A computer software security vulnerability fixing system and method

Abstract

The application discloses a computer software security vulnerability repair system and method, relates to the technical field of computer software security, and can comprehensively consider factors such as the number of affected software Asc, the vulnerability level Vc and the vulnerability incubation time Vnt through mutual cooperation of three groups of algorithm units, calculate the effective value Rs of different repair strategies of different vulnerabilities, judge the risk of different vulnerabilities and the effective degree of the repair strategies based on the specific repair strategy effective value Rs obtained through calculation, and preferentially repair vulnerabilities with high repair strategy effective value Rs, so that repair resources and time can be more scientifically and effectively allocated under limited repair resources, the repair efficiency of computer software vulnerabilities is improved, the change trend of the Re value in the database can be obtained, the repair strategy can be adjusted and optimized, and the repair effect of the computer software security vulnerability repair system and the utilization efficiency of repair resources are further improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer software security, in particular to a computer software security vulnerability repair system and method. BACKGROUND

[0002] A computer, commonly known as a computer, is a modern intelligent electronic device capable of running according to a program, automatically and high-speed processing mass data. Computer software refers to the program and its documents in a computer system. The program is a description of the processing object and algorithm of the problem, usually written in a certain program design language. It must be loaded into a computer to run. With the rapid development of Internet technology, software applications are becoming increasingly complex. This complexity also means an increase in the number of security vulnerabilities in software. Software vulnerabilities provide attackers with opportunities to invade systems, which can lead to system paralysis, data leakage and other serious damage. Therefore, timely repair of software vulnerabilities is particularly important.

[0003] When a computer has a security vulnerability, it often affects multiple software and extends multiple vulnerabilities. The existing computer software security vulnerability repair method is to write a patch and directly repair the vulnerability, which cannot consider the severity of multiple vulnerability risks and estimate the effectiveness of each vulnerability repair strategy before vulnerability repair. Therefore, under limited repair resources, the efficiency of computer software security vulnerability repair is low, which is not conducive to use. SUMMARY

[0004] The purpose of the present application is to provide a computer software security vulnerability repair system and method to solve the problems raised in the background art.

[0005] To achieve the above purpose, the present application provides the following technical solution: a computer software security vulnerability repair system, comprising:

[0006] A vulnerability detection module is used to scan the computer through a system vulnerability scanning software, obtain the security vulnerabilities existing in the computer and the number of affected software Asc of each security vulnerability, and transmit the obtained data information to the database of the security vulnerability repair system after classifying the security vulnerabilities into four levels of low, medium, high and serious.

[0007] A data preprocessing module is used to decode and preprocess the data information in the database to obtain parameter values for calculation in the calculation processing module.

[0008] The calculation processing module specifically comprises:

[0009] The vulnerability risk assessment value algorithm unit, the remediation strategy effective value algorithm unit, and the vulnerability remediation effect value algorithm unit are used to input the decoded parameters into the vulnerability risk assessment value algorithm unit to calculate different vulnerability risk assessment values ​​Ra for different security vulnerabilities. Then, the vulnerability risk assessment value Ra is used as an input parameter and substituted into the remediation strategy effective value algorithm unit to calculate the remediation strategy effective value Rs.

[0010] The vulnerability remediation module uses a code editor, debugger, and patch management tools to fix vulnerabilities.

[0011] Optionally, the system vulnerability scanning software used in the vulnerability detection module is Nessus software, and the decoding preprocessing includes data cleaning and data standardization.

[0012] Optionally, the code editor used in the vulnerability remediation module is Visual Studio software, the debugger is GDB debugger, and the patch management tool is Patch Management software.

[0013] Optionally, the vulnerability risk assessment algorithm unit is as follows:

[0014]

[0015] in:

[0016] Ra represents the vulnerability risk assessment value;

[0017] Vc represents the vulnerability level, which is determined by scanning the computer with Nessus software. It is divided into four levels: low, medium, high, and critical, with corresponding parameter values ​​of 1, 2, 3, and 4, respectively.

[0018] Asc represents the number of affected software programs, which is the total number of system software and application software in a computer affected by the vulnerability.

[0019] Kv represents the level of vulnerability awareness;

[0020] In the formula calculation:

[0021] log 10 The part "(Kv+1)" represents a base-10 logarithmic function used to convert the vulnerability awareness value Kv into a logarithmic value. As the vulnerability awareness value Kv increases, "log..." 10 The growth rate of the value "(Kv+1)" will gradually slow down, which means that as more people become aware of the vulnerability, the impact of the vulnerability awareness value Kv on the vulnerability risk assessment value Ra will gradually decrease.

