A software vulnerability intelligent detection and repair method for network and information security

Abstract

The application discloses a kind of software vulnerability intelligent detection repair methods for network and information security, it is related to electric digital data processing technical field.The software vulnerability intelligent detection repair method for network and information security, it includes the following steps: first exception monitoring;Second exception monitoring;Third exception monitoring.The application is judged whether to carry out first vulnerability repair by carrying out request quantity and session frequency exception monitoring, then carries out browsing exception monitoring and judges whether to carry out second vulnerability repair, finally carries out user end transmission exception monitoring and judges whether to carry out third vulnerability repair, reaches the effect of improving the accuracy of identifying vulnerability when detecting and repairing software vulnerability, solve the problem of low accuracy of identifying vulnerability when detecting and repairing software vulnerability in prior art.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of digital data processing, and particularly relates to a software vulnerability intelligent detection and repair method for network and information security. BACKGROUND

[0002] With the rapid development and wide popularization of information technology, various information systems, network platforms, etc. have sprung up like mushrooms. These systems and platforms inevitably have various vulnerabilities and defects in the process of design, development, deployment and operation. Once these vulnerabilities are exploited by attackers, they may pose a serious threat to the security of the system, leading to data leakage, system crash, illegal control and other serious consequences.

[0003] The prior art prevents XSS (Cross-Site Scripting) attacks at the user end by detecting and preventing the execution of malicious scripts through browser plug-ins, but the browser security plug-in needs to occupy certain system resources, including memory and bandwidth, etc. when running, which may cause the browser to run slowly, the page loading time to be prolonged, and false positives and false negatives to occur due to the failure to update in time.

[0004] For example, the application software vulnerability scanning method and system disclosed in the patent No. CN117874772B includes: first, judging the operating system kernel function crash signal and the source code crash signal when the application program crashes; if the two signals are inconsistent, it is preliminarily judged that there is no source code vulnerability; if they are consistent, the problem occurrence probability is sorted, and special problems are detected in turn, the discovered special problems are recorded, and after all special problem detection is completed, the user or system is notified to repair; if it cannot be repaired, the system will prompt that the detection is invalid and re-execute the detection process; if it can be successfully repaired, the operating system kernel function crash signal and the source code crash signal are compared again, if the two signals are inconsistent after repair, it is confirmed that there is no source code vulnerability; otherwise, if they are the same, it is determined that there is a source code vulnerability, and the special problem can be excluded to avoid misjudgment.

[0005] For example, the invention patent announcement No. CN117972714B vulnerability detection method and system, including: step S1, determine the detection range; Step S2, select the calibration file; Step S3, determine the suspected vulnerability file; Step S4, vulnerability classification; Step S5, file storage; By selecting and executing the file content matching history execution file in the history database as the calibration file, and analyzing the path source of the execution file, the execution file with unknown source is preliminarily determined as the suspected vulnerability file, and the code matching is carried out on the suspected vulnerability file, the new code is detected whether to input, the vulnerability matching is carried out on the new code segment, the vulnerability level is determined, the high-risk vulnerability is intercepted in time, and the execution file with new code is screened out for vulnerability matching.

[0006] But in the process of implementing the technical scheme of the embodiments of the present application, it is found that the above-mentioned technology at least has the following technical problems:

[0007] In the prior art, the software vulnerability of network and information security refers to the defects or weaknesses existing in the development, design or implementation process of software. These vulnerabilities may be exploited by attackers. Since the software may contain security vulnerabilities due to not being updated in time, these vulnerabilities are easy to be exploited by attackers (for example, an attacker may exploit XSS vulnerability to execute malicious script in the user's browser to send spam), resulting in low accuracy of identifying vulnerabilities when detecting and repairing software vulnerabilities. SUMMARY

[0008] The embodiments of the present application provide a software vulnerability intelligent detection and repair method for network and information security, which solves the problem of low accuracy of identifying vulnerabilities when detecting and repairing software vulnerabilities in the prior art, and improves the accuracy of identifying vulnerabilities when detecting and repairing software vulnerabilities.

[0009] The embodiments of the present application provide a software vulnerability intelligent detection and repair method for network and information security, which includes the following steps: S1, request quantity and session frequency anomaly monitoring, judging whether to perform the first vulnerability repair; S2, browsing anomaly monitoring, judging whether to perform the second vulnerability repair; S3, user end transmission anomaly monitoring, judging whether to perform the third vulnerability repair.

[0010] Further, the specific process of the request quantity and session frequency anomaly monitoring is as follows: monitoring the total request quantity and the session frequency average value in a preset time period; when the monitored total request quantity is greater than the preset maximum request quantity obtained from the database, or the session frequency average value is greater than the preset maximum session frequency obtained from the database, the corresponding request address is marked as a suspicious address, and the first vulnerability repair is performed; the first vulnerability repair includes first interception, first repair, and first update and verification; the first interception means that the suspicious address is intercepted through a dynamic code analysis method; the specific process of the first vulnerability repair is as follows: monitoring whether the repair detection parameters meet the interception qualified conditions, the repair detection parameters including the interception speed and the interception load, the interception load representing the average value of the load of the server in the first interception process; when the repair detection parameters do not meet the interception qualified conditions, the first interception optimization is performed, which means sending a prompt to a preset personnel to set a dynamic backup bandwidth; when the repair detection parameters meet the interception qualified conditions, the first repair is continued, which means sending an access prohibition prompt to a preset personnel and performing suspicious address code setting.

[0011] Further, the first update and verification includes first update and first verification; the first update means updating the first vulnerability repair qualified data to obtain first update data; the first verification means re-monitoring the total request quantity and the session frequency average value in a preset time period after the first update; the first vulnerability repair qualified data represents the browsing related data after the first repair.

[0012] Further, the specific process of the first update is as follows: judging whether the monitored to-be-verified parameters meet the update qualified conditions, the to-be-verified parameters including the server load and the total request quantity after the first interception; when the monitored to-be-verified parameters meet the update qualified conditions, the browsing anomaly monitoring is continued; when the monitored to-be-verified parameters do not meet the update qualified conditions, the verification load optimization is performed, which means sending a prompt to a preset personnel to set a backup server and distributing qualified requests to the backup server.

