device comprising:
[0047] A receiving and determining module, used for receiving vulnerability data retrieval content, and determining vulnerability retrieval entities and vulnerability retrieval constraints from the vulnerability data retrieval content;
[0048] An acquisition module, used for acquiring a plurality of first vulnerability data from a vulnerability database based on a vulnerability retrieval entity and a vulnerability retrieval constraint condition;
[0049] A first determination module is used to determine the retrieval score of each first vulnerability data according to the vulnerability retrieval entity and the vulnerability retrieval constraint condition; wherein the retrieval score is a quantitative indicator used to measure the relevance degree of the first vulnerability data to the vulnerability data retrieval content;
[0050] The second determination module is used to determine a plurality of second vulnerability data from the plurality of first vulnerability data based on the retrieval score; wherein the number of the second vulnerability data is less than the number of the first vulnerability data.
[0051] In a third aspect, an embodiment of the present invention provides an electronic device, which includes: a processor and a memory, the processor is used to execute a vulnerability data retrieval program stored in the memory to implement the above-mentioned vulnerability data retrieval method.
[0052] In a fourth aspect, an embodiment of the present invention provides a storage medium, wherein the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the above-mentioned vulnerability data retrieval method.
[0053] The vulnerability data retrieval method, device, electronic device and storage medium provided by the embodiment of the present invention include: receiving vulnerability data retrieval content, determining vulnerability retrieval entity and vulnerability retrieval constraint conditions from the vulnerability data retrieval content; obtaining multiple first vulnerability data from the vulnerability database based on the vulnerability retrieval entity and the vulnerability retrieval constraint conditions; determining the retrieval score of each first vulnerability data according to the vulnerability retrieval entity and the vulnerability retrieval constraint conditions; and determining multiple second vulnerability data from the multiple first vulnerability data based on the retrieval score. In the above technical solution, multiple first vulnerability data related to the vulnerability data retrieval content are first obtained from the vulnerability database through the vulnerability retrieval entity and the vulnerability retrieval constraint conditions. Since the retrieval score is a quantitative indicator for measuring the degree of relevance between the first vulnerability data and the vulnerability data retrieval content, the retrieval score is then used to determine the second vulnerability data that is closely related to the vulnerability data retrieval content from the multiple first vulnerability data, which improves the accuracy of vulnerability data retrieval to a certain extent, and effectively alleviates the technical problem that the vulnerability data irrelevant to the retrieval content cannot be removed in the prior art, which cannot reflect the latest vulnerability in a timely manner, and the risk of network attack is increased by not updating or patching the vulnerability in a timely manner. BRIEF DESCRIPTION OF THE DRAWINGS
[0054] Figure 1 A flowchart of an embodiment of a vulnerability data retrieval method provided by an embodiment of the present invention;
[0055] Figure 2 A flowchart of another vulnerability data retrieval method provided by an embodiment of the present invention;
[0056] Figure 3 A flowchart of another vulnerability data retrieval method provided by an embodiment of the present invention;
[0057] Figure 4 A flowchart of another vulnerability data retrieval method provided by an embodiment of the present invention;
[0058] Figure 5 A block diagram of an embodiment of a vulnerability data retrieval device provided by an embodiment of the present invention;
[0059] Figure 6 A schematic structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION
[0060] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0061] To facilitate understanding of the embodiments of the present invention, specific embodiments will be further explained below in conjunction with the accompanying drawings. The embodiments do not constitute a limitation on the embodiments of the present invention.
[0062] An embodiment of the present invention provides a vulnerability data retrieval method, which is applied to a vulnerability data retrieval system that can communicate with vulnerability databases such as CVE (Common Vulnerabilities and Exposures) and NVD (National Vulnerability Database).
[0063] See also Figure 1 , Figure 1 A flowchart of an embodiment of a method for retrieving vulnerability data provided by an embodiment of the present invention. Figure 1 The process shown may include the following steps:
[0064] Step 101, receiving vulnerability data search content, and determining vulnerability search entities and vulnerability search constraints from the vulnerability data search content;
[0065] Typically, the vulnerability data retrieval system has an input control for inputting vulnerability data retrieval content, so that the user can input the vulnerability data retrieval content that the user wants to retrieve. For example, the user inputs the vulnerability data retrieval content of "querying the high-risk vulnerabilities that recently affect the Apache server" or "querying the serious vulnerabilities that affect Windows" through the input control.
