Software security management method and system based on artificial intelligence

Abstract

The present invention discloses a software security management method and system based on artificial intelligence, which relates to the technical field of software security management. The system discloses a software security problem prediction module, a software scenario resistance analysis module, a software crisis problem marking module, and a software crisis problem processing module. The software security problem prediction module and the software scenario resistance analysis module are set. By constructing a problem means simulation scenario for various problem means, each problem means that the software may encounter is simulated, and then the software's resistance effect to each problem means is simulated and analyzed. A software crisis problem marking module and a software crisis problem processing module are set. In combination with the prediction possibility and the resistance performance, various management intervention problems of the software are deeply analyzed, the security crisis problems that the software will face in the future are analyzed, and the processing order of the security crisis problems is sorted to ensure that the subsequent security crisis problems of the software are handled first.

Description

Technical Field

[0001] The present invention relates to the technical field of software security management, and more specifically, to a software security management method and system based on artificial intelligence. Background Art

[0002] With the rapid development of information technology, software is increasingly used in modern society, encompassing a wide range of areas, from personal entertainment to business operations and national security. However, the resulting software security issues are becoming increasingly prominent, becoming a major factor hindering the healthy development of the software industry.

[0003] In recent years, the rise of artificial intelligence (AI) technology has provided new solutions for software security management. By leveraging advanced technologies such as machine learning and deep learning, software security issues can be predicted and analyzed more accurately and efficiently. The LSTM (Long Short-Term Memory) model, a specialized recurrent neural network, demonstrates great potential for predicting software security issues due to its powerful ability to process time series data.

[0004] However, existing AI-based software security management methods still have many shortcomings. These methods often focus solely on predicting security issues while neglecting to analyze the software's resilience to potential security issues. This can lead to difficulties in prioritizing the predicted potential for multiple security issues to arise later in the software lifecycle, resulting in some issues not being addressed promptly.

[0005] Therefore, the present invention proposes a software security management method and system based on artificial intelligence. Summary of the Invention

[0006] In view of the shortcomings of the existing technology, the purpose of the present invention is to provide a software security management method and system based on artificial intelligence.

[0007] To achieve the above object, the present invention provides the following technical solutions:

[0008] An AI-based software security management system, including a software security issue prediction module, a software scenario defense analysis module, a software crisis issue marking module, and a software crisis issue handling module;

[0009] The software security problem prediction module obtains a problem prediction index Zmx of various security problems in the software after each software security management cycle, and determines the management intervention problem in the software based on the comparison result of the problem prediction index and the problem prediction threshold index;

[0010] The software scenario resistance analysis module obtains scenario resistance indexes of various management intervention problems when management intervention problems occur in the software;

[0011] The software crisis problem marking module obtains the security management index of various management intervention problems based on the problem prediction index and scenario resistance index of the management intervention problem, and determines the security crisis problem in the software based on the comparison result of the security management index and the security management threshold index;

[0012] The software crisis problem processing module sorts all security crisis problems in order from small to large according to the values of the security management index, and processes the security crisis problems in the software in the sorted order.

[0013] Furthermore, a problem prediction index of a security issue is obtained through the following steps: obtaining software operation features of y consecutive software security management cycles before the current time, combining the software operation features of y software security management cycles into a software operation feature set, obtaining a problem prediction model for the security issue, inputting the software operation feature set into the problem prediction model, and the problem prediction model outputs the problem prediction index of the security issue.

[0014] Furthermore, the software operation characteristics of a software security management cycle are obtained through the following steps: collecting the software operation data within a software security management cycle, performing feature extraction on the operation data, and obtaining the software operation characteristics.

[0015] Furthermore, a scenario resistance index of a management intervention problem is obtained by the following steps: determining that a management intervention problem includes various problem means, constructing problem means simulation scenarios for various problem means, and then obtaining means resistance indexes of various problem means, matching all problem means into a resistance comparison group, and obtaining the resistance stability index Gsp of each resistance comparison group, s=1, 2, …, S, S is the total number of resistance comparison groups, s is the number of resistance comparison groups, setting the resistance stability coefficient to bp, p=1, 2, …, p, b1<b2<b3<…<bp-1<bp, using the formula The scenario resistance index Ysg of this management intervention problem is obtained.

[0016] Furthermore, a problem means simulation scenario for a problem means is constructed, specifically: select simulation software, determine the current version of the software, download the current version of the software to the simulation software, build a real test environment in the simulation software, determine a problem means, add the corresponding parameters involved in the problem means in the simulation software, and construct a problem means simulation scenario for the problem means.

