Software security management method and system based on artificial intelligence

Abstract

The invention discloses a software security management method and system based on artificial intelligence, relates to the technical field of software security management, and discloses a software security problem prediction module, a software scene resistance analysis module, a software crisis problem marking module and a software crisis problem processing module. A software security problem prediction module and a software scene defense analysis module are arranged, each problem means possibly encountered by software is simulated by constructing a problem means simulation scene for various problem means, and then the defense effect of the software for each problem means is simulated and analyzed. A software crisis problem marking module and a software crisis problem processing module are arranged, various management intervention problems of software are deeply analyzed in combination with prediction possibility and resistance expressivity, the subsequent security crisis problems of the software are analyzed, the processing sequence of the security crisis problems is ranked, and the security crisis problem processing efficiency is improved. And the subsequent security crisis problem of the software is preferentially processed.

Description

Technical Field

[0001] The present invention relates to the technical field of software security management, and more specifically, to a software security management method and system based on artificial intelligence. Background Art

[0002] With the rapid development of information technology, software is increasingly used in modern society, covering various fields from personal entertainment to business operations, national security, etc. However, the software security issues that follow are becoming increasingly prominent, becoming an important factor restricting the healthy development of the software industry.

[0003] In recent years, the rise of artificial intelligence technology has provided new solutions for software security management. By using advanced technologies such as machine learning and deep learning, software security issues can be predicted and analyzed more accurately and efficiently. Among them, the LSTM (Long Short-Term Memory Network) model, as a special recurrent neural network, has shown great potential in predicting software security issues with its powerful time series data processing capabilities.

[0004] However, existing AI-based software security management methods still have many shortcomings. These methods often only focus on the prediction of security issues, while ignoring the analysis of the software's ability to resist potential security issues. This will lead to difficulties in deciding the priority of handling these security issues when it is predicted that multiple security issues may occur at the same time in the later stage of the software, resulting in some security issues not being handled in a timely manner.

[0005] Therefore, the present invention proposes a software security management method and system based on artificial intelligence. Summary of the invention

[0006] In view of the deficiencies in the prior art, the purpose of the present invention is to provide a software security management method and system based on artificial intelligence.

[0007] To achieve the above object, the present invention provides the following technical solutions:

[0008] The software security management system based on artificial intelligence includes software security problem prediction module, software scenario defense analysis module, software crisis problem marking module, and software crisis problem handling module;

[0009] The software security problem prediction module obtains the problem prediction index Zmx of various security problems in the software every time a software security management cycle passes, and determines the management intervention problem in the software based on the comparison result of the problem prediction index and the problem prediction threshold index;

[0010] The software scenario resistance analysis module obtains scenario resistance indexes of various management intervention problems when management intervention problems occur in the software;

[0011] The software crisis problem marking module obtains the security management index of various management intervention problems based on the problem prediction index and scenario resistance index of the management intervention problem, and determines the security crisis problem in the software based on the comparison result of the security management index and the security management threshold index;

[0012] The software crisis problem processing module sorts all security crisis problems in order from small to large according to the values ​​of the security management index, and processes the security crisis problems in the software in the sorted order.

[0013] Furthermore, a problem prediction index of a security issue is obtained through the following steps: obtaining software operation characteristics of y consecutive software security management cycles before the current time, combining the software operation characteristics of y software security management cycles into a software operation feature set, obtaining a problem prediction model for the security issue, inputting the software operation feature set into the problem prediction model, and the problem prediction model outputs the problem prediction index of the security issue.

[0014] Furthermore, the software operation characteristics of a software security management cycle are obtained through the following steps: collecting the operation data of the software within a software security management cycle, performing feature extraction on the operation data, and obtaining the software operation characteristics.

[0015] Furthermore, a scenario resistance index of a management intervention problem is obtained through the following steps: determining that a management intervention problem contains various problem means, constructing problem means simulation scenarios for various problem means, and then obtaining means resistance indexes of various problem means, matching all problem means two by two into a resistance comparison group, and obtaining a resistance stability index Gsp of each resistance comparison group, s = 1, 2, ..., S, S is the total number of resistance comparison groups, s is the number of the resistance comparison group, setting the resistance stability coefficient to bp, p = 1, 2, ..., p, b1 < b2 < b3 < ... < bp-1 < bp, using the formula The scenario resistance index Ysg of this management intervention problem is obtained.

[0016] Furthermore, a problem means simulation scenario is constructed for a problem means, specifically: select simulation software, determine the current version of the software, download the current version of the software to the simulation software, build a real test environment in the simulation software, determine a problem means, add corresponding parameters involved in the problem means in the simulation software, and construct a problem means simulation scenario for the problem means.