[0066] Vulnerability retrieval entities refer to vulnerabilities and vulnerability impact entities. For example, the vulnerability retrieval entities in "Query high-risk vulnerabilities that recently affect Apache servers" are Apache servers and vulnerabilities, and the vulnerability retrieval entities in "Query serious vulnerabilities that affect Windows" are Windows and vulnerabilities.
[0067] Vulnerability retrieval constraints refer to conditions used to limit and filter vulnerability data retrieval. Specifically, they may be time-related vulnerability retrieval constraints or vulnerability retrieval constraints related to the severity of the impact of the vulnerability on the vulnerability retrieval entity. Specific vulnerability retrieval constraints may be determined based on actual needs and are not limited here.
[0068] Step 102, obtaining a plurality of first vulnerability data from a vulnerability database based on the vulnerability search entity and the vulnerability search constraint condition;
[0069] In this embodiment, the vulnerability search entity and the vulnerability search constraint condition can ensure that the first vulnerability data retrieved from the vulnerability database is vulnerability data closely related to the vulnerability data search content.
[0070] Step 103, determining a search score for each first vulnerability data according to the vulnerability search entity and the vulnerability search constraint condition;
[0071] Generally, since a large number of first vulnerability data are retrieved through vulnerability retrieval entities and vulnerability retrieval constraints, in order to facilitate user viewing, it is necessary to further determine vulnerability data with a strong correlation with the vulnerability data retrieval content from multiple first vulnerability data for user viewing. In this embodiment, the correlation between each first vulnerability data and the vulnerability data retrieval content can be further determined by determining the retrieval score of each first vulnerability data, so as to retrieve a small amount of vulnerability data with a strong correlation with the vulnerability data retrieval content from multiple first vulnerability data for user convenient viewing.
[0072] The above-mentioned retrieval score is a quantitative indicator used to measure the relevance degree between the first vulnerability data and the vulnerability data retrieval content; it can be understood that the higher the retrieval score, the higher the relevance degree between the first vulnerability data and the vulnerability data retrieval content, and conversely, the lower the retrieval score, the lower the relevance degree between the first vulnerability data and the vulnerability data retrieval content.
[0073] Step 104, determining a plurality of second vulnerability data from the plurality of first vulnerability data based on the search scores;
[0074] Since the vulnerability data are further screened from the plurality of first vulnerability data, the number of the second vulnerability data is less than the number of the first vulnerability data.
[0075] The specific implementation process of the above step 104 is: sorting the multiple first vulnerability data in order according to the numerical values of the search scores; and selecting a preset number of first vulnerability data from the multiple first vulnerability data in order to determine as the multiple second vulnerability data.
[0076] Among them, the preset number can be dynamically adjusted according to the number of the first vulnerability data. Specifically, the preset data can be determined by querying the number table, and the query number table stores the correspondence between the number of the first vulnerability data and the preset number. For example, the query data table stores that the number of the first vulnerability data is 100, and the corresponding preset number is 30; the number of the first vulnerability data is 50, and the corresponding preset number is 25; the number of the first vulnerability data is 30, and the corresponding preset number is 20. It should be noted that the correspondence between the number of the first vulnerability data and the preset number listed above is only an example. The specific correspondence between the number of the first vulnerability data and the preset number can be set according to actual needs and is not limited here.
[0077] For example, the number of first vulnerability data is 100. The process of determining the second vulnerability data is to first sort the 100 first vulnerability data in descending order according to the search score, and then determine the first vulnerability data ranked in the top 30 as the second vulnerability data. The determined second vulnerability data is the vulnerability data with a high degree of relevance to the vulnerability data search content. By viewing these vulnerability data, users can update or patch the vulnerability in time to reduce the risk of network attacks.
