Vulnerability analyzing and repairing method of self-made system

Abstract

The invention relates to the technical field of computer software security analysis, and discloses a bug analysis and repair method of a self-made system, which comprises the following steps: S1, collecting bug related data from a system operation log and a user operation record; performing cleaning, standardization and feature extraction on the collected data to generate feature vectors for vulnerability analysis; s2, training a preliminary vulnerability detection model in a local system by using the feature vector; performing disturbance encryption on model parameters by using a differential privacy technology; s3, transmitting the encrypted local model parameters to a central server; the central server aggregates the local model parameters through a federated average algorithm to generate a global optimization model; s4, transmitting the global optimization model to each local system; and S5, scanning local system vulnerabilities by using the optimized model, and performing risk assessment and classification. According to the invention, the federated learning and differential privacy technology is introduced, so that the leakage hidden danger in the data transmission process is ingeniously avoided.

Description

Technical Field

[0001] The present invention relates to the technical field of computer software security analysis, and in particular to a vulnerability analysis and repair method for a self-made system. Background Art

[0002] With the rapid development of information technology, self-made systems have been widely used in many fields such as enterprises, industrial control, Internet of Things, medical care, finance, etc. However, due to the complexity of the system and the diversity of the operating environment, the potential security vulnerabilities in these systems have become a key factor threatening information security.

[0003] Traditional centralized vulnerability detection methods require uploading local system logs, operation data or behavior records to a central server for analysis. However, these data often contain sensitive information (such as user identity, access records, operation logs, etc.), which may lead to privacy leakage if attacked during transmission or storage. Summary of the invention

[0004] In order to make up for the above shortcomings, the present invention provides a vulnerability analysis and repair method for a homemade system, aiming to improve the problem that the traditional centralized vulnerability detection method needs to upload the local system logs, operation data or behavior records to the central server for analysis, which may lead to privacy leakage.

[0005] In a first aspect, the present invention provides the following technical solution, a vulnerability analysis and repair method for a self-made system, comprising the following steps:

[0006] S1. Data collection and processing

[0007] Collect vulnerability-related data from system operation logs and user operation records;

[0008] Clean, normalize and extract features from the collected data to generate feature vectors for vulnerability analysis;

[0009] S2. Local model training and parameter encryption

[0010] Use the feature vectors to train a preliminary vulnerability detection model in the local system;

[0011] Use differential privacy technology to encrypt the model parameters;

[0012] S3, federated model aggregation

[0013] Transmit the encrypted local model parameters to the central server;

[0014] The central server aggregates the local model parameters through the federated averaging algorithm to generate a global optimization model;

[0015] S4. Global model distribution and fine-tuning

[0016] Transmitting the global optimization model to each local system;

[0017] The local system fine-tunes the global model based on its own data to improve the model’s adaptability in the local environment;

[0018] S5. Vulnerability detection and repair

[0019] Use the optimized model to scan local system vulnerabilities for risk assessment and classification;

[0020] Generate a repair patch based on the vulnerability detection results and verify the patch;

[0021] Perform dynamic rollback when repair fails or produces side effects.

[0022] Preferably, the S1 data collection and processing includes:

[0023] Collect call sequences, abnormal behavior records, and user interaction data through a combination of real-time monitoring and batch analysis;

[0024] The principal component analysis (PCA) algorithm is used to reduce the dimension of the feature vector and reduce the interference of redundant information on model training.

[0025] Preferably, the S2 local model training and parameter encryption includes:

[0026] Use convolutional neural networks (CNNs) to extract vulnerability behavior patterns;

[0027] Use recurrent neural network (RNN) to capture abnormal features of time series;

[0028] Use the cross entropy loss function to optimize local model training:

[0029]

[0030] Among them, y i.c The true label of sample i in category c is 0 or 1. The predicted probability of sample i in category c is in the range of [0,1]. is the loss function, which is used to measure the error between the model prediction and the actual result. N is the total number of training samples, C is the total number of categories, and σ 2 is the variance of Gaussian noise;

[0031] Encrypt training parameters using differential privacy techniques:

[0032]

[0033] Among them, θ′ is the encrypted parameter, is Gaussian noise, and θ is the parameter of the local training model.