[0013] Further, the specific process of the browsing exception monitoring is as follows: the traffic-request frequency analysis value is obtained by performing proportion degree analysis on the request frequency average value and the preset request frequency, and performing joint analysis on the weighting effect of the browsing traffic peak proportion degree value and the preset browsing traffic influence first weight, wherein the browsing traffic peak proportion degree value is used to reflect the proportion degree of the browsing traffic maximum value relative to the preset maximum browsing traffic; the traffic-same request analysis value is obtained by performing proportion degree analysis on the same request number and the preset same request number, and performing joint analysis on the weighting effect of the browsing traffic peak proportion degree value and the preset browsing traffic influence second weight; the traffic-bandwidth occupation analysis value is obtained by performing proportion degree analysis on the browsing bandwidth occupation rate and the preset browsing bandwidth occupation rate, and performing joint analysis on the weighting effect of the browsing traffic peak proportion degree value and the preset browsing traffic influence third weight; the traffic-concurrency analysis value is obtained by performing proportion degree analysis on the request concurrent connection number maximum value and the preset request concurrent connection number, and performing joint analysis on the weighting effect of the browsing traffic peak proportion degree value and the preset browsing traffic influence fourth weight; the browsing exception monitoring value is obtained by performing joint analysis on the browsing traffic and exception reflection value obtained above; the browsing exception monitoring value is used to reflect the quantitative situation of the influence degree of the browsing traffic and exception reflection value in the preset time period on the webpage information browsing exception situation of the user; the traffic and exception reflection value includes the traffic-request frequency analysis value, the traffic-same request analysis value, the traffic-bandwidth occupation analysis value and the traffic-concurrency analysis value; the traffic-request frequency analysis value is used to reflect the comprehensive influence degree of the browsing traffic maximum value and the request frequency average value on the webpage information browsing exception situation of the user; the traffic-same request analysis value is used to reflect the comprehensive influence degree of the browsing traffic maximum value and the same request number on the webpage information browsing exception situation of the user; the traffic-bandwidth occupation analysis value is used to reflect the comprehensive influence degree of the browsing traffic maximum value and the browsing bandwidth occupation rate on the webpage information browsing exception situation of the user; the traffic-concurrency analysis value is used to reflect the comprehensive influence degree of the browsing traffic maximum value and the request concurrent connection number maximum value on the webpage information browsing exception situation of the user.

[0014] Further, the specific process of judging whether to perform the second vulnerability repair is as follows: comparing whether the browsing exception monitoring value is less than the preset browsing exception monitoring value obtained from the database; if yes, continuing to perform the user end transmission exception monitoring; if not, performing the second vulnerability repair; the second vulnerability repair includes second interception, second repair and second update; the second interception means intercepting through the set browser plug-in; the second repair means automatically repairing the vulnerability through the set browser plug-in; the second update means updating the second vulnerability repair qualified data to obtain second update data; the second vulnerability repair qualified data means data after the first vulnerability repair qualified data is repaired for the second time.

[0015] Further, the specific process of performing the user end transmission exception monitoring and judging whether to perform the third vulnerability repair is as follows: monitoring the script change rate and judging whether to perform the third vulnerability repair; when the monitored script change rate is not greater than the preset script change rate obtained from the database, transmitting the second update data to the user end; when the monitored script change rate is greater than the preset script change rate obtained from the database, performing the third vulnerability repair; the third vulnerability repair includes third interception, third repair and third update and verification.

[0016] Further, the third interception means sending a prompt of prohibiting running the malicious script to the preset personnel; the malicious script means a script with a script change rate greater than the preset script change rate; the third repair means sending a prompt of deleting the malicious script to the preset personnel; the third update and verification includes third update and script change rate verification; the third update means updating the third vulnerability repair qualified data to obtain third update data; the third vulnerability repair qualified data means data after the second vulnerability repair qualified data is repaired for the third time; the script change rate verification means re-monitoring the script change rate until the script change rate verification times reach the preset maximum script change rate verification times.

[0017] Further, the user end transmission abnormality monitoring further includes obtaining a user end transmission abnormality monitoring value, and the specific process is as follows: through proportion degree analysis of the browsing interruption times and the preset browsing interruption times, and joint analysis of the weighting effect with the page loading proportion degree value and the preset user end transmission first weight value, a loading-interruption analysis value is obtained, the page loading proportion degree value is used to reflect the proportion degree of the average page loading time length relative to the preset page loading time length; through proportion degree analysis of the interception times and the preset interception times, and joint analysis of the weighting effect with the page loading proportion degree value and the preset user end transmission second weight value, a loading-interception analysis value is obtained; through proportion degree analysis of the browser crash times and the preset browser crash times, and joint analysis of the weighting effect with the page loading proportion degree value and the preset user end transmission third weight value, a loading-crash analysis value is obtained; through proportion degree analysis of the request response time length maximum value and the preset request response time length, and joint analysis of the weighting effect with the page loading proportion degree value and the preset user end transmission fourth weight value, a loading-request response analysis value is obtained; through joint analysis of the above-mentioned obtained user end transmission abnormality reflection values, a user end transmission abnormality monitoring value is obtained; the user end transmission abnormality monitoring value is used to reflect the quantitative situation of the influence degree of the user end transmission abnormality reflection values in the preset user end monitoring time period on the abnormal situation of the web information transmission to the user end; the user end transmission abnormality reflection values include the loading-interruption analysis value, the loading-interception analysis value, the loading-crash analysis value and the loading-request response analysis value; the loading-interruption analysis value is used to reflect the comprehensive influence degree of the browsing interruption times and the average page loading time length on the abnormal situation of the web information transmission to the user end; the loading-interception analysis value is used to reflect the comprehensive influence degree of the interception times and the average page loading time length on the abnormal situation of the web information transmission to the user end; the loading-crash analysis value is used to reflect the comprehensive influence degree of the browser crash times and the average page loading time length on the abnormal situation of the web information transmission to the user end; the loading-request response analysis value is used to reflect the comprehensive influence degree of the request response time length maximum value and the average page loading time length on the abnormal situation of the web information transmission to the user end.

[0018] Further, the user end transmission abnormality monitoring further comprises judging whether to perform user end transmission optimization, and the specific process is as follows: if the user end transmission abnormality monitoring value is greater than the preset user end transmission abnormality threshold value obtained from the database, the third updated data is transmitted to the user end; if the user end transmission abnormality monitoring value is not greater than the preset user end transmission abnormality threshold value obtained from the database, the user end transmission optimization is performed; the specific steps of the user end transmission optimization are as follows: first, monitoring the transmission distance and setting the priority, wherein the transmission distance represents the transmission distance between the server and the user end; second, performing the update frequency optimization, wherein the update frequency optimization represents sending a prompt to the preset personnel to gradually increase the update frequency of the browser plug-in by a preset multiple.