[0022] Use "log" 10The calculation result of "(Kv+1)" is incremented by 1 to ensure that the vulnerability awareness value Kv approaches 0. That is, when the vulnerability awareness is low, the formula "[1+log 10 The calculated value of "(Kv+1)" will not be 0, and it reflects that even if the known level of the vulnerability Kv is very low, there is still a potential risk.

[0023] Optionally, the formula for calculating the vulnerability awareness value Kv is as follows:

[0024]

[0025] in:

[0026] Kv represents the level of vulnerability awareness;

[0027] To represents the time between the release of the vulnerable software and the current patching of the security vulnerability, which is the length of time the software is exposed to potential attackers during use;

[0028] Vnt represents the vulnerability latency time, which is the period from software release to actual detection of a vulnerability.

[0029] ε represents the adjustment factor;

[0030] In the formula calculation:

[0031] The numerator "To-Vnt" is calculated by subtracting the vulnerability latency time Vnt from the time To between the release of the vulnerable software and the current security vulnerability patch. It represents the time difference between the discovery of the vulnerability and the current security patch. The longer the time difference, the more time the vulnerability has been studied and patched, and the higher the vulnerability awareness level Kv.

[0032] The denominator "To+ε" introduces an adjustment factor ε to ensure that even if the time between the release of the vulnerable software and the time between the release and the patching of the current security vulnerability (To) approaches 0, the denominator will not be zero. This ensures that the vulnerability awareness value Kv will not fluctuate excessively due to the magnitude of the time between the release of the vulnerable software and the patching of the current security vulnerability (To), thus more accurately reflecting the vulnerability awareness value Kv of the discovered vulnerability.

[0033] Optionally, the effective value algorithm unit of the repair strategy is as follows:

[0034]

[0035] in:

[0036] Rs represents the effective value of the repair strategy;

[0037] Ra represents the vulnerability risk assessment value;

[0038] R represents the number of patches available for the vulnerability. It is obtained by adding the number of patches available for fixing the vulnerability from the software's official website to the number of patches that security personnel can create based on the vulnerability type.

[0039] R min This represents the minimum number of patches required; that is, the minimum number of patches needed to fix a vulnerability. In computer software security vulnerabilities, a script vulnerability requires at least one patch to fix it.

[0040] In the formula calculation:

[0041] Minimum number of patches R min In the formula, a reference threshold is used when the number of patches R available for a vulnerability is less than the minimum number of patches R. min At that time, in the denominator This value will become very large, causing the calculated effective value Rs of the remediation strategy to approach 0. This means that when the number of patches R available for the vulnerability is insufficient to meet the remediation requirements, the calculated effective value Rs of the remediation strategy will be very low, emphasizing the importance of ensuring that the number of available patches meets the remediation requirements.

[0042] Optionally, the algorithm unit for the vulnerability repair effect value is as follows:

[0043]

[0044] in:

[0045] Re represents the vulnerability remediation effectiveness value;

[0046] Rs represents the effective value of the repair strategy;

[0047] Ra represents the vulnerability risk assessment value;

[0048] Ra post The vulnerability risk assessment value, representing the vulnerability remediation strategy after its implementation, is the value obtained by recalculating the risk of the vulnerability after a remediation is completed. It reflects whether the remediation strategy can effectively reduce the risk of the vulnerability.

[0049] R used This represents the actual number of patches used;

[0050] R represents the number of patches that can be used to address the vulnerability;

[0051] In the formula calculation:

[0052] This part represents the square of the relative change in risk assessment value before and after the implementation of the remediation strategy. The square calculation amplifies the impact of the relative change and occupies a more important position in the formula, which is used to highlight the remediation strategy that significantly reduces the risk of vulnerabilities.

[0053] When R used When the value is close to R, it indicates that the number of patches R available for the vulnerability has been efficiently utilized, which will lead to the formula "|RR used The calculated value of this part decreases, resulting in A value close to 1 has a positive impact on the vulnerability remediation effect value Re in the formula calculation.

[0054] This invention also provides a method for patching computer software security vulnerabilities, comprising the following steps:

[0055] The system vulnerability scanning software in the vulnerability detection module scans the computer to obtain the security vulnerabilities present on the computer and the number of software affected by each security vulnerability (Asc). The security vulnerabilities are classified into four levels: low, medium, high, and severe, and the obtained data information is transmitted to the database of the security vulnerability remediation system.

