Security defense method based on AI algorithm

Abstract

The invention relates to the technical field of computer security defense, and particularly discloses an AI algorithm-based security defense method, which comprises the following steps of: regularly scanning a computer system by using a vulnerability scanning tool to detect vulnerabilities in the system; the CVSS score of the vulnerability is calculated, a DAST tool is used for testing during system running, and the specific trigger point number, the influenced function number, the resource occupancy rate, the data leakage index and the remote code execution degree of the vulnerability are obtained; analyzing the vulnerability operation data tested by the vulnerability test unit to obtain a vulnerability severity index; the safety of the system can be obviously improved, and the risk management capability of an enterprise can be enhanced. Through regular security assessment, potential safety hazards can be found and repaired in time, the attack risk is reduced, and sensitive data and service continuity are protected. By continuously improving the detection technology and the analysis capability, the enterprise can keep an active position in safety protection, and the safety and integrity of information assets of the enterprise are ensured.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer security defense and relates to a security defense method based on AI algorithm. Background Art

[0002] Vulnerability monitoring plays a vital role in modern information security, and its importance and necessity are mainly reflected in several aspects. First, with the rapid development of information technology, enterprises and organizations are increasingly dependent on digital systems. The existence of any vulnerability may lead to serious security incidents, resulting in economic losses and reputation damage. Vulnerability monitoring can help timely discover security risks in the system, prevent potential attack risks, and ensure the stability of the system and the integrity of the data. Secondly, compliance requirements are becoming increasingly stringent. Many industry regulations and standards (such as GDPR, HIPAA, etc.) require organizations to have effective vulnerability management mechanisms to protect sensitive information and user privacy. Through continuous vulnerability monitoring, enterprises can meet these compliance requirements and avoid legal risks. In addition, vulnerability monitoring can also improve the security awareness and response capabilities of organizations, enabling them to take quick measures and reduce losses when security incidents occur.

[0003] However, despite the importance of vulnerability monitoring, current technologies still have some defects and drawbacks. First, many vulnerability scanning tools are inadequate in detecting new and complex vulnerabilities. They often rely on known vulnerability databases for matching and cannot effectively identify unknown threats or zero-day vulnerabilities. Second, false positives and false negatives are still common. False positives cause security teams to waste a lot of time on insignificant issues, while false negatives may cause real threats to be ignored. In addition, existing vulnerability monitoring technologies usually require high professional skills and experience to configure and manage, which may be a considerable challenge for small and medium-sized enterprises. Insufficient automation is also a key issue. Many tools still require a lot of manual intervention to analyze and process detection results, which increases time and labor costs. Finally, with the development of cloud computing and the Internet of Things, the network environment has become more complex and dynamic, which has put higher requirements on traditional vulnerability monitoring technologies. Existing tools often find it difficult to adapt to such changes, resulting in poor monitoring results. Therefore, although vulnerability monitoring technology is constantly improving, it still needs to be improved in terms of accuracy, automation, and adaptability to better cope with increasingly complex security challenges. Summary of the invention

[0004] In view of the above problems existing in the prior art, the present invention provides a security defense method based on AI algorithm to solve the above technical problems.

[0005] In order to achieve the above purpose and other purposes, the technical solution adopted by the present invention is as follows: On the one hand, the present invention provides a security defense method based on an AI algorithm, the method comprising the following steps: Use vulnerability scanning tools to regularly scan computer systems, detect vulnerabilities in the system, and classify and number them; Calculate the CVSS score of the vulnerability and use the DAST tool to test it while the system is running to obtain the specific number of trigger points, number of affected functions, resource usage, data leakage index, and remote code execution degree of the vulnerability; Analyze the vulnerability operation data tested by the vulnerability testing unit to obtain the vulnerability severity index.

[0006] Detect vulnerabilities in the system. The specific detection process is as follows: First, the preparation phase includes selecting the appropriate vulnerability scanning tool and configuring it according to the system's operating environment and security requirements. Next, define the scan scope and identify the network segments, IP addresses, hosts, and applications that need to be scanned to ensure that all potential vulnerability points are fully covered. Then, perform initial settings, including configuring the scan strategy, which is divided into deep scan and quick scan, and selecting the update frequency of the vulnerability database to ensure that the scanning tool can identify the latest vulnerabilities. During the scan execution phase, the scanning tool is started, the scanning progress is monitored in real time, and the scanning log is recorded; the scanning tool simulates the attacker's behavior to actively detect open ports, service versions, and configuration errors in the system to identify known security vulnerabilities; at the same time, the scan results are analyzed and verified to eliminate false positives and ultimately determine the vulnerabilities in the system.

