Remote scan miss report generation method, device, computer equipment and storage medium

Abstract

The embodiments of the present application belong to the field of artificial intelligence technology and relate to a remote vulnerability scan report generation method, apparatus, computer equipment, and storage medium. The method comprises: reading a target database corresponding to target database identification information, and obtaining historical data of remote vulnerability scan results in the target database; inputting the historical data of remote vulnerability scan results into a pre-trained model to perform a vulnerability type identification operation to obtain a vulnerability type identification result; performing a weight optimization operation on the vulnerability type identification result according to an attention mechanism to obtain an attention value; performing a feature fusion operation on the attention value to obtain feature fusion data; calling a KAN model, and inputting the feature fusion data into the KAN model to perform a suggestion prediction operation to obtain a suggestion prediction result; generating a vulnerability scan report based on the suggestion prediction result, and outputting the vulnerability scan report to a user terminal. The present application can improve the accuracy of vulnerability scan report recommendations.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to a method, apparatus, computer equipment, and storage medium for generating a remote missed scan report. Background Art

[0002] Network security has become an important part of national security, and its related technologies have increasingly become research topics for scholars at home and abroad. Among them, the detection and evaluation of network security environments have been widely studied.

[0003] However, the applicant found that the accuracy of existing network vulnerability scanning results is low. Summary of the Invention

[0004] The purpose of the embodiments of the present application is to propose a remote vulnerability scan report generation method, apparatus, computer equipment and storage medium to solve the problem of low accuracy of existing network vulnerability scan results.

[0005] In order to solve the above technical problems, the present invention provides a method for generating a remote missed scan report, which adopts the following technical solutions:

[0006] receiving a missed scan report generation request sent by a user terminal, wherein the missed scan report generation request includes target database identification information;

[0007] Reading a target database corresponding to the target database identification information, and obtaining historical data of remote missed scan results in the target database;

[0008] Inputting the historical data of the remote vulnerability scanning results into the pre-trained model to perform vulnerability type identification operation to obtain a vulnerability type identification result;

[0009] Perform a weight optimization operation on the vulnerability type identification result according to the attention mechanism to obtain an attention value;

[0010] Performing a feature fusion operation on the attention value to obtain feature fusion data;

[0011] Calling a KAN model, and inputting the feature fusion data into the KAN model to perform a suggestion prediction operation, thereby obtaining a suggestion prediction result;

[0012] A vulnerability scanning report is generated according to the suggested prediction result, and the vulnerability scanning report is output to the user terminal.

[0013] Furthermore, after the step of reading the target database corresponding to the target database identification information and obtaining historical data of remote vulnerability scanning results in the target database, and before the step of inputting the pre-processed historical data into the pre-trained model to perform vulnerability type identification operation and obtain vulnerability type identification results, the following steps are also included:

[0014] Performing a preprocessing operation on the historical data of the remote missed scanning result to obtain preprocessed historical data;

[0015] The step of inputting the historical data of the remote vulnerability scanning result into the pre-trained model to perform vulnerability type identification operation to obtain the vulnerability type identification result specifically includes the following steps:

[0016] The pre-processed historical data is input into a pre-trained model to perform a vulnerability type identification operation to obtain the vulnerability type identification result.

[0017] Furthermore, the step of inputting the historical data of the remote vulnerability scanning result into the pre-trained model to perform vulnerability type identification operation to obtain the vulnerability type identification result specifically includes the following steps:

[0018] Integrating the historical data of the remote missed scanning results into a data set, and marking the data set to obtain a marked data set;

[0019] Performing a feature vector conversion operation on the labeled data set to obtain feature vector data;

[0020] Inputting the feature vector data into the convolutional layer of the DeCharCNN model to perform a first feature extraction operation to obtain first feature extracted data;

[0021] Inputting the first feature extraction data into the pooling layer of the DeCharCNN model to perform a second feature extraction operation to obtain second feature extraction data;

[0022] performing feature integration processing on the first feature extraction data and the second feature extraction data to obtain integrated feature extraction data;

[0023] The integrated feature data is input into the fully connected layer to perform a vulnerability type identification operation to obtain the vulnerability type identification result.

[0024] Furthermore, the step of performing a weight optimization operation on the vulnerability type identification result according to the attention mechanism to obtain an attention value specifically includes the following steps:

[0025] Calculate the weight coefficient of the vulnerability type identification result according to the attention mechanism;

[0026] performing a normalization operation on the weight coefficients, and performing a weight mapping operation on the normalized weight coefficients to obtain weight mapping data;

[0027] A weighted sum operation is performed on the vulnerability type identification results according to the weight mapping data to obtain the attention value.

