Vulnerability detection method and related equipment based on differential privacy

Abstract

This application provides a vulnerability detection method and related equipment based on differential privacy, which executes preset query tasks for each distributed node to ensure the pertinence and efficiency of data collection. Then, the privacy budget is allocated according to the node trust level, and differential privacy noise is added according to the query sensitivity. This mechanism not only protects the privacy of user data, but also enhances the robustness of data query. For the query results, security vulnerabilities are discovered and reported in a timely manner through preset threshold verification, thereby achieving active defense of network security. Finally, the central control node summarizes the vulnerability detection results of each node and applies differential privacy protection again, further consolidating the security of the data aggregation stage, which can significantly improve the comprehensive efficiency of data query and network security protection, ensure the safe use and privacy protection of user data in a distributed environment, and provide strong support for network security reinforcement.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a vulnerability detection method and related equipment based on differential privacy. Background Art

[0002] With the rapid development of the internet and information technology, cyberattacks and data leaks are becoming increasingly frequent worldwide, posing an increasingly serious threat to network security. To address this challenge, vulnerability mining technology has become a crucial tool for ensuring information system security. Vulnerability mining aims to identify potential security vulnerabilities through comprehensive system analysis, helping system administrators promptly discover and patch security flaws and prevent malicious attackers from exploiting these vulnerabilities to compromise systems.

[0003] However, existing vulnerability mining technologies may cause leakage of users' important data and fail to ensure network security. Summary of the Invention

[0004] In view of this, the purpose of this application is to propose a vulnerability detection method and related equipment based on differential privacy to solve the above technical problems.

[0005] Based on the above objectives, the first aspect of the present application provides a vulnerability detection method based on differential privacy, which is applied to a vulnerability detection system based on differential privacy. The system includes a central control node and multiple distributed nodes, each distributed node is used to process different types of user behavior data. The method includes:

[0006] Querying user behavior data corresponding to the target user from each distributed node according to the preset query task corresponding to each distributed node, and determining an initial query result corresponding to the query task based on each user behavior data;

[0007] The following operations are performed for each distributed node: obtaining a trust level corresponding to the distributed node, and allocating a privacy budget of the distributed node using the trust level corresponding to the distributed node; determining a query sensitivity corresponding to the query task of the distributed node, determining differential privacy noise based on a noise distribution mechanism according to the privacy budget and the query sensitivity, and adding the differential privacy noise to the initial query result corresponding to the distributed node to obtain a noise-added query result; in response to the query result after the noise addition not being within a range of a preset query result threshold, determining that a vulnerability detection result corresponding to the distributed node is that a security vulnerability exists, and sending the vulnerability detection result corresponding to the distributed node to a central control node; or, in response to the query result after the noise addition being within a range of a preset query result threshold, determining that a vulnerability detection result corresponding to the distributed node is that a security vulnerability does not exist, and sending the vulnerability detection result corresponding to the distributed node to the central control node.

[0008] The vulnerability detection results corresponding to each distributed node are summarized through the central control node to obtain a summary result, and preset differential privacy noise is added to the summary result to obtain a summary result after noise addition. A vulnerability detection report is generated based on the summary result after noise addition for vulnerability repair according to the vulnerability detection report.

[0009] Based on the same inventive concept, the second aspect of the present application provides a vulnerability detection device based on differential privacy. The device is provided in a vulnerability detection system based on differential privacy. The system includes a central control node and multiple distributed nodes, each distributed node is used to process different types of user behavior data, and the device includes:

[0010] A query module is configured to query user behavior data corresponding to a target user from each distributed node according to a preset query task corresponding to each distributed node, and determine an initial query result corresponding to the query task based on each user behavior data;

[0011] The vulnerability detection module is configured to perform the following operations for each distributed node: obtain a trust level corresponding to the distributed node, and allocate a privacy budget of the distributed node using the trust level corresponding to the distributed node; determine a query sensitivity corresponding to the query task of the distributed node, determine differential privacy noise based on a noise distribution mechanism according to the privacy budget and the query sensitivity, and add the differential privacy noise to the initial query result corresponding to the distributed node to obtain a noise-added query result; in response to the query result after the noise addition not being within a preset query result threshold, determine that the vulnerability detection result corresponding to the distributed node is that a security vulnerability exists, and send the vulnerability detection result corresponding to the distributed node to the central control node; or, in response to the query result after the noise addition being within a preset query result threshold, determine that the vulnerability detection result corresponding to the distributed node is that no security vulnerability exists, and send the vulnerability detection result corresponding to the distributed node to the central control node.

[0012] The aggregation module is configured to aggregate the vulnerability detection results corresponding to each distributed node through a central control node to obtain an aggregated result, add preset differential privacy noise to the aggregated result to obtain an aggregated result with noise added, and generate a vulnerability detection report based on the aggregated result with noise added, so that the vulnerability can be repaired according to the vulnerability detection report.

[0013] Based on the same inventive concept, the third aspect of this application provides an electronic device, comprising a memory, a processor, and a computer program stored on the memory and executed on the processor, wherein the processor implements the method described in the first aspect above when executing the computer program.

[0014] Based on the same inventive concept, the fourth aspect of the present application provides a non-transitory computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable a computer to execute the method described in the first aspect above.

[0015] From the above, it can be seen that the vulnerability detection method and related equipment based on differential privacy provided by this application execute preset query tasks for each distributed node to ensure the pertinence and efficiency of data collection. Then, the privacy budget is allocated according to the node trust level, and differential privacy noise is added according to the query sensitivity. This mechanism not only protects the privacy of user data, but also enhances the robustness of data query. For the query results, security vulnerabilities are discovered and reported in a timely manner through preset threshold verification, thereby realizing active defense of network security. Finally, the central control node summarizes the vulnerability detection results of each node and applies differential privacy protection again, further consolidating the security of the data aggregation stage, which can significantly improve the comprehensive efficiency of data query and network security protection, ensure the safe use and privacy protection of user data in a distributed environment, and provide strong support for network security reinforcement. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in this application or related technologies, the following briefly introduces the drawings required for use in the embodiments or related technical descriptions. Obviously, the drawings described below are merely embodiments of this application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0017] Figure 1 This is a flowchart of a vulnerability detection method based on differential privacy according to an embodiment of the present application;

[0018] Figure 2 This is a schematic diagram of the architecture of a vulnerability detection system based on differential privacy according to an embodiment of the present application;

[0019] Figure 3 A data flow diagram of vulnerability detection according to an embodiment of the present application;

[0020] Figure 4 A flowchart of adding noise to the differential privacy algorithm of an embodiment of the present application;

[0021] Figure 5 This is a structural block diagram of a vulnerability detection device based on differential privacy according to an embodiment of the present application;

[0022] Figure 6 A schematic diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0023] In order to make the objectives, technical solutions and advantages of this application more clear, this application is further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0024] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present application should have the usual meanings understood by people with ordinary skills in the field to which this application belongs. The "first", "second" and similar words used in the embodiments of the present application do not indicate any order, quantity or importance, but are only used to distinguish different components. "Include" or "comprise" and similar words mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0025] It is understandable that before using the technical solutions of each embodiment of this application, the type, scope of use, usage scenarios, etc. of the personal information involved will be informed to the user in an appropriate manner, and the user's authorization will be obtained.

[0026] For example, in response to receiving a user's active request, a prompt message is sent to the user to clearly inform the user that the operation requested will require the acquisition and use of the user's personal information. Thus, the user can independently choose whether to provide personal information to the electronic device, application, server, storage medium, or other software or hardware that performs the operation of the technical solution of this application based on the prompt message.

