Vulnerability Analysis and Repair Methods for Homemade Systems

Abstract

The present invention relates to the technical field of computer software security analysis and discloses a vulnerability analysis and repair method for a self-made system, comprising the following steps: S1, collecting vulnerability-related data from system operation logs and user operation records; cleaning, normalizing, and feature extracting the collected data to generate a feature vector for vulnerability analysis; S2, using the feature vector to train a preliminary vulnerability detection model in the local system; utilizing differential privacy technology to perturb and encrypt the model parameters; S3, transmitting the encrypted local model parameters to a central server; the central server aggregates the local model parameters using a federated averaging algorithm to generate a global optimization model; S4, transmitting the global optimization model to each local system; and S5, using the optimized model to scan local system vulnerabilities for risk assessment and classification. In the present invention, by introducing federated learning and differential privacy technology, the potential for leakage during data transmission is cleverly avoided.

Description

Technical Field

[0001] The present invention relates to the technical field of computer software security analysis, and in particular to a vulnerability analysis and repair method for a self-made system. Background Art

[0002] With the rapid development of information technology, self-made systems have been widely used in many fields such as enterprises, industrial control, Internet of Things, medical care, finance, etc. However, due to the complexity of the systems and the diversity of the operating environments, potential security vulnerabilities in these systems have become a key factor threatening information security.

[0003] Traditional centralized vulnerability detection methods require uploading local system logs, operational data, or behavioral records to a central server for analysis. However, this data often contains sensitive information (such as user identities, access records, and operation logs). If attacked during transmission or storage, it could lead to privacy leaks. Summary of the Invention

[0004] In order to make up for the above shortcomings, the present invention provides a vulnerability analysis and repair method for a self-made system, which aims to improve the problem that the traditional centralized vulnerability detection method requires uploading the local system logs, operation data or behavior records to the central server for analysis, which may lead to privacy leakage.

[0005] In a first aspect, the present invention provides the following technical solution: a vulnerability analysis and repair method for a self-made system, comprising the following steps:

[0006] S1. Data Collection and Processing

[0007] Collect vulnerability-related data from system operation logs and user operation records;

[0008] Clean, normalize, and extract features from the collected data to generate feature vectors for vulnerability analysis;

[0009] S2, local model training and parameter encryption

[0010] Use the feature vectors to train a preliminary vulnerability detection model in the local system;

[0011] Use differential privacy technology to perturb and encrypt model parameters;

[0012] S3, federated model aggregation

[0013] Transmit the encrypted local model parameters to the central server;

[0014] The central server aggregates the local model parameters through the federated averaging algorithm to generate a global optimization model;

[0015] S4. Global model distribution and fine-tuning

[0016] Transmitting the global optimization model to each local system;

[0017] The local system fine-tunes the global model based on its own data to improve the model's adaptability in the local environment;

[0018] S5. Vulnerability detection and repair

[0019] Use the optimized model to scan local system vulnerabilities and conduct risk assessment and classification;

[0020] Generate repair patches based on vulnerability detection results and verify the patches;

[0021] Perform dynamic rollback when repair fails or produces side effects.

[0022] Preferably, the S1 data collection and processing includes:

[0023] Collect call sequences, abnormal behavior records, and user interaction data through a combination of real-time monitoring and batch analysis;

[0024] The principal component analysis (PCA) algorithm is used to reduce the dimension of the feature vector and reduce the interference of redundant information on model training.

[0025] Preferably, the S2 local model training and parameter encryption includes:

[0026] Use convolutional neural networks (CNNs) to extract vulnerability behavior patterns;

[0027] Use recurrent neural network (RNN) to capture abnormal features of time series;

[0028] Use the cross entropy loss function to optimize local model training:

[0029]

[0030] Among them, y i.c The true label of sample i in category c is 0 or 1. The predicted probability of sample i in category c is in the range of [0,1]. is the loss function, which is used to measure the error between the model prediction and the actual result, N is the total number of training samples, C is the total number of categories, σ 2 is the variance of Gaussian noise;

[0031] Encrypt training parameters using differential privacy techniques:

[0032]

[0033] Among them, θ′ is the encrypted parameter, is Gaussian noise, and θ is the parameter of the local training model.