[0078] Through the method in this embodiment, the vulnerability data retrieval content is received, and the vulnerability retrieval entity and the vulnerability retrieval constraint conditions are determined from the vulnerability data retrieval content; multiple first vulnerability data are obtained from the vulnerability database based on the vulnerability retrieval entity and the vulnerability retrieval constraint conditions; the retrieval score of each first vulnerability data is determined according to the vulnerability retrieval entity and the vulnerability retrieval constraint conditions; and multiple second vulnerability data are determined from the multiple first vulnerability data based on the retrieval score. In the above technical scheme, multiple first vulnerability data related to the vulnerability data retrieval content are first obtained from the vulnerability database through the vulnerability retrieval entity and the vulnerability retrieval constraint conditions. Since the retrieval score is a quantitative indicator for measuring the degree of relevance between the first vulnerability data and the vulnerability data retrieval content, the retrieval score is then used to determine the second vulnerability data that is closely related to the vulnerability data retrieval content from the multiple first vulnerability data, which improves the accuracy of vulnerability data retrieval to a certain extent, and effectively alleviates the technical problem that the vulnerability data irrelevant to the retrieval content cannot be removed in the prior art, which cannot reflect the latest vulnerability in a timely manner, and the risk of network attacks is increased by not updating or patching the vulnerability in a timely manner.
[0079] In this embodiment, the above-mentioned vulnerability retrieval constraint condition preferably selects the time window and the vulnerability threshold, wherein the vulnerability threshold is used to characterize the severity of the vulnerability affecting the vulnerability retrieval entity; that is, the vulnerability threshold is a quantitative indicator of the severity of the vulnerability affecting the vulnerability retrieval entity, which can be understood as the higher the vulnerability threshold, the greater the severity of the impact of the vulnerability on the vulnerability retrieval entity, and conversely, the lower the vulnerability threshold, the smaller the severity of the impact of the vulnerability on the vulnerability retrieval entity.
[0080] Based on the above description, if Figure 2 As shown, as an optional implementation, as in the aforementioned method, step 101 of determining vulnerability search entities and vulnerability search constraints from vulnerability data search content includes the following steps:
[0081] Step 201, obtaining a vulnerability search object, a time object and a vulnerability severity object from the vulnerability data search content;
[0082] The vulnerability search object is the vulnerability search entity, the time object is the content related to the time description, and the vulnerability severity object is the content related to the description of the severity of the vulnerability affecting the vulnerability search entity. Continuing with the previous example, if the vulnerability data search content is "query for high-risk vulnerabilities that recently affect Apache servers", then the vulnerability search objects are: Apache server and vulnerability; the time object is: recent; and the vulnerability severity object is: high risk.
[0083] Step 202, determining the vulnerability search object as a vulnerability search entity;
[0084] Step 203, querying the time window matching the time object from the time window query table;
[0085] The time window query table stores the correspondence between the time object and the time window. For ease of understanding, the time window query table is shown in Table 1:
[0086] Table 1
[0087] Time Object Time window / day recent 30 past 90 default 60
[0088] It should be noted that the correspondence between the time objects and time windows listed above is only an example, and the correspondence between the specific time objects and time windows can be set according to actual needs and is not limited here.
[0089] In specific implementation, when there is no time object in the vulnerability data retrieval content, the time object is regarded as a time object, and the time window is 60 days.
[0090] Step 204, querying the vulnerability threshold value matching the vulnerability severity object from the vulnerability threshold table;
[0091] Among them, the vulnerability threshold query table stores the correspondence between vulnerability severity objects and vulnerability thresholds; for ease of understanding, the vulnerability threshold table is shown in Table 2:
[0092] Table 2
[0093] Serious vulnerability targets Vulnerability Threshold generally 4 High risk 7 serious 9
[0094] It should be noted that the correspondence between the vulnerability severity objects and the vulnerability thresholds listed above is only an example. The correspondence between the specific vulnerability severity objects and the vulnerability thresholds can be set according to actual needs and is not limited here.
[0095] In specific implementation, when there is no severe vulnerability object in the vulnerability data retrieval content, the severe vulnerability object is considered to be general, and the vulnerability threshold is 4.
[0096] Based on the above description, if Figure 3 As shown, as an optional implementation, as in the aforementioned method, step 102 of acquiring a plurality of first vulnerability data from a vulnerability database based on the vulnerability search entity and the vulnerability search constraint condition comprises the following steps:
[0097] Step 301, determining the similarity with each vulnerability search data in the vulnerability database based on the vulnerability search entity;
[0098] Usually, it is necessary to convert each vulnerability retrieval data and vulnerability retrieval entity (such as Apache server + vulnerability) in the vulnerability database into a vector conversion model, and then calculate the similarity between the vector of the vulnerability retrieval entity and the vector of each vulnerability retrieval data in the vulnerability database to obtain the similarity between the vulnerability retrieval entity and each vulnerability retrieval data.
