Remote scanning missing report generation method and device, computer equipment and storage medium

Abstract

The embodiment of the invention belongs to the technical field of artificial intelligence, and relates to a remote missing scanning report generation method and device, computer equipment and a storage medium, and the method comprises the following steps: reading a target database corresponding to target database identification information, and obtaining historical data of a remote missing scanning result in the target database; inputting the historical data of the remote missing scanning result into a pre-trained model for vulnerability type identification operation to obtain a vulnerability type identification result; performing weight optimization operation on the vulnerability type identification result according to an attention mechanism to obtain an attention value; performing feature fusion operation on the attention numerical value to obtain feature fusion data; calling a KAN model, and inputting the feature fusion data into the KAN model for suggestion prediction operation to obtain a suggestion prediction result; and generating a vulnerability scanning report according to the suggested prediction result, and outputting the vulnerability scanning report to the user terminal. According to the method and the device, the accuracy of vulnerability scanning report suggestion can be improved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to a remote missed scan report generation method, device, computer equipment and storage medium. Background Art

[0002] Network security has become an important part of national security, and its related technologies have increasingly become research topics for scholars at home and abroad. Among them, the detection and evaluation of network security environments have been widely studied.

[0003] However, the applicant has found that the accuracy of existing network vulnerability scanning results is low. Summary of the invention

[0004] The purpose of the embodiments of the present application is to propose a remote vulnerability scanning report generation method, device, computer equipment and storage medium to solve the problem of low accuracy of existing network vulnerability scanning results.

[0005] In order to solve the above technical problems, the present application embodiment provides a remote missed scan report generation method, which adopts the following technical solutions: Receiving a missed scan report generation request sent by a user terminal, wherein the missed scan report generation request includes target database identification information; Reading a target database corresponding to the target database identification information, and acquiring historical data of remote missed scanning results in the target database; Inputting the historical data of the remote vulnerability scanning result into the pre-trained model to perform a vulnerability type identification operation to obtain a vulnerability type identification result; Perform a weight optimization operation on the vulnerability type identification result according to the attention mechanism to obtain an attention value; Performing a feature fusion operation on the attention value to obtain feature fusion data; Calling the KAN model, and inputting the feature fusion data into the KAN model to perform a suggestion prediction operation, and obtaining a suggestion prediction result; A vulnerability scanning report is generated according to the suggested prediction result, and the vulnerability scanning report is output to the user terminal.

[0006] Furthermore, after the step of reading the target database corresponding to the target database identification information and obtaining the historical data of the remote vulnerability scanning result in the target database, and before the step of inputting the pre-processed historical data into the pre-trained model to perform the vulnerability type identification operation and obtain the vulnerability type identification result, the following steps are also included: Performing a preprocessing operation on the historical data of the remote missed scanning result to obtain preprocessed historical data; The step of inputting the historical data of the remote vulnerability scanning result into the pre-trained model to perform a vulnerability type identification operation to obtain a vulnerability type identification result specifically includes the following steps: The pre-processed historical data is input into a pre-trained model to perform a vulnerability type identification operation to obtain the vulnerability type identification result.

[0007] Furthermore, the step of inputting the historical data of the remote vulnerability scanning result into the pre-trained model to perform a vulnerability type identification operation to obtain a vulnerability type identification result specifically includes the following steps: Integrate the historical data of the remote missed scanning results into a data set, and perform labeling processing on the data set to obtain a labeled data set; Performing a feature vector conversion operation on the labeled data set to obtain feature vector data; Inputting the feature vector data into the convolution layer of the DeCharCNN model to perform a first feature extraction operation to obtain first feature extraction data; Input the first feature extraction data into the pooling layer of the DeCharCNN model to perform a second feature extraction operation to obtain second feature extraction data; Performing feature integration processing on the first feature extraction data and the second feature extraction data to obtain integrated feature extraction data; The integrated feature data is input into the fully connected layer to perform a vulnerability type identification operation to obtain the vulnerability type identification result.

[0008] Furthermore, the step of performing a weight optimization operation on the vulnerability type identification result according to the attention mechanism to obtain an attention value specifically includes the following steps: Calculate the weight coefficient of the vulnerability type identification result according to the attention mechanism; Normalizing the weight coefficients, and performing a weight mapping operation on the normalized weight coefficients to obtain weight mapping data; A weighted sum operation is performed on the vulnerability type identification results according to the weight mapping data to obtain the attention value.