[0034] Preferably, the S3 federated model aggregation includes:

[0035] The central server receives the encrypted local model parameters and verifies their integrity;

[0036] Use the FedAvg algorithm to perform weighted aggregation on the parameters to generate a global optimization model:

[0037]

[0038] Among them, θ global is the global model parameter, w i The weight of the local model, which represents the contribution weight of each participant in the federated averaging algorithm;

[0039] Gaussian noise is added during the parameter aggregation process to enhance the privacy protection of the aggregation results.

[0040] Preferably, the S4 global model distribution and fine-tuning includes:

[0041] Use SSL / TLS protocol to encrypt and transmit global model parameters to prevent tampering during transmission;

[0042] The local system combines transfer learning technology to use a small amount of local data to fine-tune the global model and improve its applicability in the local environment.

[0043] Preferably, the S5 vulnerability detection and repair includes:

[0044] Use the optimized federated model to perform vulnerability scanning, classify vulnerability types, and provide repair priority recommendations;

[0045] Automatically generate repair patches based on vulnerability types and perform functionality and security verification.

[0046] Preferably, the dynamic rollback operation includes:

[0047] Monitor abnormal conditions caused by patch repair process;

[0048] Automatically restore the system to the safe state before repair and generate a rollback log.

[0049] In a second aspect, the present invention provides the following technical solution: a vulnerability analysis and repair system for a self-made system, comprising:

[0050] Data collection and processing module: used to collect logs, abnormal behavior records and user operation data from the local system, clean the data and extract features to generate feature vectors for vulnerability detection;

[0051] Local model training module: used to train a preliminary vulnerability detection model based on feature vectors, and encrypt the model parameters using differential privacy technology to generate encrypted local model parameters;

[0052] Federated model aggregation module: This module receives encrypted model parameters uploaded by multiple local systems, aggregates the parameters using a federated averaging algorithm, and adds Gaussian noise during the aggregation process to generate a global optimization model.

[0053] Global model distribution module: used to distribute the global optimization model to the local system through encrypted transmission, and combine transfer learning technology to perform model fine-tuning locally;

[0054] Vulnerability detection and repair module: Used to use the optimized model to detect vulnerabilities in the local system, generate repair patches based on the detection results and verify the repair effect, and support dynamic rollback function to restore the system to a safe state when the repair fails.

[0055] In a third aspect, the invention provides the following technical solution: a computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the vulnerability analysis and repair method of the self-made system when executing the computer program.

[0056] In a fourth aspect, the present invention provides the following technical solution: a readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the vulnerability analysis and repair method of the self-made system.

[0057] The present invention has the following beneficial effects:

[0058] 1. In this invention, by introducing federated learning and differential privacy technologies, the risk of leakage during data transmission is cleverly avoided; each local system only needs to upload encrypted model parameters without transmitting original data, thus ensuring localized data processing; differential privacy technology further prevents malicious inference attacks by perturbing the uploaded model parameters; it is suitable for scenarios requiring high privacy protection, such as medical care, finance, and the Internet of Things, and realizes the security guarantee of distributed collaborative vulnerability management.

[0059] 2. In the present invention, the efficiency of system vulnerability management is greatly improved through an automated vulnerability detection and repair mechanism: relying on the optimized global model, the present invention can perform efficient real-time vulnerability scanning on the local system, quickly identify potential threats and conduct risk assessments; the system can automatically generate targeted repair patches based on the characteristics and types of the vulnerabilities, avoiding time delays and possible operational errors caused by manual intervention; after the repair is completed, the patch effect is fully verified through simulated attacks and automated testing; when the repair fails or an exception is caused, the system can automatically trigger a rollback mechanism to restore the system to a stable state before the repair to avoid affecting the normal operation of the business.