[0034] Preferably, the S3 federated model aggregation includes:

[0035] The central server receives the encrypted local model parameters and verifies their integrity;

[0036] Use the FedAvg algorithm to perform weighted aggregation on the parameters and generate a global optimization model:

[0037]

[0038] Among them, θ global is the global model parameter, w i The weight of the local model, which represents the contribution weight of each participant in the federated averaging algorithm;

[0039] Gaussian noise is added during the parameter aggregation process to enhance the privacy protection of the aggregation results.

[0040] Preferably, the S4 global model distribution and fine-tuning includes:

[0041] Use SSL / TLS protocol to encrypt and transmit global model parameters to prevent tampering during transmission;

[0042] The local system combines transfer learning technology to use a small amount of local data to fine-tune the global model and improve its applicability in the local environment.

[0043] Preferably, the S5 vulnerability detection and repair includes:

[0044] Use the optimized federated model to perform vulnerability scanning, classify vulnerability types, and provide repair priority recommendations;

[0045] Automatically generate repair patches based on vulnerability types and perform functionality and security verification.

[0046] Preferably, the dynamic rollback operation includes:

[0047] Monitor abnormal conditions caused during patch repair;

[0048] Automatically restore the system to the safe state before repair and generate a rollback log.

[0049] In a second aspect, the present invention provides the following technical solution, a vulnerability analysis and repair system for a self-made system, comprising:

[0050] Data collection and processing module: used to collect logs, abnormal behavior records and user operation data from the local system, clean and extract features from the data, and generate feature vectors for vulnerability detection;

[0051] Local model training module: used to train a preliminary vulnerability detection model based on feature vectors, and use differential privacy technology to encrypt model parameters to generate encrypted local model parameters;

[0052] Federated model aggregation module: used to receive encrypted model parameters uploaded by multiple local systems, aggregate the parameters through the federated averaging algorithm, and add Gaussian noise during the aggregation process to generate a global optimization model;

[0053] Global model distribution module: used to distribute the global optimization model to the local system through encrypted transmission, and fine-tune the model locally in combination with transfer learning technology;

[0054] Vulnerability detection and repair module: used to use the optimized model to detect vulnerabilities in the local system, generate repair patches based on the detection results and verify the repair effect, and support dynamic rollback function to restore the system to a safe state when the repair fails.

[0055] In a third aspect, the invention provides the following technical solution: a computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the vulnerability analysis and repair method of the homemade system when executing the computer program.

[0056] In a fourth aspect, the present invention provides the following technical solution: a readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the vulnerability analysis and repair method of the homemade system.

[0057] The present invention has the following beneficial effects:

[0058] 1. In the present invention, by introducing federated learning and differential privacy technology, the risk of leakage in the process of data transmission is cleverly avoided; each local system only needs to upload encrypted model parameters without transmitting original data, thereby ensuring the localization of data processing; differential privacy technology further prevents malicious inference attacks by perturbing the uploaded model parameters; it is suitable for scenarios such as medical care, finance, and the Internet of Things that require high privacy protection, and realizes the security guarantee of distributed collaborative vulnerability management.

[0059] 2. In the present invention, the efficiency of system vulnerability management is greatly improved through the automated vulnerability detection and repair mechanism: relying on the optimized global model, the present invention can perform efficient real-time vulnerability scanning on the local system, quickly identify potential threats and conduct risk assessment; the system can automatically generate targeted repair patches according to the characteristics and types of the vulnerabilities, avoiding time delays and possible operational errors caused by manual intervention; after the repair is completed, the patch effect is fully verified through simulated attacks and automated testing; when the repair fails or an exception is caused, the system can automatically trigger the rollback mechanism to restore the system to a stable state before the repair to avoid affecting the normal operation of the business.