[0009] Furthermore, the step of calling the KAN model and inputting the feature fusion data into the KAN model to perform a suggestion prediction operation to obtain a suggestion prediction result specifically includes the following steps: Performing a nonlinear activation operation on the feature fusion data according to the activation layer of the KAN model to obtain a nonlinear activation function; Constructing a function matrix according to the nonlinear activation function; A prediction mapping operation is performed on the feature fusion data according to the function matrix to obtain the suggested prediction result.

[0010] In order to solve the above technical problems, the embodiment of the present application further provides a remote missed scan report generation device, which adopts the following technical solution: A request receiving module, configured to receive a missed scan report generation request sent by a user terminal, wherein the missed scan report generation request includes target database identification information; A historical data acquisition module, used for reading a target database corresponding to the target database identification information, and acquiring historical data of remote missed scanning results in the target database; A vulnerability type identification module is used to input the historical data of the remote vulnerability scanning result into a pre-trained model to perform a vulnerability type identification operation to obtain a vulnerability type identification result; A weight optimization module, used to perform a weight optimization operation on the vulnerability type identification result according to the attention mechanism to obtain an attention value; A feature fusion module, used for performing a feature fusion operation on the attention value to obtain feature fusion data; A suggestion prediction module is used to call the KAN model and input the feature fusion data into the KAN model to perform a suggestion prediction operation to obtain a suggestion prediction result; A report generation module is used to generate a vulnerability scanning report according to the recommended prediction result and output the vulnerability scanning report to the user terminal.

[0011] Furthermore, the device further comprises: a preprocessing module, the vulnerability type identification module comprises: a vulnerability type identification submodule, wherein: The preprocessing module is used to perform a preprocessing operation on the historical data of the remote missed scanning result to obtain preprocessed historical data; The vulnerability type identification submodule is used to input the pre-processed historical data into a pre-trained model to perform a vulnerability type identification operation to obtain the vulnerability type identification result.

[0012] Furthermore, the vulnerability type identification module includes: A marked data acquisition submodule is used to integrate the historical data of the remote missed scanning results into a data set, and mark the data set to obtain a marked data set; A feature vector conversion submodule is used to perform a feature vector conversion operation on the labeled data set to obtain feature vector data; A first feature extraction submodule, used for inputting the feature vector data into the convolution layer of the DeCharCNN model to perform a first feature extraction operation to obtain first feature extraction data; A second feature extraction submodule is used to input the first feature extraction data into the pooling layer of the DeCharCNN model to perform a second feature extraction operation to obtain second feature extraction data; A feature integration submodule, used for performing feature integration processing on the first feature extraction data and the second feature extraction data to obtain integrated feature extraction data; The vulnerability type identification submodule is used to input the integrated feature data into the fully connected layer to perform a vulnerability type identification operation to obtain the vulnerability type identification result.

[0013] In order to solve the above technical problems, the embodiment of the present application further provides a computer device, which adopts the following technical solution: The system comprises a memory and a processor, wherein the memory stores computer-readable instructions, and the processor implements the steps of the remote missed scan report generation method as described above when executing the computer-readable instructions.

[0014] In order to solve the above technical problems, the embodiment of the present application further provides a computer-readable storage medium, which adopts the following technical solution: The computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the steps of the remote missed scan report generation method as described above are implemented.