[0060] 3. In the present invention, collaborative optimization among multiple systems is achieved through federated learning technology. The encryption model parameters uploaded by each participating system are aggregated in the central server, and a global model is generated through the federated averaging algorithm, which effectively improves the generalization ability of the model. After the global model is distributed to the local system, it is fine-tuned in combination with local data through transfer learning technology, thereby further improving the adaptability of the model in the local environment. The federated learning mechanism supports periodic model parameter updates and can dynamically optimize the global model based on newly discovered vulnerabilities to ensure that the model performance is always in the optimal state. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 This is a flow chart of the vulnerability analysis and repair method for the self-made system proposed by the present invention;

[0062] Figure 2 This is a system architecture diagram of the vulnerability analysis and repair system of the self-made system proposed by the present invention;

[0063] Figure 3 This is a federated model aggregation flow chart of the vulnerability analysis and repair method for the self-made system proposed in this invention. DETAILED DESCRIPTION

[0064] The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0065] Example 1

[0066] Reference Figure 1 and Figure 3 In a first embodiment of the present invention, a vulnerability analysis and repair method for a self-made system is provided, comprising the following steps:

[0067] S1. Data Collection and Processing

[0068] Collect vulnerability-related data from system operation logs and user operation records;

[0069] Clean, normalize, and extract features from the collected data to generate feature vectors for vulnerability analysis;

[0070] S2, local model training and parameter encryption

[0071] Use the feature vectors to train a preliminary vulnerability detection model in the local system;

[0072] Use differential privacy technology to perturb and encrypt model parameters;

[0073] S3, federated model aggregation

[0074] Transmit the encrypted local model parameters to the central server;

[0075] The central server aggregates the local model parameters through the federated averaging algorithm to generate a global optimization model;

[0076] S4. Global model distribution and fine-tuning

[0077] Transmitting the global optimization model to each local system;

[0078] The local system fine-tunes the global model based on its own data to improve the model's adaptability in the local environment;

[0079] S5. Vulnerability detection and repair

[0080] Use the optimized model to scan local system vulnerabilities and conduct risk assessment and classification;

[0081] Generate repair patches based on vulnerability detection results and verify the patches;

[0082] Perform dynamic rollback when repair fails or produces side effects.

[0083] Specifically, the present invention effectively solves the risk of data privacy leakage in traditional centralized vulnerability analysis methods by introducing federated learning technology and differential privacy protection mechanism in a multi-system collaborative environment. Specifically:

[0084] Each local system only needs to upload encrypted model parameters, completely avoiding the privacy leakage that may be caused by transmitting original data. It is particularly suitable for highly sensitive data scenarios such as medical care, finance, and the Internet of Things.

[0085] The federated learning framework enables model collaboration among multiple systems. The central server generates a global optimization model by aggregating locally uploaded encrypted parameters, thereby significantly improving the accuracy of vulnerability detection and the generalization ability of the model.

[0086] After the global model is distributed to the local system, it is fine-tuned using transfer learning technology combined with local data, enabling the model to adapt to the needs of specific environments, further improving detection effectiveness and system adaptability.

[0087] S1 data acquisition and processing includes:

[0088] Collect call sequences, abnormal behavior records, and user interaction data through a combination of real-time monitoring and batch analysis;

[0089] The principal component analysis (PCA) algorithm is used to reduce the dimension of the feature vector and reduce the interference of redundant information on model training.

[0090] Specifically, S1 data collection and processing

[0091] Log data collection

[0092] Collection source:

[0093] System call logs: such as file read, write, and execute operations.

[0094] Network log: records IP traffic, port scans, abnormal connections, etc.

[0095] User behavior logs: such as failed login records, repeated operation sequences, etc.

[0096] Collection tools:

[0097] Use open source log collection frameworks such as Filebeat or Fluentd to collect logs in real time.

[0098] Collection method:

[0099] Real-time collection: monitors the system's key log directories and captures new or changed log files.

[0100] Batch collection: Scan system log files regularly and extract data within a specified time range.

[0101] Data cleaning

[0102] Processing steps:

[0103] Remove duplicate log entries to reduce redundant information.

[0104] Extract key fields (such as timestamp, event type, and operation object) through regular expressions.

[0105] Use anomaly detection algorithms to flag noisy data (such as data points with unusually high frequency spikes).

[0106] Tool implementation:

[0107] Use Python to write data cleaning scripts and combine them with the Pandas library to process large-scale log data.