[0028] Furthermore, the step of calling the KAN model and inputting the feature fusion data into the KAN model to perform a suggestion prediction operation to obtain a suggestion prediction result specifically includes the following steps:

[0029] Performing a nonlinear activation operation on the feature fusion data according to the activation layer of the KAN model to obtain a nonlinear activation function;

[0030] Constructing a function matrix according to the nonlinear activation function;

[0031] A prediction mapping operation is performed on the feature fusion data according to the function matrix to obtain the suggested prediction result.

[0032] In order to solve the above technical problems, the embodiment of the present application further provides a remote missed scan report generation device, which adopts the following technical solution:

[0033] a request receiving module, configured to receive a missed scan report generation request sent by a user terminal, wherein the missed scan report generation request includes target database identification information;

[0034] A historical data acquisition module is used to read the target database corresponding to the target database identification information and obtain historical data of remote missed scanning results in the target database;

[0035] A vulnerability type identification module is used to input the historical data of the remote vulnerability scanning results into a pre-trained model to perform a vulnerability type identification operation to obtain a vulnerability type identification result;

[0036] A weight optimization module is used to perform a weight optimization operation on the vulnerability type identification result according to the attention mechanism to obtain an attention value;

[0037] A feature fusion module, configured to perform a feature fusion operation on the attention value to obtain feature fusion data;

[0038] A suggestion prediction module is used to call the KAN model and input the feature fusion data into the KAN model to perform a suggestion prediction operation to obtain a suggestion prediction result;

[0039] A report generation module is used to generate a vulnerability scanning report based on the recommended prediction result and output the vulnerability scanning report to the user terminal.

[0040] Furthermore, the device further includes: a pre-processing module, and the vulnerability type identification module includes: a vulnerability type identification submodule, wherein:

[0041] The preprocessing module is used to perform a preprocessing operation on the historical data of the remote missed scanning result to obtain preprocessed historical data;

[0042] The vulnerability type identification submodule is used to input the pre-processed historical data into a pre-trained model to perform a vulnerability type identification operation to obtain the vulnerability type identification result.

[0043] Furthermore, the vulnerability type identification module includes:

[0044] a marked data acquisition submodule, configured to integrate the historical data of the remote missed scan results into a data set, and perform marking processing on the data set to obtain a marked data set;

[0045] A feature vector conversion submodule, configured to perform a feature vector conversion operation on the labeled data set to obtain feature vector data;

[0046] A first feature extraction submodule is used to input the feature vector data into the convolution layer of the DeCharCNN model to perform a first feature extraction operation to obtain first feature extracted data;

[0047] A second feature extraction submodule is used to input the first feature extraction data into the pooling layer of the DeCharCNN model to perform a second feature extraction operation to obtain second feature extraction data;

[0048] a feature integration submodule, configured to perform feature integration processing on the first feature extraction data and the second feature extraction data to obtain integrated feature extraction data;

[0049] The vulnerability type identification submodule is used to input the integrated feature data into the fully connected layer to perform a vulnerability type identification operation to obtain the vulnerability type identification result.

[0050] In order to solve the above technical problems, the embodiment of the present application further provides a computer device, which adopts the following technical solution:

[0051] The system comprises a memory and a processor, wherein the memory stores computer-readable instructions, and the processor implements the steps of the remote missed scan report generation method as described above when executing the computer-readable instructions.

[0052] In order to solve the above technical problems, the embodiment of the present application further provides a computer-readable storage medium, which adopts the following technical solution:

[0053] The computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the steps of the remote missed scan report generation method described above are implemented.

[0054] The present application provides a remote vulnerability scan report generation method, comprising: receiving a vulnerability scan report generation request sent by a user terminal, wherein the vulnerability scan report generation request includes target database identification information; reading a target database corresponding to the target database identification information, and obtaining historical data of remote vulnerability scan results in the target database; inputting the historical data of the remote vulnerability scan results into a pre-trained model to perform a vulnerability type identification operation to obtain a vulnerability type identification result; performing a weight optimization operation on the vulnerability type identification result according to an attention mechanism to obtain an attention value; performing a feature fusion operation on the attention value to obtain feature fusion data; calling a KAN model, and inputting the feature fusion data into the KAN model to perform a suggestion prediction operation to obtain a suggestion prediction result; generating a vulnerability scan report based on the suggestion prediction result, and outputting the vulnerability scan report to the user terminal. Compared with the prior art, the present application introduces an attention mechanism to increase the weight of important features. At the same time, the DeCharCNN-KAN model is used to perform preliminary classification of the scanned vulnerability categories. In particular, a new convolution method is combined to enhance the flexibility of the model's 6-layer convolution, and then combined with the KAN model to perform feature fusion to predict the recommended results for vulnerability treatment, thereby improving the accuracy of vulnerability scan report recommendations. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the solutions in this application, a brief introduction will be given below to the drawings required for use in the description of the embodiments of this application. Obviously, the drawings described below are some embodiments of this application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0056] Figure 1 is an exemplary system architecture diagram to which the present application may be applied;