[0027] As an optional but non-limiting implementation, in response to a user's active request, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. Furthermore, the pop-up window may also contain a selection control for the user to select "agree" or "disagree" to provide personal information to the electronic device.

[0028] It is understandable that the above notification and user authorization process are merely illustrative and do not constitute a limitation on the implementation of this application. Other methods that comply with relevant laws and regulations may also be applied to the implementation of this application.

[0029] With the rapid development of the internet and information technology, cyberattacks and data leaks are becoming increasingly frequent worldwide, posing an increasingly serious threat to network security. To address this challenge, vulnerability mining technology has become a crucial tool for ensuring information system security. Vulnerability mining aims to identify potential security vulnerabilities through comprehensive system analysis, helping system administrators promptly discover and patch security flaws and prevent malicious attackers from exploiting them to compromise systems. However, existing vulnerability mining technologies still face numerous challenges in practical application, particularly with regard to privacy protection, which is becoming increasingly prominent.

[0030] Currently, vulnerability mining is primarily categorized into static analysis and dynamic analysis. With the increasing complexity of systems, vulnerability mining in distributed systems and cloud computing environments has become a growing focus. In these environments, systems involve multiple parties and contain vast amounts of user data. Since security testing requires access to critical user data, protecting the privacy of this data becomes a key issue in vulnerability mining.

[0031] Vulnerability mining techniques typically require the analysis of large amounts of system data, including log files, system calls, network traffic, and user input. However, this data often contains a wealth of critical information, such as users' personally identifiable information (PII) and medical records. Traditional vulnerability mining techniques can lead to privacy leaks when processing this critical data, especially in distributed environments with multi-party collaboration, where privacy protection becomes even more complex. Therefore, effective vulnerability mining without compromising user privacy is a pressing issue in this field.

[0032] This application utilizes differential privacy technology. Differential privacy introduces random noise into the data analysis process, ensuring that query results on adjacent datasets are indistinguishable. This reduces the impact of individual data records on the overall analysis, ensuring that even if an attacker obtains the analysis results, they cannot infer specific user data. This mechanism balances privacy protection and data availability by controlling the "privacy budget." Differential privacy technology can be applied in a variety of scenarios, such as data sharing, data analysis, and machine learning model training, protecting the privacy of data providers while ensuring the usefulness of data analysis results.

[0033] In the field of vulnerability mining, differential privacy can solve the following problems:

[0034] Protecting data privacy: During vulnerability detection, differential privacy can prevent external attackers or untrusted partners from inferring users' specific information by protecting important data.

[0035] Improving the security of multi-party collaboration: In distributed or multi-party collaborative vulnerability mining scenarios, differential privacy allows vulnerability mining results to be shared between different organizations and platforms without sharing the original data, thereby improving the efficiency of collaboration while ensuring privacy.

[0036] Existing vulnerability mining technologies primarily focus on detecting system security vulnerabilities, but pay limited attention to privacy protection. In scenarios involving multi-party data sharing or distributed vulnerability mining, the main problems faced by traditional technologies include:

[0037] Privacy Leakage Risk: Traditional methods for multi-party vulnerability detection require different parties to share important data, increasing the risk of privacy leakage. For example, in a cloud computing environment, after users upload data, cloud service providers or external security auditing firms may obtain important user information through this data.

[0038] Challenges of cross-platform vulnerability mining: Security vulnerability mining between different systems and platforms requires a large amount of data exchange and collaboration, and traditional vulnerability mining technology cannot guarantee that data leakage will not occur during these collaborations.

[0039] Limitations of static and dynamic vulnerability mining: Existing static analysis cannot detect vulnerabilities that rely on runtime conditions, while dynamic analysis is easily limited by test coverage, especially in distributed systems, and cannot fully detect all potential vulnerabilities.

[0040] To address the shortcomings of the existing technology, this application proposes a vulnerability detection method based on differential privacy, which is applied to a vulnerability detection system based on differential privacy. This system can perform distributed vulnerability mining while protecting user privacy and has the following technical advantages:

[0041] Introduction of differential privacy mechanism: Through differential privacy technology, important data is processed to ensure that user privacy is not leaked during the vulnerability detection process. Even if an attacker obtains the vulnerability mining results, it is still impossible to restore the original important data.

[0042] Distributed vulnerability mining: The system supports vulnerability mining in a distributed environment. Each node can independently analyze local data and share the analysis results with other nodes through the differential privacy protection mechanism to ensure privacy and security during the collaboration process.

[0043] Multi-party collaboration and data sharing: The system is particularly suitable for cross-organizational and cross-platform data sharing and vulnerability mining scenarios, allowing multiple participants to collaborate on the system's vulnerability detection tasks without sharing specific data.

[0044] Security enhancement function: Based on the vulnerability mining results, the system automatically assesses risks and generates repair suggestions, thereby improving the overall security of the system.

[0045] This application aims to address the privacy leakage issues existing in existing vulnerability mining technologies by proposing a vulnerability detection method based on differential privacy, which is applied to a differential privacy-based vulnerability detection system. Traditional vulnerability mining technologies typically require access to large amounts of important data, such as system logs, network traffic, and user input, when performing vulnerability detection. This data privacy protection becomes a major challenge, especially in distributed systems or multi-party collaboration scenarios. Existing technologies often fail to effectively mine vulnerabilities while ensuring data privacy, resulting in the risk of privacy leakage during security analysis.

[0046] To address this issue, this application introduces differential privacy technology to pre-process important data, ensuring that during the vulnerability detection process, a single data point does not significantly affect the final detection results, thereby effectively preventing external attackers from inferring specific user information through analysis results. Furthermore, based on a distributed computing framework, this application supports vulnerability mining across multiple nodes. Each node can independently perform vulnerability detection and share analysis results while protecting privacy, thereby improving the efficiency and security of distributed vulnerability mining.

[0047] The purposes of this application are to:

[0048] Protect data privacy: Through differential privacy technology, random noise is added to the data query results during the vulnerability mining process to ensure that important user information is not leaked. The system controls the privacy budget To adjust the intensity of noise, we can find the best balance between data accuracy and privacy protection. Especially in multi-party collaboration and distributed system environments, it can effectively avoid privacy leakage.

[0049] Improve vulnerability mining efficiency: Utilize a distributed computing framework to distribute vulnerability mining tasks to multiple nodes. Each node independently completes the detection task and shares vulnerability detection results through a differential privacy mechanism, thereby speeding up detection.

[0050] Multi-party collaboration and data sharing: Allows multiple organizations or platforms to conduct collaborative vulnerability detection without sharing original data, ensuring the security of data privacy for all parties.

[0051] Security enhancement and risk assessment: Based on vulnerability detection results, the system can automatically assess potential security risks and generate repair suggestions, helping system administrators take timely measures to improve the overall security of the system.

[0052] This application mainly uses the following technologies:

[0053] (1) For the first time, differential privacy technology is applied to distributed vulnerability mining. A comprehensive privacy protection mechanism is designed to address the issue of access to important data during vulnerability mining. In data analysis, random noise is injected into query results to ensure that query results of adjacent data sets are difficult to distinguish, thereby protecting the privacy of individual data records. Specifically for time series data (such as network logs, call traces, etc.), a time window partitioning method is proposed to achieve a balance between privacy protection and data accuracy by dynamically adjusting the noise intensity. In addition, Fourier transform and wavelet analysis techniques are used to preserve time series trends and periodic patterns, avoiding the damage of noise to global characteristics, which provides higher reliability for time-based vulnerability mining.