[0108] Feature extraction

[0109] Extract dimensions:

[0110] Time dimension: such as operation interval and event frequency.

[0111] Behavioral pattern dimension: such as abnormal call chains and specific operation combinations.

[0112] Method implementation:

[0113] Use time series analysis tools such as the statsmodels library to extract time-dependent features.

[0114] Convert the behavior pattern into a feature vector and use the bag-of-words model or TF-IDF to digitize the operation sequence.

[0115] S2 local model training and parameter encryption include:

[0116] Use convolutional neural networks (CNNs) to extract vulnerability behavior patterns;

[0117] Use recurrent neural network (RNN) to capture abnormal features of time series;

[0118] Use the cross entropy loss function to optimize local model training:

[0119]

[0120] Among them, y i.c The true label of sample i in category c is 0 or 1. The predicted probability of sample i in category c is in the range of [0,1]. is the loss function, which is used to measure the error between the model prediction and the actual result, N is the total number of training samples, C is the total number of categories, σ 2 is the variance of Gaussian noise;

[0121] Encrypt training parameters using differential privacy techniques:

[0122]

[0123] Among them, θ′ is the encrypted parameter, is Gaussian noise, and θ is the parameter of the local training model.

[0124] Specifically, S2 local model training and parameter encryption

[0125] Model building

[0126] Input: Data feature vector, in the form of [x1,x2,…,xn], where each feature corresponds to a dimension.

[0127] Model Architecture:

[0128] Input layer: accepts a feature vector of dimension n.

[0129] Hidden layer:

[0130] Use convolutional neural network (CNN) to extract vulnerability behavior features.

[0131] Use recurrent neural networks (RNNs) to capture time series characteristics.

[0132] Output layer: multiple classifiers that output vulnerability types and their confidence levels.

[0133] Optimization goal: minimize the loss function:

[0134]

[0135] Among them, y i，c The true label of sample i in category c is 0 or 1. The predicted probability of sample i in category c is in the range of [0,1]. is the loss function, which is used to measure the error between the model prediction and the actual result, N is the total number of training samples, C is the total number of categories, σ 2 is the variance of Gaussian noise;

[0136] Model training

[0137] Algorithm selection: Use Adam optimizer to adjust learning rate and gradient update.

[0138] Data partitioning: The training set and validation set are divided into 7:3 to prevent overfitting.

[0139] Training tools: implemented using a deep learning framework such as TensorFlow or PyTorch.

[0140] Parameter encryption

[0141] Encryption method: Using differential privacy technology:

[0142]

[0143] Among them, θ′ is the encrypted parameter, is Gaussian noise, and θ is the parameter of the local training model.

[0144] Implementation method:

[0145] Add independent Gaussian noise to each parameter;

[0146] The noise intensity is given by the variance σ 2 Control, ensuring a balance between privacy and model performance.

[0147] S3 federation model aggregation includes:

[0148] The central server receives the encrypted local model parameters and verifies their integrity;

[0149] Use the FedAvg algorithm to perform weighted aggregation on the parameters to generate a global optimization model:

[0150]

[0151] Among them, θ global is the global model parameter, ω i The weight of the local model, which represents the contribution weight of each participant in the federated averaging algorithm;

[0152] Gaussian noise is added during the parameter aggregation process to enhance the privacy protection of the aggregation results.

[0153] Specifically, upload parameters

[0154] Encrypted transmission: Encrypted local model parameters are uploaded to the central server via SSL / TLS protocol to ensure transmission security.

[0155] Federated Averaging Algorithm

[0156] Implementation:

[0157] The central server receives encryption parameters from all local systems;

[0158] The model parameters are aggregated according to the following formula:

[0159]

[0160] Among them, θ global is the global model parameter, ω i The weight of the local model, which represents the contribution weight of each participant in the federated averaging algorithm;

[0161] Enhanced privacy protection: Gaussian noise is added after aggregation to further protect global parameter privacy.

[0162] Aggregation Tools

[0163] Use a distributed computing framework (such as Apache Spark or Ray) to process the aggregation task of model parameters to improve efficiency.