[0057] Figure 2 This is a flowchart of the implementation of the remote missed scan report generation method provided in an embodiment of the present application;

[0058] Figure 3 This is a schematic structural diagram of an embodiment of the DeCharCNN-KAN model provided in an embodiment of the present application;

[0059] Figure 4 Schematic diagram of the flexible convolution method provided in an embodiment of the present application;

[0060] Figure 5Schematic diagram of the structure of the remote scan missed report generating device provided in an embodiment of the present application;

[0061] Figure 6 It is a structural diagram of an embodiment of a computer device according to the present application. DETAILED DESCRIPTION

[0062] Unless otherwise defined, all technical and scientific terms used herein have the same meanings as commonly understood by those skilled in the art to which this application belongs. The terms used in the specification of the application are for the purpose of describing specific embodiments only and are not intended to limit this application. The terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned drawings are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of this application or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.

[0063] References herein to "embodiments" mean that a particular feature, structure, or characteristic described in connection with the embodiments may be included in at least one embodiment of the present application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor does it constitute an independent or alternative embodiment that is mutually exclusive of other embodiments. It is understood, both explicitly and implicitly, by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0064] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0065] like Figure 1 As shown, system architecture 100 may include a terminal device 101, a network 102, and a server 103. Terminal device 101 may be a laptop computer 1011, a tablet computer 1012, or a mobile phone 1013. Network 102 is a medium for providing a communication link between terminal device 101 and server 103. Network 102 may include various connection types, such as wired or wireless communication links or fiber optic cables.

[0066] The user can use the terminal device 101 to interact with the server 103 via the network 102 to receive or send messages, etc. Various communication client applications can be installed on the terminal device 101, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0067] The terminal device 101 can be various electronic devices with a display screen and supporting web browsing. In addition to the laptop computer 1011, the tablet computer 1012 or the mobile phone 1013, the terminal device 101 can also be an e-book reader, an MP3 player (Moving Picture Experts Group Audio Layer III), an MP4 (Moving Picture Experts Group Audio Layer IV) player, a laptop computer, a desktop computer, etc.

[0068] The server 103 may be a server that provides various services, such as a background server that provides support for web pages displayed on the terminal device 101 .

[0069] It should be noted that the remote missed scan report generation method provided in the embodiment of the present application is generally executed by a server / terminal device, and accordingly, the remote missed scan report generation device is generally set in the server / terminal device.

[0070] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is merely illustrative. Any number of terminal devices, networks and servers may be provided as required.

[0071] Continue to refer Figure 2 , which shows a flow chart of an embodiment of a remote missed scan report generation method according to the present application. The remote missed scan report generation method includes: step S201, step S202, step S203, step S204, step S205, step S206 and step S207.

[0072] In step S201, a missed scan report generation request sent by a user terminal is received, wherein the missed scan report generation request includes target database identification information;

[0073] In the embodiments of the present application, the user terminal refers to a terminal device used to execute the image processing method for preventing document abuse provided by the present application. The user terminal can be a mobile terminal such as a mobile phone, a smart phone, a laptop computer, a digital broadcast receiver, a PDA (personal digital assistant), a PAD (tablet computer), a PMP (portable multimedia player), a navigation device, etc., as well as a fixed terminal such as a digital TV, a desktop computer, etc. It should be understood that the examples of user terminals here are only for convenience of understanding and are not used to limit the present application.

[0074] In step S202, the target database corresponding to the target database identification information is read, and historical data of remote missed scanning results is obtained in the target database.

[0075] In step S203, the historical data of the remote vulnerability scanning result is input into the pre-trained model to perform a vulnerability type identification operation to obtain a vulnerability type identification result.

[0076] In an embodiment of the present application, after obtaining historical data of remote vulnerability scanning results, the historical data is input into a pre-trained model to determine the category of vulnerability features.

[0077] In step S204, a weight optimization operation is performed on the vulnerability type identification result according to the attention mechanism to obtain an attention value.

[0078] In an embodiment of the present application, after obtaining the prediction data from the initial training of the DeCharCNN model, the data is processed based on the attention mechanism to obtain the attention value of the data.

