Computer software security vulnerability repairing system and method

Abstract

The invention discloses a computer software security vulnerability repairing system and method, and relates to the technical field of computer software security, through mutual cooperation of three groups of algorithm units, factors such as the number Asc of affected software, the vulnerability level Vc and the vulnerability latency Vnt can be comprehensively considered, and effective values Rs of different repairing strategies of different vulnerabilities are calculated; and based on the specific effective value Rs of the repair strategy obtained through calculation, the risks of different vulnerabilities and the effective degree of the repair strategy are judged, and the vulnerabilities with the high effective value Rs of the repair strategy are preferentially repaired, so that repair resources and time can be more scientifically and effectively distributed under limited repair resources, the repair efficiency of the computer software vulnerabilities is improved, and the repair cost is reduced. And the repair strategy can be adjusted and optimized according to the change trend of the Re value in the database, so that the repair effect of the computer software security vulnerability repair system and the utilization efficiency of repair resources are further improved.

Description

Technical Field

[0001] The present invention relates to the technical field of computer software security, and in particular to a computer software security vulnerability repair system and method. Background Art

[0002] Computers, commonly known as computers, are modern intelligent electronic devices that can run according to programs and automatically and quickly process massive amounts of data. Computer software refers to the programs and their documents in the computer system. The program is a description of the processing object and algorithm of the problem, usually written in a certain programming language. It must be installed in the computer to run. With the rapid development of Internet technology, software applications are becoming increasingly complex. This complexity also means an increase in the number of security vulnerabilities in the software. Software vulnerabilities provide attackers with opportunities to invade the system, which may lead to system paralysis, data leakage and other serious damage. Therefore, it is particularly important to repair software vulnerabilities in a timely manner.

[0003] When a security vulnerability appears in a computer, it often affects multiple software and extends to multiple vulnerabilities. The current existing methods for repairing computer software security vulnerabilities often directly repair the vulnerabilities after writing patches. It is unable to consider the severity of multiple vulnerability risks and estimate the effectiveness of each vulnerability repair strategy before the vulnerability is repaired. Therefore, with limited repair resources, the efficiency of computer software security vulnerability repair is low and is not conducive to use. Summary of the invention

[0004] The purpose of the present invention is to provide a computer software security vulnerability repair system and method to solve the problems raised in the above background technology.

[0005] To achieve the above object, the present invention provides the following technical solution: a computer software security vulnerability repair system, comprising:

[0006] The vulnerability detection module is used to scan the computer through the system vulnerability scanning software, obtain the security vulnerabilities existing in the computer and the number of affected software Asc for each security vulnerability, and classify the security vulnerabilities into four levels: low, medium, high, and severe, and then transmit the obtained data information to the database of the security vulnerability repair system;

[0007] The data preprocessing module is used to decode and preprocess the data information in the database to obtain parameter values ​​for calculation in the calculation processing module;

[0008] The computing and processing module includes:

[0009] The vulnerability risk assessment value algorithm unit, the repair strategy effective value algorithm unit and the vulnerability repair effect value algorithm unit are used to input the decoded parameters into the vulnerability risk assessment value algorithm unit to calculate different vulnerability risk assessment values ​​Ra for different security vulnerabilities, and then substitute the vulnerability risk assessment value Ra as an input parameter into the repair strategy effective value algorithm unit to calculate the repair strategy effective value Rs.

[0010] The vulnerability repair module uses code editors, debuggers, and patch management tools to repair vulnerabilities.

[0011] Optionally, the system vulnerability scanning software used in the vulnerability detection module is Nessus software, and the decoding preprocessing includes data cleaning and data standardization.

[0012] Optionally, the code editor used in the vulnerability repair module is Visual Studio software, the debugger is GDB debugger, and the patch management tool is Patch Management software.

[0013] Optionally, the vulnerability risk assessment value algorithm unit is as follows:

[0014]

[0015] in:

[0016] Ra represents the vulnerability risk assessment value;

[0017] Vc stands for vulnerability level, which is obtained by scanning the computer with Nessus software. It is divided into four levels: low, medium, high, and severe. The corresponding parameter values ​​of the four levels are 1, 2, 3, and 4 respectively;

[0018] Asc represents the number of affected software, which is the total number of system software and application software affected by the vulnerability in the computer;

[0019] Kv represents the known degree value of the vulnerability;

[0020] In the calculation formula:

[0021] "log 10 The "(Kv+1)" part represents a logarithmic function with a base of 10, which is used to convert the vulnerability known degree value Kv into a value on a logarithmic scale. As the vulnerability known degree value Kv increases, the "log 10 The growth rate of the value of "(Kv+1)" will gradually slow down, which means that as the vulnerability becomes known to more people, the impact of the vulnerability known degree value Kv on the vulnerability risk assessment value Ra will gradually decrease;

[0022] Use "log 10(Kv+1)”, add 1 to the calculation result of this part to ensure that the vulnerability knowledge value Kv approaches 0. That is, when the vulnerability is less known, the formula “[1+log 10 The calculated value of this part (Kv+1)] will not be 0, and it reflects that even if the known degree value Kv of the vulnerability is very low, it still has potential risks.