[0099] The above-mentioned vector conversion model can be implemented by models such as BERT (Bidirectional Encoder Representations from Transformers), SBERT (Sentence-BERT), etc., which are not limited here; the above-mentioned similarity calculation can be implemented using algorithms such as cosine similarity, Euclidean distance, Manhattan distance, etc., which are not limited here.
[0100] Step 302, obtaining a plurality of third vulnerability data having a similarity exceeding a preset similarity from a vulnerability database;
[0101] The preset similarity is a preset similarity threshold, for example, 0.6, wherein the preset similarity can be set according to actual conditions and is not limited here.
[0102] Since the similarity between each vulnerability search data and the vulnerability search entity in the vulnerability database is calculated through the above step 301, third vulnerability data having a similarity exceeding a preset similarity can be further obtained from the plurality of vulnerability search data.
[0103] The third vulnerability data obtained by preset similarity guarantees the similarity with the vulnerability retrieval entity to a certain extent.
[0104] Step 303, obtaining the vulnerability score and data upload time of each third vulnerability data;
[0105] In actual application, each vulnerability retrieval data in the vulnerability database has a corresponding vulnerability score and data upload time. Therefore, the vulnerability score and data upload time of each third vulnerability data can be obtained; the vulnerability score has the same meaning as the vulnerability threshold and will not be repeated here.
[0106] Step 304: Acquire, from the plurality of third vulnerability data, a plurality of first vulnerability data whose data upload time is within the time window and whose vulnerability scores reach the vulnerability threshold.
[0107] The third vulnerability data not meeting the vulnerability search constraint condition can be further excluded from the plurality of third vulnerability data based on the time window and the vulnerability threshold, so as to ensure that the first vulnerability data obtained is further related to the vulnerability data search content.
[0108] Through the above steps, relevant vulnerability data that meets the conditions can be efficiently screened out, which to a certain extent ensures the breadth and basic relevance of the search results.
[0109] Based on the above description, if Figure 4 As shown, as an optional implementation, as in the aforementioned method, step 103 determines the search score of each first vulnerability data according to the vulnerability search entity and the vulnerability search constraint condition, including the following steps:
[0110] Step 401, for each first vulnerability data: determining a relevance score of the first vulnerability data based on a vulnerability search entity;
[0111] The specific relevance scoring can be achieved through steps A1 to A2:
[0112] Step A1, obtaining the total number of relevant features of the vulnerability search entity, and the number of relevant features of the first vulnerability data and the vulnerability search entity;
[0113] Specifically, relevant features of the vulnerability retrieval entity are first obtained. For example, the relevant features of the vulnerability retrieval entity obtained include version number, product name, module name, and configuration item, so the total number of relevant features is 4. Then, the first vulnerability data is matched with the relevant features of the above vulnerability retrieval entity through keyword matching. If the matched relevant features include product name and module name, then the number of relevant features of the first vulnerability data and the vulnerability retrieval entity is 2.
[0114] Step A2: determining a relevance score of the first vulnerability data based on the number of relevant features and the total number of relevant features.
[0115] The ratio of the number of relevant features to the total number of relevant features is determined as the relevance score of the first vulnerability data. Continuing with the previous example, the relevance score is 2 / 4=0.5.
[0116] Step 402, determining a security score of the first vulnerability data according to the vulnerability threshold;
[0117] The specific security score implementation process is: querying the vulnerability threshold weight corresponding to the vulnerability threshold from the vulnerability threshold weight query table; and determining the security score of the first vulnerability data based on the vulnerability threshold and the vulnerability threshold weight.
[0118] Among them, the vulnerability threshold weight query table stores the correspondence between vulnerability thresholds and vulnerability threshold weights; it can be understood that the vulnerability threshold weights corresponding to different vulnerability thresholds are different. Therefore, it is necessary to specifically determine the vulnerability threshold weight of the vulnerability threshold corresponding to the vulnerability data retrieval content through the vulnerability threshold weight query table, and then determine the product of the vulnerability threshold and the vulnerability threshold weight as the security score of the first vulnerability data.