[0015] The present application provides a remote missed scan report generation method, comprising: receiving a missed scan report generation request sent by a user terminal, wherein the missed scan report generation request includes target database identification information; reading a target database corresponding to the target database identification information, and obtaining historical data of remote missed scan results in the target database; inputting the historical data of the remote missed scan results into a pre-trained model to perform a vulnerability type recognition operation to obtain a vulnerability type recognition result; performing a weight optimization operation on the vulnerability type recognition result according to an attention mechanism to obtain an attention value; performing a feature fusion operation on the attention value to obtain feature fusion data; calling a KAN model, and inputting the feature fusion data into the KAN model to perform a suggestion prediction operation to obtain a suggestion prediction result; generating a vulnerability scan report according to the suggestion prediction result, and outputting the vulnerability scan report to the user terminal. Compared with the prior art, the present application introduces an attention mechanism to increase the weight of important features, and at the same time, performs a preliminary classification of the scanned vulnerability categories through a DeCharCNN-KAN model, wherein a new convolution method is combined to enhance the flexibility of the 6-layer convolution of the model, and then the KAN model is combined to perform feature fusion to predict the recommended results for dealing with the vulnerability, so as to improve the accuracy of the vulnerability scan report recommendations. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the scheme in the present application, a brief introduction is given below to the drawings required for use in the description of the embodiments of the present application. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0017] Figure 1 is an exemplary system architecture diagram to which the present application may be applied; Figure 2 is a flowchart of the implementation of the remote missed scan report generation method provided in the embodiment of the present application; Figure 3 It is a structural diagram of an embodiment of the DeCharCNN-KAN model provided in the embodiments of the present application; Figure 4 is a schematic diagram of a flexible convolution method provided in an embodiment of the present application; Figure 5 It is a structural diagram of a remote missed scan report generating device provided in an embodiment of the present application; Figure 6 It is a structural diagram of an embodiment of a computer device according to the present application. DETAILED DESCRIPTION

[0018] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by technicians in the technical field of the present application; the terms used in the specification of the application herein are only for the purpose of describing specific embodiments and are not intended to limit the present application; the terms "including" and "having" and any variations thereof in the specification and claims of the present application and the above-mentioned drawings are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of the present application or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.

[0019] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0020] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0021] like Figure 1As shown, the system architecture 100 may include a terminal device 101, a network 102 and a server 103. The terminal device 101 may be a laptop 1011, a tablet computer 1012 or a mobile phone 1013. The network 102 is used to provide a medium for a communication link between the terminal device 101 and the server 103. The network 102 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0022] The user can use the terminal device 101 to interact with the server 103 through the network 102 to receive or send messages, etc. Various communication client applications can be installed on the terminal device 101, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0023] The terminal device 101 can be any electronic device with a display screen and supporting web browsing. In addition to the laptop computer 1011, the tablet computer 1012 or the mobile phone 1013, the terminal device 101 can also be an e-book reader, an MP3 player (Moving Picture Experts Group Audio Layer III), an MP4 (Moving Picture Experts Group Audio Layer IV), a laptop computer, a desktop computer, etc.

[0024] The server 103 may be a server that provides various services, such as a background server that provides support for a web page displayed on the terminal device 101 .

[0025] It should be noted that the remote missed scan report generation method provided in the embodiment of the present application is generally executed by a server / terminal device, and accordingly, the remote missed scan report generation device is generally arranged in the server / terminal device.

[0026] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0027] Continue to refer Figure 2 , shows a flow chart of an embodiment of a remote missed scan report generation method according to the present application. The remote missed scan report generation method comprises: step S201, step S202, step S203, step S204, step S205, step S206 and step S207.

[0028] In step S201, a missed scan report generation request sent by a user terminal is received, wherein the missed scan report generation request includes target database identification information; In the embodiments of the present application, the user terminal refers to a terminal device used to execute the image processing method for preventing document abuse provided by the present application. The user terminal can be a mobile terminal such as a mobile phone, a smart phone, a laptop computer, a digital broadcast receiver, a PDA (personal digital assistant), a PAD (tablet computer), a PMP (portable multimedia player), a navigation device, etc., as well as a fixed terminal such as a digital TV, a desktop computer, etc. It should be understood that the examples of user terminals here are only for the convenience of understanding and are not used to limit the present application.

[0029] In step S202, a target database corresponding to the target database identification information is read, and historical data of remote missed scanning results is obtained in the target database.

[0030] In step S203, the historical data of the remote vulnerability scanning result is input into the pre-trained model to perform a vulnerability type identification operation to obtain a vulnerability type identification result.

[0031] In an embodiment of the present application, after obtaining the historical data of the remote vulnerability scanning results, the historical data is input into a pre-trained model to determine the category of the vulnerability feature.

[0032] In step S204, a weight optimization operation is performed on the vulnerability type identification result according to the attention mechanism to obtain an attention value.

[0033] In an embodiment of the present application, after obtaining the prediction data from the DeCharCNN model after preliminary training, the data is processed based on the attention mechanism to obtain the attention value of the data.

[0034] In step S205, a feature fusion operation is performed on the attention value to obtain feature fusion data.

[0035] In an embodiment of the present application, after obtaining the data processed by the attention mechanism, feature fusion is performed on it.