[0023] Optionally, the calculation formula of the vulnerability known degree value Kv is as follows:

[0024]

[0025] in:

[0026] Kv represents the known degree value of the vulnerability;

[0027] To represents the time from when the vulnerable software was released to when the current security vulnerability was fixed, which is the length of time the software is exposed to potential attackers during use;

[0028] Vnt stands for vulnerability latency, which is the latency period from when the vulnerability is released to when it is actually detected;

[0029] ε represents the adjustment factor;

[0030] In the calculation formula:

[0031] The numerator "To-Vnt" is the time from the release of the vulnerable software to the time when the current security vulnerability is fixed, To, minus the vulnerability latency time Vnt. It represents the time difference from the discovery of the vulnerability to the current security fix. The longer the time difference, the more time the vulnerability has been studied and fixed, and the higher the vulnerability is known.

[0032] The denominator "To+ε" introduces an adjustment factor ε to ensure that even if the release time of the vulnerable software is close to the time To when the current security vulnerability is fixed, the denominator will not be zero, ensuring that the vulnerability knowledge value Kv will not fluctuate excessively due to the value of the time To between the release time of the vulnerable software and the current security vulnerability is fixed, so as to more accurately reflect the vulnerability knowledge value Kv of the discovered vulnerability.

[0033] Optionally, the repair strategy effective value algorithm unit is as follows:

[0034]

[0035] in:

[0036] Rs represents the effective value of the repair strategy;

[0037] Ra represents the vulnerability risk assessment value;

[0038] R represents the number of patches that can be used to fix the vulnerability. It is obtained by adding the number of patches that can be made by security personnel based on the vulnerability type obtained from the official website of the software.

[0039] R min Represents the minimum number of patches; that is, the minimum number of patches required for a vulnerability. In computer software security vulnerabilities, a script vulnerability requires at least one patch to be repaired.

[0040] In the calculation formula:

[0041] Minimum number of patches R min As a reference threshold in the formula, when the number of patches R that can be used for the vulnerability is less than the minimum number of patches R min When, in the denominator This part of the value will become very large, causing the calculated effective value of the repair strategy Rs to approach 0, indicating that when the number of patches R that can be used for the vulnerability is not enough to meet the repair requirements, the calculated effective value of the repair strategy Rs will be very low, emphasizing the importance of ensuring that the number of available patches meets the repair requirements.

[0042] Optionally, the vulnerability repair effect value algorithm unit is as follows:

[0043]

[0044] in:

[0045] Re represents the vulnerability repair effect value;

[0046] Rs represents the effective value of the repair strategy;

[0047] Ra represents the vulnerability risk assessment value;

[0048] Ra post The vulnerability risk assessment value after the vulnerability repair strategy is implemented is the value obtained by calculating the risk assessment value of the vulnerability risk again after the vulnerability repair work is completed. It reflects whether the repair strategy can effectively reduce the risk of the vulnerability.

[0049] R used Represents the number of patches actually used;

[0050] R represents the number of patches that can be used for the vulnerability;

[0051] In the calculation formula:

[0052] This part represents the square of the relative change in risk assessment value before and after the implementation of the repair strategy. The square calculation amplifies the impact of the relative change and occupies a more important position in the formula. It is used to highlight the repair strategy that significantly reduces the risk of the vulnerability.

[0053] When R used When the value is close to R, it means that the number of patches R that can be used for the vulnerability has been efficiently utilized, which will result in the formula "|RR used |"The calculated value of this part decreases, resulting in It is close to 1, which has a positive impact on the vulnerability repair effect value Re in the formula calculation.