[0119] Step 403, determining a timeliness score of the first vulnerability data based on the vulnerability threshold and the data upload time;
[0120] The above-mentioned timeliness rating can be achieved through steps B1 to B2:
[0121] Step B1, determining the duration based on the data upload time and the current time;
[0122] The duration is the time interval between the data upload time and the current time. For example, if the data upload time is 2023-10-01 and the current time is 2023-12-01, the duration is 2 months.
[0123] Step B2, determining the timeliness score of the first vulnerability data according to the duration, the vulnerability threshold and the preset time decay factor.
[0124] The calculation formula for the timeliness score is: z1 = p1 × e -a×t ; Among them, p1 is the vulnerability threshold, a is the preset time attenuation factor, and t is the duration.
[0125] Step 404: Determine a retrieval score for the first vulnerability data according to the relevance score, the security score, and the timeliness score.
[0126] The retrieval score of the first vulnerability data is determined specifically based on the relevance score, the preset relevance weight corresponding to the relevance score, the security score, the preset security weight corresponding to the security score, the timeliness score, and the preset timeliness weight corresponding to the timeliness score.
[0127] From the description, we can know that the calculation formula for the retrieval score is: z=z1×c1+z2×c2+z3×c3; among them, z1 is the timeliness score, c1 is the preset timeliness weight, z2 is the relevance score, c2 is the preset relevance weight, z3 is the security score, and c3 is the preset security weight.
[0128] For example, the timeliness score is 8.2, the preset timeliness weight is 0.3, the relevance score is 1, the preset relevance weight is 0.3, the security score is 9, and the preset security weight is 0.4, then the retrieval score is z = 8.2×0.3+1×0.3+9×0.4=6.36.
[0129] In actual application, in order to ensure efficient reading of information, the second vulnerability data may be compressed to simplify the second vulnerability data. This may be achieved through steps C1 to C3:
[0130] Step C1, determining the vulnerability type from the vulnerability data retrieval content;
[0131] Vulnerability type is used to indicate the type of vulnerability. For example, the vulnerability type can be remote code execution vulnerability, configuration error vulnerability, information leakage vulnerability, etc.
[0132] If the vulnerability data search content is "query for high-risk information leakage vulnerabilities that recently affect Apache servers", then the vulnerability type is information leakage vulnerability.
[0133] Step C2, determining data compression parameters based on the vulnerability type;
[0134] Due to the different types of vulnerabilities, the complexity of their technical details and the focus of their descriptions are different, so the data compression parameters are different. For example, the data compression parameters include two parameters: technical details priority retention rate and background information retention rate. For remote code execution vulnerabilities, the corresponding technical details priority retention rate is 90%, and the background information retention rate is 30%; for information leakage vulnerabilities, the corresponding technical details priority retention rate is 100%, and the background information retention rate is 50%; for configuration error vulnerabilities, the corresponding technical details priority retention rate is 85%, and the background information retention rate is 40%.
[0135] In specific implementation, the data compression parameter corresponding to the vulnerability type can be determined by querying a data compression parameter query table storing the corresponding relationship between the vulnerability type and the data compression parameter.
[0136] Step C3, performing data compression processing on each second vulnerability data according to the data compression parameter to obtain compressed second vulnerability data.
[0137] The specific implementation process is: for each second vulnerability data: extract the compression reserved field from the second vulnerability data based on the vulnerability retrieval entity and the vulnerability retrieval constraint condition; perform data compression processing on the second vulnerability data based on the data compression parameter and the compression reserved field to obtain compressed second vulnerability data.
[0138] The example is as follows: If the second vulnerability data is: Vulnerability ID: CVE-2023-22222, Affected product: Apache HTTPServer 2.4.x, Description: This vulnerability may be used by attackers to achieve remote code execution, and the attack method is related to the HTTP / 2 flow control feature. The main problem is that there is a flaw in the HTTP / 2 input validation mechanism, which causes a buffer overflow and allows malicious requests to trigger arbitrary code injection or execution.