[0036] In step S206, the KAN model is called, and the feature fusion data is input into the KAN model to perform a suggestion prediction operation to obtain a suggestion prediction result.

[0037] In the embodiment of the present application, the feature fusion data after feature fusion is input into the KAN model to perform secondary prediction of model integration.

[0038] In step S207, a vulnerability scanning report is generated according to the suggested prediction result, and the vulnerability scanning report is output to the user terminal.

[0039] In the embodiments of this application, see Figure 3 The structural diagram of the DeCharCNN-KAN model shown in the figure, by integrating the output of the DeCharCNN-KAN model, the prediction information about the vulnerability data is obtained, which includes the category information of the vulnerability and the recommended treatment plan for the vulnerability, and a vulnerability scanning report is generated.

[0040] In an embodiment of the present application, a remote missed scan report generation method is provided, comprising: receiving a missed scan report generation request sent by a user terminal, wherein the missed scan report generation request includes target database identification information; reading a target database corresponding to the target database identification information, and obtaining historical data of remote missed scan results in the target database; inputting the historical data of remote missed scan results into a pre-trained model for vulnerability type recognition operation to obtain vulnerability type recognition results; performing weight optimization operation on the vulnerability type recognition results according to the attention mechanism to obtain attention values; performing feature fusion operation on the attention values ​​to obtain feature fusion data; calling a KAN model, and inputting the feature fusion data into the KAN model for suggestion prediction operation to obtain suggestion prediction results; generating a vulnerability scan report according to the suggestion prediction results, and outputting the vulnerability scan report to the user terminal. Compared with the prior art, the present application introduces an attention mechanism to increase the weight of important features, and at the same time, performs preliminary classification of the scanned vulnerability categories through the DeCharCNN-KAN model, wherein a new convolution method is combined to enhance the flexibility of the 6-layer convolution of the model, and then combines the KAN model for feature fusion to predict the recommended results for dealing with the vulnerabilities, so as to improve the accuracy of the vulnerability scan report recommendations.

[0041] In some optional implementations of the embodiments of the present application, after the step of reading the target database corresponding to the target database identification information and obtaining the historical data of the remote vulnerability scanning result in the target database, and before the step of inputting the pre-processed historical data into the pre-trained model to perform the vulnerability type identification operation and obtain the vulnerability type identification result, the following steps are also included: Performing a preprocessing operation on the historical data of the remote missed scanning results to obtain preprocessed historical data; The steps of inputting the historical data of the remote vulnerability scanning results into the pre-trained model to perform vulnerability type identification operation and obtain the vulnerability type identification result specifically include the following steps: The preprocessed historical data is input into the pre-trained model to perform vulnerability type identification operations to obtain vulnerability type identification results.

[0042] In an embodiment of the present application, pre-processing operations such as data cleaning and segmentation are performed on the acquired vulnerability information.

[0043] In some optional implementations of the embodiments of the present application, the above step of inputting the historical data of the remote vulnerability scanning result into the pre-trained model to perform a vulnerability type identification operation to obtain the vulnerability type identification result specifically includes the following steps: Integrate the historical data of the remote missed scanning results into a data set, and label the data set to obtain a labeled data set; Perform feature vector conversion operation on the labeled data set to obtain feature vector data; Input the feature vector data into the convolution layer of the DeCharCNN model to perform a first feature extraction operation to obtain first feature extraction data; Input the first feature extraction data into the pooling layer of the DeCharCNN model to perform a second feature extraction operation to obtain second feature extraction data; Performing feature integration processing on the first feature extraction data and the second feature extraction data to obtain integrated feature extraction data; The integrated feature data is input into the fully connected layer to perform vulnerability type identification operation to obtain the vulnerability type identification result.

[0044] In the embodiments of this application, see Figure 4 The schematic diagram of the flexible convolution method shown in the figure integrates the historical data of the remote missed scanning results into a data set for labeling, converts it into a feature vector and inputs it into the DeCharCNN model. First, the feature extraction of the data is performed. The input layer of the model transmits the data to the convolution layer of the model. The granularity of feature extraction is adjusted according to the set convolution kernel size, and then the convolution kernel is moved to realize the operation of extracting feature information. The traditional convolution bias term is usually a decimal, and an offset error will be generated after convolution. A new offset t that can be continuously learned is added to reduce the error and ensure the flexibility and accuracy of the convolution.