[0017] Furthermore, a means resistance index of a problem means is obtained through the following steps: determining a problem means simulation scenario of a problem means, starting the software in the problem means simulation scenario, performing a simulation run of the software in the problem means simulation scenario for a period of T, collecting simulation run data of the software within the period of T after the simulation run, performing feature extraction on the simulation run data to obtain simulation run features, obtaining a means resistance analysis model for the problem means, inputting the simulation run features into the means resistance analysis model, and the means resistance analysis model outputs the means resistance index for the problem means.

[0018] Furthermore, the resistance stability index of the resistance comparison group is obtained by the following steps: summing the means resistance indexes of the two problem means in the resistance comparison group and taking the mean to obtain the means resistance mean Fak; performing the difference calculation on the means resistance indexes of the two problem means in the resistance comparison group and taking the absolute value to obtain the means resistance difference value Bsw; using the formula The resistance stability index Gsp of the resistance comparison group is obtained, where g1 is the means resistance coefficient and g2 is the resistance difference coefficient.

[0019] Furthermore, a security management index of a management intervention problem is obtained by the following steps: obtaining a problem prediction index Zmx and a scenario resistance index Ysg of a management intervention problem, and using the formula The safety management index Lkx of this type of management intervention problem is obtained, where qa is the problem prediction coefficient and qb is the scenario resistance coefficient.

[0020] Furthermore, the software security management method based on artificial intelligence includes the following steps:

[0021] Step 1: After each software security management cycle, obtain the problem prediction index of various security issues in the software. Based on the comparison results of the problem prediction index and the problem prediction threshold index, determine the management intervention issues in the software;

[0022] Step 2: When management intervention issues occur in the software, obtain scenario resilience indexes for various management intervention issues.

[0023] Step 3: Based on the problem prediction index and scenario resistance index of the management intervention problem, obtain the security management index of various management intervention problems. Based on the comparison results of the security management index and the security management threshold index, determine the security crisis issues in the software;

[0024] Step 4: Sort all security crisis issues in order from small to large according to the value of the security management index, and deal with the security crisis issues in the software in the sorted order.

[0025] Compared with the prior art, the present invention has the following beneficial effects:

[0026] 1. The method of the present invention combines predictive possibility and resistance performance to conduct in-depth analysis of various management intervention issues of the software, analyze the security crises that the software will face in the future, and sort the order of handling security crises to ensure that the security crises of the software are handled first;

[0027] 2. Set up a software security issue prediction module and a software scenario defense analysis module, and use the LSTM model to periodically predict various types of software security issues. When predicting that the software may encounter corresponding security issues in the future, analyze the various problem means of the corresponding security issues. By constructing simulation scenarios for various problem means, simulate each problem means that the software may encounter, and then simulate and analyze the software's defense effect against each problem means. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 A flowchart of a software security management method based on artificial intelligence;

[0029] Figure 2 This is a system module diagram of an artificial intelligence-based software security management system;

[0030] Figure 3 A flowchart for obtaining a problem prediction index for a safety issue;

[0031] Figure 4 Obtain a flowchart for a means to resist index for a problem means. DETAILED DESCRIPTION

[0032] Example 1: Reference Figure 1 , the software security management method based on artificial intelligence includes the following steps:

[0033] Step 1: After each software security management cycle, obtain the problem prediction index of various security issues in the software. Based on the comparison results of the problem prediction index and the problem prediction threshold index, determine the management intervention issues in the software;

[0034] Step 2: When management intervention issues occur in the software, obtain scenario resilience indexes for various management intervention issues.

[0035] Step 3: Based on the problem prediction index and scenario resistance index of the management intervention problem, obtain the security management index of various management intervention problems. Based on the comparison results of the security management index and the security management threshold index, determine the security crisis issues in the software;

[0036] Step 4: Sort all security crisis issues in order from small to large according to the value of the security management index, and deal with the security crisis issues in the software in the sorted order.

[0037] The above method combines predictive possibility and resistance to manifestation to conduct an in-depth analysis of various management intervention issues of the software, analyzes the security crisis issues that the software will face in the future, and sorts the order of handling security crisis issues to ensure that the subsequent security crisis issues of the software are handled first.

[0038] Example 2: Reference Figure 2-Figure 4 , the software security management system based on artificial intelligence includes software security problem prediction module, software scenario defense analysis module, software crisis problem marking module, and software crisis problem handling module.