[0054] The present invention also provides a method for repairing a computer software security vulnerability, comprising the following steps:

[0055] Use the system vulnerability scanning software in the vulnerability detection module to scan the computer, obtain the security vulnerabilities existing in the computer and the number of affected software Asc for each security vulnerability, and classify the security vulnerabilities into four levels: low, medium, high, and severe, and then transmit the obtained data information to the database of the security vulnerability repair system;

[0056] Obtain the release time of the software and the vulnerability latency time Vnt through the registry information of the software affected by the security vulnerability and transmit them to the database;

[0057] The data information in the database is decoded and preprocessed by the data preprocessing module to obtain the parameter values ​​involved in the calculation in the calculation processing module;

[0058] The parameter value obtained after decoding is input into the vulnerability risk assessment value algorithm unit in the calculation processing module to calculate different vulnerability risk assessment values ​​Ra for different security vulnerabilities, and then the vulnerability risk assessment value Ra is substituted as an input parameter into the repair strategy effective value algorithm unit to calculate the repair strategy effective value Rs;

[0059] According to the calculated effective value Rs of the repair strategy, the effectiveness of different vulnerability repair strategies is judged, and the vulnerabilities with high effective value Rs of the repair strategy are repaired first;

[0060] Vulnerability repair, using code editors, debuggers, and patch management tools to repair vulnerabilities;

[0061] Feedback on the repair effect: after the vulnerability is repaired, the vulnerability in the computer is rescanned using the system vulnerability scanning software, and the vulnerability risk assessment value Ra is recalculated through the vulnerability risk assessment value algorithm unit in the calculation processing module to obtain the vulnerability risk assessment value Ra after the vulnerability repair strategy is implemented. post , the vulnerability risk assessment value Ra post Substitute the original Ra value into the vulnerability repair effect value algorithm unit in the calculation processing module to calculate the vulnerability repair effect value Re;

[0062] The multiple vulnerability repair effect values ​​Re values ​​calculated after multiple repairs are uploaded to the database. According to the changing trend of the Re values, the repair strategy is adjusted and optimized to improve the repair effect and repair resource utilization efficiency of the computer software security vulnerability repair system.

[0063] Compared with the prior art, the present invention has the following beneficial effects:

[0064] 1. The present invention forms the core architecture of a computer software security vulnerability repair method through the mutual cooperation of three groups of algorithm units. In the process of computer software security vulnerability repair, the present invention can comprehensively consider factors such as the number of affected software Asc, the vulnerability level Vc, and the vulnerability latent time, calculate the effective value Rs of different repair strategies, and judge the risks of different vulnerabilities and the effectiveness of the repair strategies based on the calculated specific effective value Rs of the repair strategy, and give priority to the repair of vulnerabilities with high effective value Rs of the repair strategy, so as to allocate repair resources and time more scientifically and effectively under limited repair resources, thereby improving the efficiency of repairing computer software vulnerabilities.

[0065] 2. In the present invention, after a vulnerability is repaired, the vulnerability risk assessment value Ra after the vulnerability repair strategy is implemented is recalculated by the vulnerability risk assessment value algorithm unit in the calculation processing module. post , and then the vulnerability risk assessment value Ra post The original Ra value is substituted into the vulnerability repair effect value algorithm unit in the calculation and processing module to obtain the vulnerability repair effect value Re, and the multiple vulnerability repair effect values ​​Re values ​​calculated after multiple repairs are uploaded to the database. According to the changing trend of the Re value, the repair strategy can be adjusted and optimized to further improve the repair effect of the computer software security vulnerability repair system and the utilization efficiency of the repair resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] Figure 1 A flowchart of a computer software security vulnerability repair system and method;

[0067] Figure 2 The present invention is a schematic diagram of the overall structure of a computer software security vulnerability repair system and method. DETAILED DESCRIPTION

[0068] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0069] For example, see Figure 1 to Figure 2 The present invention provides a computer software security vulnerability repair system, comprising:

[0070] The vulnerability detection module uses system vulnerability scanning software to scan the computer, obtain the security vulnerabilities existing in the computer and the total number of system software and application software that each security vulnerability can affect, and classify the security vulnerabilities into four levels: low, medium, high, and severe, and then transmit the obtained data information to the database of the security vulnerability repair system;

[0071] A data preprocessing module is used to transmit the data information in the database to the data processing module for decoding preprocessing to obtain important parameters involved in the calculation in the calculation processing module;

[0072] The computing and processing module includes:

[0073] The vulnerability risk assessment value algorithm unit, the repair strategy effective value algorithm unit and the vulnerability repair effect value algorithm unit are used to input the decoded parameters into the vulnerability risk assessment value algorithm unit to calculate different vulnerability risk assessment values ​​Ra for different security vulnerabilities, and then substitute the vulnerability risk assessment value Ra as an input parameter into the repair strategy effective value algorithm unit to calculate the repair strategy effective value Rs.