[0045]

[0046]

[0047]

[0048] The above process maps the interpolation point position to the weighted sum of the four domains, which is the pixel point closest to itself in the feature map. The weight is set according to the distance of the horizontal and vertical coordinates of each point. Max (0, 1-...) reduces the distance between the interpolation point and the domain point to within 1 pixel error. Assume that the input function is , the convolution kernel function is , the step length is c , the bias term is k , then the convolution formula is:

[0049] .

[0050] In the embodiment of the present application, after the above feature extraction step, the convolution layer of the model transfers the data to the pooling layer for secondary feature extraction. The pooling layer of the DeCharCNN model uses the maximum pooling method to reduce the training parameters to increase the overall model training rate, while retaining the most significant features of the data and improving the generalization ability of the model. Assume that the input function is , the maximum pooling function is , the bias term is k , then the formula is:

[0051]

[0052] In the embodiment of the present application, after the above-mentioned secondary feature extraction operation, the fully connected layer integrates the information of the convolution layer and the pooling layer to predict the category of the data. The pooling layer will obtain s training set data for labeling, and the feature vector of the data is recorded as , represents the category of data. Suppose through the function h(x) Given a data vector x The class probability p , the function formula is as follows:

[0053] Represents the model parameters, and the minimum cost function is as follows:

[0054]

[0055] .

[0056] In some optional implementations of the embodiments of the present application, the step of performing a weight optimization operation on the vulnerability type identification result according to the attention mechanism to obtain the attention value specifically includes the following steps: Calculate the weight coefficient of vulnerability type identification results based on the attention mechanism; The weight coefficients are normalized, and the normalized weight coefficients are weight mapped to obtain weight mapping data; The vulnerability type identification results are weighted and summed according to the weight mapping data to obtain the attention value.

[0057] In an embodiment of the present application, the fused attention mechanism calculates weight coefficients for the acquired data.

[0058] In the embodiment of the present application, the output of the previous step is normalized and mapped to {0,1}.

[0059] In an embodiment of the present application, the data is weighted and summed according to the calculated weight coefficient to obtain a corresponding attention value.

[0060] In some optional implementations of the embodiments of the present application, the above-mentioned step of calling the KAN model and inputting the feature fusion data into the KAN model for performing a suggestion prediction operation to obtain a suggestion prediction result specifically includes the following steps: According to the activation layer of the KAN model, a nonlinear activation operation is performed on the feature fusion data to obtain a nonlinear activation function; Construct a function matrix based on the nonlinear activation function; The feature fusion data is predicted and mapped according to the function matrix to obtain the recommended prediction results.

[0061] In the embodiment of the present application, the KAN model directly performs nonlinear activation on the input feature data, and in the activation layer of the model, functions of different shapes are fitted by using B-spline functions with different numbers of control points. , , , then the general form of the KAN network is:

[0062] In the embodiment of the present application, each KAN layer is represented by a function matrix , stack each KAN layer multiple times to construct the relationship between input mapping and output, that is, to construct the matrix from the input layer to the output layer. It is The function matrix of the layer KAN is:

[0063]

[0064] In the embodiment of the present application, the output data of the KAN model is obtained, and the input , the output is: .

[0065] The embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Artificial Intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0066] AI basic technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, mechatronics, etc. AI software technologies mainly include computer vision technology, robotics technology, biometrics technology, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0067] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through computer-readable instructions, and the computer-readable instructions can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the aforementioned storage medium can be a non-volatile storage medium such as a disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0068] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0069] Further references Figure 5 , as a response to the above Figure 2 The present application provides an embodiment of a remote scan miss report generation device, and the device embodiment is similar to Figure 2 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0070] like Figure 5 As shown, the remote missed scan report generating device 200 of the embodiment of the present application includes: The request receiving module 210 is used to receive a missed scan report generation request sent by a user terminal, wherein the missed scan report generation request includes target database identification information; The historical data acquisition module 220 is used to read the target database corresponding to the target database identification information, and obtain the historical data of the remote missed scanning result in the target database; The vulnerability type identification module 230 is used to input the historical data of the remote vulnerability scanning results into the pre-trained model to perform a vulnerability type identification operation to obtain a vulnerability type identification result; A weight optimization module 240 is used to perform a weight optimization operation on the vulnerability type identification result according to the attention mechanism to obtain an attention value; A feature fusion module 250 is used to perform a feature fusion operation on the attention value to obtain feature fusion data; The suggestion prediction module 260 is used to call the KAN model and input the feature fusion data into the KAN model to perform a suggestion prediction operation to obtain a suggestion prediction result; The report generation module 270 is used to generate a vulnerability scanning report according to the recommended prediction results and output the vulnerability scanning report to the user terminal.