[0019] The one or more technical solutions provided in the embodiments of the present application have at least the following technical effects or advantages:

[0020] 1. By performing request volume and session frequency abnormality monitoring and judging whether to perform first-time vulnerability repair, then performing browsing abnormality monitoring and judging whether to perform second-time vulnerability repair, and finally performing user end transmission abnormality monitoring and judging whether to perform third-time vulnerability repair, the reliability of identifying vulnerabilities when detecting and repairing software vulnerabilities is improved, and the accuracy of identifying vulnerabilities when detecting and repairing software vulnerabilities is improved, effectively solving the problem of low accuracy of identifying vulnerabilities when detecting and repairing software vulnerabilities in the prior art.

[0021] 2. By jointly analyzing the browsing abnormality monitoring parameters and the preset browsing abnormality monitoring parameters to obtain the browsing traffic and abnormality reflection value, and jointly analyzing the browsing traffic and abnormality reflection value to obtain the browsing abnormality monitoring value, the influence degree of the browsing traffic and abnormality reflection value on the abnormal situation of the user browsing web page information is accurately quantified, and the analysis accuracy of the abnormal situation of the user browsing web page information is improved.

[0022] 3. By performing user end transmission optimization when the user end transmission abnormality monitoring value is not greater than the preset user end transmission abnormality threshold value, then monitoring the transmission distance and setting the priority, and finally performing the update frequency optimization, the reliability of the user end transmission abnormality monitoring is improved, and the accuracy of the user end transmission abnormality monitoring is improved. BRIEF DESCRIPTION OF DRAWINGS

[0023] Figure 1 A flowchart of a software vulnerability intelligent detection and repair method for network and information security is provided for the embodiments of the present application.

[0024] Figure 2 A general flowchart of the software vulnerability intelligent detection and repair is provided for the embodiments of the present application. DETAILED DESCRIPTION

[0025] The embodiment of the present application provides a software vulnerability intelligent detection and repair method for network and information security, and solves the problem of low accuracy of identifying vulnerabilities when detecting and repairing software vulnerabilities in the prior art. When the total number of requests monitored is greater than the preset maximum number of requests or the average value of session frequency is greater than the preset maximum value of session frequency, the corresponding request address is marked as a suspicious address, and first vulnerability repair is performed. Then, browsing anomaly monitoring is performed, and it is judged whether second vulnerability repair is performed. Finally, user end transmission anomaly monitoring is performed, and it is judged whether third vulnerability repair is performed, so that the accuracy of identifying vulnerabilities when detecting and repairing software vulnerabilities is improved.

[0026] The technical solution in the embodiment of the present application is used for solving the problem of low accuracy of identifying vulnerabilities when detecting and repairing software vulnerabilities, and the general idea is as follows:

[0027] The request quantity and session frequency anomaly monitoring are performed, and it is judged whether the first vulnerability repair is performed. Then, the browsing anomaly monitoring is performed, and it is judged whether the second vulnerability repair is performed. Finally, the user end transmission anomaly monitoring is performed, and it is judged whether the third vulnerability repair is performed, so that the accuracy of identifying vulnerabilities when detecting and repairing software vulnerabilities is improved.

[0028] In order to better understand the above technical solution, the above technical solution will be described in detail in combination with the drawings of the specification and the specific embodiments.

[0029] As shown in Figure 1 Fig. 1 is a flowchart of a software vulnerability intelligent detection and repair method for network and information security provided by the embodiment of the present application. The method comprises the following steps: S1, first anomaly monitoring: request quantity and session frequency anomaly monitoring are performed, and it is judged whether the first vulnerability repair is performed; S2, second anomaly monitoring: browsing anomaly monitoring is performed, and it is judged whether the second vulnerability repair is performed; S3, third anomaly monitoring: user end transmission anomaly monitoring is performed, and it is judged whether the third vulnerability repair is performed.

[0030] In the embodiment, as shown in Figure 2As shown, the overall flowchart of the software vulnerability intelligent detection and repair provided by the embodiment of the application is as follows: when the total number of requests monitored is greater than the preset maximum number of requests or the average value of session frequency is greater than the preset maximum value of session frequency, first vulnerability repair is performed; the browsing abnormality monitoring value is obtained through browsing abnormality monitoring, and when the browsing abnormality monitoring value is not less than the preset browsing abnormality monitoring value, second vulnerability repair is performed; when the monitored script change rate is greater than the preset script change rate, third vulnerability repair is performed, and at the same time, the user terminal transmission abnormality monitoring value is obtained through user terminal transmission abnormality monitoring, and when the user terminal transmission abnormality monitoring value is not greater than the preset user terminal transmission abnormality threshold, user terminal transmission optimization is performed.

[0031] The first, second and third abnormality monitoring levels are progressive, and the first, second and third vulnerability repairs are correlated. The first vulnerability repair intercepts suspicious addresses through a dynamic code analysis method, effectively preventing malicious access and attacks. The second vulnerability repair uses a browser plug-in to automatically intercept and repair, improving repair efficiency and accuracy. The third vulnerability repair targets user terminal transmission abnormalities, sends a prompt to prohibit running and delete malicious scripts, and ensures the safety of the user terminal. Through first and second updates and third update and verification, the safety of the browsing information transmitted to the user terminal is ensured, and the accuracy of identifying vulnerabilities when detecting and repairing software vulnerabilities is improved.

[0032] For example, XSS vulnerabilities are easily exploited when network traffic is large during peak hours, and malicious scripts are executed in the user's browser to send spam information. Through the first, second and third abnormality monitoring, the success rate of XSS attacks is reduced. Through the first, second and third vulnerability repairs, the detected malicious scripts are intercepted and repaired, and the browsing information transmitted to the user terminal is completely safe and reliable.

[0033] Further, the specific process of request quantity and session frequency anomaly monitoring is as follows: monitoring the total request quantity and session frequency average value in a preset time period; when the monitored total request quantity is greater than the preset maximum request quantity obtained from the database, or the session frequency average value is greater than the preset maximum session frequency obtained from the database, the corresponding request address is marked as a suspicious address, and the first vulnerability repair is performed; the first vulnerability repair includes first interception, first repair, and first update and verification; the first interception means that the suspicious address is intercepted through a dynamic code analysis method; the specific process of the first vulnerability repair is as follows: monitoring whether the repair detection parameter meets the interception qualified condition, the repair detection parameter including the interception speed and the interception load, the interception load indicating the average value of the load of the server in the first interception process, and the interception qualified condition indicating that the interception speed is greater than the preset interception speed obtained from the database, and the interception load is not greater than the preset repair load obtained from the database; when the repair detection parameter does not meet the interception qualified condition, the first interception optimization is performed, which means sending a prompt to the preset personnel to set a dynamic backup bandwidth; when the repair detection parameter meets the interception qualified condition, the first repair is continued, which means sending an access prohibition prompt to the preset personnel and performing suspicious address code setting, which means prompting the preset personnel to encode the output code corresponding to the suspicious address before outputting to the HTML (HyperText Markup Language, HyperText Markup Language) page.