[0007] Calculate the CVSS score of the vulnerability. The specific calculation process is: Obtain attribute information of the vulnerability, where the attribute information includes attack vector AV, attack complexity AC, permission requirement PR, user interaction UI, impact range S, confidentiality impact C, integrity impact I, and availability impact A; The impact range S is divided into unchanged and changed values, and the impact range of the vulnerability is calculated from this. , ; Calculate the exploitability of the vulnerability = 8.22 × AV × AC × PR × UI; The CVSS score of the vulnerability is calculated from this , CVSS' is the CVSS score of the vulnerability.

[0008] Get the specific number of trigger points of the vulnerability. The specific process is as follows: Use DAST tools to perform system runtime testing to obtain the specific number of vulnerability trigger points. First, you need to install and configure DAST tools, such as OWASP ZAP or Burp Suite, and make sure the target application is running and accessible; Next, enter the target application URL in the tool, configure the scan options and authentication information, and then start the scan; After the scan is complete, review the generated report, identify all vulnerability types and their specific trigger points, record the number of trigger points for each vulnerability, and summarize the total number.

[0009] Get the number of functions affected by the vulnerability. The specific calculation process is: To obtain the number of affected functions of the vulnerability, first use the DAST tool to perform a comprehensive scan of the application to identify all potential vulnerabilities; Next, analyze the scan report and map each vulnerability to a specific functional module, usually by looking at the URL or request path where the vulnerability is located; Then, the mapped functional modules are deduplicated and counted to ensure that each function is counted only once. Finally, the number of functional modules after deduplication is summarized, which is the number of affected functions.

[0010] Get the resource occupancy rate of the vulnerability. The specific calculation process is: Measure the system's resource usage without exploits; In the case where the vulnerability is exploited, measure the system's resource usage again; Use the following formula to calculate the resource usage of the vulnerability: 00%.

[0011] Get the data leakage index of the vulnerability. The specific calculation process is: According to the analysis formula: correspond The calculation formula is as above.

[0012] Get the remote code execution degree of the vulnerability. The specific calculation process is: According to the analysis formula: The calculation formula for the remote code execution degree of the corresponding vulnerability is as above.

[0013] Get the vulnerability severity index. The specific calculation process is as follows: Set weights for the vulnerability's CVSS score, number of specific trigger points, number of affected functions, resource usage, data leakage index, and remote code execution degree; The CVSS score, number of specific trigger points, number of affected functions, resource usage, data leakage index, and remote code execution degree of the vulnerability are standardized to the same scale; A weighted composite formula is then used to calculate the vulnerability severity index: The calculation formula for the corresponding vulnerability severity index is as above, where ω1, ω2, ω3, ω4, ω5 and ω6 represent preset weights respectively.

[0014] As described above, the security defense method based on AI algorithm provided by the present invention has at least the following beneficial effects: The present invention provides a security defense method based on AI algorithm, which regularly uses vulnerability scanning tools to scan computer systems and calculate the CVSS scores of vulnerabilities. At the same time, it combines DAST tools to test the number of specific trigger points of vulnerabilities, the number of affected functions, resource occupancy, data leakage index and remote code execution degree when the system is running, which has significant benefits and necessity for improving system security. First of all, this multi-level detection method can provide a comprehensive security assessment. Through regular scanning and CVSS scoring, enterprises can promptly identify and prioritize known vulnerabilities in the system, so as to effectively allocate resources for repair. CVSS scoring provides a standardized indicator to help security teams quickly determine the severity and potential impact of vulnerabilities.

[0015] Secondly, using DAST tools to test while the system is running can dynamically identify security issues in the actual operation of the application. By detecting the specific trigger points and affected functions of the vulnerability, the security team can gain a deeper understanding of the actual impact of the vulnerability and develop a more targeted repair strategy. The analysis of resource utilization and data leakage index helps to evaluate the specific threats of the vulnerability to system performance and data security, ensuring that the normal operation of the system is not affected during the repair process.

[0016] In addition, the evaluation of remote code execution can help identify vulnerabilities that may be exploited by attackers to execute malicious code, and take precautions in advance to prevent attackers from gaining control of the system through vulnerabilities. Analyzing the vulnerability operation data tested by the vulnerability test unit and obtaining the vulnerability severity index can provide enterprises with a comprehensive security situation awareness and help management make more informed security decisions.