[0056] The release date and vulnerability latency (Vnt) of the software affected by the security vulnerability are obtained from the registry information and transmitted to the database.

[0057] The data preprocessing module decodes and preprocesses the data information in the database to obtain the parameter values ​​that will be used in the calculation in the calculation module.

[0058] The decoded parameter values ​​are input into the vulnerability risk assessment value algorithm unit in the calculation and processing module to calculate different vulnerability risk assessment values ​​Ra for different security vulnerabilities. Then, the vulnerability risk assessment value Ra is used as an input parameter and substituted into the remediation strategy effective value algorithm unit to calculate the remediation strategy effective value Rs.

[0059] Based on the calculated effective value Rs of the remediation strategy, the effectiveness of different vulnerability remediation strategies is judged, and vulnerabilities with high effective values ​​Rs are remediated first.

[0060] Vulnerability remediation involves using code editors, debuggers, and patch management tools to fix vulnerabilities.

[0061] Feedback on the remediation effect: After the vulnerability is remediated, the system vulnerability scanning software rescans the computer for vulnerabilities, and the vulnerability risk assessment value Ra is recalculated by the vulnerability risk assessment value algorithm unit in the calculation and processing module. This yields the vulnerability risk assessment value Ra after the implementation of the vulnerability remediation strategy. post The vulnerability risk assessment value Ra post The original Ra value is substituted into the vulnerability repair effect value algorithm unit in the calculation and processing module to calculate the vulnerability repair effect value Re.

[0062] Multiple vulnerability remediation effectiveness values ​​(Re values) calculated after multiple remediations are uploaded to the database. Based on the changing trends of the Re values, the remediation strategy is adjusted and optimized to improve the remediation effectiveness and resource utilization efficiency of the computer software security vulnerability remediation system.

[0063] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0064] I. This invention, through the cooperation of three sets of algorithm units, constitutes the core architecture of a computer software security vulnerability repair method. During the process of repairing computer software security vulnerabilities, it can comprehensively consider factors such as the number of affected software (Asc), vulnerability level (Vc), and vulnerability latency, calculate the effective value (Rs) of different repair strategies, and based on the calculated effective value (Rs) of the specific repair strategy, judge the risk of different vulnerabilities and the effectiveness of the repair strategy, and prioritize the repair of vulnerabilities with high effective values ​​(Rs). This allows for a more scientific and effective allocation of repair resources and time with limited repair resources, thereby improving the efficiency of computer software vulnerability repair.

[0065] Second, after a vulnerability is patched, the vulnerability risk assessment value Ra after the implementation of the vulnerability patching strategy is recalculated by the vulnerability risk assessment value algorithm unit in the calculation processing module. post Then, the vulnerability risk assessment value Ra post The original Ra value, along with the vulnerability repair effect value, is substituted into the vulnerability repair effect value algorithm unit in the calculation and processing module to obtain the vulnerability repair effect value Re. The multiple vulnerability repair effect values ​​Re obtained after multiple repairs are uploaded to the database. Based on the changing trend of the Re value, the repair strategy can be adjusted and optimized to further improve the repair effect and the utilization efficiency of repair resources of the computer software security vulnerability repair system. Attached Figure Description

[0066] Fig. 1 A flowchart of a computer software security vulnerability repair system and method;

[0067] Fig. 2 This is a schematic diagram of the overall structure of a computer software security vulnerability repair system and method. Detailed Implementation

[0068] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0069] Example 1, please refer toFigs. 1-2 This invention provides a computer software security vulnerability repair system, comprising:

[0070] The vulnerability detection module scans the computer with system vulnerability scanning software to obtain the security vulnerabilities existing in the computer and the total number of system software and application software affected by each security vulnerability. After classifying the security vulnerabilities into four levels—low, medium, high, and severe—the obtained data information is transmitted to the database of the security vulnerability remediation system.

[0071] The data preprocessing module is used to transmit data information from the database to the data processing module for decoding and preprocessing, so as to obtain the important parameters that are used in the calculation in the calculation processing module.

[0072] The computational processing module specifically includes:

[0073] The vulnerability risk assessment value algorithm unit, the remediation strategy effective value algorithm unit, and the vulnerability remediation effect value algorithm unit are used to input the decoded parameters into the vulnerability risk assessment value algorithm unit to calculate different vulnerability risk assessment values ​​Ra for different security vulnerabilities. Then, the vulnerability risk assessment value Ra is used as an input parameter and substituted into the remediation strategy effective value algorithm unit to calculate the remediation strategy effective value Rs.