[0139] The compressed reserved fields extracted from the second vulnerability data through vulnerability retrieval entities and vulnerability retrieval constraints are core terms such as "remote code execution", "HTTP / 2 input validation flaw", "buffer overflow", and "arbitrary code execution".
[0140] The second vulnerability data after compressing the above-mentioned second vulnerability data through data compression parameters and compression reserved fields is: Vulnerability ID: CVE-2023-22222, description: HTTP / 2 input validation flaw causes buffer overflow, which may lead to remote code execution.
[0141] Through the above strategy, the content of the compressed second vulnerability data efficiently focuses on key information, meets the compression requirements and practicality needs, and greatly improves reading efficiency.
[0142] See also Figure 5 , is a block diagram of an embodiment of a vulnerability data retrieval device provided by an embodiment of the present invention. Figure 5 As shown, the device comprises:
[0143] A receiving and determining module 501 is used to receive vulnerability data search content and determine vulnerability search entities and vulnerability search constraints from the vulnerability data search content;
[0144] An acquisition module 502 is used to acquire a plurality of first vulnerability data from a vulnerability database based on a vulnerability search entity and a vulnerability search constraint condition;
[0145] A first determination module 503 is used to determine the search score of each first vulnerability data according to the vulnerability search entity and the vulnerability search constraint condition; wherein the search score is a quantitative indicator used to measure the relevance degree of the first vulnerability data to the vulnerability data search content;
[0146] The second determination module 504 is used to determine a plurality of second vulnerability data from the plurality of first vulnerability data based on the search scores; wherein the number of the second vulnerability data is less than the number of the first vulnerability data.
[0147] The device for vulnerability data retrieval provided by the embodiment of the present invention includes: receiving vulnerability data retrieval content, determining vulnerability retrieval entities and vulnerability retrieval constraints from the vulnerability data retrieval content; obtaining multiple first vulnerability data from a vulnerability database based on the vulnerability retrieval entity and the vulnerability retrieval constraints; determining the retrieval score of each first vulnerability data according to the vulnerability retrieval entity and the vulnerability retrieval constraints; and determining multiple second vulnerability data from multiple first vulnerability data based on the retrieval score. In the above technical solution, multiple first vulnerability data related to the vulnerability data retrieval content are first obtained from the vulnerability database through the vulnerability retrieval entity and the vulnerability retrieval constraints. Since the retrieval score is a quantitative indicator for measuring the degree of relevance between the first vulnerability data and the vulnerability data retrieval content, the retrieval score is then used to determine the second vulnerability data that is closely related to the vulnerability data retrieval content from multiple first vulnerability data, which improves the accuracy of vulnerability data retrieval to a certain extent, and effectively alleviates the technical problem that the vulnerability data that is not related to the retrieval content cannot be removed in the prior art, which cannot reflect the latest vulnerability in a timely manner, and there is a risk of network attacks due to failure to update or patch vulnerabilities in a timely manner.
[0148] Figure 6 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention, Figure 6 The electronic device 1200 shown includes: at least one processor 1201, a memory 1202, at least one network interface 1204 and other user interfaces 1203. The various components in the electronic device 1200 are coupled together via a bus system 1205. It is understood that the bus system 1205 is used to achieve connection and communication between these components. In addition to the data bus, the bus system 1205 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, the bus system 1205 is not described in detail. Figure 6 Various buses are labeled as bus system 1205.
[0149] The user interface 1203 may include a display, a keyboard, or a pointing device (eg, a mouse, a trackball, a touch pad, or a touch screen).
[0150] It can be understood that the memory 1202 in the embodiment of the present invention can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct memory bus random access memory (DRRAM). The memory 1202 described herein is intended to include, but is not limited to, these and any other suitable types of memory.
[0151] In some embodiments, the memory 1202 stores the following elements, executable units or data structures, or a subset thereof, or an extended set thereof: an operating system 12021 and an application program 12022 .
[0152] The operating system 12021 includes various system programs, such as a framework layer, a core library layer, a driver layer, etc., which are used to implement various basic services and process hardware-based tasks. The application 12022 includes various application programs, such as a media player (Media Player), a browser (Browser), etc., which are used to implement various application services. The program for implementing the method of the embodiment of the present invention can be included in the application 12022.