[0079] In step S205, a feature fusion operation is performed on the attention value to obtain feature fusion data.

[0080] In an embodiment of the present application, after obtaining the data processed by the attention mechanism, it is subjected to feature fusion.

[0081] In step S206, the KAN model is called, and the feature fusion data is input into the KAN model to perform a suggestion prediction operation to obtain a suggestion prediction result.

[0082] In an embodiment of the present application, the feature fusion data after feature fusion is input into the KAN model to perform secondary prediction of model integration.

[0083] In step S207, a vulnerability scanning report is generated according to the suggested prediction result, and the vulnerability scanning report is output to the user terminal.

[0084] In the embodiments of this application, see Figure 3 The structural diagram of the DeCharCNN-KAN model shown in the figure is used to obtain prediction information about vulnerability data by integrating the output of the DeCharCNN-KAN model, which includes vulnerability category information and recommended solutions for the vulnerability, and generate a vulnerability scanning report.

[0085] In an embodiment of the present application, a remote vulnerability scan report generation method is provided, comprising: receiving a vulnerability scan report generation request sent by a user terminal, wherein the vulnerability scan report generation request includes target database identification information; reading a target database corresponding to the target database identification information, and obtaining historical data of remote vulnerability scan results in the target database; inputting the historical data of the remote vulnerability scan results into a pre-trained model to perform a vulnerability type identification operation to obtain a vulnerability type identification result; performing a weight optimization operation on the vulnerability type identification result according to an attention mechanism to obtain an attention value; performing a feature fusion operation on the attention value to obtain feature fusion data; calling a KAN model, and inputting the feature fusion data into the KAN model to perform a suggestion prediction operation to obtain a suggestion prediction result; generating a vulnerability scan report based on the suggestion prediction result, and outputting the vulnerability scan report to the user terminal. Compared with the prior art, the present application introduces an attention mechanism to increase the weight of important features. At the same time, a DeCharCNN-KAN model is used to perform preliminary classification of the scanned vulnerability categories. In particular, a new convolution method is combined to enhance the flexibility of the model's 6-layer convolution, and then combined with the KAN model to perform feature fusion to predict the recommended results for vulnerability handling, thereby improving the accuracy of vulnerability scan report recommendations.

[0086] In some optional implementations of the embodiments of the present application, after the step of reading the target database corresponding to the target database identification information and obtaining historical data of the remote vulnerability scanning results in the target database, and before the step of inputting the preprocessed historical data into the pretrained model to perform vulnerability type identification operation and obtain the vulnerability type identification result, the following steps are also included:

[0087] Performing preprocessing operations on historical data of remote missed scanning results to obtain preprocessed historical data;

[0088] Inputting historical data of remote vulnerability scanning results into a pre-trained model to perform vulnerability type identification operations and obtain vulnerability type identification results specifically includes the following steps:

[0089] The preprocessed historical data is input into the pre-trained model to perform vulnerability type identification operations to obtain vulnerability type identification results.

[0090] In an embodiment of the present application, pre-processing operations such as data cleaning and segmentation are performed on the acquired vulnerability information.

[0091] In some optional implementations of the embodiments of the present application, the step of inputting the historical data of the remote vulnerability scanning results into the pre-trained model to perform vulnerability type identification operation to obtain the vulnerability type identification result specifically includes the following steps:

[0092] Integrate the historical data of remote missed scan results into a data set, and mark the data set to obtain a marked data set;

[0093] Perform feature vector conversion on the labeled data set to obtain feature vector data;

[0094] Input the feature vector data into the convolution layer of the DeCharCNN model to perform a first feature extraction operation to obtain first feature extraction data;

[0095] Inputting the first feature extraction data into the pooling layer of the DeCharCNN model to perform a second feature extraction operation to obtain second feature extraction data;

[0096] Performing feature integration processing on the first feature extraction data and the second feature extraction data to obtain integrated feature extraction data;

[0097] The integrated feature data is input into the fully connected layer to perform vulnerability type identification operation to obtain the vulnerability type identification result.

[0098] In the embodiments of this application, see Figure 4 The diagram shows the flexible convolution method. The historical data of remote missed scan results are integrated into a data set for labeling, converted into feature vectors and input into the DeCharCNN model. First, the feature extraction of the data is performed. The input layer of the model transmits the data to the convolution layer of the model. The granularity of feature extraction is adjusted according to the set convolution kernel size, and then the convolution kernel is moved to realize the operation of extracting feature information. The traditional convolution bias term is usually a decimal, and offset error will be generated after convolution. A new offset t that can be continuously learned is added to reduce the error and ensure the flexibility and accuracy of convolution.