[0074] The vulnerability remediation module uses a code editor, debugger, and patch management tools to fix vulnerabilities one by one.

[0075] In this embodiment:

[0076] This invention, through the cooperation of three algorithm units, constitutes the core architecture of a computer software security vulnerability repair method. During the repair process, it comprehensively considers factors such as the number of affected software (Asc), vulnerability level (Vc), and vulnerability latency, calculating the vulnerability risk assessment value Ra and the effective value Rs of different repair strategies for different vulnerabilities in the computer software. Based on specific scientific values, it can determine the risk of different vulnerabilities and the effectiveness of repair strategies, prioritizing the repair of vulnerabilities with high effective values ​​(Rs). This allows for a more scientific and effective allocation of repair resources and time with limited resources, improving the efficiency of computer software vulnerability repair.

[0077] Furthermore, after the vulnerability is patched, the computer is rescanned for vulnerabilities using system vulnerability scanning software, and the vulnerability risk assessment value Ra after the implementation of the vulnerability patching strategy is recalculated by the vulnerability risk assessment value algorithm unit in the calculation and processing module. post The vulnerability risk assessment value Ra postThe original Ra value, along with the vulnerability repair effect value, is substituted into the vulnerability repair effect value algorithm unit in the calculation and processing module to calculate the vulnerability repair effect value Re. After multiple repairs, the multiple vulnerability repair effect values ​​Re calculated are uploaded to the database. Based on the changing trend of the Re value, the repair strategy can be adjusted and optimized to further improve the repair effect of the computer software security vulnerability repair system and the utilization efficiency of repair resources.

[0078] Please see Figs. 1-2 The vulnerability risk assessment algorithm unit is as follows:

[0079]

[0080] in:

[0081] Ra represents the vulnerability risk assessment value;

[0082] Vc represents the vulnerability level, which is obtained after scanning the computer with Nessus software and is divided into four levels: low, medium, high, and severe. Since the vulnerability level Vc has a positive impact on the calculation of the vulnerability risk assessment value Ra, the corresponding parameter values ​​for the four levels are set to 1, 2, 3, and 4, respectively. The parameter values ​​corresponding to the four levels of low, medium, high, and severe are included in the formula calculation of the vulnerability risk assessment value algorithm unit to indicate the degree of influence of the vulnerability level Vc on the calculation of the vulnerability risk assessment value Ra.

[0083] Asc represents the number of affected software programs, which is the total number of system software and application software in a computer affected by the vulnerability.

[0084] Kv represents the level of vulnerability awareness;

[0085] In the formula calculation:

[0086] This part represents the square root of the total number of system software and application software affected by the vulnerability. Taking the square root can balance the difference between large-scale impact and small-scale impact, making the impact of the total number of system software and application software affected by the vulnerability Asc on the vulnerability risk assessment value Ra more smooth.

[0087] log 10 The part "(Kv+1)" represents a base-10 logarithmic function used to convert the vulnerability awareness value Kv into a logarithmic value. As the vulnerability awareness value Kv increases, "log..." 10 The growth rate of the value "(Kv+1)" will gradually slow down, reflecting that as more people become aware of the vulnerability, the additional vulnerability awareness value Kv will gradually have a smaller impact on the vulnerability risk assessment value Ra.

[0088] Use "log" 10The calculation result of "(Kv+1)" is incremented by 1 to ensure that the known level value Kv approaches 0. That is, when the known level of the vulnerability is low, the formula "[1+log 10 The adjustment factor in the part "(Kv+1)" will not be 0, and it also reflects that even if the known value of the vulnerability Kv is very low, it still poses a risk.

[0089] The formula for calculating the vulnerability awareness level value Kv is as follows:

[0090]

[0091] in:

[0092] Kv represents the level of vulnerability awareness;

[0093] To represents the time between the release of the vulnerable software and the current patching of the security vulnerability. This time span measures the time elapsed from software release to vulnerability patching and reflects the length of time the software is exposed to potential attackers during use.

[0094] Vnt represents the vulnerability latency time, which is obtained by subtracting the software release time from the time it takes for the vulnerability to be detected after scanning the computer with Nessus software. In other words, it is the latency period from the release of the software to its actual detection.

[0095] ε represents an adjustment factor used to adjust the fluctuation of the vulnerability awareness value Kv in the calculation of the time between the release time of the vulnerable software and the time To of the current security vulnerability patch.