[0074] The vulnerability repair module uses code editors, debuggers, and patch management tools to repair vulnerabilities one by one.

[0075] In this embodiment:

[0076] The present invention forms the core architecture of a computer software security vulnerability repair method through the mutual cooperation of three algorithm units. In the process of computer software security vulnerability repair, the present invention can comprehensively consider factors such as the number of affected software Asc, the vulnerability level Vc and the vulnerability latent time, calculate the vulnerability risk assessment value Ra of different vulnerabilities in the computer software and the effective value Rs of different repair strategies, judge the risks of different vulnerabilities and the effectiveness of repair strategies based on specific scientific numerical values, and give priority to the repair of vulnerabilities with high effective value Rs of repair strategies, so as to allocate repair resources and time more scientifically and effectively under limited repair resources, thereby improving the repair efficiency of computer software vulnerabilities.

[0077] Furthermore, after the vulnerability is repaired, the vulnerability in the computer is scanned again with the system vulnerability scanning software, and the vulnerability risk assessment value Ra after the vulnerability repair strategy is implemented is recalculated by the vulnerability risk assessment value algorithm unit in the calculation processing module. post , the vulnerability risk assessment value Ra postThe original Ra value is substituted into the vulnerability repair effect value algorithm unit in the calculation and processing module to calculate the vulnerability repair effect value Re, and the multiple vulnerability repair effect values ​​Re values ​​calculated after multiple repairs are uploaded to the database. According to the changing trend of the Re value, the repair strategy can be adjusted and optimized to further improve the repair effect of the computer software security vulnerability repair system and the utilization efficiency of the repair resources.

[0078] See also Figure 1 to Figure 2 , the vulnerability risk assessment value algorithm unit is as follows:

[0079]

[0080] in:

[0081] Ra represents the vulnerability risk assessment value;

[0082] Vc represents the vulnerability level, which is obtained after scanning the computer with Nessus software and is divided into four levels: low, medium, high, and severe. Since the vulnerability level Vc has a positive impact on the calculation of the vulnerability risk assessment value Ra, the corresponding parameter values ​​of the four levels are set to 1, 2, 3, and 4 respectively. The parameter values ​​corresponding to the four levels of low, medium, high, and severe are involved in the formula calculation of the vulnerability risk assessment value algorithm unit to show the influence of the vulnerability level Vc on the calculation of the vulnerability risk assessment value Ra;

[0083] Asc represents the number of affected software, which is the total number of system software and application software affected by the vulnerability in the computer;

[0084] Kv represents the known degree value of the vulnerability;

[0085] In the calculation formula:

[0086] This part represents the square root of the total number of system software and application software affected by the vulnerability. Taking the square root can balance the difference between large-scale impact and small-scale impact, making the impact of the total number of system software and application software affected by the vulnerability Asc on the vulnerability risk assessment value Ra smoother;

[0087] "log 10 The "(Kv+1)" part represents a logarithmic function with a base of 10, which is used to convert the vulnerability known degree value Kv into a value on a logarithmic scale. As the vulnerability known degree value Kv increases, the "log 10 The growth rate of the value of "(Kv+1)" will gradually slow down, reflecting that as the vulnerability becomes known to more people, the impact of the additional vulnerability knowledge value Kv on the vulnerability risk assessment value Ra will gradually decrease;

[0088] Use "log 10(Kv+1)”, the calculation result is added by 1 to ensure that the known value Kv approaches 0. That is, when the known degree of the vulnerability is low, the formula “[1+log 10 The adjustment factor for this part will not be 0, and it also reflects that even if the known degree value Kv of the vulnerability is very low, it still poses a risk;

[0089] The calculation formula of the vulnerability known degree value Kv is as follows:

[0090]

[0091] in:

[0092] Kv represents the known degree value of the vulnerability;

[0093] To represents the time from when the vulnerable software was released to when the current security vulnerability was fixed. This time span measures the time from when the software was released to when the vulnerability was fixed, and reflects the length of time the software is exposed to potential attackers during use;

[0094] Vnt stands for vulnerability latency, which is obtained by subtracting the release time of the software from the time when the vulnerability is detected after scanning the computer with Nessus software, that is, the latency period from the release of the software to the actual detection of the vulnerability;

[0095] ε represents the adjustment factor, which is used to adjust the fluctuation degree of the time between the release time of the vulnerable software and the time when the current security vulnerability is fixed To in the calculation of the vulnerability known degree value Kv;

[0096] In the calculation formula:

[0097] The numerator "To-Vnt" represents the time difference from the discovery of the vulnerability to the current security fix. The longer this time difference is, the more time the vulnerability has been studied and fixed, and the higher the vulnerability's known degree Kv is.