[0039] Software security issue prediction module: Set the software security management cycle (the software security management cycle is a system-preset time period. The specific duration of the time period is set according to demand. During the system operation, the software security management cycle is infinitely looped). After each software security management cycle, obtain the problem prediction index Zmx of various security issues in the software (security issues include but are not limited to vulnerability attack issues, authority abuse issues, data leakage issues, etc., and each security issue corresponds to a problem prediction index), set the problem prediction threshold index (the problem prediction threshold index is a system-preset index), when the problem prediction index of a security issue is greater than or equal to the problem prediction threshold index, the issue is marked as a management intervention issue. When the problem prediction index of a security issue is less than the problem prediction threshold index, no further processing is performed.

[0040] A problem prediction index of a security issue is obtained by the following steps: obtaining software operation features of y consecutive software security management cycles before the current time, combining the software operation features of the y software security management cycles into a software operation feature set, obtaining a problem prediction model for the security issue, inputting the software operation feature set into the problem prediction model, and the problem prediction model outputs the problem prediction index of the security issue.

[0041] The software operation characteristics of a software security management cycle are obtained through the following steps: collecting the software operation data within a software security management cycle, performing feature extraction on the operation data (feature extraction includes statistical feature extraction, frequency domain feature extraction, etc.) to obtain the software operation characteristics.

[0042] Each security issue corresponds to a problem prediction model, and all problem prediction models are built based on the LSTM model. In this embodiment, taking the vulnerability attack problem as an example, the construction process of the problem prediction model of the vulnerability attack problem is disclosed: multiple software operation feature sets are collected to build an LSTM model, and the software operation feature set is used as the training data of the LSTM model. A problem prediction index is assigned to each training data. The value range of the problem prediction index is (0.1~3.0). The larger the value of the problem prediction index, the greater the possibility that the software will have a vulnerability attack problem in the next software security management cycle. The smaller the value of the problem prediction index, the smaller the possibility that the software will have a vulnerability attack problem in the next software security management cycle. The training data is divided into a training set, a validation set, and a test set according to a set ratio of 4:1:1. The training set, validation set, and test set are trained. After the training is completed, a problem prediction model for the vulnerability attack problem is constructed.

[0043] The construction process of the problem prediction model for the permission abuse problem is as follows: the larger the value of the problem prediction index, the greater the possibility that the software will have permission abuse problems in the next software security management cycle; the smaller the value of the problem prediction index, the smaller the possibility that the software will have permission abuse problems in the next software security management cycle. The rest of the construction process is consistent with the construction process of the problem prediction model for vulnerability attack problems.

[0044] Software scenario resistance analysis module: When management intervention issues occur, obtain scenario resistance indexes for various management intervention issues.

[0045] A scenario resistance index for management intervention problems is achieved through the following steps: determining that a management intervention problem contains various problem means (taking vulnerability attack problems as an example, the problem means of vulnerability attack problems include injection attack means, cross-site scripting attack means, cross-site request forgery attack means, formatted string attack means, zero-day vulnerability attack means, etc. Taking permission abuse problems as an example, the problem means of permission abuse problems include unauthorized access means, permission escalation means, permission confusion means, permission bypass means, etc.), building problem means simulation scenarios for various problem means, and then obtaining means resistance indexes for various problem means, and combining all of them. The problem means that each pair is matched into a resistance comparison group, and the resistance stability index Gsp of each resistance comparison group is obtained, s=1, 2, …, S, S is the total number of resistance comparison groups, s is the number of resistance comparison groups, and the resistance stability coefficient is set to bp, p=1, 2, …, p, b1<b2<b3<…<bp-1<bp, each resistance stability coefficient corresponds to a resistance stability index within a range, and the value range of the resistance stability index includes (0, Gs1], (Gs1, Gs2], …, (Gsp-1, Gsp], when Gsp∈(0, Gs1], the resistance stability coefficient is b1, using the formula The scenario resistance index Ysg of this management intervention problem is obtained.

[0046] The resistance stability index of the resistance comparison group is obtained by the following steps: summing the means resistance indexes of the two problem means in the resistance comparison group and taking the mean to obtain the means resistance mean Fak; performing the difference calculation on the means resistance indexes of the two problem means in the resistance comparison group and taking the absolute value to obtain the means resistance difference value Bsw; using the formula The resistance stability index Gsp of the resistance comparison group was obtained, where g1 is the means resistance coefficient and g2 is the resistance difference coefficient. The value of g1 is 0.74 and the value of g2 is 0.83.