[0071] In an embodiment of the present application, a remote missed scan report generation device 200 is provided, including: a request receiving module 210, which is used to receive a missed scan report generation request sent by a user terminal, wherein the missed scan report generation request includes target database identification information; a historical data acquisition module 220, which is used to read the target database corresponding to the target database identification information, and obtain the historical data of the remote missed scan result in the target database; a vulnerability type identification module 230, which is used to input the historical data of the remote missed scan result into a pre-trained model to perform a vulnerability type identification operation to obtain a vulnerability type identification result; a weight optimization module 240, which is used to perform a weight optimization operation on the vulnerability type identification result according to the attention mechanism to obtain an attention value; a feature fusion module 250, which is used to perform a feature fusion operation on the attention value to obtain feature fusion data; a suggestion prediction module 260, which is used to call the KAN model, and input the feature fusion data into the KAN model to perform a suggestion prediction operation to obtain a suggestion prediction result; a report generation module 270, which is used to generate a vulnerability scan report according to the suggestion prediction result, and output the vulnerability scan report to the user terminal. Compared with the prior art, this application introduces an attention mechanism to increase the weights of important features. At the same time, the DeCharCNN-KAN model is used to perform preliminary classification of the scanned vulnerability categories. A new convolution method is combined to enhance the flexibility of the model's 6-layer convolution, and then the KAN model is combined for feature fusion to predict the recommended results for vulnerability handling, so as to improve the accuracy of vulnerability scanning report recommendations.

[0072] In some optional implementations of the embodiments of the present application, the remote vulnerability scan report generating device 200 further includes: a preprocessing module, and the vulnerability type identification module includes: a vulnerability type identification submodule, wherein: A preprocessing module is used to perform a preprocessing operation on the historical data of the remote missed scanning results to obtain preprocessed historical data; The vulnerability type identification submodule is used to input the pre-processed historical data into the pre-trained model to perform vulnerability type identification operations and obtain vulnerability type identification results.

[0073] In some optional implementations of the embodiments of the present application, the vulnerability type identification module includes: The marked data acquisition submodule is used to integrate the historical data of the remote missed scanning results into a data set, and mark the data set to obtain a marked data set; The feature vector conversion submodule is used to perform feature vector conversion operations on the labeled data set to obtain feature vector data; A first feature extraction submodule is used to input the feature vector data into the convolution layer of the DeCharCNN model to perform a first feature extraction operation to obtain first feature extraction data; A second feature extraction submodule is used to input the first feature extraction data into the pooling layer of the DeCharCNN model to perform a second feature extraction operation to obtain second feature extraction data; A feature integration submodule, used for performing feature integration processing on the first feature extraction data and the second feature extraction data to obtain integrated feature extraction data; The vulnerability type identification submodule is used to input the integrated feature data into the fully connected layer to perform vulnerability type identification operations and obtain vulnerability type identification results.

[0074] To solve the above technical problems, the present application also provides a computer device. Figure 6 , Figure 6 This is a basic structural block diagram of a computer device according to an embodiment of the present application.

[0075] The computer device 300 includes a memory 310, a processor 320, and a network interface 330 that are interconnected and communicated through a system bus. It should be noted that the figure only shows a computer device 300 having components 310-330, but it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application specific integrated circuits (Application Specific Integrated Circuit, ASIC), programmable gate arrays (Field-Programmable Gate Array, FPGA), digital processors (Digital Signal Processor, DSP), embedded devices, etc.

[0076] The computer device may be a computing device such as a desktop computer, a notebook, a PDA, a cloud server, etc. The computer device may interact with a user through a keyboard, a mouse, a remote controller, a touch pad, or a voice control device.