[0164] S4 global model distribution and fine-tuning include:

[0165] Use SSL / TLS protocol to encrypt and transmit global model parameters to prevent tampering during transmission;

[0166] The local system combines transfer learning technology to use a small amount of local data to fine-tune the global model and improve its applicability in the local environment.

[0167] Specifically, model distribution

[0168] Encrypted transmission: Global model parameters are transmitted to each local system using the SSL / TLS protocol.

[0169] Version control: Manage different iterations of the global model through model version numbers to ensure consistency.

[0170] Local fine-tuning

[0171] Transfer Learning:

[0172] Freeze some parameters of the global model and only adjust the local relevant layers.

[0173] Use a small amount of local data for fine-tuning to optimize local adaptability.

[0174] Implementation:

[0175] Fine-tuning the model using PyTorch's Fine-Tuning tool.

[0176] S5 vulnerability detection and repair includes:

[0177] Use the optimized federated model to perform vulnerability scanning, classify vulnerability types, and provide repair priority recommendations;

[0178] Automatically generate repair patches based on vulnerability types and perform functionality and security verification.

[0179] Dynamic rollback operations include:

[0180] Monitor abnormal conditions caused by patch repair process;

[0181] Automatically restore the system to the safe state before repair and generate a rollback log.

[0182] Specifically, vulnerability detection

[0183] Scanning method: Input system logs into the optimized model in real time, and output vulnerability types and risk assessment results.

[0184] Risk ranking:

[0185] Generate a priority list based on vulnerability confidence and impact scope.

[0186] Fix patch generation

[0187] Patch creation:

[0188] Generate customized remediation scripts using vulnerability description information;

[0189] Supports multi-platform compatibility.

[0190] Patch Verification:

[0191] Simulate attacks to verify patch effectiveness;

[0192] Automated testing of the functional integrity of the repaired system.

[0193] Dynamic rollback

[0194] Trigger conditions:

[0195] Repair patch failure;

[0196] System performance fluctuates abnormally.

[0197] Rollback mechanism:

[0198] Quickly restore to the state before repair;

[0199] Automatically record rollback operation logs.

[0200] Example 2:

[0201] Reference Figure 2 and Figure 3 In a second embodiment of the present invention, the present invention provides a vulnerability analysis and repair system for a self-made system, comprising:

[0202] Data collection and processing module: used to collect logs, abnormal behavior records and user operation data from the local system, clean the data and extract features to generate feature vectors for vulnerability detection;

[0203] Local model training module: used to train a preliminary vulnerability detection model based on feature vectors, and encrypt the model parameters using differential privacy technology to generate encrypted local model parameters;

[0204] Federated model aggregation module: This module receives encrypted model parameters uploaded by multiple local systems, aggregates the parameters using a federated averaging algorithm, and adds Gaussian noise during the aggregation process to generate a global optimization model.

[0205] Global model distribution module: used to distribute the global optimization model to the local system through encrypted transmission, and combine transfer learning technology to perform model fine-tuning locally;

[0206] Vulnerability detection and repair module: Used to use the optimized model to detect vulnerabilities in the local system, generate repair patches based on the detection results and verify the repair effect, and support dynamic rollback function to restore the system to a safe state when the repair fails.

[0207] Specifically, 1.1 Data acquisition and processing module

[0208] Function: Used to collect vulnerability-related data from the local system in real time, clean the data and extract features, and provide high-quality input for subsequent vulnerability detection.

[0209] Module composition and functions:

[0210] Log collection submodule:

[0211] Collection sources include system call logs, user behavior records, and network traffic logs;

[0212] Monitor log directory changes in real time and perform incremental collection of new logs;

[0213] Supports multiple log formats, including text logs, JSON format, and binary logs.

[0214] Data cleaning sub-module:

[0215] Format the collected data to remove redundant information and noise data;

[0216] Extract key fields such as action time, event type, and target resource.

[0217] Feature extraction submodule:

[0218] Analyze data for behavioral patterns, abnormal trends, and time series characteristics;

[0219] Generate standardized feature vectors to provide input data for subsequent training.