[0047] Construct a problem means simulation scenario for a problem means, specifically: select simulation software, determine the current version of the software, download the current version of the software to the simulation software, build a real test environment in the simulation software (this step includes configuring the software, setting the network topology, etc.), determine a problem means, add the corresponding parameters involved in the problem means in the simulation software (taking the injection attack means as an example, the corresponding parameters involved include attack payload, target URL, etc.), and construct a problem means simulation scenario for this problem means.

[0048] The means resistance index of a problem means is obtained through the following steps: determining a problem means simulation scenario of a problem means, starting the software in the problem means simulation scenario, performing simulation operation of the software in the problem means simulation scenario for T time, after the simulation operation is completed, collecting simulation operation data of the software within T time, performing feature extraction on the simulation operation data to obtain simulation operation features, obtaining a means resistance analysis model for this problem means, inputting the simulation operation features into the means resistance analysis model, and the means resistance analysis model outputs the means resistance index of this problem means.

[0049] Each problem means corresponds to a means resistance analysis model, and all means resistance analysis models are constructed based on the neural network model. In this embodiment, taking the injection attack means as an example, the construction process of the injection attack means resistance analysis model is disclosed: multiple simulation operation characteristics are collected, a neural network model is constructed, and the simulation operation characteristics are used as training data for the neural network model. A means resistance index is assigned to each training data. The value range of the means resistance index is (1.0~5.0). The larger the value of the means resistance index, the better the software's resistance to injection attack means in the problem means simulation scenario. The smaller the value of the means resistance index, the worse the software's resistance to injection attack means in the problem means simulation scenario. The training data is divided into a training set, a validation set, and a test set according to a set ratio of 5:2:1. The training set, validation set, and test set are trained. After the training is completed, a means resistance analysis model for the injection attack means is constructed.

[0050] The construction process of the cross-site scripting attack means resistance analysis model is as follows: the larger the value of the means resistance index, the better the software's resistance to cross-site scripting attack means in the problem means simulation scenario; the smaller the value of the means resistance index, the worse the software's resistance to cross-site scripting attack means in the problem means simulation scenario. The rest of the construction process is consistent with the construction process of the injection attack means resistance analysis model.

[0051] A software security issue prediction module and a software scenario defense analysis module are set up, and the LSTM model is used to periodically predict various types of software security issues. When predicting that the software may encounter corresponding security issues in the future, the various problem means of the corresponding security issues are disassembled and analyzed. By constructing problem means simulation scenarios for various problem means, each problem means that the software may encounter is simulated, and then the software's defense effect against each problem means is simulated and analyzed.

[0052] Software crisis problem marking module: Based on the problem prediction index and scenario resistance index of management intervention problems, obtain the security management index of various management intervention problems, set the security management threshold index (the security management threshold index is a system preset index), when the security management index of a management intervention problem is greater than or equal to the security management threshold index, no further processing is done; when the security management index of a management intervention problem is less than the security management threshold index, the management intervention problem is marked as a security crisis problem.

[0053] Software crisis problem handling module: sort all security crisis problems from small to large according to the value of the security management index, and handle the security crisis problems in the software in the sorted order (the handling method can be vulnerability repair, software upgrade, etc.).

[0054] A security management index of a management intervention problem is obtained by the following steps: obtaining a problem prediction index Zmx and a scenario resistance index Ysg of a management intervention problem, and using the formula The safety management index Lkx of this type of management intervention problem is obtained, where qa is the problem prediction coefficient, qb is the scenario resistance coefficient, the value of qa is 0.85, and the value of qb is 0.73.

[0055] Set up a software crisis problem marking module and a software crisis problem handling module, combine the prediction possibility and resistance performance to conduct in-depth analysis of various management intervention issues of the software, analyze the security crisis problems that the software will face in the future, and sort the order of handling security crisis problems to ensure that the subsequent security crisis problems of the software are handled first.

[0056] The above formulas are all dimensionless and numerically calculated, and the preset parameters in the formulas are set by technicians in this field according to actual conditions.

[0057] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer program are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center via wired or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state drive.