[0099]

[0100]

[0101]

[0102] The above process maps the interpolation point position to the weighted sum of the four domains, which is the pixel closest to itself in the feature map. The weight is set according to the distance of the horizontal and vertical coordinates of each point. Max(0, 1-...) reduces the distance between the interpolation point and the domain point to within 1 pixel error. Assume that the input function is , the convolution kernel function is , the step size is c , the bias term is k , then the convolution formula is:

[0103]

[0104] .

[0105] In the embodiment of the present application, after the above feature extraction steps, the convolutional layer of the model transfers the data to the pooling layer for secondary feature extraction. The pooling layer of the DeCharCNN model uses the maximum pooling method to reduce the training parameters to increase the overall model training rate, while retaining the most significant features of the data and improving the generalization ability of the model. Assume that the input function is , the maximum pooling function is , the bias term is k , then the formula is:

[0106]

[0107]

[0108] In the embodiment of the present application, after the above-mentioned secondary feature extraction operation, the fully connected layer integrates the information of the convolution layer and the pooling layer to predict the category of the data. The pooling layer will obtain s training set data for labeling, and the feature vector of the data is recorded as , represents the category of data. Suppose that through the function h(x) Given a data vector x The class probability p , the function formula is as follows:

[0109]

[0110] Represents the model parameters, and the minimum cost function is as follows:

[0111]

[0112]

[0113] .

[0114] In some optional implementations of the embodiments of the present application, the step of performing a weight optimization operation on the vulnerability type identification result according to the attention mechanism to obtain the attention value specifically includes the following steps:

[0115] Calculate the weight coefficient of vulnerability type identification results based on the attention mechanism;

[0116] Normalizing the weight coefficients, and performing a weight mapping operation on the normalized weight coefficients to obtain weight mapping data;

[0117] The vulnerability type identification results are weighted and summed according to the weight mapping data to obtain the attention value.

[0118] In an embodiment of the present application, the fusion attention mechanism calculates the weight coefficient for the acquired data.

[0119] In the embodiment of the present application, the output of the previous step is normalized and mapped to {0, 1}.

[0120] In an embodiment of the present application, the data is weighted and summed according to the calculated weight coefficient to obtain the corresponding attention value.

[0121] In some optional implementations of the embodiments of the present application, the above-mentioned steps of calling the KAN model and inputting the feature fusion data into the KAN model for performing a suggestion prediction operation to obtain a suggestion prediction result specifically include the following steps:

[0122] According to the activation layer of the KAN model, a nonlinear activation operation is performed on the feature fusion data to obtain a nonlinear activation function;

[0123] Construct a function matrix based on the nonlinear activation function;

[0124] The feature fusion data is predicted and mapped according to the function matrix to obtain the recommended prediction results.

[0125] In the embodiment of the present application, the KAN model directly performs nonlinear activation on the input feature data, and in the activation layer of the model, functions of different shapes are fitted by using B-spline functions with different numbers of control points. , , , then the general form of the KAN network is:

[0126]

[0127] In the embodiment of the present application, each KAN layer is represented by a function matrix , stack each KAN layer multiple times to build the relationship between input mapping and output, that is, to build the matrix from the input layer to the output layer, let It is The function matrix of the layer KAN is:

[0128]

[0129]

[0130] In the embodiment of the present application, the output data of the KAN model is obtained, and the input , the output is:

[0131] .

[0132] The embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Artificial intelligence (AI) refers to the theories, methods, techniques, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results.

[0133] Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interaction systems, and mechatronics. AI software technologies primarily encompass computer vision, robotics, biometrics, speech processing, natural language processing, and machine learning / deep learning.

[0134] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing related hardware using computer-readable instructions. The computer-readable instructions can be stored in a computer-readable storage medium. When executed, the program can include the processes in the above-described method embodiments. The aforementioned storage medium can be a non-volatile storage medium such as a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0135] It should be understood that although the steps in the flowcharts of the accompanying drawings are shown in sequence as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some of the steps in the flowcharts of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0136] Further references Figure 5 , as a response to the above Figure 2 In order to realize the method shown in the figure, the present application provides an embodiment of a remote missed scan report generating device. Figure 2 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0137] like Figure 5 As shown, the remote missed scan report generating device 200 of the embodiment of the present application includes:

[0138] The request receiving module 210 is configured to receive a missed scan report generation request sent by a user terminal, wherein the missed scan report generation request includes target database identification information;

[0139] The historical data acquisition module 220 is used to read the target database corresponding to the target database identification information and obtain the historical data of the remote missed scanning results in the target database;