[0096] In the formula calculation:

[0097] The numerator "To-Vnt" represents the time difference between the discovery of a vulnerability and the current security fix. The longer this time difference, the more time the vulnerability has been studied and fixed, and the higher the vulnerability's known level (Kv).

[0098] The denominator "To+ε" introduces an adjustment factor ε to ensure that even if the release time of the vulnerable software is close to 0 from the time To is the time To for patching the current security vulnerability, the denominator will not be zero. Normalization ensures that the calculation of the vulnerability awareness value Kv is comparable under different circumstances, and ensures that the vulnerability awareness value Kv will not fluctuate excessively due to the absolute value of To, so as to more accurately reflect the awareness of the vulnerability.

[0099] In this embodiment:

[0100] By comprehensively considering multiple influencing factors such as the vulnerability level obtained after Nessus software scans the computer, the number of affected software programs (Asc), and the vulnerability awareness value (Kv), the vulnerability risk assessment value Ra is calculated for different vulnerabilities. This can measure the vulnerability risk of multiple software programs on the computer, providing scientific and reliable data support for security teams to remediate vulnerabilities. It enables remediation decisions to be based on specific scientific data, rather than relying on subjective judgment or experience. By comparing the different vulnerability risk assessment values ​​Ra of different vulnerabilities, security teams can prioritize vulnerabilities with higher risks, thereby allocating resources and time more effectively and improving the efficiency of computer software vulnerability remediation.

[0101] Furthermore, since the vulnerability level Vc, the number of affected software Asc, and the vulnerability awareness value Kv involved in the calculation of the vulnerability risk assessment value algorithm unit are variable with each calculation of the vulnerability risk assessment value Ra, the vulnerability risk assessment value Ra can be dynamically updated as these parameters change. This allows the vulnerability risk assessment value Ra to reflect the real-time status of the vulnerability, including whether the severity of the vulnerability has increased, whether new exploitation methods have been discovered, and whether the vulnerability has become known to more people. This dynamic assessment capability helps security teams respond to new threats and vulnerabilities in a timely manner.

[0102] Please see Figs. 1-2 The effective value algorithm unit for the repair strategy is as follows:

[0103]

[0104] in:

[0105] Rs represents the effective value of the repair strategy;

[0106] Ra represents the vulnerability risk assessment value;

[0107] R represents the number of patches available for the vulnerability. It is obtained by adding the number of patches available for fixing the vulnerability from the software's official website to the number of patches that security personnel can create based on the vulnerability type.

[0108] R min This represents the minimum number of patches required; that is, the minimum number of patches needed to fix a vulnerability. In computer software security vulnerabilities, a script vulnerability requires at least one patch to fix it.

[0109] In the formula calculation:

[0110] Minimum number of patches R min In the formula, a reference threshold is used when the number of patches R available for a vulnerability is less than the minimum number of patches R. min When, the negative of e in the denominator (RR) minThe power of ) will become very large, causing the calculated effective value Rs of the remediation strategy to be close to 0. This means that when the number of patches R available for the vulnerability is insufficient to meet the remediation requirements, the effectiveness of the remediation strategy will be very low, emphasizing the importance of ensuring that the number of available patches meets the remediation requirements.

[0111] In this embodiment:

[0112] The effective value algorithm unit for the remediation strategy comprehensively considers the vulnerability risk assessment value Ra, the number of patches that can be used for the vulnerability R, and the minimum number of patches R. mi Multiple influencing factors are considered to calculate the effective value (Rs) of the remediation strategy. This value serves as a quantitative indicator for evaluating the effectiveness of the remediation strategy and can intuitively reflect the expected effect of the remediation strategy under given resource conditions. It helps security teams optimize resource allocation based on the level of the Rs value, allocating limited remediation resources to software vulnerabilities that are expected to have better remediation effects. This resource allocation method can ensure that resources are used most effectively and improve the overall remediation efficiency.

[0113] Furthermore, in addition to being used for current vulnerability remediation decisions, the calculated effective value (Rs) of remediation strategies can also serve as an important reference for long-term planning. By analyzing and comparing historical Rs values, security teams can identify which remediation strategies are more effective at fixing which vulnerabilities, and which remediation strategies have lower effective values ​​and need to be improved or optimized. This information helps to formulate more scientific and reasonable long-term security plans in computer software security vulnerability remediation systems, further improving the system's security and efficiency.

[0114] Please see Figs. 1-2 The algorithm unit for calculating the vulnerability remediation effect value is as follows:

[0115]

[0116] in:

[0117] Re represents the vulnerability remediation effectiveness value;

[0118] Rs represents the effective value of the repair strategy;

[0119] Ra represents the vulnerability risk assessment value, which is calculated by the vulnerability risk assessment value algorithm unit and is used to measure the potential risk posed by the vulnerability before the remediation work begins.