[0017] Furthermore, a means resistance index of a problem means is obtained through the following steps: determining a problem means simulation scenario of a problem means, starting the software in the problem means simulation scenario, performing simulation operation of the software in the problem means simulation scenario for T time, after the simulation operation is completed, collecting simulation operation data of the software within T time, performing feature extraction on the simulation operation data to obtain simulation operation features, obtaining a means resistance analysis model for the problem means, inputting the simulation operation features into the means resistance analysis model, and the means resistance analysis model outputs the means resistance index for the problem means.

[0018] Furthermore, the resistance stability index of the resistance comparison group is obtained by the following steps: summing the means resistance indexes of the two problem means in the resistance comparison group and taking the average to obtain the means resistance mean Fak; performing difference calculation on the means resistance indexes of the two problem means in the resistance comparison group and taking the absolute value to obtain the means resistance difference value Bsw; using the formula The resistance stability index Gsp of the resistance comparison group is obtained, wherein g1 is the means resistance coefficient and g2 is the resistance difference coefficient.

[0019] Furthermore, a safety management index of a management intervention problem is obtained by the following steps: obtaining a problem prediction index Zmx and a scenario defense index Ysg of a management intervention problem, using the formula The safety management index Lkx of this type of management intervention problem is obtained, where qa is the problem prediction coefficient and qb is the scenario resistance coefficient.

[0020] Furthermore, the software security management method based on artificial intelligence includes the following steps:

[0021] Step 1: After each software security management cycle, obtain the problem prediction index of various security issues in the software, and determine the management intervention problem in the software based on the comparison result between the problem prediction index and the problem prediction threshold index;

[0022] Step 2: When management intervention problems occur in the software, obtain scenario resistance indexes for various management intervention problems;

[0023] Step 3: Based on the problem prediction index and scenario defense index of the management intervention problem, obtain the security management index of various management intervention problems, and determine the security crisis problems in the software based on the comparison results of the security management index and the security management threshold index;

[0024] Step 4: Sort all security crisis issues in order from small to large according to the value of the security management index, and deal with the security crisis issues in the software in the sorted order.

[0025] Compared with the prior art, the present invention has the following beneficial effects:

[0026] 1. The method of the present invention combines the prediction possibility and resistance performance to conduct in-depth analysis of various management intervention issues of the software, analyze the security crisis issues that the software will face in the future, and sort the processing order of the security crisis issues to ensure that the security crisis issues of the software in the future are handled first;

[0027] 2. Set up a software security problem prediction module and a software scenario defense analysis module, and use the LSTM model to periodically predict various types of software security problems. When predicting that the software may have corresponding security problems in the future, analyze the various problem means of the corresponding security problems. By constructing simulation scenarios for various problem means, simulate each problem means that the software may encounter, and then simulate and analyze the software's defense effect against each problem means. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 A method flow chart of a software security management method based on artificial intelligence;

[0029] Figure 2 This is a system module diagram of an artificial intelligence-based software security management system;

[0030] Figure 3 A flowchart for obtaining a problem prediction index for a safety problem;

[0031] Figure 4 Obtain a flowchart for a means of resisting index for a problem. DETAILED DESCRIPTION

[0032] Example 1: Reference Figure 1 , the software security management method based on artificial intelligence includes the following steps:

[0033] Step 1: After each software security management cycle, obtain the problem prediction index of various security issues in the software, and determine the management intervention problem in the software based on the comparison result between the problem prediction index and the problem prediction threshold index;

[0034] Step 2: When management intervention problems occur in the software, obtain scenario resistance indexes for various management intervention problems;

[0035] Step 3: Based on the problem prediction index and scenario defense index of the management intervention problem, obtain the security management index of various management intervention problems, and determine the security crisis problems in the software based on the comparison results of the security management index and the security management threshold index;

[0036] Step 4: Sort all security crisis issues in order from small to large according to the value of the security management index, and deal with the security crisis issues in the software in the sorted order.

[0037] The above method combines the prediction possibility and resistance performance to conduct an in-depth analysis of various management intervention issues of the software, analyzes the security crisis problems that the software will face in the future, and sorts the order of handling the security crisis problems to ensure that the subsequent security crisis problems of the software are handled first.

[0038] Example 2: Reference Figure 2-Figure 4 , the software security management system based on artificial intelligence includes software security problem prediction module, software scenario defense analysis module, software crisis problem marking module, and software crisis problem handling module.