[0054] (2) Collaborative optimization based on trust level. To cope with the complexity of multi-party collaboration in distributed vulnerability mining scenarios, this application proposes a collaborative optimization mechanism based on trust level. By assigning a trust level (high, medium, low) to each collaborative node, the system can dynamically adjust the privacy budget ( The trust level mechanism not only improves collaboration efficiency but also ensures privacy in multi-party collaboration.

[0055] (3) In order to reduce the risk of privacy leakage caused by data transmission in distributed vulnerability mining, this application introduces edge computing technology. By performing differential privacy preprocessing at the edge node close to the data source, the system realizes data localization analysis and reduces the risk of exposure of important data during transmission. After the edge node passes the differential privacy protection, the analysis results are uploaded to the central node for aggregation. In addition, in a distributed environment, the differential privacy mechanism is also used when sharing intermediate results between nodes, thereby ensuring the privacy of node collaboration. This design combined with edge computing makes vulnerability detection more efficient and secure.

[0056] (4) To address the issue of privacy leakage caused by multiple queries in a distributed environment, this application proposes a dynamic privacy budget allocation mechanism. By comprehensively considering the trust level of nodes and the global privacy budget, the system achieves dynamic allocation of the privacy budget and designs a sensitivity calculation method that adapts to different data types. In important data scenarios such as time series data or user behavior logs, the system dynamically adjusts the noise intensity based on the query sensitivity, ensuring the accuracy of data analysis results while avoiding excessive consumption of the privacy budget.

[0057] (5) In distributed vulnerability mining, the detection results of each node need to be aggregated to a central node. To avoid leaking important information in the aggregated results, this application designs a secondary differential privacy protection mechanism. On the basis of injecting initial noise into the node detection results, the system injects global noise again during the aggregation process to ensure that attackers cannot infer the original data through multiple queries. In addition, the system adjusts the result aggregation strategy based on the node trust level. High-trust nodes directly participate in the aggregation, while the results of low-trust nodes are included in the form of low resolution. This two-layer protection strategy strengthens the global privacy protection capability.

[0058] The embodiment of the present application provides a vulnerability detection method based on differential privacy, which executes preset query tasks for each distributed node to ensure the pertinence and efficiency of data collection. Then, the privacy budget is allocated according to the node trust level, and differential privacy noise is added according to the query sensitivity. This mechanism not only protects the privacy of user data, but also enhances the robustness of data query. For the query results, security vulnerabilities are discovered and reported in a timely manner through preset threshold verification, thereby realizing active defense of network security. Finally, the central control node summarizes the vulnerability detection results of each node and applies differential privacy protection again, further consolidating the security of the data aggregation stage, which can significantly improve the comprehensive efficiency of data query and network security protection, ensure the safe use and privacy protection of user data in a distributed environment, and provide strong support for network security reinforcement.

[0059] like Figure 1 As shown, the method of this embodiment is applied to a vulnerability detection system based on differential privacy. The system includes a central control node and multiple distributed nodes, each of which is used to process different types of user behavior data. The method includes:

[0060] Step 101 : querying user behavior data corresponding to a target user from each distributed node according to a preset query task corresponding to each distributed node, and determining an initial query result corresponding to the query task based on each user behavior data.

[0061] In this step, specific query tasks are preset for each distributed node. These tasks define what types of user behavior data or what conditions must be met to retrieve from the corresponding node.

[0062] Distributed nodes refer to different computing units or data storage locations distributed across a network. In a vulnerability detection system based on differential privacy, data is stored dispersed across these nodes to improve data access efficiency, scalability, and fault tolerance. Each node stores a different portion or type of data related to user behavior.

[0063] Based on the pre-defined query task, the system retrieves user behavior data related to the target user from various distributed nodes. Target users may be determined based on specific user identifiers (such as user ID), user attributes (such as age, gender), or other business logic. User behavior data may include user click behavior, browsing history, etc.

[0064] User behavior data collected from various nodes is used to generate initial query results for the corresponding query task. This process may involve operations such as data aggregation, filtering, and transformation to ensure that the results meet the requirements of the pre-defined query task. The initial query results may be a direct summary of the raw data or may have undergone some degree of processing or analysis.

[0065] In step 102, the following operations are performed for each distributed node: the trust level corresponding to the distributed node is obtained, and the privacy budget of the distributed node is allocated using the trust level corresponding to the distributed node; the query sensitivity corresponding to the query task of the distributed node is determined, the differential privacy noise is determined based on the noise distribution mechanism according to the privacy budget and the query sensitivity, and the differential privacy noise is added to the initial query result corresponding to the distributed node to obtain a query result after noise addition; in response to the query result after noise addition not being within the range of a preset query result threshold, the vulnerability detection result corresponding to the distributed node is determined to be that a security vulnerability exists, and the vulnerability detection result corresponding to the distributed node is sent to the central control node; or, in response to the query result after noise addition being within the range of a preset query result threshold, the vulnerability detection result corresponding to the distributed node is determined to be that there is no security vulnerability, and the vulnerability detection result corresponding to the distributed node is sent to the central control node.

[0066] In this step, each distributed node has a corresponding trust level. This trust level may be determined based on various factors such as the node's historical behavior, security, data processing capabilities, etc.

[0067] Based on this trust level, the system assigns a privacy budget to each node. The privacy budget is a measure of the strength of privacy protection. A higher budget means that more data queries or analyses can be allowed while protecting privacy without leaking too much information.

[0068] For each distributed node query task, the system first determines the query sensitivity. Query sensitivity reflects the sensitivity of the query result to changes in a single data item in the dataset.

[0069] Based on the privacy budget and query sensitivity, the system uses a noise distribution mechanism (such as Laplace noise or Gaussian noise) to determine the amount of differential privacy noise to add. Differential privacy is a privacy-preserving technique that protects individual privacy by adding noise to query results while ensuring that the accuracy of the query results is within an acceptable range.

[0070] The determined differential privacy noise is added to the initial query result to obtain the noise-processed query result.

[0071] The system presets a query result threshold range to evaluate the rationality of the query results after noise processing.

[0072] If the query result after adding noise is not within the preset threshold, the system will consider that the distributed node may have a security vulnerability. This may be due to an abnormal amount of noise added, indicating that the data has been tampered with or there is abnormal behavior in the system.

[0073] On the contrary, if the query result is within the preset threshold range, it is considered that the node has no security vulnerability.

[0074] Regardless of the detection results, the system will send the vulnerability detection results corresponding to each distributed node to the central control node. The central control node is responsible for collecting the detection results of all nodes, conducting a comprehensive analysis, and may take further actions, such as notifying administrators and isolating affected nodes.

[0075] This process combines differential privacy technology and security vulnerability detection, aiming to ensure the security and stability of the system while protecting data privacy in distributed systems.

[0076] In step 103, the vulnerability detection results corresponding to each distributed node are summarized through the central control node to obtain a summary result, preset differential privacy noise is added to the summary result to obtain a summary result after noise addition, and a vulnerability detection report is generated based on the summary result after noise addition for vulnerability repair according to the vulnerability detection report.

[0077] In this step, each distributed node performs vulnerability detection independently. This means that each node checks its own security to look for possible vulnerabilities or weaknesses.

[0078] After all distributed nodes complete vulnerability detection, they send their respective detection results to the central control node. The central control node is responsible for collecting these results and aggregating them into a unified summary. This summary reflects the vulnerability detection status of all nodes in the entire distributed system.

[0079] To protect data privacy and prevent the leakage of important information, the central control node adds preset differential privacy noise to the summary results. By adding noise to the original data, the privacy of individual data records can be protected while ensuring the accuracy of data query results.

[0080] The summary results after adding noise no longer directly reflect the original detection data, but it still retains enough information to generate a vulnerability detection report. This report is based on the statistics and analysis of the summary results, indicating the type, location, and possible severity of the vulnerabilities in the system.