[0060] 3. In the present invention, the collaborative optimization among multiple systems is realized through the federated learning technology. The encryption model parameters uploaded by each participating system are aggregated in the central server, and the global model is generated by the federated averaging algorithm, which effectively improves the generalization ability of the model. After the global model is distributed to the local system, it is fine-tuned in combination with local data through transfer learning technology, thereby further improving the adaptability of the model in the local environment. The federated learning mechanism supports periodic model parameter updates, and can dynamically optimize the global model according to newly discovered vulnerabilities to ensure that the model performance is always in the optimal state. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 A method flow chart of the vulnerability analysis and repair method of the self-made system proposed by the present invention;

[0062] Figure 2 This is a system architecture diagram of the vulnerability analysis and repair system of the self-made system proposed by the present invention;

[0063] Figure 3 This is a federated model aggregation flow chart of the vulnerability analysis and repair method for the homemade system proposed in the present invention. DETAILED DESCRIPTION

[0064] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0065] Embodiment 1

[0066] Reference Figure 1 and Figure 3 In a first embodiment of the present invention, the present invention provides a vulnerability analysis and repair method for a self-made system, comprising the following steps:

[0067] S1. Data collection and processing

[0068] Collect vulnerability-related data from system operation logs and user operation records;

[0069] Clean, normalize and extract features from the collected data to generate feature vectors for vulnerability analysis;

[0070] S2. Local model training and parameter encryption

[0071] Use the feature vectors to train a preliminary vulnerability detection model in the local system;

[0072] Use differential privacy technology to encrypt the model parameters;

[0073] S3, federated model aggregation

[0074] Transmit the encrypted local model parameters to the central server;

[0075] The central server aggregates the local model parameters through the federated averaging algorithm to generate a global optimization model;

[0076] S4. Global model distribution and fine-tuning

[0077] Transmitting the global optimization model to each local system;

[0078] The local system fine-tunes the global model based on its own data to improve the model’s adaptability in the local environment;

[0079] S5. Vulnerability detection and repair

[0080] Use the optimized model to scan local system vulnerabilities for risk assessment and classification;

[0081] Generate a repair patch based on the vulnerability detection results and verify the patch;

[0082] Perform dynamic rollback when repair fails or produces side effects.

[0083] Specifically, the present invention effectively solves the risk of data privacy leakage in traditional centralized vulnerability analysis methods by introducing federated learning technology and differential privacy protection mechanism in a multi-system collaborative environment. Specifically:

[0084] Each local system only needs to upload the encrypted model parameters, completely avoiding the privacy leakage that may be caused by the transmission of original data. It is particularly suitable for highly sensitive data scenarios such as medical care, finance, and the Internet of Things.

[0085] The federated learning framework enables model collaboration among multiple systems. The central server generates a global optimization model by aggregating encrypted parameters uploaded locally, thereby significantly improving the accuracy of vulnerability detection and the generalization ability of the model.

[0086] After the global model is distributed to the local system, it is fine-tuned using transfer learning technology combined with local data, allowing the model to adapt to the needs of specific environments, further improving detection results and system adaptability.

[0087] S1 data acquisition and processing includes:

[0088] Collect call sequences, abnormal behavior records, and user interaction data through a combination of real-time monitoring and batch analysis;

[0089] The principal component analysis (PCA) algorithm is used to reduce the dimension of the feature vector and reduce the interference of redundant information on model training.

[0090] Specifically, S1 data collection and processing

[0091] Log data collection

[0092] Source:

[0093] System call logs: such as file read, write, and execute operations.

[0094] Network log: records IP traffic, port scans, abnormal connections, etc.

[0095] User behavior logs: such as failed login records, repeated operation sequences, etc.

[0096] Collection tools:

[0097] Use an open source log collection framework such as Filebeat or Fluentd to collect logs in real time.

[0098] Collection method:

[0099] Real-time collection: monitor the system's key log directories and capture new or changed log files.

[0100] Batch collection: Scan system log files regularly and extract data within a specified time range.

[0101] Data cleaning

[0102] Processing steps:

[0103] Remove duplicate log entries to reduce redundant information.

[0104] Extract key fields (such as timestamp, event type, operation object) through regular expressions.

[0105] Use anomaly detection algorithms to flag noisy data (such as data points with unusually high frequency spikes).

[0106] Tool implementation:

[0107] Use Python to write data cleaning scripts and combine them with the Pandas library to process large-scale log data.