[0039] Software security issue prediction module: Set the software security management cycle (the software security management cycle is a system preset time period. The specific duration of the time period is set according to demand. During the operation of the system, the software security management cycle is infinitely looped). After each software security management cycle, obtain the problem prediction index Zmx of various security issues in the software (security issues include but are not limited to vulnerability attack issues, authority abuse issues, data leakage issues, etc., and each security issue corresponds to a problem prediction index), set the problem prediction threshold index (the problem prediction threshold index is a system preset index), when the problem prediction index of a security issue is greater than or equal to the problem prediction threshold index, mark the issue as a management intervention issue, and when the problem prediction index of a security issue is less than the problem prediction threshold index, no further processing is performed.

[0040] A problem prediction index of a security issue is obtained by the following steps: obtaining software operation features of y consecutive software security management cycles before the current time, combining the software operation features of y software security management cycles into a software operation feature set, obtaining a problem prediction model for the security issue, inputting the software operation feature set into the problem prediction model, and the problem prediction model outputs the problem prediction index of the security issue.

[0041] The software operation characteristics of a software security management cycle are obtained through the following steps: collecting the software operation data within a software security management cycle, performing feature extraction on the operation data (feature extraction includes statistical feature extraction, frequency domain feature extraction, etc.), and obtaining the software operation characteristics.

[0042] Each security issue corresponds to a problem prediction model, and all problem prediction models are built based on the LSTM model. In this embodiment, taking the vulnerability attack problem as an example, the construction process of the problem prediction model of the vulnerability attack problem is disclosed: multiple software operation feature sets are collected, and an LSTM model is constructed. The software operation feature set is used as training data for the LSTM model, and a problem prediction index is assigned to each training data. The value range of the problem prediction index is (0.1~3.0). The larger the value of the problem prediction index, the greater the possibility that the software will have a vulnerability attack problem in the next software security management cycle. The smaller the value of the problem prediction index, the smaller the possibility that the software will have a vulnerability attack problem in the next software security management cycle. The training data is divided into a training set, a verification set, and a test set according to a set ratio of 4:1:1, and the training set, the verification set, and the test set are trained. After the training is completed, a problem prediction model for the vulnerability attack problem is constructed.

[0043] The construction process of the problem prediction model for the permission abuse problem is as follows: the larger the value of the problem prediction index, the greater the possibility that the software will have permission abuse problems in the next software security management cycle; the smaller the value of the problem prediction index, the smaller the possibility that the software will have permission abuse problems in the next software security management cycle. The rest of the construction process is consistent with the construction process of the problem prediction model for the vulnerability attack problem.

[0044] Software scenario resistance analysis module: When management intervention problems occur, the scenario resistance index of various management intervention problems is obtained.

[0045] A scenario resistance index for management intervention problems is achieved through the following steps: determining that a management intervention problem contains various means of problems (taking vulnerability attack problems as an example, the means of vulnerability attack problems include injection attack means, cross-site scripting attack means, cross-site request forgery attack means, formatted string attack means, zero-day vulnerability attack means, etc.; taking permission abuse problems as an example, the means of permission abuse problems include unauthorized access means, permission escalation means, permission confusion means, permission bypass means, etc.), building problem means simulation scenarios for various means of problems, and then obtaining means resistance indexes for various means of problems, and combining all of them into a single entity. Problem means: Match two by two to form a resistance comparison group, obtain the resistance stability index Gsp of each resistance comparison group, s = 1, 2, ..., S, S is the total number of resistance comparison groups, s is the number of resistance comparison groups, set the resistance stability coefficient to bp, p = 1, 2, ..., p, b1 < b2 < b3 < ... < bp-1 < bp, each resistance stability coefficient corresponds to a resistance stability index within a range, the value range of the resistance stability index includes (0, Gs1], (Gs1, Gs2], ..., (Gsp-1, Gsp], when Gsp∈(0, Gs1], the resistance stability coefficient is b1, using the formula The scenario resistance index Ysg of this management intervention problem is obtained.

[0046] The resistance stability index of the resistance comparison group is obtained by the following steps: summing the means resistance indexes of the two problem means in the resistance comparison group and taking the average to obtain the means resistance mean Fak; performing difference calculation on the means resistance indexes of the two problem means in the resistance comparison group and taking the absolute value to obtain the means resistance difference value Bsw; using the formula The resistance stability index Gsp of the resistance comparison group was obtained, where g1 is the means resistance coefficient, g2 is the resistance difference coefficient, the value of g1 is 0.74, and the value of g2 is 0.83.