[0098] The denominator "To+ε" introduces the adjustment factor ε to ensure that even if the release time of the vulnerable software is close to 0 from the time when the current security vulnerability is fixed, the denominator will not be zero. Normalization ensures that the calculation of the vulnerability knowledge value Kv is comparable in different situations, and ensures that the vulnerability knowledge value Kv will not fluctuate excessively due to the absolute value of To, which can more accurately reflect the degree of knowledge of the vulnerability.

[0099] In this embodiment:

[0100] The vulnerability risk assessment value algorithm unit comprehensively considers multiple influencing factors, such as the vulnerability level obtained after the Nessus software scans the computer, the number of affected software in the computer Asc, and the vulnerability known degree value Kv, and calculates different vulnerability risk assessment values ​​Ra for different vulnerabilities. It can measure the vulnerability risks of multiple software in the computer, and provide scientific and reliable data support for the security team to repair vulnerabilities. It can make repair decisions based on specific scientific data instead of relying on subjective judgment or experience. By comparing the different vulnerability risk assessment values ​​Ra of different vulnerabilities, the security team can give priority to vulnerabilities with higher risks, thereby allocating resources and time more effectively and improving the efficiency of repairing computer software vulnerabilities.

[0101] Furthermore, since the vulnerability level Vc, the number of affected software Asc, and the vulnerability known degree value Kv, which are the influencing factors involved in the calculation of the vulnerability risk assessment value algorithm unit, are variable with each calculation of the vulnerability risk assessment value Ra, the vulnerability risk assessment value Ra can be dynamically updated as these parameters change, thereby enabling the vulnerability risk assessment value Ra to reflect the real-time status of the vulnerability, including whether the severity of the vulnerability has increased, whether new exploitation methods have been discovered, and whether the vulnerability has become known to more people. This dynamic assessment capability helps the security team respond to new threats and vulnerabilities in a timely manner.

[0102] See also Figure 1 to Figure 2 , the effective value algorithm unit of the repair strategy is as follows:

[0103]

[0104] in:

[0105] Rs represents the effective value of the repair strategy;

[0106] Ra represents the vulnerability risk assessment value;

[0107] R represents the number of patches that can be used to fix the vulnerability. It is obtained by adding the number of patches that can be made by security personnel based on the vulnerability type obtained from the official website of the software.

[0108] R min Represents the minimum number of patches; that is, the minimum number of patches required for a vulnerability. In computer software security vulnerabilities, a script vulnerability requires at least one patch to be repaired.

[0109] In the calculation formula:

[0110] Minimum number of patches R min As a reference threshold in the formula, when the number of patches R that can be used for the vulnerability is less than the minimum number of patches R min When the negative of e in the denominator (RR min) will become very large, causing the calculated effective value of the repair strategy Rs to be close to 0, indicating that when the number of patches R that can be used for the vulnerability is not enough to meet the repair requirements, the effectiveness of the repair strategy will be very low, emphasizing the importance of ensuring that the number of available patches meets the repair requirements.

[0111] In this embodiment:

[0112] The repair strategy effective value algorithm unit comprehensively considers the vulnerability risk assessment value Ra, the number of patches that can be used for the vulnerability R, and the minimum number of patches R mi Based on multiple influencing factors, the effective value Rs of the repair strategy is calculated as a quantitative indicator for evaluating the effectiveness of the repair strategy. It can intuitively reflect the expected effect of the repair strategy under given resource conditions, and help the security team optimize resource allocation according to the Rs value, and allocate limited repair resources to those software vulnerabilities with better expected repair effects. This resource allocation method can ensure that resources are used most effectively and improve the overall repair efficiency.

[0113] In addition to being used for current vulnerability repair decisions, the calculated effective value Rs of the repair strategy can also serve as an important reference for long-term planning. By analyzing and comparing historical Rs values, the security team can identify which repair strategies are more effective for repairing which vulnerabilities, and which repair strategies have lower effective values ​​and need to be improved or optimized. This information helps to formulate a more scientific and reasonable long-term security plan in the computer software security vulnerability repair system, further improving the security and efficiency of the system.