[0108] Feature extraction

[0109] Extract dimensions:

[0110] Time dimension: such as operation interval and event frequency.

[0111] Behavioral pattern dimension: such as abnormal call chains and specific operation combinations.

[0112] Method implementation:

[0113] Use time series analysis tools such as the statsmodels library to extract time-dependent features.

[0114] Convert the behavior pattern into a feature vector and use the bag-of-words model or TF-IDF to digitize the operation sequence.

[0115] S2 local model training and parameter encryption include:

[0116] Use convolutional neural networks (CNNs) to extract vulnerability behavior patterns;

[0117] Use recurrent neural network (RNN) to capture abnormal features of time series;

[0118] Use the cross entropy loss function to optimize local model training:

[0119]

[0120] Among them, y i.c The true label of sample i in category c is 0 or 1. The predicted probability of sample i in category c is in the range of [0,1]. is the loss function, which is used to measure the error between the model prediction and the actual result. N is the total number of training samples, C is the total number of categories, and σ 2 is the variance of Gaussian noise;

[0121] Encrypt training parameters using differential privacy techniques:

[0122]

[0123] Among them, θ′ is the encrypted parameter, is Gaussian noise, and θ is the parameter of the local training model.

[0124] Specifically, S2 local model training and parameter encryption

[0125] Model building

[0126] Input: data feature vector, in the form of [x1,x2,…,xn], where each feature corresponds to a dimension.

[0127] Model Architecture:

[0128] Input layer: accepts a feature vector of dimension n.

[0129] Hidden Layer:

[0130] Use convolutional neural network (CNN) to extract vulnerability behavior features.

[0131] Use Recurrent Neural Network (RNN) to capture time series characteristics.

[0132] Output layer: multiple classifiers, output vulnerability types and their confidence levels.

[0133] Optimization goal: minimize the loss function:

[0134]

[0135] Among them, y i，c The true label of sample i in category c is 0 or 1. The predicted probability of sample i in category c is in the range of [0,1]. is the loss function, which is used to measure the error between the model prediction and the actual result. N is the total number of training samples, C is the total number of categories, and σ 2 is the variance of Gaussian noise;

[0136] Model Training

[0137] Algorithm selection: Use Adam optimizer to adjust learning rate and gradient updates.

[0138] Data division: The training set and validation set are divided into 7:3 to prevent overfitting.

[0139] Training tools: implemented using a deep learning framework such as TensorFlow or PyTorch.

[0140] Parameter encryption

[0141] Encryption method: Using differential privacy technology:

[0142]

[0143] Among them, θ′ is the encrypted parameter, is Gaussian noise, and θ is the parameter of the local training model.

[0144] Implementation method:

[0145] Add independent Gaussian noise to each parameter;

[0146] The noise intensity is given by the variance σ 2 Controls to ensure a balance between privacy and model performance.

[0147] S3 federation model aggregation includes:

[0148] The central server receives the encrypted local model parameters and verifies their integrity;

[0149] Use the FedAvg algorithm to perform weighted aggregation on the parameters and generate a global optimization model:

[0150]

[0151] Among them, θ global is the global model parameter, ω i The weight of the local model, which represents the contribution weight of each participant in the federated averaging algorithm;

[0152] Gaussian noise is added during the parameter aggregation process to enhance the privacy protection of the aggregation results.

[0153] Specific, parameter upload

[0154] Encrypted transmission: The encrypted local model parameters are uploaded to the central server via the SSL / TLS protocol to ensure transmission security.

[0155] Federated Averaging Algorithm

[0156] Implementation:

[0157] The central server receives encryption parameters from all local systems;

[0158] The model parameters are aggregated as follows:

[0159]

[0160] Among them, θ global is the global model parameter, ω i The weight of the local model, which represents the contribution weight of each participant in the federated averaging algorithm;

[0161] Enhanced privacy protection: Gaussian noise is added after aggregation to further protect the privacy of global parameters.

[0162] Aggregation tools

[0163] Use a distributed computing framework (such as Apache Spark or Ray) to process the aggregation task of model parameters to improve efficiency.