[0140] The vulnerability type identification module 230 is used to input the historical data of the remote vulnerability scanning results into the pre-trained model to perform vulnerability type identification operations and obtain vulnerability type identification results;

[0141] A weight optimization module 240 is used to perform a weight optimization operation on the vulnerability type identification result according to the attention mechanism to obtain an attention value;

[0142] A feature fusion module 250 is used to perform a feature fusion operation on the attention value to obtain feature fusion data;

[0143] The suggestion prediction module 260 is used to call the KAN model and input the feature fusion data into the KAN model to perform a suggestion prediction operation to obtain a suggestion prediction result;

[0144] The report generation module 270 is used to generate a vulnerability scanning report according to the recommended prediction results and output the vulnerability scanning report to the user terminal.

[0145] In an embodiment of the present application, a remote missed scan report generation device 200 is provided, including: a request receiving module 210, used to receive a missed scan report generation request sent by a user terminal, wherein the missed scan report generation request includes target database identification information; a historical data acquisition module 220, used to read the target database corresponding to the target database identification information, and obtain historical data of remote missed scan results in the target database; a vulnerability type identification module 230, used to input the historical data of the remote missed scan results into a pre-trained model to perform a vulnerability type identification operation to obtain a vulnerability type identification result; a weight optimization module 240, used to perform a weight optimization operation on the vulnerability type identification result according to the attention mechanism to obtain an attention value; a feature fusion module 250, used to perform a feature fusion operation on the attention value to obtain feature fusion data; a suggestion prediction module 260, used to call the KAN model, and input the feature fusion data into the KAN model to perform a suggestion prediction operation to obtain a suggestion prediction result; a report generation module 270, used to generate a vulnerability scan report according to the suggestion prediction result, and output the vulnerability scan report to the user terminal. Compared with the existing technology, this application introduces an attention mechanism to increase the weight of important features. At the same time, the DeCharCNN-KAN model is used to perform preliminary classification of the scanned vulnerability categories. Among them, a new convolution method is combined to enhance the flexibility of the model's 6-layer convolution, and then combined with the KAN model for feature fusion to predict the recommended results for vulnerability handling, so as to improve the accuracy of vulnerability scanning report recommendations.

[0146] In some optional implementations of the embodiments of the present application, the remote vulnerability scan report generating device 200 further includes: a pre-processing module, and the vulnerability type identification module includes: a vulnerability type identification submodule, wherein:

[0147] A preprocessing module is used to perform preprocessing operations on the historical data of the remote missed scanning results to obtain preprocessed historical data;

[0148] The vulnerability type identification submodule is used to input the pre-processed historical data into the pre-trained model to perform vulnerability type identification operations and obtain vulnerability type identification results.

[0149] In some optional implementations of the embodiments of the present application, the vulnerability type identification module includes:

[0150] The labeled data acquisition submodule is used to integrate the historical data of remote missed scanning results into a data set and label the data set to obtain a labeled data set;

[0151] The feature vector conversion submodule is used to perform feature vector conversion operations on the labeled data set to obtain feature vector data;

[0152] A first feature extraction submodule is used to input the feature vector data into the convolution layer of the DeCharCNN model to perform a first feature extraction operation to obtain first feature extracted data;

[0153] The second feature extraction submodule is used to input the first feature extraction data into the pooling layer of the DeCharCNN model to perform a second feature extraction operation to obtain second feature extraction data;

[0154] A feature integration submodule, configured to perform feature integration processing on the first feature extraction data and the second feature extraction data to obtain integrated feature extraction data;

[0155] The vulnerability type identification submodule is used to input the integrated feature data into the fully connected layer to perform vulnerability type identification operations and obtain vulnerability type identification results.

[0156] To solve the above technical problems, the present application also provides a computer device. Figure 6 , Figure 6 This is a basic structural block diagram of the computer device according to an embodiment of the present application.

[0157] The computer device 300 includes a memory 310, a processor 320, and a network interface 330 that are interconnected through a system bus. It should be noted that the figure only shows the computer device 300 having components 310-330, but it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.

[0158] The computer device may be a desktop computer, notebook computer, PDA, cloud server, etc. The computer device may interact with the user via a keyboard, mouse, remote control, touchpad, or voice control device.

[0159] The memory 310 includes at least one type of readable storage medium, including flash memory, a hard disk, a multimedia card, a card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic storage, a magnetic disk, an optical disk, etc. In some embodiments, the memory 310 may be an internal storage unit of the computer device 300, such as a hard disk or memory of the computer device 300. In other embodiments, the memory 310 may also be an external storage device of the computer device 300, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. Of course, the memory 310 may also include both the internal storage unit of the computer device 300 and its external storage device. In the embodiment of the present application, the memory 310 is generally used to store the operating system and various application software installed on the computer device 300, such as computer-readable instructions for the remote missed scan report generation method. In addition, the memory 310 can also be used to temporarily store various data that has been output or is about to be output.