[0120] Ra post This represents the vulnerability risk assessment value after the implementation of the vulnerability remediation strategy. This value is obtained by recalculating the risk of the vulnerability after one remediation work is completed. It reflects whether the remediation strategy can effectively reduce the risk of the vulnerability.

[0121] R usedThis represents the actual number of patches used;

[0122] R represents the number of patches that can be used to address the vulnerability;

[0123] In the formula calculation:

[0124] “Ra-Ra post "This represents the difference between the vulnerability risk assessment value before and after the implementation of the remediation strategy. This difference reflects the degree to which the remediation work reduces the vulnerability risk. If the difference is large, it means that the remediation strategy has effectively reduced the vulnerability risk and will have a positive impact on the calculation of the vulnerability remediation effect value Re. Conversely, if the difference is zero or close to zero, it means that the remediation strategy has not significantly changed the vulnerability risk, and therefore the calculated vulnerability remediation effect value Re will be reduced.

[0125] Ra-Ra post "This difference divided by the vulnerability remediation effect value Ra," This part shows the relative change in vulnerability risk assessment value before and after the implementation of the remediation strategy. This relative change is a ratio value, which is not affected by the absolute size of the vulnerability remediation effect value Ra. Therefore, it can more smoothly represent the relative degree of vulnerability risk reduction of the remediation strategy.

[0126] This section represents the square of the relative change in risk assessment value before and after the implementation of the remediation strategy. The square calculation amplifies the impact of the relative change, and larger changes take on a more important role in the formula, highlighting remediation strategies that significantly reduce vulnerability risk.

[0127] When R used When the value of is close to or equal to R, it indicates that the number of patches R available for the vulnerability has been efficiently utilized, thus making "|RR" in the formula... used |" Decrease, leading to A value close to 1 has a positive impact on the vulnerability remediation effect value Re in the formula calculation.

[0128] In this embodiment:

[0129] In the process of patching computer software security vulnerabilities, the patching effect is often difficult to observe or measure directly. However, by comprehensively considering multiple influencing factors such as the relative change in risk assessment value before and after the implementation of the patching strategy, the number of available patches R, and the utilization of the vulnerability patching effect value Re, the vulnerability patching effect value Re can be calculated. This can intuitively reflect the vulnerability patching effect after the implementation of the patching strategy, and clearly show whether the patching strategy is effective and the magnitude of the effect.

[0130] Furthermore, the calculated vulnerability remediation effect value Re can not only be used to evaluate the remediation effect, but also provide scientific and reliable data support for guiding the optimization of remediation strategies. For example, if the calculated vulnerability remediation effect value Re is still low after a security vulnerability is remediated, it indicates that there may be a problem with the remediation strategy, such as improper resource allocation or ineffective remediation methods. In this case, the remediation strategy can be adjusted and optimized based on the trend of the Re value to improve the remediation effect and resource utilization efficiency.

[0131] A method for patching computer software security vulnerabilities includes the following steps:

[0132] The system vulnerability scanning software in the vulnerability detection module scans the computer to obtain the security vulnerabilities present in the computer and the total number of system software and application software affected by each security vulnerability. The security vulnerabilities are classified into four levels: low, medium, high, and severe, and the obtained data information is transmitted to the database of the security vulnerability remediation system.

[0133] The release date and vulnerability latency of the software affected by the security vulnerability are obtained from the registry information and transmitted to the database of the security vulnerability remediation system.

[0134] The data preprocessing module transmits the data information from the database to the data processing module for decoding and preprocessing, thereby obtaining the important parameters that are used in the calculation in the computation processing module.

[0135] The decoded parameter values ​​are substituted into the vulnerability risk assessment value algorithm unit in the calculation and processing module to calculate the different vulnerability risk assessment values ​​Ra for different security vulnerabilities. Then, the vulnerability risk assessment value Ra is substituted into the effective value algorithm unit of the repair strategy as an input parameter to calculate the effective value Rs of the repair strategy.

[0136] Based on the calculated effective value Rs of the remediation strategy, the effectiveness of different vulnerability remediation strategies is judged, and vulnerabilities with high effective values ​​Rs are remediated first.

[0137] Vulnerability patching involves using code editors, debuggers, and patch management tools to fix vulnerabilities one by one. This is a relatively mature existing technology in the field of computer software security vulnerability patching, and will not be described in detail here.