[0164] S4 global model distribution and fine-tuning include:

[0165] Use SSL / TLS protocol to encrypt and transmit global model parameters to prevent tampering during transmission;

[0166] The local system combines transfer learning technology to use a small amount of local data to fine-tune the global model and improve its applicability in the local environment.

[0167] Specifically, model distribution

[0168] Encrypted transmission: Global model parameters are transmitted to each local system using the SSL / TLS protocol.

[0169] Version control: Manage different iterations of the global model through model version numbers to ensure consistency.

[0170] Local fine-tuning

[0171] Transfer Learning:

[0172] Freeze some parameters of the global model and only adjust the local relevant layers.

[0173] Use a small amount of local data for fine-tuning and optimize local adaptability.

[0174] Implementation:

[0175] Fine-tuning the model using PyTorch’s Fine-Tuning tool.

[0176] S5 vulnerability detection and repair includes:

[0177] Use the optimized federated model to perform vulnerability scanning, classify vulnerability types, and provide repair priority recommendations;

[0178] Automatically generate repair patches based on vulnerability types and perform functionality and security verification.

[0179] Dynamic rollback operations include:

[0180] Monitor abnormal conditions caused during patch repair;

[0181] Automatically restore the system to the safe state before repair and generate a rollback log.

[0182] Specifically, vulnerability detection

[0183] Scanning method: Input system logs into the optimized model in real time, and output vulnerability types and risk assessment results.

[0184] Risk ranking:

[0185] Generate a priority list based on vulnerability confidence and impact scope.

[0186] Fix patch generation

[0187] Patch creation:

[0188] Generate customized remediation scripts using vulnerability description information;

[0189] Supports multi-platform compatibility.

[0190] Patch Verification:

[0191] Simulate attacks to verify patch effectiveness;

[0192] Automated testing of the functional integrity of the repaired system.

[0193] Dynamic rollback

[0194] Trigger conditions:

[0195] Repair patch failure;

[0196] System performance fluctuates abnormally.

[0197] Rollback mechanism:

[0198] Quickly restore to the state before repair;

[0199] Automatically record rollback operation logs.

[0200] Embodiment 2:

[0201] Reference Figure 2 and Figure 3 In a second embodiment of the present invention, the present invention provides a vulnerability analysis and repair system for a self-made system, comprising:

[0202] Data collection and processing module: used to collect logs, abnormal behavior records and user operation data from the local system, clean and extract features from the data, and generate feature vectors for vulnerability detection;

[0203] Local model training module: used to train a preliminary vulnerability detection model based on feature vectors, and use differential privacy technology to encrypt model parameters to generate encrypted local model parameters;

[0204] Federated model aggregation module: used to receive encrypted model parameters uploaded by multiple local systems, aggregate the parameters through the federated averaging algorithm, and add Gaussian noise during the aggregation process to generate a global optimization model;

[0205] Global model distribution module: used to distribute the global optimization model to the local system through encrypted transmission, and fine-tune the model locally in combination with transfer learning technology;

[0206] Vulnerability detection and repair module: used to use the optimized model to detect vulnerabilities in the local system, generate repair patches based on the detection results and verify the repair effect, and support dynamic rollback function to restore the system to a safe state when the repair fails.

[0207] Specifically, 1.1 Data acquisition and processing module

[0208] Function: Used to collect vulnerability-related data from the local system in real time, clean the data and extract features, and provide high-quality input for subsequent vulnerability detection.

[0209] Module composition and functions:

[0210] Log collection submodule:

[0211] The collection sources include system call logs, user behavior records, and network traffic logs;

[0212] Monitor log directory changes in real time and collect new logs incrementally;

[0213] Supports multiple log formats, including text logs, JSON format, and binary logs.

[0214] Data cleaning submodule:

[0215] Format the collected data to remove redundant information and noise data;

[0216] Extract key fields such as action time, event type, and target resource.

[0217] Feature extraction submodule:

[0218] Analyze data for behavioral patterns, abnormal trends, and time series characteristics;

[0219] Generate standardized feature vectors to provide input data for subsequent training.

[0220] 1.2 Local Model Training Module

[0221] Function: Used to train vulnerability detection models using local data and encrypt the generated model parameters to protect data privacy.