[0081] Finally, the system administrator or security team will take the necessary measures to fix the discovered vulnerabilities based on the information in the vulnerability detection report. This may include updating software, modifying configurations, strengthening access controls, etc.

[0082] The entire process not only achieves a comprehensive test of the security of the distributed system, but also effectively protects the privacy of important information in the system through the application of differential privacy technology, ensuring the security and compliance of the data.

[0083] Through the above scheme, preset query tasks are executed for each distributed node to ensure the targeted and efficient data collection. Then, a privacy budget is allocated based on the node trust level, and differential privacy noise is added based on the query sensitivity. This mechanism not only protects the privacy of user data but also enhances the robustness of data queries. For query results, through preset threshold verification, security vulnerabilities are promptly discovered and reported, achieving active defense of network security. Finally, the central control node summarizes the vulnerability detection results of each node and re-applies differential privacy protection, further consolidating the security of the data aggregation stage. It can significantly improve the combined effectiveness of data query and network security protection, ensure the safe use and privacy protection of user data in a distributed environment, and provide strong support for network security reinforcement.

[0084] In some embodiments, in step 102, allocating privacy budgets of distributed nodes using trust levels corresponding to the distributed nodes includes:

[0085] Step A1: Obtain the privacy budget of all distributed nodes.

[0086] In step A2, based on the privacy budgets of all distributed nodes and the weights of the trust levels corresponding to the distributed nodes, the privacy budgets of the distributed nodes are determined using the following formula:

[0087]

[0088] in, Represents a distributed node privacy budget, Represents a distributed node The weight of the trust level, Represents the privacy budget of all distributed nodes.

[0089] In the above scheme, each distributed node is assigned a trust level, which reflects the degree to which the node is considered trustworthy. The trust level is usually expressed in the form of a weight, with a higher weight indicating a more trustworthy node.

[0090] Distributed nodes with high trust levels have high data security, distribute less noise, and ensure data practicality, allowing for more accurate or complex data processing while ensuring privacy.

[0091] By flexibly adjusting privacy protection measures according to the trustworthiness of nodes, a balance is found between privacy protection and data processing efficiency.

[0092] In some embodiments, in step 102, determining the query sensitivity corresponding to the query task of the distributed node includes:

[0093] Step B1: Obtain initial query results corresponding to a first user behavior dataset in a current time window and initial query results corresponding to a second user behavior dataset in a time window adjacent to the current time window.

[0094] Step B2: Based on the initial query result corresponding to the first user behavior dataset and the initial query result corresponding to the second user behavior dataset, the query sensitivity is determined by the following formula:

[0095]

[0096] in, Indicates query sensitivity, Represents the first user behavior dataset The corresponding initial query results, Represents the second user behavior dataset The corresponding initial query results.

[0097] In the above solution, a first user behavior dataset exists within the current time window. After querying this dataset, the corresponding initial query result is obtained. Simultaneously, a second user behavior dataset exists within an adjacent time window (perhaps the previous or next time window) of the current time window. This dataset is also queried to obtain the corresponding initial query result.

[0098] Query sensitivity is an indicator used to measure the sensitivity of query results to changes in input data (here, the user behavior dataset).

[0099] High query sensitivity means that the query results are very sensitive to small changes in the user behavior dataset, which may cause the query results to be unstable or difficult to predict.

[0100] Low query sensitivity means that the query results are less sensitive to changes in the user behavior dataset, which generally means that the query results are more stable and reliable.

[0101] In summary, this method evaluates the sensitivity of the query task by comparing the initial query results corresponding to user behavior datasets in different time windows, which helps to understand the stability and reliability of the query results.

[0102] In some embodiments, the noise distribution mechanism comprises a Laplace mechanism.

[0103] In step 102, determining the differential privacy noise based on the noise distribution mechanism according to the privacy budget and the query sensitivity includes:

[0104] In step C1, the query sensitivity and privacy budget are ratio-processed to obtain the scale parameter.

[0105] In step C2, the scale parameter is processed using the probability density function of the Laplace distribution to obtain differential privacy noise.

[0106] In the above scheme, differential privacy technology protects privacy by adding noise to data query results. The distribution of noise can take many forms, among which the Laplace distribution is a continuous probability distribution whose probability density function is symmetric about its mean and has a heavier tail than the normal distribution. This means that it allows for larger noise values, helping to maintain data availability while protecting privacy.

[0107] Privacy budget is a parameter that measures the degree of privacy protection. Query sensitivity is a parameter that measures the sensitivity of query results to changes in a single data point in a dataset.

[0108] In the Laplace mechanism, the amount of noise is controlled by a scale parameter, which is calculated by dividing the query sensitivity by the privacy budget.

[0109] Once the scale parameter is determined, the noise can be generated using the probability density function of the Laplace distribution. In the Laplace distribution, the noise value is randomly drawn from a distribution centered at 0 and scaled by the scale parameter. This noise value is then added to the query result to ensure that the requirements of differential privacy are met.

[0110] In some embodiments, the noise distribution mechanism comprises a Gaussian mechanism.

[0111] In step 102, determining the differential privacy noise based on the noise distribution mechanism according to the privacy budget and the query sensitivity includes:

[0112] Step D1: Determine the variance of the probability density function of the Gaussian distribution, and based on the variance of the probability density function of the Gaussian distribution, the query sensitivity, and the privacy budget, determine the noise standard deviation using the following formula:

[0113]

[0114] in, represents the noise standard deviation, Indicates query sensitivity, represents the privacy budget, Represents the variance of the probability density function of the Gaussian distribution.

[0115] In step D2, the noise standard deviation is processed using the probability density function of the Gaussian distribution to obtain differential privacy noise.

[0116] In the above scheme, in differential privacy protection, Gaussian distribution (normal distribution) can be used to generate noise added to the query results. Gaussian distribution is a common continuous probability distribution whose shape is determined by mean and variance.

[0117] When using the Gaussian mechanism, you first need to determine the variance of the probability density function of the Gaussian distribution This variance determines the dispersion of the noise, that is, the possible fluctuation range of the noise value.

[0118] Determine the noise standard deviation based on the variance of the probability density function of the Gaussian distribution, query sensitivity, and privacy budget .

[0119] Once the noise standard deviation is determined , we can use the probability density function of the Gaussian distribution to generate specific noise values. This usually involves randomly drawing a value from the Gaussian distribution, where the distribution of the value is determined by the standard deviation of the noise.

[0120] By adding this randomly generated noise value to the query result, we can obtain a differentially private query result that protects privacy while retaining the characteristics of the original data as much as possible.

[0121] In some embodiments, in step 102, adding differential privacy noise to the initial query result corresponding to the distributed node to obtain the noise-added query result includes:

[0122] Step E1: performing summation processing based on the initial query result corresponding to the distributed node and the differential privacy noise to determine the initial query result after noise addition.

[0123] Step E2: obtaining a time window of the initial query result corresponding to the distributed node, and determining a data activity period of the time window, wherein the data activity period is used to indicate the activity status of data within a specific time period.

[0124] Step E3: In response to the data activity period belonging to the preset first data activity period type, the initial noise-added query result is reduced according to the preset noise threshold to obtain the noise-added query result. Or,

[0125] Step E4 , in response to the data activity period belonging to a preset second data activity period type, adding the initial noise-added query result according to a preset noise threshold to obtain a noise-added query result.

[0126] In the above scheme, each distributed node generates an initial query result. To protect privacy, differential privacy noise is added to each distributed node's initial query result. Differential privacy noise is a carefully designed random noise, and the amount added depends on the privacy protection requirements and the sensitivity of the data.