[0138] Feedback on the remediation effect: After the vulnerability is remediated, the system vulnerability scanning software rescans the computer for vulnerabilities, and the vulnerability risk assessment value is recalculated by the vulnerability risk assessment value algorithm unit in the calculation and processing module to obtain the vulnerability risk assessment value Ra after the implementation of the vulnerability remediation strategy. post The vulnerability risk assessment value Ra postThe original Ra value is substituted into the vulnerability repair effect value algorithm unit in the calculation and processing module to calculate the vulnerability repair effect value Re.

[0139] Multiple vulnerability remediation effectiveness values ​​(Re values) calculated after multiple remediations are uploaded to the database. Based on the changing trends of the Re values, the remediation strategy is adjusted and optimized to improve the remediation effectiveness and resource utilization efficiency of the computer software security vulnerability remediation system.

[0140] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A computer software security vulnerability repair system, characterized in that, include: The vulnerability detection module is used to scan the computer with system vulnerability scanning software, obtain the security vulnerabilities existing in the computer and the number of software affected by each security vulnerability (Asc), and then transmit the obtained data information to the database of the security vulnerability remediation system after classifying the security vulnerabilities into four levels: low, medium, high and severe. The data preprocessing module is used to decode and preprocess the data information in the database to obtain the parameter values ​​that will be used in the calculation in the calculation module. The computational processing module specifically includes: The vulnerability risk assessment value algorithm unit, the remediation strategy effective value algorithm unit, and the vulnerability remediation effect value algorithm unit are used to input the decoded parameters into the vulnerability risk assessment value algorithm unit to calculate different vulnerability risk assessment values ​​Ra for different security vulnerabilities, and then use the vulnerability risk assessment value Ra as input parameters into the remediation strategy effective value algorithm unit to calculate the remediation strategy effective value Rs. The vulnerability risk assessment value Ra and the remediation strategy effective value Rs are used as input parameters into the vulnerability remediation effect value algorithm unit to calculate the vulnerability remediation effect value Re. The vulnerability remediation module uses a code editor, debugger, and patch management tools to fix vulnerabilities. The system vulnerability scanning software used in the vulnerability detection module is Nessus software, and the decoding preprocessing includes data cleaning and data standardization; The vulnerability repair module uses Visual Studio as its code editor, GDB as its debugger, Patch Management software as its patch management tool, and Python software to run its computational processing module. The vulnerability risk assessment algorithm unit is as follows: ； in: Ra represents the vulnerability risk assessment value; Vc represents the vulnerability level, which is obtained after scanning the computer with Nessus software. It is divided into four levels: low, medium, high, and severe. The corresponding parameter values ​​for the four levels are set to 1, 2, 3, and 4, respectively. The parameter values ​​corresponding to the four levels are used in the formula calculation of the vulnerability risk assessment value algorithm unit to show the degree of influence of the vulnerability level Vc on the calculation of the vulnerability risk assessment value Ra. Asc represents the number of affected software programs; Kv represents the level of vulnerability awareness; In the formula calculation: " "This part represents a base-10 logarithmic function used to convert the vulnerability awareness value Kv into a value on a logarithmic scale. As the vulnerability awareness value Kv increases,..." "The growth rate of this value will gradually slow down, which means that as more people become aware of the vulnerability, the vulnerability awareness value Kv will gradually reduce its impact on the vulnerability risk assessment value Ra." use" "Increase the calculation result of this part by 1 to ensure that the vulnerability awareness value Kv approaches 0, that is, when the vulnerability awareness is low, the formula..." "The calculated value of this part will not be 0, reflecting that even if the known level value Kv of the vulnerability is very low, it still poses a potential risk." 2. The computer software security vulnerability repair system according to claim 1, characterized in that: The formula for calculating the vulnerability awareness level value Kv is as follows: ； in: Kv represents the level of vulnerability awareness; To represents the time between the release of the vulnerable software and the current patching of the security vulnerability; Vnt represents the vulnerability's latency period; ε represents an adjustment factor used to adjust the fluctuation of the vulnerability awareness value Kv in the calculation of the time between the release time of the vulnerable software and the time To of the current security vulnerability patch. In the formula calculation: Molecular part "The time difference between the release time of the vulnerable software and the current security vulnerability patching time To minus the vulnerability latency time Vnt represents the time difference between the vulnerability being discovered and the current security patching time. The longer the time difference, the more time the vulnerability has been studied and patched, and the higher the vulnerability awareness level Kv." denominator part By introducing an adjustment factor ε, it is ensured that even if the release time of the vulnerable software is close to 0 and the time To of the current security vulnerability is fixed, the denominator will not be zero, thus ensuring that the vulnerability awareness value Kv will not fluctuate excessively due to the magnitude of the time To between the release time of the vulnerable software and the current security vulnerability is fixed.