[0034] It should be noted that the first update and verification includes first update and first verification; the first update means updating the first vulnerability repair qualified data to obtain first update data; the first verification means re-monitoring the total request quantity and session frequency average value in a preset time period after the first update; the first vulnerability repair qualified data means the browsing related data (such as user session ID, request time, browser stored Cookie and cache file, etc.) after the first repair; when the number of times of re-monitoring the total request quantity and session frequency average value in a preset time period is greater than the preset first monitoring number obtained from the database, an alarm prompt is sent to the preset personnel.

[0035] The specific process of the first update is as follows: it is judged whether the monitored to-be-verified parameters meet the update qualified condition, the to-be-verified parameters include the server load and the total request quantity after the first interception, and the update qualified condition means that the server load and the total request quantity after the first interception are both not greater than the preset repair load and the preset request quantity maximum value obtained from the database; when the monitored to-be-verified parameters meet the update qualified condition, the browsing anomaly monitoring is continued; when the monitored to-be-verified parameters do not meet the update qualified condition, the verification load optimization is performed, and the verification load optimization means that a prompt is sent to the preset personnel to set a backup server and the qualified requests are distributed to the backup server.

[0036] In the embodiment, the aforementioned database is a database for storing various setting data in the software vulnerability intelligent detection and repair method for network and information security provided by the embodiment, and contains but is not limited to the preset request frequency, the preset same request quantity, the preset browsing bandwidth occupancy rate and the like, in which various values are directly set by technical personnel; for example, the preset request quantity maximum value is represented by the maximum value of the request quantity in a historical time period, the preset session frequency maximum value is represented by the maximum value of the session frequency in a historical time period, the preset interception speed is represented by the average value of the interception speed in a historical time period, the preset repair load is represented by the average value of the server load in a historical time period, the preset first monitoring times is represented by the average value of the number of times of monitoring the average value of the total request quantity and the session frequency in a preset time period in a historical time period, and the preset first monitoring times is set by the preset personnel.

[0037] The first interception is optimized by setting a dynamic backup bandwidth by the preset personnel, and in the embodiment, when the monitored preset interception speed is greater than the interception speed or the interception load is greater than the preset repair load, the backup bandwidth is set to be equal to the preset bandwidth threshold value, the preset bandwidth threshold value is specified by the preset personnel, when the preset interception speed is greater than twice the interception speed or the interception load is greater than twice the preset repair load, the backup bandwidth is set to be equal to twice the preset bandwidth threshold value, and so on.

[0038] The first repair is confirmed to be effective through the first update and verification, so as to ensure the safety and stability of the first interception; the preset personnel encodes the output code corresponding to the suspicious address before outputting to an HTML page, which helps to prevent attacks such as cross-site scripting (XSS); the dynamic code analysis method (such as fuzzy testing) can monitor and analyze the code behavior in real time, can quickly make an interception decision on the suspicious address, effectively prevents the suspicious address from continuing to send requests, thereby improving the accuracy of interception, and further improves the accuracy of identifying vulnerabilities when detecting and repairing software vulnerabilities.

[0039] Further, the specific process of browsing exception monitoring is as follows: the request frequency average value and the preset request frequency are analyzed by proportion degree, and the browsing traffic peak proportion degree value and the preset browsing traffic influence first weight are analyzed by power effect combination to obtain the traffic-request frequency analysis value; the browsing traffic peak proportion degree value is used to reflect the proportion degree of the browsing traffic maximum value relative to the preset maximum browsing traffic; the browsing traffic peak proportion degree value is represented by the ratio result of the browsing traffic maximum value and the preset maximum browsing traffic; the same request quantity and the preset same request quantity are analyzed by proportion degree, and the browsing traffic peak proportion degree value and the preset browsing traffic influence second weight are analyzed by power effect combination to obtain the traffic-same request analysis value; the browsing bandwidth occupancy rate and the preset browsing bandwidth occupancy rate are analyzed by proportion degree, and the browsing traffic peak proportion degree value and the preset browsing traffic influence third weight are analyzed by power effect combination to obtain the traffic-bandwidth occupancy analysis value; the maximum request concurrent connection number and the preset request concurrent connection number are analyzed by proportion degree, and the browsing traffic peak proportion degree value and the preset browsing traffic influence fourth weight are analyzed by power effect combination to obtain the traffic-concurrent analysis value; the browsing traffic and the abnormal reflection value obtained above are analyzed by combination to obtain the browsing exception monitoring value; the browsing exception monitoring value is used to reflect the quantitative situation of the influence degree of the browsing traffic and the abnormal reflection value in the preset time period on the user's webpage information browsing exception situation; the traffic and the abnormal reflection value include the traffic-request frequency analysis value, the traffic-same request analysis value, the traffic-bandwidth occupancy analysis value and the traffic-concurrent analysis value; the traffic-request frequency analysis value is used to reflect the comprehensive influence degree of the browsing traffic maximum value and the request frequency average value on the user's webpage information browsing exception situation, and the traffic-request frequency analysis value is obtained by multiplying the preset browsing traffic influence first weight, the ratio result of the request frequency average value and the preset request frequency, and the browsing traffic peak proportion degree value; the traffic-same request analysis value is used to reflect the comprehensive influence degree of the browsing traffic maximum value and the same request quantity on the user's webpage information browsing exception situation, and the traffic-same request analysis value is obtained by multiplying the preset browsing traffic influence second weight, the ratio result of the same request quantity and the preset same request quantity, and the browsing traffic peak proportion degree value; the traffic-bandwidth occupancy analysis value is used to reflect the comprehensive influence degree of the browsing traffic maximum value and the browsing bandwidth occupancy rate on the user's webpage information browsing exception situation, and the traffic-bandwidth occupancy analysis value is obtained by multiplying the preset browsing traffic influence third weight, the ratio result of the browsing bandwidth occupancy rate and the preset browsing bandwidth occupancy rate, and the browsing traffic peak proportion degree value;The traffic-concurrency analysis value is used to reflect the comprehensive influence degree of the maximum value of browsing traffic and the maximum value of request concurrency connection number on the webpage information browsing exception of the user, and the traffic-concurrency analysis value is obtained by multiplying the fourth weight of preset browsing traffic influence, the ratio result of the maximum value of request concurrency connection number and preset request concurrency connection number, and the peak value proportion degree value of browsing traffic.