[0047] Construct a problem means simulation scenario for a problem means, specifically: select simulation software, determine the current version of the software, download the current version of the software to the simulation software, build a real test environment in the simulation software (this step includes configuring the software, setting the network topology, etc.), determine a problem means, add the corresponding parameters involved in the problem means in the simulation software (taking the injection attack means as an example, the corresponding parameters involved include the attack payload, target URL, etc.), and construct a problem means simulation scenario for this problem means.

[0048] The means resistance index of a problem means is obtained through the following steps: determining a problem means simulation scenario of a problem means, starting the software in the problem means simulation scenario, performing simulation operation of the software in the problem means simulation scenario for T time, collecting simulation operation data of the software within T time after the simulation operation, performing feature extraction on the simulation operation data to obtain simulation operation features, obtaining a means resistance analysis model for the problem means, inputting the simulation operation features into the means resistance analysis model, and the means resistance analysis model outputs the means resistance index of the problem means.

[0049] Each problem means corresponds to a means resistance analysis model, and all means resistance analysis models are constructed based on the neural network model. In this embodiment, taking the injection attack means as an example, the construction process of the injection attack means resistance analysis model is disclosed: multiple simulation operation characteristics are collected, and a neural network model is constructed. The simulation operation characteristics are used as training data for the neural network model, and a means resistance index is assigned to each training data. The value range of the means resistance index is (1.0~5.0). The larger the value of the means resistance index, the better the software's resistance to injection attack means in the problem means simulation scenario. The smaller the value of the means resistance index, the worse the software's resistance to injection attack means in the problem means simulation scenario. The training data is divided into a training set, a verification set, and a test set according to a set ratio of 5:2:1. The training set, the verification set, and the test set are trained. After the training is completed, a means resistance analysis model for the injection attack means is constructed.

[0050] The construction process of the cross-site scripting attack means resistance analysis model is as follows: the larger the value of the means resistance index, the better the software's resistance to cross-site scripting attack means in the problem means simulation scenario; the smaller the value of the means resistance index, the worse the software's resistance to cross-site scripting attack means in the problem means simulation scenario; the rest of the construction process is consistent with the construction process of the injection attack means resistance analysis model.

[0051] Set up a software security problem prediction module and a software scenario defense analysis module, and use the LSTM model to periodically predict various types of software security problems. When predicting that the software may have corresponding security problems in the future, analyze the various problem means of the corresponding security problems. By constructing simulation scenarios for various problem means, simulate each problem means that the software may encounter, and then simulate and analyze the software's defense effect against each problem means.

[0052] Software crisis problem marking module: Based on the problem prediction index and scenario resistance index of management intervention problems, obtain the safety management index of various management intervention problems, set the safety management threshold index (the safety management threshold index is a system preset index), and when the safety management index of a management intervention problem is greater than or equal to the safety management threshold index, no further processing is performed; when the safety management index of a management intervention problem is less than the safety management threshold index, the management intervention problem is marked as a security crisis problem.

[0053] Software crisis problem handling module: sort all security crisis problems in order from small to large according to the value of the security management index, and handle the security crisis problems in the software in the sorted order (the handling method can be vulnerability repair, software upgrade, etc.).

[0054] A security management index of a management intervention problem is obtained by the following steps: obtaining a problem prediction index Zmx and a scenario defense index Ysg of a management intervention problem, using the formula The safety management index Lkx of this type of management intervention problem is obtained, where qa is the problem prediction coefficient, qb is the scenario resistance coefficient, the value of qa is 0.85, and the value of qb is 0.73.

[0055] Set up a software crisis problem marking module and a software crisis problem handling module, combine the prediction possibility and resistance performance to conduct in-depth analysis of various management intervention issues of the software, analyze the security crisis problems that the software will face in the future, and sort the order of handling security crisis problems to ensure that the subsequent security crisis problems of the software are handled first.

[0056] The above formulas are all dimensionless and numerical calculations are performed, and the preset parameters in the formulas are set by technicians in this field according to actual conditions.

[0057] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0058] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0059] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0060] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0061] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0062] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories (ROM), random access memories (RAM), magnetic disks or optical disks.