3. The computer software security vulnerability repair system according to claim 2, characterized in that: The effective value algorithm unit of the repair strategy is as follows: ； in: Rs represents the effective value of the repair strategy; Ra represents the vulnerability risk assessment value; R represents the number of patches that can be used to address the vulnerability; R min This represents the minimum number of patches required; that is, the minimum number of patches needed to fix a vulnerability. In computer software security vulnerabilities, a script vulnerability requires at least one patch. In the formula calculation: Minimum number of patches R min In the formula, a reference threshold is used when the number of patches R available for a vulnerability is less than the minimum number of patches R. min At that time, in the denominator " "This part of the value will become very large, causing the calculated effective value Rs of the remediation strategy to approach 0. This means that when the number of patches R available for the vulnerability is insufficient to meet the remediation requirements, the calculated effective value Rs of the remediation strategy will be very low, emphasizing the importance of ensuring that the number of available patches meets the remediation requirements." 4. A computer software security vulnerability repair system according to claim 3, characterized in that: The algorithm unit for calculating the vulnerability remediation effect value is as follows: ； in: Re represents the vulnerability remediation effectiveness value; Ra represents the vulnerability risk assessment value; Ra post The vulnerability risk assessment value, representing the vulnerability remediation strategy after its implementation, is the value obtained by performing a second risk assessment on the vulnerability after the first remediation work is completed. It reflects whether the remediation strategy can effectively reduce the risk of the vulnerability. R used This represents the actual number of patches used; R represents the number of patches that can be used to address the vulnerability; In the formula calculation: " "This part represents the square of the relative change in risk assessment value before and after the implementation of the remediation strategy. The square calculation amplifies the impact of the relative change and occupies a more important position in the formula, which is used to highlight the remediation strategy that significantly reduces the risk of vulnerabilities." When R used When the value is close to R, it indicates that the number of patches R available for the vulnerability has been efficiently utilized, which will lead to the formula " "The reduction in this part of the calculated value leads to..." A value close to 1 has a positive impact on the vulnerability remediation effect value Re in the formula calculation.

5. The repair method of a computer software security vulnerability repair system according to claim 1, characterized in that, Includes the following steps: The system vulnerability scanning software in the vulnerability detection module scans the computer to obtain the security vulnerabilities present on the computer and the number of software affected by each security vulnerability (Asc). The security vulnerabilities are classified into four levels: low, medium, high, and severe, and the obtained data information is transmitted to the database of the security vulnerability remediation system. The release date and vulnerability latency (Vnt) of the software affected by the security vulnerability are obtained from the registry information and transmitted to the database. The data preprocessing module decodes and preprocesses the data information in the database to obtain the parameter values ​​that will be used in the calculation in the calculation module. The decoded parameter values ​​are input into the vulnerability risk assessment value algorithm unit in the calculation and processing module to calculate different vulnerability risk assessment values ​​Ra for different security vulnerabilities. Then, the vulnerability risk assessment value Ra is used as an input parameter and substituted into the remediation strategy effective value algorithm unit to calculate the remediation strategy effective value Rs. Based on the calculated effective value Rs of the remediation strategy, the effectiveness of different vulnerability remediation strategies is judged, and vulnerabilities with high effective values ​​Rs are remediated first. Vulnerability remediation involves using code editors, debuggers, and patch management tools to fix vulnerabilities. Feedback on the remediation effect: After the vulnerability is remediated, the system vulnerability scanning software rescans the computer for vulnerabilities, and the vulnerability risk assessment value Ra is recalculated by the vulnerability risk assessment value algorithm unit in the calculation and processing module. This yields the vulnerability risk assessment value Ra after the implementation of the vulnerability remediation strategy. post The vulnerability risk assessment value Ra post The original Ra value is substituted into the vulnerability repair effect value algorithm unit in the calculation and processing module to calculate the vulnerability repair effect value Re. Multiple vulnerability remediation effectiveness values ​​(Re values) calculated after multiple remediations are uploaded to the database. Based on the changing trends of the Re values, the remediation strategy is adjusted and optimized to improve the remediation effectiveness and resource utilization efficiency of the computer software security vulnerability remediation system.

Images