[0160] In some embodiments, the processor 320 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip. The processor 320 is generally used to control the overall operation of the computer device 300. In the embodiment of the present application, the processor 320 is used to execute computer-readable instructions stored in the memory 310 or process data, such as computer-readable instructions for executing the remote missed scan report generation method.

[0161] The network interface 330 may include a wireless network interface or a wired network interface. The network interface 330 is generally used to establish a communication connection between the computer device 300 and other electronic devices.

[0162] The computer device provided in this application introduces an attention mechanism to increase the weight of important features. At the same time, the DeCharCNN-KAN model is used to perform preliminary classification of the scanned vulnerability categories. Among them, a new convolution method is combined to enhance the flexibility of the model's 6-layer convolution, and then combined with the KAN model for feature fusion to predict the recommended results for vulnerability handling, so as to improve the accuracy of vulnerability scanning report recommendations.

[0163] The present application also provides another embodiment, namely, providing a computer-readable storage medium, wherein the computer-readable storage medium stores computer-readable instructions, and the computer-readable instructions can be executed by at least one processor to enable the at least one processor to perform the steps of the remote missed scan report generation method as described above.

[0164] The computer-readable storage medium provided in this application introduces an attention mechanism to increase the weight of important features. At the same time, the DeCharCNN-KAN model is used to perform preliminary classification of the scanned vulnerability categories. A new convolution method is combined to enhance the flexibility of the model's 6-layer convolution, and then combined with the KAN model for feature fusion to predict the recommended results for vulnerability handling, thereby improving the accuracy of vulnerability scanning report recommendations.

[0165] Through the description of the above embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform. Of course, they can also be implemented by hardware, but in many cases the former is a better embodiment. Based on this understanding, the technical solution of this application, or the part that contributes to the existing technology, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of this application.

[0166] Obviously, the embodiments described above are only some of the embodiments of the present application, rather than all of the embodiments. The preferred embodiments of the present application are given in the accompanying drawings, but they do not limit the patent scope of the present application. The present application can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application has been described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions described in the aforementioned specific embodiments, or to make equivalent replacements for some of the technical features therein. Any equivalent structure made using the contents of the present application specification and the accompanying drawings, directly or indirectly used in other related technical fields, is also within the scope of patent protection of the present application.

Claims

1. A remote scan miss report generation method, characterized in that: The steps include: receiving a missed scan report generation request sent by a user terminal, wherein the missed scan report generation request includes target database identification information; Reading a target database corresponding to the target database identification information, and obtaining historical data of remote missed scan results in the target database; Inputting the historical data of the remote vulnerability scanning results into the pre-trained model to perform vulnerability type identification operation to obtain a vulnerability type identification result; Perform a weight optimization operation on the vulnerability type identification result according to the attention mechanism to obtain an attention value; Performing a feature fusion operation on the attention value to obtain feature fusion data; Calling a KAN model, and inputting the feature fusion data into the KAN model to perform a suggestion prediction operation, thereby obtaining a suggestion prediction result; Generate a vulnerability scan report based on the suggested prediction result, and output the vulnerability scan report to the user terminal; The step of performing a weight optimization operation on the vulnerability type identification result according to the attention mechanism to obtain an attention value specifically includes the following steps: Calculate the weight coefficient of the vulnerability type identification result according to the attention mechanism; performing a normalization operation on the weight coefficients, and performing a weight mapping operation on the normalized weight coefficients to obtain weight mapping data; A weighted sum operation is performed on the vulnerability type identification results according to the weight mapping data to obtain the attention value.

2. The remote scan missed report generation method according to claim 1, characterized in that: After the step of reading the target database corresponding to the target database identification information and obtaining historical data of remote vulnerability scanning results in the target database, and before the step of inputting the historical data of the remote vulnerability scanning results into a pre-trained model to perform a vulnerability type identification operation and obtain a vulnerability type identification result, the following step is also included: Performing a preprocessing operation on the historical data of the remote missed scanning result to obtain preprocessed historical data; The step of inputting the historical data of the remote vulnerability scanning result into the pre-trained model to perform vulnerability type identification operation to obtain the vulnerability type identification result specifically includes the following steps: The pre-processed historical data is input into a pre-trained model to perform a vulnerability type identification operation to obtain the vulnerability type identification result.