[0040] The browsing exception monitoring value is obtained by the following method:

[0041] ;

[0042] ;

[0043] In the formula, represents the browsing exception monitoring value in the Yth preset time period, Y represents the number of preset time periods, and T represents the total number of preset time periods, represents the peak value proportion degree value of browsing traffic in the Yth preset time period, represents the average value of request frequency in the Yth preset time period, represents the same request quantity in the Yth preset time period, represents the browsing bandwidth occupancy rate in the Yth preset time period, represents the maximum value of request concurrency connection number in the Yth preset time period, represents the maximum value of browsing traffic in the Yth preset time period, represents the preset request frequency, represents the preset same request quantity, represents the preset browsing bandwidth occupancy rate, represents the preset request concurrency connection number, represents the preset maximum browsing traffic, represents the first weight of preset browsing traffic influence, represents the second weight of preset browsing traffic influence, represents the third weight of preset browsing traffic influence, represents the fourth weight of preset browsing traffic influence, and e represents a natural constant.

[0044] In the embodiment, the traffic and abnormal reflection value is based on the browsing abnormal monitoring parameter and the preset browsing abnormal monitoring parameter analysis, by monitoring the browsing abnormal monitoring parameter and the preset browsing abnormal monitoring parameter, it is helpful to analyze the comprehensive influence degree of the browsing traffic maximum value and the request frequency average value on the user's webpage information browsing abnormal situation, the comprehensive influence degree of the browsing traffic maximum value and the same request number on the user's webpage information browsing abnormal situation, the comprehensive influence degree of the browsing traffic maximum value and the browsing bandwidth occupation rate on the user's webpage information browsing abnormal situation, and the comprehensive influence degree of the browsing traffic maximum value and the request concurrent connection number maximum value on the user's webpage information browsing abnormal situation.

[0045] It should be understood that, wherein the browsing abnormal monitoring parameter includes the request frequency average value, the same request number, the browsing bandwidth occupation rate, the request concurrent connection number maximum value and the browsing traffic maximum value; the preset browsing abnormal monitoring parameter includes the preset request frequency, the preset same request number, the preset browsing bandwidth occupation rate, the preset request concurrent connection number, the preset maximum browsing traffic and the preset browsing traffic influence weight group; the preset browsing traffic influence weight group is used to reflect the influence degree of the traffic and abnormal reflection value in the preset time period on the browsing abnormal monitoring value, specifically including the preset browsing traffic influence first weight, the preset browsing traffic influence second weight, the preset browsing traffic influence third weight, the preset browsing traffic influence fourth weight.

[0046] The preset request frequency is represented by the average value of the request frequency in the historical time period, the preset same request number is represented by the average value of the same request number in the historical time period, the preset browsing bandwidth occupation rate is represented by the average value of the browsing bandwidth occupation rate in the historical time period, the preset request concurrent connection number is represented by the maximum value of the request concurrent connection number in the historical time period, and the preset maximum browsing traffic is represented by the maximum value of the browsing traffic in the historical time period.

[0047] The request number per unit time in the preset time period is monitored by a network monitoring tool (such as SolarWinds Network Performance Monitor), and the average value is counted to obtain the request frequency average value; the same request number in the preset time period is monitored by a server log, which is the same request number; the bandwidth proportion occupied by browsing activity in the preset time period is monitored by a network monitoring tool, which is the browsing bandwidth occupation rate; the concurrent connection number in the preset time period is monitored by a server performance monitoring tool (such as NewRelic, Datadog), and the maximum value is counted to obtain the request concurrent connection number maximum value; the network traffic generated by browsing activity in the preset time period is monitored by a network monitoring tool, and the maximum value is counted to obtain the browsing traffic maximum value.

[0048] The embodiment provides a set of mapping sets for reflecting the mapping relationship between the traffic and the abnormal corresponding parameter and the corresponding preset browsing traffic influence weight set. The mapping relationship in the mapping set can be one-to-one or many-to-one. The mapping set is obtained from a mapping group, and the mapping group is obtained from a database. The preset browsing traffic influence weight set can be obtained by inputting the real-time traffic and the abnormal corresponding parameter into the mapping group. For example, in the embodiment, the value range of the weight is 0-1. The traffic and the abnormal corresponding parameter include the request frequency average value, the same request quantity, the browsing bandwidth occupancy rate, and the request concurrent connection maximum value.

[0049] The embodiment algorithm combines the traffic and the abnormal reflection value to analyze the browsing abnormal monitoring value. In the embodiment, the traffic and the abnormal reflection value are processed by using a logarithmic function, so as to reflect that the traffic and the abnormal reflection value is proportional to the browsing abnormal monitoring value, and the corresponding change trend is that the browsing abnormal monitoring value gradually increases with the increase of the traffic and the abnormal reflection value. The greater the traffic-request frequency analysis value is, the greater the comprehensive influence degree of the browsing traffic maximum value and the request frequency average value on the webpage information browsing abnormal situation of the user is, and the greater the browsing abnormal monitoring value is. The greater the traffic-same request analysis value is, the greater the comprehensive influence degree of the browsing traffic maximum value and the same request quantity on the webpage information browsing abnormal situation of the user is, and the greater the browsing abnormal monitoring value is. The greater the traffic-bandwidth occupancy analysis value is, the greater the comprehensive influence degree of the browsing traffic maximum value and the browsing bandwidth occupancy rate on the webpage information browsing abnormal situation of the user is, and the greater the browsing abnormal monitoring value is. The greater the traffic-concurrency analysis value is, the greater the comprehensive influence degree of the browsing traffic maximum value and the request concurrent connection maximum value on the webpage information browsing abnormal situation of the user is. In summary, the traffic and the abnormal reflection value is proportional to the traffic and the abnormal reflection value.

[0050] The browsing anomaly monitoring parameters in the algorithm of the embodiment are not independent, and there is mutual correlation between the variables, which needs to be analyzed comprehensively. The greater the number of same requests, the more likely it is that there is a malicious script repeatedly requesting the same information, which may cause the average value of the browsing bandwidth occupancy rate and the request frequency to increase. The greater the number of same requests, the more likely it is that there is network traffic anomaly and the possibility of malicious scripts increases. When multiple requests are the same and are simultaneously interacted, the increase in the number of same requests may be accompanied by an increase in the number of concurrent connections, which in turn causes the maximum value of the request concurrent connection number to increase. The greater the maximum value of the request concurrent connection number, the more likely it is that the network bandwidth resource is tight, and the network bandwidth resource is occupied, which in turn causes the browsing bandwidth occupancy rate to increase. The greater the maximum value of the request concurrent connection number, the more likely it is that the network is congested or the server is overloaded, which in turn causes the maximum value of the browsing traffic to increase. Through the comprehensive analysis of the influence between the parameters, the accurate evaluation of the abnormal situation of the user browsing web page information in the preset time period is realized, and the effect of improving the accuracy of identifying vulnerabilities when detecting and repairing software vulnerabilities is achieved.