[0222] Module composition and functions:

[0223] Model training submodule:

[0224] Use the standardized data to train a preliminary vulnerability detection model;

[0225] Output vulnerability type and its risk level prediction results.

[0226] Parameter encryption submodule:

[0227] The model parameters after training are perturbed and encrypted to ensure privacy and security when uploading to the server.

[0228] 1.3 Federated Model Aggregation Module

[0229] Function: Used to receive encrypted model parameters uploaded by multiple local systems, aggregate them to generate a global optimization model, and ensure the privacy protection of the model.

[0230] Module composition and functions:

[0231] Parameter receiving submodule:

[0232] Receive locally uploaded model parameters via a secure transmission protocol;

[0233] Verify the integrity and legality of parameter data to prevent tampering during transmission.

[0234] Model aggregation submodule:

[0235] Aggregate the parameters uploaded by each system to generate a globally optimized vulnerability detection model;

[0236] The privacy of all local models is ensured during the aggregation process.

[0237] 1.4 Global Model Distribution and Fine-tuning Module

[0238] Function: Used to securely distribute the global optimization model to each local system and fine-tune the model based on local data to adapt to the specific needs of the local environment.

[0239] Module composition and functions:

[0240] Model distribution submodule:

[0241] Use encryption protocols to securely transmit global models to prevent man-in-the-middle attacks or data leaks;

[0242] Provides version management function to ensure that each distributed model is traceable.

[0243] Model fine-tuning submodule:

[0244] Use a small amount of local data to fine-tune the global model and optimize the model's adaptability in the local environment;

[0245] Supports freezing some global model parameters and only adjusting the local relevant layers to reduce training time and resource consumption.

[0246] 1.5 Vulnerability Detection and Repair Module

[0247] Function: Use the optimized model to detect vulnerabilities in the local system, generate repair patches and verify the repair effects, while supporting dynamic rollback function.

[0248] Module composition and functions:

[0249] Vulnerability detection submodule:

[0250] Scan the local system for potential vulnerabilities, identify vulnerability types and assess their risk levels;

[0251] Generates priority ranking recommendations based on detection results.

[0252] Fix patch generation submodule:

[0253] Automatically generate vulnerability repair scripts to adapt to various system environments;

[0254] Support compatibility testing and effect evaluation of repair patches.

[0255] Fix the verification submodule:

[0256] Simulate common attack scenarios to verify the effectiveness of the repair patch;

[0257] Automatically test the functional integrity and stability of the repaired system.

[0258] Dynamic rollback submodule:

[0259] When the patch repair fails or causes system abnormality, it automatically restores to the state before the repair;

[0260] Record the log and detailed information of the rollback operation for subsequent analysis.

[0261] Embodiment 3

[0262] The third embodiment of the present invention is based on the same inventive concept and proposes a computer-readable storage medium. The computer-readable storage medium stores a computer program. When the computer program is executed by a processor, the steps of the vulnerability analysis and repair method of the homemade system of the above embodiment are implemented.

[0263] Embodiment 4

[0264] The fourth embodiment of the present invention is based on the same inventive concept. The present invention proposes a computer device, the terminal includes: a processor, a memory; the processor and the memory communicate with each other; the memory is used to store instructions; the processor is used to execute the instructions in the memory, and execute the vulnerability analysis and repair method of the homemade system of the above embodiment.

[0265] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0266] Finally, it should be noted that the above is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments or to make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A vulnerability analysis and repair method for a self-made system, characterized in that: The following steps are involved: S1. Data collection and processing Collect vulnerability-related data from system operation logs and user operation records; Clean, normalize and extract features from the collected data to generate feature vectors for vulnerability analysis; S2. Local model training and parameter encryption Use the feature vectors to train a preliminary vulnerability detection model in the local system; Use differential privacy technology to encrypt the perturbations of model parameters; S3, federated model aggregation Transmit the encrypted local model parameters to the central server; The central server aggregates the local model parameters through the federated averaging algorithm to generate a global optimization model; S4. Global model distribution and fine-tuning Transmitting the global optimization model to each local system; The local system fine-tunes the global model based on its own data to improve the model’s adaptability in the local environment; S5. Vulnerability detection and repair Use the optimized model to scan local system vulnerabilities for risk assessment and classification; Generate a repair patch based on the vulnerability detection results and verify the patch; Perform dynamic rollback when repair fails or produces side effects.