[0127] By summing the initial query result with the differential privacy noise, a preliminary query result with added noise is obtained.

[0128] For each distributed node's query results, the system also considers its corresponding time window. The time window refers to the time range covered by the query results.

[0129] Within this time window, the system further determines the data activity period. The data activity period is used to indicate the activity status of data within a specific time period, such as frequent data updates, accesses, or operations.

[0130] Depending on the type of data activity period, the system will further adjust the query results after the initial noise addition.

[0131] If the data activity period falls within the predefined first data activity period type (which may indicate high data activity, such as periods of high data traffic or periods of frequent abnormal behavior), the initial noise-added query results are degraded by the predefined noise threshold. This is done to reduce noise injection during periods of high data activity and improve detection accuracy.

[0132] If the data activity period falls into the second predefined data activity period type (which may indicate relatively low data activity), the query results that have been initially noised are augmented by a predefined noise threshold. This is done to appropriately increase the noise intensity when data activity is low, thereby enhancing privacy protection.

[0133] In this way, the system can dynamically adjust the amount of noise added based on the activity of the data while protecting user privacy, thereby finding a balance between privacy protection and statistical accuracy.

[0134] In some embodiments, in step 103, adding a preset differential privacy noise to the summary result to obtain the noise-added summary result includes:

[0135] In step F1, based on the summary result and the preset differential privacy noise, the noise-added summary result is obtained using the following formula:

[0136]

[0137] in, represents the summary result after noise addition, represents the preset differential privacy noise, Indicates query sensitivity, represents the privacy budget of all distributed nodes, Indicates the summary results, Representation and distributed nodes The corresponding vulnerability detection results, Indicates the order of distributed nodes, Indicates the number of distributed nodes.

[0138] In the above scheme, the noise-added summary result is obtained by adding preset differential privacy noise to the summary result.

[0139] The size and distribution of noise are determined based on query sensitivity, privacy budget, and the specific noise addition mechanism.

[0140] In this way, even if an attacker obtains the aggregated result with added noise, it is difficult to infer the original data of a single distributed node from it, thus protecting personal privacy.

[0141] In some embodiments, the present application enables efficient vulnerability mining in distributed systems while ensuring data privacy is not leaked. The system consists of multiple computing nodes, each of which independently performs vulnerability detection tasks. The analysis results are shared between nodes using differential privacy technology, ultimately generating a global vulnerability report. The system is suitable for multi-party collaborative, cross-platform security vulnerability detection scenarios, and can ensure data security and privacy, especially when important data is involved.

[0142] This application provides a vulnerability detection method based on differential privacy, which is applied to a vulnerability detection system based on differential privacy. The architecture of the system is as follows: Figure 2As shown, it includes multiple distributed nodes (distributed node 1, distributed node 2, ..., distributed node N) and a system control and aggregation module (i.e., central control node). Each distributed node can perform differential privacy processing and vulnerability detection using the vulnerability detection module, and then send the vulnerability detection results to the system control and aggregation module respectively. The system control and aggregation module includes a report generation and visualization module, a result aggregation and differential privacy protection module, and a security enhancement and repair suggestion module.

[0143] This application provides a vulnerability detection method based on differential privacy, which includes the following steps:

[0144] Step 1: Data preprocessing and differential privacy protection:

[0145] Before vulnerability detection begins, the system performs differential privacy processing on important data of each node. By adding noise to the data, it ensures that attackers cannot infer the original data through analysis results.

[0146] The core of the differential privacy algorithm is to control the privacy budget To adjust noise intensity, we ensure maximum data privacy while maintaining analytical accuracy. For time series data processing, the system uses a dynamic noise distribution optimization strategy to dynamically adjust noise intensity based on the importance of each time period. Furthermore, Fourier transforms are used to preserve global time series patterns, ensuring that noise does not affect critical timing characteristics.

[0147] Step 2: Distributed vulnerability mining:

[0148] After the data has been processed with differential privacy, the system distributes it to multiple nodes for distributed computing. Each node independently runs a vulnerability mining algorithm to perform security analysis on local data and identify potential vulnerabilities in the system.

[0149] Vulnerability mining algorithms include static analysis, dynamic analysis, and a comprehensive analysis combining the two. They can detect code structure vulnerabilities, network communication vulnerabilities, and security vulnerabilities that may arise during dynamic execution.

[0150] Step 3: Result aggregation and differential privacy protection:

[0151] After each node completes vulnerability detection, it returns the results to the central control module. To prevent potential privacy leaks caused by accumulated queries during the aggregation process, the system adds differential privacy noise to the results. This mechanism sets a global privacy budget to ensure that no matter how many queries are made, attackers cannot infer the original data content. This prevents attackers from analyzing the aggregated results to reversely infer the specific data of each node.

[0152] In distributed collaboration, the system allocates differential privacy budgets to nodes based on the trust evaluation model. Nodes with higher trust levels are allocated less noise to improve result accuracy, while nodes with lower trust levels are allocated more noise to enhance privacy protection.

[0153] Combined with edge computing technology, each edge node completes differential privacy protection processing locally and only shares the protected analysis results.

[0154] The summary of detection results includes the type of vulnerabilities in the system, their severity, their occurrence location, and related security risk assessment.

[0155] Step 4: Generate vulnerability detection report:

[0156] The aggregated detection results are used to generate a global vulnerability detection report. The system further evaluates the accuracy of the detection data based on the noise level in the detection results and quantifies the risk of the vulnerabilities involved in the report, ensuring that an effective risk assessment can be provided while protecting privacy. The report includes the following:

[0157] The type of vulnerability detected (such as buffer overflow, unauthorized access, SQL injection, etc.).

[0158] A severity assessment of each vulnerability (e.g., high, medium, low).

[0159] The location of the vulnerability and its associated system components.

[0160] Analysis of potential risks that may be caused by vulnerabilities.

[0161] Step 5: Security enhancement and repair suggestions:

[0162] Based on the vulnerability detection report, the system conducts an automated risk assessment and generates corresponding security enhancement recommendations. The recommendations include repair solutions, vulnerability patching methods, and specific code modification examples.

[0163] System administrators can quickly fix vulnerabilities and improve system security based on reports and suggestions.

[0164] Step 6: System Communication and Collaboration:

[0165] The system connects distributed edge nodes through secure communication channels. While ensuring communication security, it protects intermediate results through differential privacy and ensures data privacy during node collaboration.

[0166] System Architecture:

[0167] 1. Data preprocessing module:

[0168] Responsible for preprocessing the original data and adding differential privacy protection mechanisms to ensure that users' important information will not be leaked during data analysis and vulnerability detection.

[0169] Use differential privacy technology (such as Laplace noise mechanism or exponential mechanism) to randomize the input data. During the processing, according to the set privacy budget ( ) to control the intensity of noise to ensure data security without significantly affecting the accuracy of vulnerability detection.

[0170] A time series optimization mechanism is introduced to dynamically allocate differential privacy budgets according to time periods, and Fourier transform is combined to retain key time series patterns to prevent noise from affecting the global trend of the data.

[0171] A dynamic optimization mechanism for differential privacy algorithms is introduced to select the optimal privacy budget and noise distribution method based on the data type and application. For example, for time series data, a dynamic noise distribution strategy is used.

[0172] The data processed with differential privacy is distributed to different distributed nodes, and each node performs vulnerability detection tasks independently.

[0173] Data distribution adopts a weighted random allocation strategy, prioritizing high-risk data to high-performance nodes for preprocessing; lower-importance data is allocated to edge nodes to reduce the load on the main node.