[0220] 1.2 Local Model Training Module

[0221] Function: Used to train vulnerability detection models using local data and encrypt the generated model parameters to protect data privacy.

[0222] Module composition and functions:

[0223] Model training submodule:

[0224] Use the standardized data to train a preliminary vulnerability detection model;

[0225] Output vulnerability type and risk level prediction results.

[0226] Parameter encryption submodule:

[0227] The model parameters after training are perturbed and encrypted to ensure privacy and security when uploading to the server.

[0228] 1.3 Federated Model Aggregation Module

[0229] Function: Used to receive encrypted model parameters uploaded by multiple local systems, aggregate them to generate a global optimization model, and ensure the privacy protection of the model.

[0230] Module composition and functions:

[0231] Parameter receiving submodule:

[0232] Receive locally uploaded model parameters through a secure transmission protocol;

[0233] Verify the integrity and legality of parameter data to prevent tampering during transmission.

[0234] Model aggregation submodule:

[0235] Aggregate the parameters uploaded by each system to generate a globally optimized vulnerability detection model;

[0236] The privacy of all local models is ensured during the aggregation process.

[0237] 1.4 Global Model Distribution and Fine-tuning Module

[0238] Function: Used to securely distribute global optimization models to local systems and fine-tune the models based on local data to adapt to the specific needs of the local environment.

[0239] Module composition and functions:

[0240] Model distribution submodule:

[0241] Use encryption protocols to securely transmit global models to prevent man-in-the-middle attacks or data leaks;

[0242] Provides version management capabilities to ensure that each distributed model is traceable.

[0243] Model fine-tuning submodule:

[0244] Use a small amount of local data to fine-tune the global model and optimize the model's adaptability to the local environment;

[0245] Supports freezing some global model parameters and only adjusting local related layers, reducing training time and resource consumption.

[0246] 1.5 Vulnerability Detection and Repair Module

[0247] Function: Use the optimized model to detect vulnerabilities in the local system, generate repair patches and verify the repair effect, while supporting dynamic rollback function.

[0248] Module composition and functions:

[0249] Vulnerability detection submodule:

[0250] Scan the local system for potential vulnerabilities, identify vulnerability types and assess their risk levels;

[0251] Generates priority ranking recommendations based on detection results.

[0252] Fix patch generation submodule:

[0253] Automatically generate vulnerability repair scripts to adapt to various system environments;

[0254] Support compatibility testing and effect evaluation of repair patches.

[0255] Fix the verification submodule:

[0256] Simulate common attack scenarios to verify the effectiveness of repair patches;

[0257] Automatically test the functional integrity and stability of the repaired system.

[0258] Dynamic rollback submodule:

[0259] When a patch repair fails or causes a system abnormality, it automatically restores to the state before the repair;

[0260] Record the log and detailed information of the rollback operation for subsequent analysis.

[0261] Example 3

[0262] The third embodiment of the present invention is based on the same inventive concept and proposes a computer-readable storage medium. The computer-readable storage medium stores a computer program. When the computer program is executed by a processor, the steps of the vulnerability analysis and repair method of the homemade system of the above embodiment are implemented.

[0263] Example 4

[0264] The fourth embodiment of the present invention is based on the same inventive concept. The present invention proposes a computer device, the terminal including: a processor, a memory; the processor and the memory communicate with each other; the memory is used to store instructions; the processor is used to execute the instructions in the memory, and execute the vulnerability analysis and repair method of the homemade system of the above embodiment.