3. The remote scan missed report generation method according to claim 1, characterized in that: The step of inputting the historical data of the remote vulnerability scanning result into the pre-trained model to perform vulnerability type identification operation to obtain the vulnerability type identification result specifically includes the following steps: Integrating the historical data of the remote missed scanning results into a data set, and marking the data set to obtain a marked data set; Performing a feature vector conversion operation on the labeled data set to obtain feature vector data; Inputting the feature vector data into the convolutional layer of the DeCharCNN model to perform a first feature extraction operation to obtain first feature extracted data; Inputting the first feature extraction data into the pooling layer of the DeCharCNN model to perform a second feature extraction operation to obtain second feature extraction data; performing feature integration processing on the first feature extraction data and the second feature extraction data to obtain integrated feature extraction data; The integrated feature data is input into the fully connected layer to perform a vulnerability type identification operation to obtain the vulnerability type identification result.

4. The remote scan missed report generation method according to claim 1, characterized in that: The step of calling the KAN model and inputting the feature fusion data into the KAN model to perform a suggestion prediction operation to obtain a suggestion prediction result specifically includes the following steps: Performing a nonlinear activation operation on the feature fusion data according to the activation layer of the KAN model to obtain a nonlinear activation function; Constructing a function matrix according to the nonlinear activation function; A prediction mapping operation is performed on the feature fusion data according to the function matrix to obtain the suggested prediction result.

5. A remote scan miss report generating device, characterized in that: include: a request receiving module, configured to receive a missed scan report generation request sent by a user terminal, wherein the missed scan report generation request includes target database identification information; A historical data acquisition module is used to read the target database corresponding to the target database identification information and obtain historical data of remote missed scanning results in the target database; A vulnerability type identification module is used to input the historical data of the remote vulnerability scanning results into a pre-trained model to perform a vulnerability type identification operation to obtain a vulnerability type identification result; A weight optimization module is used to perform a weight optimization operation on the vulnerability type identification result according to the attention mechanism to obtain an attention value; A feature fusion module, configured to perform a feature fusion operation on the attention value to obtain feature fusion data; A suggestion prediction module is used to call the KAN model and input the feature fusion data into the KAN model to perform a suggestion prediction operation to obtain a suggestion prediction result; A report generation module, configured to generate a vulnerability scanning report based on the suggested prediction result, and output the vulnerability scanning report to the user terminal; The weight optimization module includes: a weight coefficient calculation submodule, a normalization submodule and a weighted summation submodule, wherein: A weight coefficient calculation submodule, used to calculate the weight coefficient of the vulnerability type identification result according to the attention mechanism; A normalization submodule, configured to perform a normalization operation on the weight coefficients and perform a weight mapping operation on the normalized weight coefficients to obtain weight mapping data; A weighted summation submodule is used to perform a weighted summation operation on the vulnerability type identification results according to the weight mapping data to obtain the attention value.

6. The remote missed scan report generating device according to claim 5, characterized in that: The device further includes: a pre-processing module, and the vulnerability type identification module includes: a vulnerability type identification submodule, wherein: The preprocessing module is used to perform a preprocessing operation on the historical data of the remote missed scanning result to obtain preprocessed historical data; The vulnerability type identification submodule is used to input the pre-processed historical data into a pre-trained model to perform a vulnerability type identification operation to obtain the vulnerability type identification result.

7. The remote scan missed report generating device according to claim 5, characterized in that: The vulnerability type identification module includes: a marked data acquisition submodule, configured to integrate the historical data of the remote missed scan results into a data set, and perform marking processing on the data set to obtain a marked data set; A feature vector conversion submodule, configured to perform a feature vector conversion operation on the labeled data set to obtain feature vector data; A first feature extraction submodule is used to input the feature vector data into the convolution layer of the DeCharCNN model to perform a first feature extraction operation to obtain first feature extracted data; A second feature extraction submodule is used to input the first feature extraction data into the pooling layer of the DeCharCNN model to perform a second feature extraction operation to obtain second feature extraction data; a feature integration submodule, configured to perform feature integration processing on the first feature extraction data and the second feature extraction data to obtain integrated feature extraction data; The vulnerability type identification submodule is used to input the integrated feature data into the fully connected layer to perform a vulnerability type identification operation to obtain the vulnerability type identification result.

8. A computer device comprising a memory and a processor, characterized in that: The memory stores computer-readable instructions, and when the processor executes the computer-readable instructions, the steps of the remote missed scan report generation method according to any one of claims 1 to 4 are implemented.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the remote missed scan report generation method according to any one of claims 1 to 4.

Images