[0174] 2. Distributed vulnerability detection module:

[0175] Vulnerability detection tasks are executed in parallel across multiple distributed nodes, primarily focusing on security analysis of local data across different nodes or systems. Static analysis detects code structure issues such as buffer overflows and Structured Query Language (SQL) injections, while dynamic analysis identifies runtime vulnerabilities that rely on user input by simulating runtime behavior.

[0176] Leveraging edge computing technology, data can be analyzed and privacy protected locally at nodes close to the data source, reducing privacy risks associated with data transmission. In node-based collaborative analysis, differential privacy budgets are allocated based on trust models to improve cross-platform collaboration efficiency. After localized data preprocessing using edge computing technology, differential privacy processing results are shared, mitigating privacy risks associated with inter-node data transmission.

[0177] Differential privacy mechanisms ensure that vulnerability detection information can be shared between different nodes without leaking specific data content. Collaboration between nodes can better cover cross-platform and cross-system vulnerabilities.

[0178] 3. Result summary and report generation module:

[0179] The vulnerability detection results independently completed by each distributed node are summarized and a global vulnerability detection report is generated.

[0180] To prevent attackers from inferring the specific data of nodes through the summary results, differential privacy mechanisms are used to add noise protection during the aggregation process. Even if an attacker obtains the summary results, they cannot restore the original data through reverse analysis.

[0181] The aggregated vulnerability detection information includes the following:

[0182] The type of vulnerability detected and where it occurred.

[0183] The risk level assessment of vulnerabilities is divided into three levels: low, medium, and high.

[0184] System threats and potential attack paths that may be caused by vulnerabilities.

[0185] Repair suggestions and security enhancement solutions.

[0186] The vulnerability detection report generated by the system is presented to the system administrator in a visual manner, helping operators to more intuitively understand the vulnerability distribution and security status in the system.

[0187] When aggregating the detection results of each node, the system injects global noise into the cumulative query results to avoid privacy leakage due to multiple queries, while protecting the privacy of the final aggregated results.

[0188] 4. Security Enhancement Module:

[0189] Based on the vulnerability detection report, the system automatically generates risk assessments and security enhancement recommendations to help administrators quickly fix vulnerabilities and improve system security.

[0190] Based on the detected vulnerability type and risk level, the system provides automated remediation suggestions. For example:

[0191] To address SQL injection issues, it is recommended to use parameterized queries or an Object-Relational Mapping (ORM) framework.

[0192] To prevent buffer overflow issues, it is recommended to use safe string operation functions.

[0193] The system can be integrated with automated remediation tools to directly mark remediation suggestions at the code locations where vulnerabilities are detected and generate change reports that can be used for code review.

[0194] 5. Differential Privacy Mechanism:

[0195] The differential privacy mechanism runs through all stages of the system to ensure the privacy protection of important data throughout the entire vulnerability detection process.

[0196] Privacy Budget Control: By setting a privacy budget ε, the system can adjust the noise intensity as needed. A lower privacy budget value means stronger privacy protection, but may sacrifice some data accuracy. A higher privacy budget allows for more accurate vulnerability detection, but with relatively weaker privacy protection.

[0197] The system dynamically adjusts the privacy budget ( ), limiting privacy consumption in multiple query scenarios. For example, setting a maximum budget allocation cap for each query to ensure that the total privacy budget is not exhausted.

[0198] During the vulnerability detection process performed by each node, random noise is injected into the intermediate output results to prevent attackers from inferring the original data through the output of a single node.

[0199] Differential privacy automatically adjusts the noise level when data is queried multiple times, preventing attackers from inferring important data content through repeated analysis. The system dynamically adjusts the noise level based on the privacy budget consumed by each query to maintain the effectiveness of overall privacy protection.

[0200] Adaptive sensitivity calculation methods are used for various data types (such as time series data and user behavior logs). The sensitivity calculation of dynamic analysis is based on the maximum change in system calls or behavior patterns.

[0201] 6. System communication and collaboration:

[0202] In a distributed system, each node needs to exchange data through a secure communication channel. Differential privacy technology can prevent data leakage between nodes during communication. Even if the communication channel is attacked, the node's important data cannot be recovered.

[0203] The system uses a differential privacy mechanism to ensure that intermediate results of vulnerability detection can be shared between different nodes, and to collaboratively analyze cross-system vulnerabilities without leaking important information.

[0204] Implementation steps:

[0205] (1) Differential privacy algorithm design: By introducing noise, the privacy of each data point is protected. For time series data (such as network logs and call traces), a time window partitioning method is used to dynamically adjust the noise intensity to ensure the accuracy of data in high activity periods. Specifically, differential privacy ensures that the query results on two adjacent data sets are difficult to distinguish by adding noise to the query results. The most commonly used noise distribution mechanisms are the Laplace mechanism and the Gaussian mechanism. The Laplace mechanism adds noise to the query results, and its distribution is:

[0206]

[0207] in, is the global sensitivity of the query, It's a privacy budget.

[0208] The Gaussian mechanism uses normally distributed noise and is suitable for satisfying ( , ) Differential privacy scenarios:

[0209]

[0210] in, : Noise standard deviation, which is related to query sensitivity and privacy budget, is:

[0211]

[0212] This protection mechanism is especially important for vulnerability mining scenarios, as important data (such as user identity, browsing history, etc.) may be accessed during the vulnerability detection process.

[0213] (2) Definition of differential privacy:

[0214] By adding noise to the query results, a mathematical definition of privacy protection is provided. , given adjacent datasets and (There is only one data point difference between them), differential privacy requires the following formula to hold:

[0215]

[0216] is the privacy budget, which controls the trade-off between privacy and accuracy. Provides stronger privacy protection, but may sacrifice the accuracy of query results.

[0217] It is a probabilistic failure term and is usually set to a very small value to ensure that privacy protection is effective in most cases.

[0218] An arbitrary subset of query results, representing the possible results that a query may return.

[0219] (3) Time series data processing optimization:

[0220] The system first identifies the type of input data. If it is time series data (such as network traffic logs or call traces), the system uses a time window partitioning method to process the data in segments.

[0221] Dynamically adjust the noise intensity for the data in each time window:

[0222] During periods of high data activity (such as high traffic and frequent abnormal behavior), reduce noise injection and improve the accuracy of detection results.

[0223] During periods of low data activity, the noise intensity is increased to enhance privacy protection.

[0224] Use Fourier transform or wavelet analysis techniques to preserve the trend and periodic patterns of the time series and ensure that noise does not destroy the global timing characteristics.

[0225] Fourier transform formula:

[0226]

[0227] Used to extract frequency characteristics of time series.

[0228] (4) Privacy budget allocation based on trust level:

[0229] For multi-party collaboration scenarios, the system allocates different privacy budgets based on the trust level of the participants ( ):

[0230] High confidence level: reduces noise intensity and enhances the analytical value of data.

[0231] Medium trust level: Maintains normal noise intensity, balancing privacy and data utility.

[0232] Low trust level: Increases noise intensity and strengthens data protection.

[0233] Dynamic allocation formula:

[0234]

[0235] in: :node privacy budget. : The trust weight of the node, the higher the trust node, the greater the weight.

[0236] (5) Edge node localization processing:

[0237] In a distributed environment, edge nodes close to the data source perform differential privacy preprocessing. This step processes important data locally, reducing privacy risks that data may face during transmission.

[0238] The application process of differential privacy in vulnerability mining:

[0239] Step 1: Data preprocessing:

[0240] On each distributed node, first the local data set Run a query. For example, a query could be "the number of abnormal function calls triggered by users" or "the frequency of a certain type of access behavior."