[0017] This comprehensive vulnerability detection and analysis approach can not only significantly improve the security of the system, but also enhance the risk management capabilities of the enterprise. Through regular security assessments, enterprises can promptly discover and repair security risks, reduce the risk of being attacked, and protect sensitive data and business continuity. In addition, this approach also helps to meet various security compliance requirements and avoid legal liability and economic losses caused by data leakage or system failure. In today's complex network environment, a single security measure is often not enough to resist the ever-changing security threats. Therefore, the use of multi-level vulnerability detection and analysis methods is a necessary means to ensure system security. By continuously improving detection technology and analysis capabilities, enterprises can maintain a proactive position in security protection and ensure the security and integrity of their information assets. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for describing the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0019] Figure 1 It is a schematic diagram of the connection of each step of the method of the present invention. DETAILED DESCRIPTION

[0020] The above contents in combination with the implementation of the present invention are merely examples and explanations of the concept of the present invention. The technical personnel in the relevant technical field may make various modifications or supplements to the specific embodiments described or replace them in a similar manner. As long as they do not deviate from the concept of the invention or exceed the scope defined by the claims, they shall all fall within the protection scope of the present invention. Example

[0021] See also Figure 1 As shown, a security defense method based on AI algorithm includes the following steps: Use vulnerability scanning tools to regularly scan computer systems, detect vulnerabilities in the system, and classify and number them; Calculate the CVSS score of the vulnerability and use the DAST tool to test it while the system is running to obtain the specific number of trigger points, number of affected functions, resource usage, data leakage index, and remote code execution degree of the vulnerability; Analyze the vulnerability operation data tested by the vulnerability testing unit to obtain the vulnerability severity index.

[0022] Detect vulnerabilities in the system. The specific detection process is as follows: First, the preparation phase includes selecting the appropriate vulnerability scanning tool and configuring it according to the system's operating environment and security requirements. Next, define the scan scope and identify the network segments, IP addresses, hosts, and applications that need to be scanned to ensure that all potential vulnerability points are fully covered. Then, perform initial settings, including configuring the scan strategy, which is divided into deep scan and quick scan, and selecting the update frequency of the vulnerability database to ensure that the scanning tool can identify the latest vulnerabilities. During the scan execution phase, the scanning tool is started, the scanning progress is monitored in real time, and the scanning log is recorded; the scanning tool simulates the attacker's behavior to actively detect open ports, service versions, and configuration errors in the system to identify known security vulnerabilities; at the same time, the scan results are analyzed and verified to eliminate false positives and ultimately determine the vulnerabilities in the system.

[0023] Calculate the CVSS score of the vulnerability. The specific calculation process is: Obtain attribute information of the vulnerability, where the attribute information includes attack vector AV, attack complexity AC, permission requirement PR, user interaction UI, impact range S, confidentiality impact C, integrity impact I, and availability impact A; The impact range S is divided into unchanged and changed values, and the impact range of the vulnerability is calculated from this. , ; Calculate the exploitability of the vulnerability = 8.22 × AV × AC × PR × UI; The CVSS score of the vulnerability is calculated from this , CVSS' is the CVSS score of the vulnerability.

[0024] Get the specific number of trigger points of the vulnerability. The specific process is as follows: Use DAST tools to perform system runtime testing to obtain the specific number of vulnerability trigger points. First, you need to install and configure DAST tools, such as OWASP ZAP or Burp Suite, and make sure the target application is running and accessible; Next, enter the target application URL in the tool, configure the scan options and authentication information, and then start the scan; After the scan is complete, review the generated report, identify all vulnerability types and their specific trigger points, record the number of trigger points for each vulnerability, and summarize the total number.

[0025] Get the number of functions affected by the vulnerability. The specific calculation process is: To obtain the number of affected functions of the vulnerability, first use the DAST tool to perform a comprehensive scan of the application to identify all potential vulnerabilities; Next, analyze the scan report and map each vulnerability to a specific functional module, usually by looking at the URL or request path where the vulnerability is located; Then, the mapped functional modules are deduplicated and counted to ensure that each function is counted only once. Finally, the number of functional modules after deduplication is summarized, which is the number of affected functions.

[0026] Get the resource occupancy rate of the vulnerability. The specific calculation process is: Measure the system's resource usage without exploits; In the case where the vulnerability is exploited, the system's resource usage is measured again; Use the following formula to calculate the resource usage of the vulnerability: 00%.

[0027] Get the data leakage index of the vulnerability. The specific calculation process is: According to the analysis formula: correspond The calculation formula is as above.

[0028] Get the remote code execution degree of the vulnerability. The specific calculation process is: According to the analysis formula: The calculation formula for the remote code execution degree of the corresponding vulnerability is as above.

[0029] Get the vulnerability severity index. The specific calculation process is as follows: Set weights for the vulnerability's CVSS score, number of specific trigger points, number of affected functions, resource usage, data leakage index, and remote code execution degree; The CVSS score, number of specific trigger points, number of affected functions, resource usage, data leakage index, and remote code execution degree of the vulnerability are standardized to the same scale; A weighted composite formula is then used to calculate the vulnerability severity index: The calculation formula for the corresponding vulnerability severity index is as above, where ω1, ω2, ω3, ω4, ω5 and ω6 represent preset weights respectively.