[0114] See also Figure 1 to Figure 2 , the vulnerability repair effect value algorithm unit is as follows:

[0115]

[0116] in:

[0117] Re represents the vulnerability repair effect value;

[0118] Rs represents the effective value of the repair strategy;

[0119] Ra represents the vulnerability risk assessment value, which is calculated by the vulnerability risk assessment algorithm unit and is used to measure the potential risk brought by the vulnerability before the repair work begins;

[0120] Ra post Represents the vulnerability risk assessment value after the vulnerability repair strategy is implemented. This is the value obtained by calculating the risk assessment value of the vulnerability risk again after the vulnerability repair work is completed. It reflects whether the repair strategy can effectively reduce the risk of the vulnerability;

[0121] R usedRepresents the number of patches actually used;

[0122] R represents the number of patches that can be used for the vulnerability;

[0123] In the calculation formula:

[0124] "Ra-Ra post " indicates the difference between the vulnerability risk assessment values ​​before and after the implementation of the repair strategy. This difference reflects the degree to which the repair work reduces the vulnerability risk. If the difference is large, it means that the repair strategy effectively reduces the risk of the vulnerability, which will have a positive impact on the calculation of the vulnerability repair effect value Re. On the contrary, if the difference is zero or close to zero, it means that the repair strategy does not significantly change the risk of the vulnerability, so the calculated vulnerability repair effect value Re will be reduced;

[0125] The "Ra-Ra post "The difference in this part is divided by the vulnerability repair effect value Ra, This part obtains the relative change of vulnerability risk assessment value before and after the implementation of the repair strategy. This relative change is a proportional value, which is not affected by the absolute value of the vulnerability repair effect value Ra. Therefore, it can more smoothly express the relative degree of vulnerability risk reduction caused by the repair strategy.

[0126] This part represents the square of the relative change in risk assessment value before and after the implementation of the repair strategy. The square calculation amplifies the impact of the relative change. Larger changes occupy a more important position in the formula and are used to highlight those repair strategies that significantly reduce vulnerability risks.

[0127] When R used When the value of is close to or equal to R, it means that the number of patches R that can be used for the vulnerability has been efficiently utilized, so that the “|RR used |" decreases, resulting in It is close to 1, which has a positive impact on the vulnerability repair effect value Re in the formula calculation.

[0128] In this embodiment:

[0129] In the process of repairing computer software security vulnerabilities, the repair effect is often difficult to observe or measure directly. The vulnerability repair effect value algorithm unit comprehensively considers multiple influencing factors such as the relative change in the risk assessment value before and after the implementation of the repair strategy, the utilization of the number of patches R that can be used, and calculates the vulnerability repair effect value Re. It can intuitively reflect the vulnerability repair effect after the implementation of the repair strategy, and can clearly see whether the repair strategy is effective and the size of the effect.

[0130] The calculated vulnerability repair effect value Re can not only be used to evaluate the repair effect, but also provide scientific and reliable data support for guiding the optimization of repair strategies. For example, when a security vulnerability is repaired, if the calculated vulnerability repair effect value Re is still low, it means that there may be problems with the repair strategy, such as improper resource allocation, ineffective repair method, etc. At this time, the repair strategy can be adjusted and optimized according to the changing trend of the Re value to improve the repair effect and resource utilization efficiency.

[0131] A method for repairing a computer software security vulnerability repair system comprises the following steps:

[0132] Use the system vulnerability scanning software in the vulnerability detection module to scan the computer, obtain the security vulnerabilities existing in the computer and the total number of system software and application software that each security vulnerability can affect, and classify the security vulnerabilities into four levels: low, medium, high, and severe, and then transmit the obtained data information to the database of the security vulnerability repair system;

[0133] Obtain the release time of the software and the latent time of the vulnerability through the registry information of the software affected by the security vulnerability and transmit them to the database of the security vulnerability repair system;

[0134] The data information in the database is transmitted to the data processing module through the data preprocessing module for decoding preprocessing, and the important parameters involved in the calculation in the calculation processing module are obtained;

[0135] Substitute the decoded parameter value into the vulnerability risk assessment value algorithm unit in the calculation processing module to calculate different vulnerability risk assessment values ​​Ra for different security vulnerabilities, and then substitute the vulnerability risk assessment value Ra as an input parameter into the repair strategy effective value algorithm unit to calculate the repair strategy effective value Rs;

[0136] According to the calculated effective value Rs of the repair strategy, the effectiveness of different vulnerability repair strategies is judged, and the vulnerabilities with high effective value Rs of the repair strategy are repaired first;

[0137] Vulnerability repair, using code editors, debuggers, patch management tools to repair vulnerabilities one by one. This is a relatively mature existing technology in the field of computer software security vulnerability repair, which will not be described in detail here;

[0138] Feedback on the repair effect: After the vulnerability is repaired, the vulnerability in the computer is rescanned using the system vulnerability scanning software, and the vulnerability risk assessment value is recalculated through the vulnerability risk assessment value algorithm unit in the calculation processing module to obtain the vulnerability risk assessment value Ra after the vulnerability repair strategy is implemented. post , the vulnerability risk assessment value Ra postSubstitute the original Ra value into the vulnerability repair effect value algorithm unit in the calculation processing module to calculate the vulnerability repair effect value Re;

[0139] The multiple vulnerability repair effect values ​​Re values ​​calculated after multiple repairs are uploaded to the database. According to the changing trend of the Re values, the repair strategy is adjusted and optimized to improve the repair effect and repair resource utilization efficiency of the computer software security vulnerability repair system.