[0063] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. Software security management system based on artificial intelligence, characterized by: It includes software security problem prediction module, software scenario defense analysis module, software crisis problem marking module, and software crisis problem handling module; The software security problem prediction module obtains the problem prediction index Zmx of various security problems in the software every time a software security management cycle passes, and determines the management intervention problem in the software based on the comparison result of the problem prediction index and the problem prediction threshold index; The software scenario resistance analysis module obtains scenario resistance indexes of various management intervention problems when management intervention problems occur in the software; The software crisis problem marking module obtains the security management index of various management intervention problems based on the problem prediction index and scenario resistance index of the management intervention problem, and determines the security crisis problem in the software based on the comparison result of the security management index and the security management threshold index; The software crisis problem processing module sorts all security crisis problems in order from small to large according to the values ​​of the security management index, and processes the security crisis problems in the software in the sorted order.

2. The artificial intelligence-based software security management system according to claim 1, characterized in that: A problem prediction index of a security issue is obtained by the following steps: obtaining software operation features of y consecutive software security management cycles before the current time, combining the software operation features of y software security management cycles into a software operation feature set, obtaining a problem prediction model for the security issue, inputting the software operation feature set into the problem prediction model, and the problem prediction model outputs the problem prediction index of the security issue.

3. The artificial intelligence-based software security management system according to claim 2 is characterized in that: The software operation characteristics of a software security management cycle are obtained through the following steps: collecting the software operation data within a software security management cycle, extracting characteristics of the operation data, and obtaining the software operation characteristics.

4. The artificial intelligence-based software security management system according to claim 1, characterized in that: A scenario resistance index for management intervention problems is obtained through the following steps: determining that a management intervention problem contains various problem means, constructing problem means simulation scenarios for various problem means, and then obtaining means resistance indexes for various problem means, matching all problem means two by two into a resistance comparison group, and obtaining a resistance stability index Gsp of each resistance comparison group, s = 1, 2, ..., S, S is the total number of resistance comparison groups, s is the number of the resistance comparison group, setting the resistance stability coefficient to bp, p = 1, 2, ..., p, b1 < b2 < b3 < ... < bp-1 < bp, using the formula The scenario resistance index Ysg of this management intervention problem is obtained.

5. The artificial intelligence-based software security management system according to claim 4, characterized in that: Construct a problem means simulation scenario for a problem means, specifically: select simulation software, determine the current version of the software, download the current version of the software to the simulation software, build a real test environment in the simulation software, determine a problem means, add corresponding parameters involved in the problem means in the simulation software, and construct a problem means simulation scenario for the problem means.

6. The artificial intelligence-based software security management system according to claim 4, characterized in that: The means resistance index of a problem means is obtained through the following steps: determining a problem means simulation scenario of a problem means, starting the software in the problem means simulation scenario, performing simulation operation of the software in the problem means simulation scenario for T time, collecting simulation operation data of the software within T time after the simulation operation, performing feature extraction on the simulation operation data to obtain simulation operation features, obtaining a means resistance analysis model for the problem means, inputting the simulation operation features into the means resistance analysis model, and the means resistance analysis model outputs the means resistance index of the problem means.

7. The artificial intelligence-based software security management system according to claim 4, characterized in that: The resistance stability index of the resistance comparison group is obtained by the following steps: summing the means resistance indexes of the two problem means in the resistance comparison group and taking the average to obtain the means resistance mean Fak; performing difference calculation on the means resistance indexes of the two problem means in the resistance comparison group and taking the absolute value to obtain the means resistance difference value Bsw; using the formula The resistance stability index Gsp of the resistance comparison group is obtained, wherein g1 is the means resistance coefficient and g2 is the resistance difference coefficient.

8. The artificial intelligence-based software security management system according to claim 1, characterized in that: A security management index of a management intervention problem is obtained by the following steps: obtaining a problem prediction index Zmx and a scenario defense index Ysg of a management intervention problem, using the formula The safety management index Lkx of this type of management intervention problem is obtained, where qa is the problem prediction coefficient and qb is the scenario resistance coefficient.

9. A software security management method based on artificial intelligence, applied to the software security management system based on artificial intelligence according to any one of claims 1 to 8, characterized in that: The steps include: Step 1: After each software security management cycle, obtain the problem prediction index of various security issues in the software, and determine the management intervention problem in the software based on the comparison result between the problem prediction index and the problem prediction threshold index; Step 2: When management intervention problems occur in the software, obtain scenario resistance indexes for various management intervention problems; Step 3: Based on the problem prediction index and scenario defense index of the management intervention problem, obtain the security management index of various management intervention problems, and determine the security crisis problems in the software based on the comparison results of the security management index and the security management threshold index; Step 4: Sort all security crisis issues in order from small to large according to the value of the security management index, and deal with the security crisis issues in the software in the sorted order.

Images