[0051] Further, the specific process of determining whether to perform the second vulnerability repair is as follows: comparing whether the browsing anomaly monitoring value is less than the preset browsing anomaly monitoring value obtained from the database; if yes, it indicates that the user's web page information browsing situation is not abnormal, and the user end transmission anomaly monitoring is continued; if not, it indicates that the user's web page information browsing situation is abnormal, and the second vulnerability repair is performed; the second vulnerability repair includes second interception, second repair and second update; the second interception means intercepting through the set browser plug-in; the second repair means automatically repairing the vulnerability through the set browser plug-in; the second update means updating the second vulnerability repair qualified data to obtain the second update data; the second vulnerability repair qualified data means the data after the first vulnerability repair qualified data is repaired for the second time.

[0052] In the embodiment, the preset browsing anomaly monitoring value is represented by the average value of the historical time period browsing anomaly monitoring value. The real-time monitoring of the requests in the preset time period is realized through the browser plug-in (such as AdBlock, uBlock Origin). When the browsing anomaly monitoring value is not less than the preset browsing anomaly monitoring value, the browser plug-in will immediately intercept and prevent it. When the browsing anomaly monitoring value is less than the preset browsing anomaly monitoring value, the second update is performed to ensure the accuracy of the browsing data. Through the second vulnerability repair, the downloading and installation of malicious scripts are effectively prevented, the system and data security of the user are protected, the tampering and damage of the malicious scripts to the browser and the system are prevented through the second interception, the stability and reliability of the user when browsing the web page are improved, and the improvement of the accuracy of identifying vulnerabilities when detecting and repairing software vulnerabilities is realized.

[0053] Further, the user end transmission abnormality monitoring is performed to determine whether to perform the third vulnerability repair, and the specific process is as follows: the script change rate is monitored to determine whether to perform the third vulnerability repair; when the monitored script change rate is not greater than the preset script change rate obtained from the database, the second update data is transmitted to the user end; when the monitored script change rate is greater than the preset script change rate obtained from the database, the third vulnerability repair is performed; the third vulnerability repair includes the third interception, the third repair, and the third update and verification.

[0054] It should be noted that the third interception means that a prompt of prohibiting running of the malicious script is sent to the preset personnel; the malicious script means a script with a script change rate greater than the preset script change rate; the third repair means that a prompt of deleting the malicious script is sent to the preset personnel; the third update and verification include the third update and script change rate verification; the third update means that the third vulnerability repair qualified data is updated to obtain the third update data; the third vulnerability repair qualified data means data after the second vulnerability repair qualified data is repaired for the third time; the script change rate verification means that the script change rate is monitored again until the number of times of the script change rate verification reaches a preset maximum script change rate verification number; when the number of times of the script change rate verification is greater than the preset maximum script change rate verification number, an alarm prompt is sent to the preset personnel.

[0055] In the embodiment, the preset script change rate is represented by an average value of historical time period script change rates, and the preset maximum script change rate verification number is set by the preset personnel; by monitoring the script change rate, the malicious script can be found in time, the execution of the malicious software or attack code is effectively prevented, and thus the security of the user when browsing the webpage is enhanced; when the monitored script change rate is abnormal, that is, the script change rate is greater than the preset script change rate, the third vulnerability repair is performed, and thus the response speed to the security event is improved; by sending the prompt of deleting the malicious script to the preset personnel, the vulnerability repair time is shortened, the potential damage caused by the malicious script is reduced, the third vulnerability repair qualified data is updated, and thus the security problem caused by data errors or omissions is avoided; by the script change rate verification, the stability of the user when browsing the webpage after the third repair is ensured; and thus the effect of improving the accuracy of identifying the vulnerability when detecting and repairing the software vulnerability is achieved.

[0056] Further, the user end transmission abnormality monitoring is performed, and further includes obtaining a user end transmission abnormality monitoring value, and the specific process is as follows: through proportion degree analysis of the browsing interruption times and the preset browsing interruption times, and joint analysis of the weighting effect of the page loading proportion degree value and the preset user end transmission first weight value, a loading-interruption analysis value is obtained, the page loading proportion degree value is used to reflect the proportion degree of the average page loading time length relative to the preset page loading time length; the page loading proportion degree value is obtained through the ratio operation result of the average page loading time length and the preset page loading time length; through proportion degree analysis of the interception times and the preset interception times, and joint analysis of the weighting effect of the page loading proportion degree value and the preset user end transmission second weight value, a loading-interception analysis value is obtained; through proportion degree analysis of the browser crash times and the preset browser crash times, and joint analysis of the weighting effect of the page loading proportion degree value and the preset user end transmission third weight value, a loading-crash analysis value is obtained; through proportion degree analysis of the request response time length maximum value and the preset request response time length, and joint analysis of the weighting effect of the page loading proportion degree value and the preset user end transmission fourth weight value, a loading-request response analysis value is obtained; through joint analysis of the above-mentioned obtained user end transmission abnormality reflection values, a user end transmission abnormality monitoring value is obtained; the user end transmission abnormality monitoring value is used to reflect the quantitative situation of the influence degree of the user end transmission abnormality reflection values in the preset user end monitoring time period on the abnormal situation of the webpage information transmission to the user end; the user end transmission abnormality reflection values include the loading-interruption analysis value, the loading-interception analysis value, the loading-crash analysis value and the loading-request response analysis value; the preset user end monitoring time period represents a preset time period after the second vulnerability repair; the loading-interruption analysis value is obtained through product operation of the ratio result of the browsing interruption times and the preset browsing interruption times, the page loading proportion degree value and the preset user end transmission first weight value, and is used to reflect the comprehensive influence degree of the browsing interruption times and the average page loading time length on the abnormal situation of the webpage information transmission to the user end; the loading-interception analysis value is obtained through product operation of the ratio result of the interception times and the preset interception times, the page loading proportion degree value and the preset user end transmission second weight value, and is used to reflect the comprehensive influence degree of the interception times and the average page loading time length on the abnormal situation of the webpage information transmission to the user end; the loading-crash analysis value is obtained through product operation of the ratio result of the browser crash times and the preset browser crash times, the page loading proportion degree value and the preset user end transmission third weight value, and is used to reflect the comprehensive influence degree of the browser crash times and the average page loading time length on the abnormal situation of the webpage information transmission to the user end;The loading-request response analysis value is obtained by multiplying the ratio result of the maximum value of the request response duration and the preset request response duration, the page loading proportion degree value and the preset user terminal transmission fourth weight value, and is used to reflect the comprehensive influence degree of the maximum value of the request response duration and the average page loading duration on the abnormal situation of the web information transmission to the user terminal.