[0058] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0059] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0060] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0061] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0062] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0063] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. The software security management system based on artificial intelligence is characterized by: It includes software security problem prediction module, software scenario defense analysis module, software crisis problem marking module, and software crisis problem handling module; The software security problem prediction module obtains a problem prediction index Zmx of various security problems in the software after each software security management cycle, and determines the management intervention problem in the software based on the comparison result of the problem prediction index and the problem prediction threshold index; The software scenario resistance analysis module obtains scenario resistance indexes of various management intervention problems when management intervention problems occur in the software; A scenario resistance index for management intervention problems is obtained by the following steps: determining that a management intervention problem includes various problem means, constructing problem means simulation scenarios for various problem means, and then obtaining means resistance indexes for various problem means, matching all problem means into a resistance comparison group, and obtaining the resistance stability index Gsp of each resistance comparison group, s=1, 2, ..., S, S is the total number of resistance comparison groups, s is the number of resistance comparison groups, setting the resistance stability coefficient to bp, p=1, 2, ..., p, b1<b2<b3<...<bp-1<bp, using the formula Obtain the scenario resistance index Ysg of this management intervention problem; The means resistance index of a problem means is obtained by the following steps: determining a problem means simulation scenario of a problem means, starting the software in the problem means simulation scenario, performing a simulation run of the software in the problem means simulation scenario for a period of T, collecting simulation run data of the software within the period of T after the simulation run, performing feature extraction on the simulation run data to obtain simulation run features, obtaining a means resistance analysis model for the problem means, inputting the simulation run features into the means resistance analysis model, and the means resistance analysis model outputs the means resistance index for the problem means; The resistance stability index of the resistance comparison group is obtained by the following steps: summing the means resistance indexes of the two problem means in the resistance comparison group and taking the mean to obtain the means resistance mean Fak; performing the difference calculation on the means resistance indexes of the two problem means in the resistance comparison group and taking the absolute value to obtain the means resistance difference value Bsw; using the formula The resistance stability index Gsp of the resistance comparison group is obtained, where g1 is the means resistance coefficient and g2 is the resistance difference coefficient; The software crisis problem marking module obtains the security management index of various management intervention problems based on the problem prediction index and scenario resistance index of the management intervention problem, and determines the security crisis problem in the software based on the comparison result of the security management index and the security management threshold index; The software crisis problem processing module sorts all security crisis problems in order from small to large according to the values of the security management index, and processes the security crisis problems in the software in the sorted order.

2. The software security management system based on artificial intelligence according to claim 1 is characterized in that: A problem prediction index of a security issue is obtained by the following steps: obtaining software operation features of y consecutive software security management cycles before the current time, combining the software operation features of the y software security management cycles into a software operation feature set, obtaining a problem prediction model for the security issue, inputting the software operation feature set into the problem prediction model, and the problem prediction model outputs the problem prediction index of the security issue.

3. The software security management system based on artificial intelligence according to claim 2 is characterized in that: The software operation characteristics of a software security management cycle are obtained through the following steps: collecting the software operation data within a software security management cycle, extracting characteristics of the operation data, and obtaining the software operation characteristics.

4. The artificial intelligence-based software security management system according to claim 1, characterized in that: Construct a problem means simulation scenario for a problem means, specifically: select simulation software, determine the current version of the software, download the current version of the software to the simulation software, build a real test environment in the simulation software, determine a problem means, add the corresponding parameters involved in the problem means in the simulation software, and construct a problem means simulation scenario for the problem means.

5. The artificial intelligence-based software security management system according to claim 1, characterized in that: A security management index of a management intervention problem is obtained by the following steps: obtaining a problem prediction index Zmx and a scenario resistance index Ysg of a management intervention problem, and using the formula The safety management index Lkx of this type of management intervention problem is obtained, where qa is the problem prediction coefficient and qb is the scenario resistance coefficient.

6. An artificial intelligence-based software security management method, applied to the artificial intelligence-based software security management system according to any one of claims 1 to 5, characterized in that: The steps include: Step 1: After each software security management cycle, obtain the problem prediction index of various security issues in the software. Based on the comparison results of the problem prediction index and the problem prediction threshold index, determine the management intervention issues in the software; Step 2: When management intervention issues occur in the software, obtain scenario resilience indexes for various management intervention issues. Step 3: Based on the problem prediction index and scenario resistance index of the management intervention problem, obtain the security management index of various management intervention problems. Based on the comparison results of the security management index and the security management threshold index, determine the security crisis issues in the software; Step 4: Sort all security crisis issues in order from small to large according to the value of the security management index, and deal with the security crisis issues in the software in the sorted order.

Images