[0265] It should be understood that various parts of the present invention can be implemented using hardware, software, firmware, or a combination thereof. In the above-described embodiments, multiple steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application-specific integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0266] Finally, it should be noted that the above is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A vulnerability analysis and repair method for a self-made system, characterized in that: The following steps are involved: S1. Data Collection and Processing Collect vulnerability-related data from system operation logs and user operation records; Clean, normalize, and extract features from the collected data to generate feature vectors for vulnerability analysis; S2, local model training and parameter encryption Use the feature vectors to train a preliminary vulnerability detection model in the local system; Use differential privacy technology to perturb and encrypt model parameters; S3, federated model aggregation Transmit the encrypted local model parameters to the central server; The central server aggregates the local model parameters through the federated averaging algorithm to generate a global optimization model; S4. Global model distribution and fine-tuning Transmitting the global optimization model to each local system; The local system fine-tunes the global model based on its own data to improve the model's adaptability in the local environment; S5. Vulnerability detection and repair Use the optimized model to scan local system vulnerabilities and conduct risk assessment and classification; Generate repair patches based on vulnerability detection results and verify the patches; Perform dynamic rollback when repair fails or produces side effects; The S2 local model training and parameter encryption include: Use convolutional neural networks (CNNs) to extract vulnerability behavior patterns; Use recurrent neural network (RNN) to capture abnormal features of time series; Use the cross entropy loss function to optimize local model training: Among them, y i，c The true label of sample i in category c is 0 or 1. The predicted probability of sample i in category c is in the range of [0,1]. is the loss function, which is used to measure the error between the model prediction and the actual result, N is the total number of training samples, C is the total number of categories, σ 2 is the variance of Gaussian noise; Encrypt training parameters using differential privacy techniques: Among them, θ′ is the encrypted parameter, is Gaussian noise, θ is the parameter of the local training model; The S3 federation model aggregation includes: The central server receives the encrypted local model parameters and verifies their integrity; Use the FedAvg algorithm to perform weighted aggregation on the parameters to generate a global optimization model: Among them, θ global is the global model parameter, w i is the weight of the local model, which represents the contribution weight of each participant in the federated averaging algorithm; Gaussian noise is added during the parameter aggregation process to enhance the privacy protection of the aggregation results.

2. The vulnerability analysis and repair method of the self-made system according to claim 1 is characterized in that: The S1 data collection and processing includes: Collect call sequences, abnormal behavior records, and user interaction data through a combination of real-time monitoring and batch analysis; The principal component analysis (PCA) algorithm is used to reduce the dimension of the feature vector and reduce the interference of redundant information on model training.

3. The vulnerability analysis and repair method of the self-made system according to claim 1 is characterized in that: The S4 global model distribution and fine-tuning includes: Use SSL / TLS protocol to encrypt and transmit global model parameters to prevent tampering during transmission; The local system combines transfer learning technology to use a small amount of local data to fine-tune the global model and improve its applicability in the local environment.

4. The vulnerability analysis and repair method of the self-made system according to claim 1 is characterized in that: The S5 vulnerability detection and repair includes: Use the optimized federated model to perform vulnerability scanning, classify vulnerability types, and provide repair priority recommendations; Automatically generate repair patches based on vulnerability types and perform functionality and security verification.

5. The vulnerability analysis and repair method of the self-made system according to claim 1 is characterized in that: The dynamic rollback operation includes: Monitor abnormal conditions caused by patch repair process; Automatically restore the system to the safe state before repair and generate a rollback log.

6. A vulnerability analysis and repair system for a self-made system, characterized by: A vulnerability analysis and repair method for a self-made system according to any one of claims 1 to 5, comprising: Data collection and processing module: used to collect logs, abnormal behavior records and user operation data from the local system, clean the data and extract features to generate feature vectors for vulnerability detection; Local model training module: used to train a preliminary vulnerability detection model based on feature vectors, and encrypt the model parameters using differential privacy technology to generate encrypted local model parameters; Federated model aggregation module: This module receives encrypted model parameters uploaded by multiple local systems, aggregates the parameters using a federated averaging algorithm, and adds Gaussian noise during the aggregation process to generate a global optimization model. Global model distribution module: used to distribute the global optimization model to the local system through encrypted transmission, and combine transfer learning technology to perform model fine-tuning locally; Vulnerability detection and repair module: Used to use the optimized model to detect vulnerabilities in the local system, generate repair patches based on the detection results and verify the repair effect, and support dynamic rollback function to restore the system to a safe state when the repair fails.

7. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the vulnerability analysis and repair method for the homemade system according to any one of claims 1 to 5 is implemented.

8. A readable storage medium, characterized in that: The readable storage medium stores a computer program, which, when executed by a processor, implements the vulnerability analysis and repair method for the self-made system according to any one of claims 1 to 5.

Images