[0077] The memory 310 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 310 can be an internal storage unit of the computer device 300, such as a hard disk or memory of the computer device 300. In other embodiments, the memory 310 can also be an external storage device of the computer device 300, such as a plug-in hard disk equipped on the computer device 300, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card, etc. Of course, the memory 310 can also include both the internal storage unit of the computer device 300 and its external storage device. In the embodiment of the present application, the memory 310 is generally used to store the operating system and various application software installed on the computer device 300, such as computer-readable instructions of the remote missed scan report generation method, etc. In addition, the memory 310 can also be used to temporarily store various data that have been output or will be output.

[0078] The processor 320 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chips in some embodiments. The processor 320 is generally used to control the overall operation of the computer device 300. In the embodiment of the present application, the processor 320 is used to run the computer-readable instructions stored in the memory 310 or process data, such as running the computer-readable instructions of the remote scan miss report generation method.

[0079] The network interface 330 may include a wireless network interface or a wired network interface. The network interface 330 is generally used to establish a communication connection between the computer device 300 and other electronic devices.

[0080] The computer device provided in this application introduces an attention mechanism to increase the weights of important features. At the same time, the DeCharCNN-KAN model is used to perform preliminary classification of the scanned vulnerability categories. A new convolution method is combined to enhance the flexibility of the model's 6-layer convolution, and then the KAN model is combined for feature fusion to predict the recommended results for vulnerability handling, so as to improve the accuracy of vulnerability scanning report recommendations.

[0081] The present application also provides another embodiment, namely, providing a computer-readable storage medium, wherein the computer-readable storage medium stores computer-readable instructions, and the computer-readable instructions can be executed by at least one processor to enable the at least one processor to perform the steps of the remote missed scan report generation method as described above.

[0082] The computer-readable storage medium provided by the present application introduces an attention mechanism to increase the weights of important features. At the same time, the DeCharCNN-KAN model is used to perform a preliminary classification of the scanned vulnerability categories. A new convolution method is combined to enhance the flexibility of the model's 6-layer convolution, and then the KAN model is combined for feature fusion to predict the recommended results for vulnerability handling, so as to improve the accuracy of the vulnerability scanning report recommendations.

[0083] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0084] Obviously, the embodiments described above are only some embodiments of the present application, rather than all embodiments. The preferred embodiments of the present application are given in the accompanying drawings, but they do not limit the patent scope of the present application. The present application can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application is described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions recorded in the aforementioned specific implementation methods, or to perform equivalent replacement of some of the technical features therein. Any equivalent structure made using the contents of the specification and drawings of this application, directly or indirectly used in other related technical fields, is similarly within the scope of patent protection of this application.

Claims

1. A remote scan miss report generation method, characterized in that: The steps include: Receiving a missed scan report generation request sent by a user terminal, wherein the missed scan report generation request includes target database identification information; Reading a target database corresponding to the target database identification information, and acquiring historical data of remote missed scanning results in the target database; Inputting the historical data of the remote vulnerability scanning result into the pre-trained model to perform a vulnerability type identification operation to obtain a vulnerability type identification result; Perform a weight optimization operation on the vulnerability type identification result according to the attention mechanism to obtain an attention value; Performing a feature fusion operation on the attention value to obtain feature fusion data; Calling the KAN model, and inputting the feature fusion data into the KAN model to perform a suggestion prediction operation, and obtaining a suggestion prediction result; A vulnerability scanning report is generated according to the suggested prediction result, and the vulnerability scanning report is output to the user terminal.

2. The remote scan miss report generation method according to claim 1, characterized in that: After the step of reading the target database corresponding to the target database identification information and obtaining the historical data of the remote vulnerability scanning result in the target database, and before the step of inputting the pre-processed historical data into the pre-trained model to perform the vulnerability type identification operation and obtain the vulnerability type identification result, the following steps are also included: Performing a preprocessing operation on the historical data of the remote missed scanning result to obtain preprocessed historical data; The step of inputting the historical data of the remote vulnerability scanning result into the pre-trained model to perform a vulnerability type identification operation to obtain a vulnerability type identification result specifically includes the following steps: The pre-processed historical data is input into a pre-trained model to perform a vulnerability type identification operation to obtain the vulnerability type identification result.