[0153] In the embodiment of the present invention, by calling the program or instruction stored in the memory 1202, specifically, the program or instruction stored in the application 12022, the processor 1201 is used to execute the method steps provided by each method embodiment.
[0154] The method disclosed in the above embodiment of the present invention can be applied to the processor 1201, or implemented by the processor 1201. The processor 1201 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 1201. The above processor 1201 can be a general processor, a digital signal processor (Digital Signal Processor, DSP), an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present invention can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in the embodiment of the present invention can be directly embodied as a hardware decoding processor to execute, or the hardware and software units in the decoding processor can be executed. The software unit can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 1202, and the processor 1201 reads the information in the memory 1202 and completes the steps of the above method in combination with its hardware.
[0155] It is understood that the embodiments described herein may be implemented in hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit may be implemented in one or more application specific integrated circuits (ASIC), digital signal processors (DSP), digital signal processing devices (DSPDevice, DSPD), programmable logic devices (PLD), field programmable gate arrays (FPGA), general purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions described in the present application, or a combination thereof.
[0156] For software implementation, the technology described herein can be implemented by a unit that performs the functions described herein. The software code can be stored in a memory and executed by a processor. The memory can be implemented in the processor or outside the processor.
[0157] The electronic device provided in this embodiment may be Figure 6 The electronic device shown in FIG. 1 may perform the following steps: Figure 1-4 All steps of the vulnerability data retrieval method are implemented Figure 1-4 For details, please refer to the technical effect of the vulnerability data retrieval method shown in Figure 1-4 For the sake of brevity, the relevant description is not repeated here.
[0158] The embodiment of the present invention also provides a storage medium (computer-readable storage medium). The storage medium here stores one or more programs. The storage medium may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a read-only memory, a flash memory, a hard disk or a solid-state drive; the memory may also include a combination of the above-mentioned types of memory.
[0159] When one or more programs in the storage medium can be executed by one or more processors, the above-mentioned vulnerability data retrieval method can be implemented.
[0160] The processor is used to execute the vulnerability data retrieval program stored in the memory to implement the steps of the vulnerability data retrieval method.
[0161] The professionals should further realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to the function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.
[0162] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.
[0163] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.
Claims
1. A method for retrieving vulnerability data, characterized in that: The method comprises: Receiving vulnerability data retrieval content, and determining vulnerability retrieval entities and vulnerability retrieval constraints from the vulnerability data retrieval content; Acquire a plurality of first vulnerability data from a vulnerability database based on the vulnerability retrieval entity and the vulnerability retrieval constraint condition; Determine a search score for each of the first vulnerability data according to the vulnerability search entity and the vulnerability search constraint; wherein the search score is a quantitative indicator for measuring the degree of relevance between the first vulnerability data and the vulnerability data search content; A plurality of second vulnerability data are determined from a plurality of the first vulnerability data based on the retrieval scores; wherein the number of the second vulnerability data is less than the number of the first vulnerability data.
2. The method according to claim 1, characterized in that The method further comprises: Determining a vulnerability type from the vulnerability data retrieval content; Determining data compression parameters based on the vulnerability type; Data compression processing is performed on each of the second vulnerability data according to the data compression parameters to obtain compressed second vulnerability data.
3. The method according to claim 1, characterized in that in, The vulnerability search constraint condition includes a time window and a vulnerability threshold, and the vulnerability threshold is used to characterize the severity of the vulnerability affecting the vulnerability search entity; The step of determining vulnerability retrieval entities and vulnerability retrieval constraints from the vulnerability data retrieval content includes: Acquire a vulnerability search object, a time object, and a vulnerability severity object from the vulnerability data search content; Determine the vulnerability search object as a vulnerability search entity; Querying a time window matching the time object from a time window query table; wherein the time window query table stores a correspondence between the time object and the time window; A vulnerability threshold value matching the vulnerability severity object is queried from a vulnerability threshold table; wherein the vulnerability threshold query table stores a correspondence between vulnerability severity objects and vulnerability threshold values.