[0140] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A computer software security vulnerability repair system and method, characterized in that: include: The vulnerability detection module is used to scan the computer through the system vulnerability scanning software, obtain the security vulnerabilities existing in the computer and the number of affected software Asc for each security vulnerability, and classify the security vulnerabilities into four levels: low, medium, high, and severe, and then transmit the obtained data information to the database of the security vulnerability repair system; The data preprocessing module is used to decode and preprocess the data information in the database to obtain parameter values ​​for calculation in the calculation processing module; The computing and processing module includes: The vulnerability risk assessment value algorithm unit, the repair strategy effective value algorithm unit and the vulnerability repair effect value algorithm unit are used to input the decoded parameters into the vulnerability risk assessment value algorithm unit to calculate different vulnerability risk assessment values ​​Ra for different security vulnerabilities, and then substitute the vulnerability risk assessment value Ra as an input parameter into the repair strategy effective value algorithm unit to calculate the repair strategy effective value Rs, and substitute different vulnerability risk assessment values ​​Ra and the repair strategy effective value Rs as input parameters into the vulnerability repair effect value algorithm unit to calculate the vulnerability repair effect value Re; The vulnerability repair module uses code editors, debuggers, and patch management tools to repair vulnerabilities.

2. A computer software security vulnerability repair system and method according to claim 1, characterized in that: The system vulnerability scanning software used in the vulnerability detection module is Nessus software, and the decoding preprocessing includes data cleaning and data standardization.

3. A computer software security vulnerability repair system and method according to claim 2, characterized in that: The code editor used in the vulnerability repair module is Visual Studio software, the debugger is GDB debugger, the patch management tool is Patch Management software, and the calculation processing module is run using Python software.

4. A computer software security vulnerability repair system and method according to claim 3, characterized in that: The vulnerability risk assessment value algorithm unit is as follows: in: Ra represents the vulnerability risk assessment value; Vc represents the vulnerability level, which is obtained after scanning the computer with Nessus software and is divided into four levels: low, medium, high, and severe. The corresponding parameter values ​​of the four levels are set to 1, 2, 3, and 4 respectively. The parameter values ​​corresponding to the four levels are included in the formula calculation of the vulnerability risk assessment value algorithm unit to show the influence of the vulnerability level Vc on the calculation of the vulnerability risk assessment value Ra; Asc represents the number of affected software; Kv represents the known degree value of the vulnerability; In the calculation formula: "log 10 (Kv+1)" represents a logarithmic function with base 10, which is used to convert the vulnerability known degree value Kv into a value on a logarithmic scale. As the vulnerability known degree value Kv increases, "log 10 The growth rate of the value of "(Kv+1)" will gradually slow down, which means that as the vulnerability becomes known to more people, the impact of the vulnerability known degree value Kv on the vulnerability risk assessment value Ra will gradually decrease; Use "log 10 (Kv+1)”, add 1 to the calculation result of this part to ensure that the vulnerability knowledge value Kv approaches 0, that is, when the vulnerability is less known, the formula "[1+log 10 The calculated value of this part (Kv+1)] will not be 0, which shows that even if the known degree value Kv of the vulnerability is very low, it still has potential risks.

5. A computer software security vulnerability repair system and method according to claim 4, characterized in that: The calculation formula of the vulnerability known degree value Kv is as follows: in: Kv represents the known degree value of the vulnerability; To represents the time from when the vulnerable software was released to when the current security vulnerability was fixed; Vnt represents the vulnerability latency time; ε represents the adjustment factor, which is used to adjust the fluctuation degree of the time between the release time of the vulnerable software and the time when the current security vulnerability is fixed To in the calculation of the vulnerability known degree value Kv; In the calculation formula: The numerator "To-Vnt" is the time from the release of the vulnerable software to the time when the current security vulnerability is fixed, To, minus the vulnerability latency time Vnt. It represents the time difference from the discovery of the vulnerability to the current security fix. The longer the time difference, the more time the vulnerability has been studied and fixed, and the higher the vulnerability known degree Kv. The denominator "To+ε" introduces the adjustment factor ε to ensure that even if the time between the release of the vulnerable software and the time when the current security vulnerability is fixed To approaches 0, the denominator will not be zero, ensuring that the vulnerability knowledge value Kv will not fluctuate excessively due to the numerical value of the time between the release of the vulnerable software and the time when the current security vulnerability is fixed To.