[0241] Step 2: Calculate query sensitivity:

[0242] Calculating the sensitivity of a query , such as the maximum possible change in the frequency of a function call in adjacent data sets.

[0243]

[0244] Step 3: Add differential privacy noise:

[0245] Use Laplace mechanism for query results Add noise, which is generated based on the sensitivity of the query and the privacy budget set. Calculate the query Sensitivity , that is, the maximum possible change in the query results on adjacent datasets. For example, in vulnerability mining, it may be necessary to analyze the frequency of calls to a specific module. The query sensitivity is the maximum change in call frequency when adding or removing a user's data. Set the privacy budget according to system requirements. , smaller This means stronger privacy protection, but the accuracy of query results may be reduced. For each query result, the node performs the following operations:

[0246]

[0247] in: It is a dataset 's query results. Is a query The global sensitivity of , which represents the maximum change in query results on adjacent datasets:

[0248]

[0249] It's a privacy budget.

[0250] is the noise term of the Laplace distribution, and the scale parameter is .

[0251] Step 4: Distributed vulnerability mining:

[0252] Distributed node tasks are divided into functional modules or areas, such as "Module A is responsible for network request log analysis," and "Module B is responsible for system call log analysis," to optimize computing load. Each node executes vulnerability detection algorithms by querying local data. Differential privacy mechanisms ensure that each node's query results on local data do not leak important information. Even if the test results are accessed by other nodes, the true value of any individual data point is not exposed.

[0253] Step 5: Summary of results:

[0254] Each node aggregates the processed query results (i.e., vulnerability detection results with noise) to the central control node. Differential privacy ensures the privacy of each node's data. The central control node aggregates the results of each node and injects noise into the aggregated data again to protect privacy:

[0255]

[0256] Noise is again added during aggregation to ensure that an attacker cannot infer information about any single data point from multiple results.

[0257] In addition, the data flow of vulnerability detection is as follows Figure 3 As shown, each distributed node (distributed node 1, distributed node 2, ..., distributed node N) performs differential privacy processing and uses the vulnerability detection module to perform vulnerability detection, and then sends the vulnerability detection results to the system control and aggregation module (that is, the local detection results are sent to the system control module for aggregation), and uses the result aggregation and differential privacy protection module in the system control and aggregation module to perform data aggregation and differential privacy noise processing. Noise injection is performed during the data processing and differential privacy process, so that the system control and aggregation module adds noise again to the summary result obtained by aggregating the local detection results to ensure that attackers cannot infer the information of any single data point through multiple results.

[0258] The process of adding noise to the differential privacy algorithm is as follows Figure 4 As shown, it includes the data preprocessing stage, calculating the query sensitivity, noise distribution selection (Laplace mechanism), and adding noise to the query results.

[0259] Among them, data preprocessing stage: the system receives query requests and extracts relevant data sets ; Calculate the sensitivity of the query: calculate the maximum change of the query on the data set and determine the sensitivity ; Noise distribution selection (Laplace mechanism): according to sensitivity and privacy budget Calculate noise intensity; add noise to query results: add the calculated noise value to the query results, generate noisy output, and return the noisy query results .

[0260] It should be noted that the method of the embodiment of the present application can be performed by a single device, such as a computer or server. The method of this embodiment can also be applied in a distributed scenario and performed by multiple devices working together. In such a distributed scenario, one of the multiple devices may only perform one or more steps of the method of the embodiment of the present application, and the multiple devices will interact with each other to complete the method.

[0261] It should be noted that the above description is limited to some embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in an order different from that described in the above embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order or sequential order shown to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0262] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the present application also provides a vulnerability detection device based on differential privacy.

[0263] refer to Figure 5 The vulnerability detection device based on differential privacy is provided in a vulnerability detection system based on differential privacy. The system includes a central control node and multiple distributed nodes, each distributed node is used to process different types of user behavior data, and the device includes:

[0264] The query module 501 is configured to query user behavior data corresponding to a target user from each distributed node according to a preset query task corresponding to each distributed node, and determine an initial query result corresponding to the query task based on each user behavior data;

[0265] The vulnerability detection module 502 is configured to perform the following operations for each distributed node: obtain a trust level corresponding to the distributed node, and allocate a privacy budget for the distributed node using the trust level corresponding to the distributed node; determine a query sensitivity corresponding to the query task of the distributed node, determine differential privacy noise based on the noise distribution mechanism according to the privacy budget and the query sensitivity, and add the differential privacy noise to the initial query result corresponding to the distributed node to obtain a noise-added query result; in response to the query result after the noise addition not being within a preset query result threshold, determine that the vulnerability detection result corresponding to the distributed node is a security vulnerability, and send the vulnerability detection result corresponding to the distributed node to the central control node; or, in response to the query result after the noise addition being within a preset query result threshold, determine that the vulnerability detection result corresponding to the distributed node is a security vulnerability, and send the vulnerability detection result corresponding to the distributed node to the central control node.

[0266] The aggregation module 503 is configured to aggregate the vulnerability detection results corresponding to each distributed node through the central control node to obtain an aggregation result, add preset differential privacy noise to the aggregation result to obtain an aggregation result with noise added, and generate a vulnerability detection report based on the aggregation result with noise added, so as to provide for vulnerability repair according to the vulnerability detection report.

[0267] For the convenience of description, the above devices are described as being divided into various modules according to their functions. Of course, when implementing this application, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0268] The device of the above embodiment is used to implement the corresponding vulnerability detection method based on differential privacy in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0269] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments and methods, the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and runnable on the processor, wherein when the processor executes the program, the vulnerability detection method based on differential privacy described in any of the above embodiments is implemented.

[0270] Figure 6 A more specific hardware structure diagram of an electronic device provided in this embodiment is shown. The device may include: a processor 601, a memory 602, an input / output interface 603, a communication interface 604, and a bus 605. The processor 601, the memory 602, the input / output interface 603, and the communication interface 604 are communicatively connected to each other within the device via the bus 605.

[0271] The processor 601 can be implemented using a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0272] The memory 602 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage devices, dynamic storage devices, etc. The memory 602 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 602 and is called and executed by the processor 601.

[0273] The input / output interface 603 is used to connect to input / output modules to implement information input and output. The input / output modules can be configured as components within the device (not shown) or externally connected to the device to provide corresponding functions. Input devices may include a keyboard, mouse, touch screen, microphone, and various sensors, while output devices may include a display, speaker, vibrator, indicator light, and the like.

[0274] The communication interface 604 is used to connect to a communication module (not shown) to enable communication between the device and other devices. The communication module can communicate via wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WiFi, Bluetooth, etc.).

[0275] The bus 605 comprises a pathway for transmitting information between various components of the device (eg, the processor 601 , the memory 602 , the input / output interface 603 , and the communication interface 604 ).

[0276] It should be noted that although the above device only shows the processor 601, the memory 602, the input / output interface 603, the communication interface 604, and the bus 605, in a specific implementation, the device may also include other components necessary for normal operation. In addition, it will be understood by those skilled in the art that the above device may only include the components necessary to implement the embodiments of this specification, and does not necessarily include all the components shown in the figure.

[0277] The electronic device of the above embodiment is used to implement the corresponding vulnerability detection method based on differential privacy in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0278] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the present application also provides a non-transitory computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable the computer to execute the differential privacy-based vulnerability detection method as described in any of the above embodiments.

[0279] The computer-readable media of this embodiment includes permanent and non-permanent, removable and non-removable media that can be used to store information by any method or technology. The information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, tape disk storage or other magnetic storage devices, or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0280] The computer instructions stored in the storage medium of the above embodiment are used to enable the computer to execute the vulnerability detection method based on differential privacy as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0281] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present application is limited to these examples. In line with the present application, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the embodiments of the present application as described above, which are not provided in detail for the sake of simplicity.