4. The method according to claim 3, characterized in that: The acquiring a plurality of first vulnerability data from a vulnerability database based on the vulnerability retrieval entity and the vulnerability retrieval constraint condition comprises: Determine, based on the vulnerability retrieval entity, a similarity with each vulnerability retrieval data in the vulnerability database; Acquire, from the vulnerability database, a plurality of third vulnerability data having a similarity exceeding a preset similarity; Obtaining a vulnerability score and data upload time of each of the third vulnerability data; A plurality of first vulnerability data whose data upload time is within the time window and whose vulnerability scores reach the vulnerability threshold are obtained from the plurality of third vulnerability data.
5. The method according to claim 4, characterized in that The determining the retrieval score of each of the first vulnerability data according to the vulnerability retrieval entity and the vulnerability retrieval constraint condition comprises: For each of the first vulnerability data: determining a relevance score of the first vulnerability data based on the vulnerability retrieval entity; Determining a security score of the first vulnerability data according to the vulnerability threshold; Determine a timeliness score for the first vulnerability data based on the vulnerability threshold and the data upload time; A retrieval score of the first vulnerability data is determined according to the relevance score, the security score, and the timeliness score.
6. The method according to claim 5, characterized in that The determining the relevance score of the first vulnerability data based on the vulnerability retrieval entity includes: Obtaining the total number of features related to the vulnerability search entity and the number of features related to the first vulnerability data and the vulnerability search entity; A relevance score of the first vulnerability data is determined based on the number of relevant features and the total number of relevant features.
7. The method according to claim 5, characterized in that Determining the security score of the first vulnerability data according to the vulnerability threshold includes: Querying a vulnerability threshold weight corresponding to the vulnerability threshold from a vulnerability threshold weight query table; wherein the vulnerability threshold weight query table stores a correspondence between vulnerability thresholds and vulnerability threshold weights; A security score of the first vulnerability data is determined based on the vulnerability threshold and the vulnerability threshold weight.
8. The method according to claim 5, characterized in that The determining the timeliness score of the first vulnerability data based on the vulnerability threshold and the data upload time includes: Determine the duration based on the data upload time and current time; A timeliness score of the first vulnerability data is determined according to the duration, the vulnerability threshold and a preset time decay factor.
9. The method according to claim 5, characterized in that The determining the retrieval score of the first vulnerability data according to the relevance score, the security score and the timeliness score includes: The retrieval score of the first vulnerability data is determined according to the relevance score, the preset relevance weight corresponding to the relevance score, the security score, the preset security weight corresponding to the security score, the timeliness score, and the preset timeliness weight corresponding to the timeliness score.
10. The method according to claim 1, characterized in that The determining a plurality of second vulnerability data from a plurality of first vulnerability data based on the search score comprises: sorting the plurality of first vulnerability data in order according to the values of the search scores; A preset number of the first vulnerability data are selected from the plurality of the first vulnerability data in order and determined as a plurality of the second vulnerability data.
11. The method according to claim 2, characterized in that The performing data compression processing on each of the second vulnerability data according to the data compression parameter to obtain compressed second vulnerability data includes: For each of the second vulnerability data: extracting a compressed reserved field from the second vulnerability data based on the vulnerability retrieval entity and the vulnerability retrieval constraint condition; The second vulnerability data is subjected to data compression processing based on the data compression parameter and the compression reserved field to obtain compressed second vulnerability data.
12. A device for retrieving vulnerability data, characterized in that: The device comprises: A receiving and determining module, configured to receive vulnerability data retrieval content, and determine vulnerability retrieval entities and vulnerability retrieval constraints from the vulnerability data retrieval content; An acquisition module, configured to acquire a plurality of first vulnerability data from a vulnerability database based on the vulnerability retrieval entity and the vulnerability retrieval constraint condition; A first determination module, configured to determine a retrieval score of each of the first vulnerability data according to the vulnerability retrieval entity and the vulnerability retrieval constraint condition; wherein the retrieval score is a quantitative indicator for measuring the relevance of the first vulnerability data to the vulnerability data retrieval content; A second determination module is used to determine a plurality of second vulnerability data from a plurality of first vulnerability data based on the retrieval score; wherein the number of the second vulnerability data is less than the number of the first vulnerability data.
13. An electronic device, characterized in that: include: A processor and a memory, wherein the processor is used to execute a vulnerability data retrieval program stored in the memory to implement the vulnerability data retrieval method according to any one of claims 1 to 11.
14. A storage medium, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the vulnerability data retrieval method according to any one of claims 1 to 11.