3. The remote missed scan report generation method according to claim 1, characterized in that: The step of inputting the historical data of the remote vulnerability scanning result into the pre-trained model to perform a vulnerability type identification operation to obtain a vulnerability type identification result specifically includes the following steps: Integrate the historical data of the remote missed scanning results into a data set, and perform labeling processing on the data set to obtain a labeled data set; Performing a feature vector conversion operation on the labeled data set to obtain feature vector data; Inputting the feature vector data into the convolution layer of the DeCharCNN model to perform a first feature extraction operation to obtain first feature extraction data; Input the first feature extraction data into the pooling layer of the DeCharCNN model to perform a second feature extraction operation to obtain second feature extraction data; Performing feature integration processing on the first feature extraction data and the second feature extraction data to obtain integrated feature extraction data; The integrated feature data is input into the fully connected layer to perform a vulnerability type identification operation to obtain the vulnerability type identification result.

4. The remote scan miss report generation method according to claim 1, characterized in that: The step of performing a weight optimization operation on the vulnerability type identification result according to the attention mechanism to obtain an attention value specifically includes the following steps: Calculate the weight coefficient of the vulnerability type identification result according to the attention mechanism; Normalizing the weight coefficients, and performing a weight mapping operation on the normalized weight coefficients to obtain weight mapping data; A weighted sum operation is performed on the vulnerability type identification results according to the weight mapping data to obtain the attention value.

5. The remote scan miss report generation method according to claim 1, characterized in that: The step of calling the KAN model and inputting the feature fusion data into the KAN model to perform a suggestion prediction operation to obtain a suggestion prediction result specifically includes the following steps: Performing a nonlinear activation operation on the feature fusion data according to the activation layer of the KAN model to obtain a nonlinear activation function; Constructing a function matrix according to the nonlinear activation function; A prediction mapping operation is performed on the feature fusion data according to the function matrix to obtain the suggested prediction result.

6. A remote scan miss report generating device, characterized in that: include: A request receiving module, configured to receive a missed scan report generation request sent by a user terminal, wherein the missed scan report generation request includes target database identification information; A historical data acquisition module, used for reading a target database corresponding to the target database identification information, and acquiring historical data of remote missed scanning results in the target database; A vulnerability type identification module is used to input the historical data of the remote vulnerability scanning result into a pre-trained model to perform a vulnerability type identification operation to obtain a vulnerability type identification result; A weight optimization module, used to perform a weight optimization operation on the vulnerability type identification result according to the attention mechanism to obtain an attention value; A feature fusion module, used for performing a feature fusion operation on the attention value to obtain feature fusion data; A suggestion prediction module is used to call the KAN model and input the feature fusion data into the KAN model to perform a suggestion prediction operation to obtain a suggestion prediction result; A report generation module is used to generate a vulnerability scanning report according to the recommended prediction result and output the vulnerability scanning report to the user terminal.

7. The remote missed scan report generating device according to claim 6, characterized in that: The device further comprises: a preprocessing module, and the vulnerability type identification module comprises: a vulnerability type identification submodule, wherein: The preprocessing module is used to perform a preprocessing operation on the historical data of the remote missed scanning result to obtain preprocessed historical data; The vulnerability type identification submodule is used to input the pre-processed historical data into a pre-trained model to perform a vulnerability type identification operation to obtain the vulnerability type identification result.

8. The remote missed scan report generating device according to claim 6, characterized in that: The vulnerability type identification module includes: A marked data acquisition submodule is used to integrate the historical data of the remote missed scanning results into a data set, and mark the data set to obtain a marked data set; A feature vector conversion submodule is used to perform a feature vector conversion operation on the labeled data set to obtain feature vector data; A first feature extraction submodule, used for inputting the feature vector data into the convolution layer of the DeCharCNN model to perform a first feature extraction operation to obtain first feature extraction data; A second feature extraction submodule is used to input the first feature extraction data into the pooling layer of the DeCharCNN model to perform a second feature extraction operation to obtain second feature extraction data; A feature integration submodule, used for performing feature integration processing on the first feature extraction data and the second feature extraction data to obtain integrated feature extraction data; The vulnerability type identification submodule is used to input the integrated feature data into the fully connected layer to perform a vulnerability type identification operation to obtain the vulnerability type identification result.

9. A computer device comprising a memory and a processor, characterized in that: The memory stores computer-readable instructions, and when the processor executes the computer-readable instructions, the steps of the remote missed scan report generation method according to any one of claims 1 to 5 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by a processor, the steps of the remote missed scan report generation method according to any one of claims 1 to 5 are implemented.

Images