[0057] The user terminal transmission abnormality monitoring value is obtained by the following method:

[0058] ;

[0059] ;

[0060] In the formula, represents the user terminal transmission abnormality monitoring value of the Dth preset user terminal monitoring time period, D represents the number of the preset user terminal monitoring time period, and K represents the total number of the preset user terminal monitoring time period, represents the page loading proportion degree value of the Dth preset user terminal monitoring time period, represents the interception times of the Dth preset user terminal monitoring time period, represents the browsing interruption times of the Dth preset user terminal monitoring time period, represents the browser crash times of the Dth preset user terminal monitoring time period, represents the maximum value of the request response duration of the Dth preset user terminal monitoring time period, represents the average page loading duration of the Dth preset user terminal monitoring time period, represents the preset browsing interruption times, represents the preset interception times, represents the preset browser crash times, represents the preset request response duration, represents the preset page loading duration, represents the preset user terminal transmission first weight value, represents the preset user terminal transmission second weight value, represents the preset user terminal transmission third weight value, represents the preset user terminal transmission fourth weight value.

[0061] In the embodiment, the user end transmission abnormality reflection value is obtained based on joint analysis of the user end transmission abnormality monitoring parameter and the preset user end transmission abnormality monitoring parameter. By monitoring the user end transmission abnormality monitoring parameter and the preset user end transmission abnormality monitoring parameter, it is helpful to analyze the comprehensive influence degree of the browsing interruption times and the average page loading time on the abnormal situation of the web information transmission to the user end, the comprehensive influence degree of the interception times and the average page loading time on the abnormal situation of the web information transmission to the user end, the comprehensive influence degree of the browser crash times and the average page loading time on the abnormal situation of the web information transmission to the user end, and the comprehensive influence degree of the maximum request response time and the average page loading time on the abnormal situation of the web information transmission to the user end.

[0062] It should be understood that the user end transmission abnormality monitoring parameter includes the interception times, the browsing interruption times, the browser crash times, the maximum request response time and the average page loading time; the preset user end transmission abnormality monitoring parameter includes the preset browsing interruption times, the preset interception times, the preset browser crash times, the preset request response time, the preset page loading time and the preset loading influence weight set; the preset loading influence weight set is used to reflect the influence degree of the user end transmission abnormality reflection value on the user end transmission abnormality monitoring value in the preset user end monitoring time period, and specifically includes the preset user end transmission first weight value, the preset user end transmission second weight value, the preset user end transmission third weight value and the preset user end transmission fourth weight value.

[0063] The preset browsing interruption times are represented by the average value of the browsing interruption times in the historical time period, the preset interception times are represented by the average value of the interception times in the historical time period, the preset browser crash times are represented by the average value of the browser crash times in the historical time period, the preset request response time is represented by the average value of the request response time in the historical time period, and the preset page loading time is represented by the average value of the page loading time in the historical time period.

[0064] The number of times of intercepting malicious content (malicious scripts) by the browser plug-ins (such as AdBlock, uBlock Origin) in the preset user terminal monitoring time period is the number of times of interception, the number of times of page loading interruption events in the preset user terminal monitoring time period is the number of times of interruption in browsing, the number of times of browser crashes in the preset user terminal monitoring time period is the number of times of browser crashes, the response time of API (Application Programming Interface) requests in the preset user terminal monitoring time period is monitored by the network monitoring tool, and the maximum value of the response time is obtained to obtain the maximum value of the response time of the request, the page loading time in the preset user terminal monitoring time period is monitored by the Web analysis tool (such as Google Analytics, Pingdom), and the average value of the page loading time is obtained to obtain the average page loading time.

[0065] The preset loading influence weight set is obtained by inputting the user terminal transmission exception corresponding parameter in real time into a set of mapping sets obtained from a database, the mapping sets provide a mapping set for reflecting the mapping relationship between the user terminal transmission exception corresponding parameter and the corresponding preset loading influence weight set, and the mapping relationship in the mapping set can be a one-to-one or many-to-one relationship; for example, in the embodiment, the value range of the weight is 0-1. The user terminal transmission exception corresponding parameter includes the number of times of interruption in browsing, the number of times of interception, the number of times of browser crashes, and the maximum value of the response time of the request.

[0066] The user end transmission abnormality monitoring value is obtained by combining the user end transmission abnormality reflection value analysis in the embodiment algorithm. In the embodiment, the user end transmission abnormality reflection value is processed by an exponential function to reflect the positive correlation between the user end transmission abnormality reflection value and the user end transmission abnormality monitoring value. The corresponding change trend is that the user end transmission abnormality monitoring value gradually increases with the increase of the user end transmission abnormality reflection value. The greater the loading-interruption analysis value, the greater the comprehensive influence of the interruption times and the average page loading time on the abnormal situation of the webpage information transmission to the user end, resulting in a larger user end transmission abnormality monitoring value. The greater the loading-interception analysis value, the greater the comprehensive influence of the interception times and the average page loading time on the abnormal situation of the webpage information transmission to the user end, resulting in a larger user end transmission abnormality monitoring value. The greater the loading-crash analysis value, the greater the comprehensive influence of the browser crash times and the average page loading time on the abnormal situation of the webpage information transmission to the user end, resulting in a larger user end transmission abnormality monitoring value. The greater the loading-request response analysis value, the greater the comprehensive influence of the maximum request response time and the average page loading time on the abnormal situation of the webpage information transmission to the user end, resulting in a larger user end transmission abnormality monitoring value. In summary, the user end transmission abnormality reflection value is positively correlated with the user end transmission abnormality monitoring value.

[0067] The user end transmission abnormality monitoring parameters in the embodiment algorithm are not independent, and there is a correlation between the variables, which needs to be analyzed comprehensively. The more the interception times, the more likely it is that the webpage content accessed by the user is disturbed by malicious scripts, which may cause frequent loading interruptions during the browsing process, thereby increasing the browsing interruption times. The increase in the interception times may cause the request to be delayed or redirected, thereby increasing the maximum request response time. The increase in the browsing interruption times may increase the possibility of forcibly closing the page or the browser, thereby increasing the browser crash times. The increase in the browsing interruption times usually means an increased possibility of interference by malicious scripts during the page loading process, which may cause the page to be reloaded, thereby increasing the average page loading time. The more the browser crash times, the more likely it is that the user needs to reopen the browser and reinitiate the request, which may increase the maximum request response time, and the greater the maximum request response time, the greater the average page loading time. By analyzing the comprehensive influence between the parameters, the precise evaluation of the abnormal situation of the webpage information transmission to the user end in the preset user end monitoring time period is realized, thereby achieving the effect of improving the accuracy of identifying vulnerabilities when detecting and repairing software vulnerabilities.