[0282] In addition, to simplify the description and discussion, and to avoid obscuring the understanding of the embodiments of the present application, well-known power / ground connections to integrated circuit (IC) chips and other components may or may not be shown in the provided figures. Furthermore, devices may be shown in block diagram form to avoid obscuring the understanding of the embodiments of the present application, and this also takes into account the fact that the implementation details of these block diagram devices are highly dependent on the platform on which the embodiments of the present application will be implemented (i.e., these details should be fully understood by those skilled in the art). Where specific details (e.g., circuits) are set forth to describe the exemplary embodiments of the present application, it will be apparent to those skilled in the art that the embodiments of the present application can be implemented without these specific details or with variations therefrom. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0283] Although the present invention has been described in conjunction with specific embodiments thereof, many alternatives, modifications, and variations of these embodiments will be apparent to those skilled in the art based on the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may utilize the discussed embodiments.

[0284] The embodiments of the present application are intended to cover all such substitutions, modifications, and variations that fall within the broad scope of the present application. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present application should be included in the scope of protection of the present application.

Claims

1. A vulnerability detection method based on differential privacy, characterized in that: Applied to a vulnerability detection system based on differential privacy, the system includes a central control node and multiple distributed nodes, each of which is used to process different types of user behavior data. The method includes: Querying user behavior data corresponding to the target user from each distributed node according to the preset query task corresponding to each distributed node, and determining an initial query result corresponding to the query task based on each user behavior data; The following operations are performed for each distributed node: obtaining a trust level corresponding to the distributed node, and allocating a privacy budget of the distributed node using the trust level corresponding to the distributed node; determining a query sensitivity corresponding to the query task of the distributed node, determining differential privacy noise based on a noise distribution mechanism according to the privacy budget and the query sensitivity, and adding the differential privacy noise to the initial query result corresponding to the distributed node to obtain a noise-added query result; in response to the query result after the noise addition not being within a range of a preset query result threshold, determining that a vulnerability detection result corresponding to the distributed node is that a security vulnerability exists, and sending the vulnerability detection result corresponding to the distributed node to a central control node; or, in response to the query result after the noise addition being within a range of a preset query result threshold, determining that a vulnerability detection result corresponding to the distributed node is that a security vulnerability does not exist, and sending the vulnerability detection result corresponding to the distributed node to the central control node. The vulnerability detection results corresponding to each distributed node are summarized through the central control node to obtain a summary result, and preset differential privacy noise is added to the summary result to obtain a summary result after noise addition. A vulnerability detection report is generated based on the summary result after noise addition for vulnerability repair according to the vulnerability detection report.

2. The method according to claim 1, characterized in that Allocating the privacy budget of the distributed nodes using the trust levels corresponding to the distributed nodes includes: Obtain the privacy budget of all distributed nodes; Based on the privacy budget of all distributed nodes and the weight of the trust level corresponding to the distributed node, the privacy budget of the distributed node is determined by the following formula: in, Represents a distributed node privacy budget, Represents a distributed node The weight of the trust level, Represents the privacy budget of all distributed nodes.

3. The method according to claim 1, characterized in that The determining of the query sensitivity corresponding to the query task of the distributed node includes: Obtaining initial query results corresponding to a first user behavior dataset in a current time window and initial query results corresponding to a second user behavior dataset in a time window adjacent to the current time window; Based on the initial query results corresponding to the first user behavior dataset and the initial query results corresponding to the second user behavior dataset, the query sensitivity is determined by the following formula: in, Indicates query sensitivity, Represents the first user behavior dataset The corresponding initial query results, Represents the second user behavior dataset The corresponding initial query results.

4. The method according to claim 1, wherein The noise distribution mechanism includes a Laplace mechanism; Determining differential privacy noise based on a noise distribution mechanism according to the privacy budget and query sensitivity includes: The query sensitivity and privacy budget are ratioed to obtain the scale parameter: The scale parameter is processed using the probability density function of the Laplace distribution to obtain differential privacy noise.

5. The method according to claim 1, wherein The noise distribution mechanism includes a Gaussian mechanism; Determining differential privacy noise based on a noise distribution mechanism according to the privacy budget and query sensitivity includes: Determine the variance of the probability density function of the Gaussian distribution, and based on the variance of the probability density function of the Gaussian distribution, the query sensitivity, and the privacy budget, determine the noise standard deviation using the following formula: in, represents the noise standard deviation, Indicates query sensitivity, represents the privacy budget, represents the variance of the probability density function of the Gaussian distribution; The noise standard deviation is processed using the probability density function of the Gaussian distribution to obtain differential privacy noise.

6. The method according to claim 1, characterized in that The adding of differential privacy noise to the initial query result corresponding to the distributed node to obtain the noise-added query result includes: Based on the summation of the initial query results corresponding to the distributed nodes and the differential privacy noise, the initial query results after noise addition are determined: Obtaining a time window of the initial query result corresponding to the distributed node and determining a data activity period of the time window, wherein the data activity period is used to indicate the activity status of data within a specific time period; In response to the data activity period belonging to a preset first data activity period type, reducing the initial noise-added query result according to a preset noise threshold to obtain a noise-added query result; or, In response to the data activity period belonging to a preset second data activity period type, the initial noise-added query result is increased according to a preset noise threshold to obtain a noise-added query result.

7. The method according to claim 1, characterized in that The step of adding preset differential privacy noise to the summary result to obtain the noise-added summary result includes: Based on the summary result and the preset differential privacy noise, the summary result after noise addition is obtained by the following formula: in, represents the summary result after noise addition, represents the preset differential privacy noise, Indicates query sensitivity, represents the privacy budget of all distributed nodes, Indicates the summary results, Representation and distributed nodes The corresponding vulnerability detection results, Indicates the order of distributed nodes, Indicates the number of distributed nodes.

8. A vulnerability detection device based on differential privacy, characterized in that: The device is set in a vulnerability detection system based on differential privacy. The system includes a central control node and multiple distributed nodes, each of which is used to process different types of user behavior data. The device includes: A query module is configured to query user behavior data corresponding to a target user from each distributed node according to a preset query task corresponding to each distributed node, and determine an initial query result corresponding to the query task based on each user behavior data; The vulnerability detection module is configured to perform the following operations for each distributed node: obtain a trust level corresponding to the distributed node, and allocate a privacy budget of the distributed node using the trust level corresponding to the distributed node; determine a query sensitivity corresponding to the query task of the distributed node, determine differential privacy noise based on a noise distribution mechanism according to the privacy budget and the query sensitivity, and add the differential privacy noise to the initial query result corresponding to the distributed node to obtain a noise-added query result; in response to the query result after the noise addition not being within a preset query result threshold, determine that the vulnerability detection result corresponding to the distributed node is that a security vulnerability exists, and send the vulnerability detection result corresponding to the distributed node to the central control node; or, in response to the query result after the noise addition being within a preset query result threshold, determine that the vulnerability detection result corresponding to the distributed node is that no security vulnerability exists, and send the vulnerability detection result corresponding to the distributed node to the central control node. The aggregation module is configured to aggregate the vulnerability detection results corresponding to each distributed node through a central control node to obtain an aggregated result, add preset differential privacy noise to the aggregated result to obtain an aggregated result with noise added, and generate a vulnerability detection report based on the aggregated result with noise added, so that the vulnerability can be repaired according to the vulnerability detection report.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the program, the method according to any one of claims 1 to 7 is implemented.

10. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to enable a computer to execute the method according to any one of claims 1 to 7.

Images