2. The vulnerability analysis and repair method of the self-made system according to claim 1 is characterized in that: The S1 data collection and processing includes: Collect call sequences, abnormal behavior records, and user interaction data through a combination of real-time monitoring and batch analysis; The principal component analysis (PCA) algorithm is used to reduce the dimension of the feature vector and reduce the interference of redundant information on model training.

3. The vulnerability analysis and repair method of the self-made system according to claim 1 is characterized in that: The S2 local model training and parameter encryption includes: Use convolutional neural networks (CNNs) to extract vulnerability behavior patterns; Use recurrent neural network (RNN) to capture abnormal features of time series; Use the cross entropy loss function to optimize local model training: Among them, y i.c The true label of sample i in category c is 0 or 1. The predicted probability of sample i in category c is in the range of [0,1]. is the loss function, which is used to measure the error between the model prediction and the actual result. N is the total number of training samples, C is the total number of categories, and σ 2 is the variance of Gaussian noise; Encrypt training parameters using differential privacy techniques: Among them, θ′ is the encrypted parameter, is Gaussian noise, and θ is the parameter of the local training model.

4. The vulnerability analysis and repair method of a self-made system according to claim 1, characterized in that: The S3 federation model aggregation includes: The central server receives the encrypted local model parameters and verifies their integrity; Use the FedAvg algorithm to perform weighted aggregation on the parameters and generate a global optimization model: Among them, θ global is the global model parameter, w i The weight of the local model, which represents the contribution weight of each participant in the federated averaging algorithm; Gaussian noise is added during the parameter aggregation process to enhance the privacy protection of the aggregation results.

5. The vulnerability analysis and repair method of a self-made system according to claim 1, characterized in that: The S4 global model distribution and fine-tuning includes: Use SSL / TLS protocol to encrypt and transmit global model parameters to prevent tampering during transmission; The local system combines transfer learning technology to use a small amount of local data to fine-tune the global model and improve its applicability in the local environment.

6. The vulnerability analysis and repair method of a self-made system according to claim 1, characterized in that: The S5 vulnerability detection and repair includes: Use the optimized federated model to perform vulnerability scanning, classify vulnerability types, and provide repair priority recommendations; Automatically generate repair patches based on vulnerability types and perform functionality and security verification.

7. The vulnerability analysis and repair method of a self-made system according to claim 1, characterized in that: The dynamic rollback operation includes: Monitor abnormal conditions caused during patch repair; Automatically restore the system to the safe state before repair and generate a rollback log.

8. A vulnerability analysis and repair system for a self-made system, characterized by: The vulnerability analysis and repair method for the self-made system according to any one of claims 1 to 7 comprises: Data collection and processing module: used to collect logs, abnormal behavior records and user operation data from the local system, clean and extract features from the data, and generate feature vectors for vulnerability detection; Local model training module: used to train a preliminary vulnerability detection model based on feature vectors, and use differential privacy technology to encrypt model parameters to generate encrypted local model parameters; Federated model aggregation module: used to receive encrypted model parameters uploaded by multiple local systems, aggregate the parameters through the federated averaging algorithm, and add Gaussian noise during the aggregation process to generate a global optimization model; Global model distribution module: used to distribute the global optimization model to the local system through encrypted transmission, and fine-tune the model locally in combination with transfer learning technology; Vulnerability detection and repair module: used to use the optimized model to detect vulnerabilities in the local system, generate repair patches based on the detection results and verify the repair effect, and support dynamic rollback function to restore the system to a safe state when the repair fails.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the vulnerability analysis and repair method of the homemade system as described in any one of claims 1 to 7 is implemented.

10. A readable storage medium, characterized in that: The readable storage medium stores a computer program, and when the computer program is executed by a processor, the vulnerability analysis and repair method for the homemade system according to any one of claims 1 to 7 is implemented.

Images