[0030] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0031] It should be understood that determining B based on A does not mean determining B only based on A. B can also be determined based on A and / or other information.

[0032] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0033] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A security defense method based on AI algorithm, characterized in that: The method comprises the following steps: Use vulnerability scanning tools to scan computer systems regularly to detect vulnerabilities in the system; Calculate the CVSS score of the vulnerability and use the DAST tool to test it while the system is running to obtain the specific number of trigger points, number of affected functions, resource usage, data leakage index, and remote code execution degree of the vulnerability; Analyze the vulnerability operation data tested by the vulnerability testing unit to obtain the vulnerability severity index.

2. According to the security defense method based on AI algorithm in claim 1, it is characterized in that: Detect vulnerabilities in the system. The specific detection process is as follows: First, the preparation phase includes selecting the appropriate vulnerability scanning tool and configuring it according to the system's operating environment and security requirements. Next, define the scan scope and identify the network segments, IP addresses, hosts, and applications that need to be scanned to ensure that all potential vulnerability points are fully covered. Then, perform initial settings, including configuring the scan strategy, which is divided into deep scan and quick scan, and selecting the update frequency of the vulnerability database to ensure that the scanning tool can identify the latest vulnerabilities. During the scan execution phase, the scanning tool is started, the scanning progress is monitored in real time, and the scanning log is recorded; the scanning tool simulates the attacker's behavior to actively detect open ports, service versions, and configuration errors in the system to identify known security vulnerabilities; at the same time, the scan results are analyzed and verified to eliminate false positives and ultimately determine the vulnerabilities in the system.

3. According to the security defense method based on AI algorithm in claim 1, it is characterized in that: Calculate the CVSS score of the vulnerability. The specific calculation process is: Obtain attribute information of the vulnerability, where the attribute information includes attack vector AV, attack complexity AC, permission requirement PR, user interaction UI, impact range S, confidentiality impact C, integrity impact I, and availability impact A; The impact range S is divided into unchanged and changed values, and the impact range of the vulnerability is calculated from this. , ; Calculate the exploitability of the vulnerability = 8.22 × AV × AC × PR × UI; The CVSS score of the vulnerability is calculated from this , CVSS' is the CVSS score of the vulnerability.

4. The security defense method based on AI algorithm according to claim 1, characterized in that: Get the specific number of trigger points of the vulnerability. The specific process is as follows: Use DAST tools to perform system runtime testing to obtain the specific number of vulnerability trigger points. First, you need to install and configure DAST tools, such as OWASP ZAP or Burp Suite, and make sure the target application is running and accessible; Next, enter the target application URL in the tool, configure the scan options and authentication information, and then start the scan; After the scan is complete, review the generated report, identify all vulnerability types and their specific trigger points, record the number of trigger points for each vulnerability, and summarize the total number.

5. The security defense method based on AI algorithm according to claim 1 is characterized in that: Get the number of functions affected by the vulnerability. The specific calculation process is: To obtain the number of affected functions of the vulnerability, first use the DAST tool to perform a comprehensive scan of the application to identify all potential vulnerabilities; Next, analyze the scan report and map each vulnerability to a specific functional module, usually by looking at the URL or request path where the vulnerability is located; Then, the mapped functional modules are deduplicated and counted to ensure that each function is counted only once. Finally, the number of functional modules after deduplication is summarized, which is the number of affected functions.

6. The security defense method based on AI algorithm according to claim 1, characterized in that: Get the resource occupancy rate of the vulnerability. The specific calculation process is: Measure the system's resource usage without exploits; In the case where the vulnerability is exploited, measure the system's resource usage again; Use the following formula to calculate the resource usage of the vulnerability: 00%。 7. The security defense method based on AI algorithm according to claim 1, characterized in that: Get the data leakage index of the vulnerability. The specific calculation process is: According to the analysis formula: correspond The calculation formula is as above.

8. The security defense method based on AI algorithm according to claim 1, characterized in that: Get the remote code execution degree of the vulnerability. The specific calculation process is: According to the analysis formula: The calculation formula for the remote code execution degree of the corresponding vulnerability is as above.

9. The security defense method based on AI algorithm according to claim 1, characterized in that: Get the vulnerability severity index. The specific calculation process is as follows: Set weights for the vulnerability's CVSS score, number of specific trigger points, number of affected functions, resource usage, data leakage index, and remote code execution degree; The CVSS score, number of specific trigger points, number of affected functions, resource usage, data leakage index, and remote code execution degree of the vulnerability are standardized to the same scale; A weighted composite formula is then used to calculate the vulnerability severity index: The calculation formula for the corresponding vulnerability severity index is as above, where ω1, ω2, ω3, ω4, ω5 and ω6 represent preset weights respectively.

Images