6. A computer software security vulnerability repair system and method according to claim 5, characterized in that: The repair strategy effective value algorithm unit is as follows: in: Rs represents the effective value of the repair strategy; Ra represents the vulnerability risk assessment value; R represents the number of patches that can be used for the vulnerability; R min Represents the minimum number of patches; that is, the minimum number of patches required for a vulnerability. In computer software security vulnerabilities, a script vulnerability requires at least one patch to be repaired. In the calculation formula: Minimum number of patches R min As a reference threshold in the formula, when the number of patches R that can be used for the vulnerability is less than the minimum number of patches R min When, in the denominator This part of the value will become very large, causing the calculated effective value of the repair strategy Rs to approach 0, indicating that when the number of patches R that can be used for the vulnerability is not enough to meet the repair requirements, the calculated effective value of the repair strategy Rs will be very low, emphasizing the importance of ensuring that the number of available patches meets the repair requirements.

7. A computer software security vulnerability repair system and method according to claim 6, characterized in that: The vulnerability repair effect value algorithm unit is as follows: in: Re represents the vulnerability repair effect value; Rs represents the effective value of the repair strategy; Ra represents the vulnerability risk assessment value; Ra post The vulnerability risk assessment value after the vulnerability repair strategy is implemented is the value obtained by calculating the secondary risk assessment value of the vulnerability after the first repair work of the vulnerability is completed, reflecting whether the repair strategy can effectively reduce the risk of the vulnerability; R used Represents the number of patches actually used; R represents the number of patches that can be used for the vulnerability; In the calculation formula: This part represents the square of the relative change in risk assessment value before and after the implementation of the repair strategy. The square calculation amplifies the impact of the relative change and occupies a more important position in the formula. It is used to highlight the repair strategy that significantly reduces the risk of the vulnerability. When R used When the value is close to R, it means that the number of patches R that can be used for the vulnerability has been efficiently utilized, which will result in the formula "|RR used |"The calculated value of this part decreases, resulting in It is close to 1, which has a positive impact on the vulnerability repair effect value Re in the formula calculation.

8. The repair method of a computer software security vulnerability repair system according to claim 1, characterized in that: The following steps are involved: Use the system vulnerability scanning software in the vulnerability detection module to scan the computer, obtain the security vulnerabilities existing in the computer and the number of affected software Asc for each security vulnerability, and classify the security vulnerabilities into four levels: low, medium, high, and severe, and then transmit the obtained data information to the database of the security vulnerability repair system; Obtain the release time of the software and the vulnerability latency time Vnt through the registry information of the software affected by the security vulnerability and transmit them to the database; The data information in the database is decoded and preprocessed by the data preprocessing module to obtain the parameter values ​​involved in the calculation in the calculation processing module; The parameter value obtained after decoding is input into the vulnerability risk assessment value algorithm unit in the calculation processing module to calculate different vulnerability risk assessment values ​​Ra for different security vulnerabilities, and then the vulnerability risk assessment value Ra is substituted as an input parameter into the repair strategy effective value algorithm unit to calculate the repair strategy effective value Rs; According to the calculated effective value Rs of the repair strategy, the effectiveness of different vulnerability repair strategies is judged, and the vulnerabilities with high effective value Rs of the repair strategy are repaired first; Vulnerability repair, using code editors, debuggers, and patch management tools to repair vulnerabilities; Feedback on the repair effect: after the vulnerability is repaired, the vulnerability in the computer is rescanned using the system vulnerability scanning software, and the vulnerability risk assessment value Ra is recalculated through the vulnerability risk assessment value algorithm unit in the calculation processing module to obtain the vulnerability risk assessment value Ra after the vulnerability repair strategy is implemented. post , the vulnerability risk assessment value Ra post Substitute the original Ra value into the vulnerability repair effect value algorithm unit in the calculation processing module to calculate the vulnerability repair effect value Re; The multiple vulnerability repair effect values ​​Re values ​​calculated after multiple repairs are uploaded to the database. According to the changing trend of the Re values, the repair strategy is adjusted and optimized to improve the repair effect and repair resource utilization efficiency of the computer software security vulnerability repair system.

Images