[0068] Further, the user terminal transmission abnormality monitoring further comprises judging whether to perform user terminal transmission optimization, and the specific process is as follows: if the user terminal transmission abnormality monitoring value is greater than the preset user terminal transmission abnormality threshold value obtained from the database, the third update data is transmitted to the user terminal; if the user terminal transmission abnormality monitoring value is not greater than the preset user terminal transmission abnormality threshold value obtained from the database, the user terminal transmission optimization is performed; the specific steps of the user terminal transmission optimization are as follows: first, the transmission distance is monitored and the priority is set, and the transmission distance represents the transmission distance between the server and the user terminal; second, the update frequency optimization is performed, and the update frequency optimization represents that the update frequency of the browser plug-in is increased by a preset multiple step by step by sending a prompt to the preset personnel.

[0069] In the embodiment, the preset user terminal transmission abnormality threshold value is represented by the average value of the historical time period user terminal transmission abnormality monitoring value; by monitoring the user terminal transmission abnormality value in real time, it is helpful to timely find the transmission abnormality and take corresponding measures (user terminal transmission optimization); when the user terminal transmission abnormality monitoring value is greater than the preset user terminal transmission abnormality threshold value, the third update data is transmitted to the user terminal, which is helpful to ensure the accuracy of the user terminal to obtain the browsing information and improve the stability and reliability of the transmission; the transmission distance is monitored and the priority is set, and the server with the shortest transmission distance is preferentially selected for browsing information distribution, which is helpful to optimize the user terminal transmission according to the dynamic change of the transmission distance and improve the transmission efficiency; by increasing the update frequency of the browser plug-in by a preset multiple step by step, it is helpful to reduce the user waiting time and the transmission interruption situation, ensure the timely update of the browser plug-in, and further improve the accuracy of identifying the software vulnerability when detecting and repairing the software vulnerability.

[0070] In summary, by performing the request volume and session frequency abnormality monitoring and judging whether to perform the first vulnerability repair, then performing the browsing abnormality monitoring and judging whether to perform the second vulnerability repair, and finally performing the user terminal transmission abnormality monitoring and judging whether to perform the third vulnerability repair, the reliability of identifying the vulnerability when detecting and repairing the software vulnerability is improved, and the accuracy of identifying the vulnerability when detecting and repairing the software vulnerability is further improved, effectively solving the problem of low accuracy of identifying the vulnerability when detecting and repairing the software vulnerability in the prior art.

[0071] Those skilled in the art will appreciate that embodiments of the present application can be provided as methods, systems, or computer program products. Accordingly, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage media, etc.) having computer-usable program code embodied therein.

[0072] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flowcharts and / or blocks Figure 1 means for functionally implementing the steps listed in the flowchart block or blocks.

[0073] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the function specified in the flowchart block or blocks. Figure 1 one or more flowcharts and / or blocks Figure 1 means for functionally implementing the steps listed in the flowchart block or blocks.

[0074] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flowcharts and / or blocks Figure 1 means for functionally implementing the steps listed in the flowchart block or blocks.

[0075] While the preferred embodiments of the application have been described, additional variations and modifications can be made to the embodiments described and shown, and it is therefore intended that the application cover any and all variations of the preferred embodiments which fall within the scope of the present application. Accordingly, the appended claims are intended to cover all such modifications and variations as falling within the scope of the application.

[0076] It will be apparent to those skilled in the art that various modifications and variations can be made to the present application without departing from the spirit or scope of the application. Thus, it is intended that the present application cover the modifications and variations of this application provided they come within the scope of the appended claims and their equivalents.

Claims

1. A software vulnerability intelligent detection and repair method for network and information security, characterized in that, The method comprises the following steps: S1, performing request quantity and session frequency anomaly monitoring to determine whether to perform first vulnerability repair; S2, performing browsing anomaly monitoring to determine whether to perform second vulnerability repair; S3, performing user end transmission anomaly monitoring to determine whether to perform third vulnerability repair; The specific process of the request quantity and session frequency anomaly monitoring is as follows: monitoring the total request quantity and the session frequency average value in a preset time period; when the monitored total request quantity is greater than the preset maximum request quantity obtained from the database, or the session frequency average value is greater than the preset maximum session frequency obtained from the database, marking the corresponding request address as a suspicious address, and performing first vulnerability repair; the first vulnerability repair comprises first interception, first repair and first update and verification; the first interception means that the suspicious address is intercepted through a dynamic code analysis method; the specific process of the first vulnerability repair is as follows: monitoring whether the repair detection parameter meets the interception qualified condition, wherein the repair detection parameter comprises an interception speed and an interception load, and the interception load means the average value of the load of the server in the first interception process; when the repair detection parameter does not meet the interception qualified condition, performing first interception optimization, wherein the first interception optimization means sending a prompt to a preset personnel to set a dynamic backup bandwidth; when the repair detection parameter meets the interception qualified condition, continuing to perform first repair, wherein the first repair means sending an access prohibition prompt to a preset personnel and performing suspicious address code setting; the first update and verification comprises first update and first verification; the first update means updating the first vulnerability repair qualified data to obtain first update data; the first verification means re-monitoring the total request quantity and the session frequency average value in a preset time period after the first update; the first vulnerability repair qualified data means browsing related data after the first repair.

2. The method of claim 1, wherein the method further comprises: The specific process of the first update is as follows: determining whether the monitored to-be-verified parameter meets the update qualified condition, wherein the to-be-verified parameter comprises the server load and the total request quantity after the first interception; when the monitored to-be-verified parameter meets the update qualified condition, continuing to perform browsing anomaly monitoring; when the monitored to-be-verified parameter does not meet the update qualified condition, performing verification load optimization, wherein the verification load optimization means sending a prompt to a preset personnel to set a backup server and distributing qualified requests to the backup server.

3. The intelligent software vulnerability detection and repair method for network and information security as described in claim 1, characterized in that, The specific process of the browsing anomaly monitoring is as follows: obtaining a flow-request frequency analysis value by performing proportion degree analysis on the request frequency average value and the preset request frequency, and performing weighting effect joint analysis on the browsing flow peak proportion degree value and the preset browsing flow influence first weight, wherein the browsing flow peak proportion degree value is used to reflect the proportion degree of the maximum browsing flow value relative to the preset maximum browsing flow. The traffic-same request analysis value is obtained by performing proportion degree analysis on the same request number and the preset same request number, and performing joint analysis on the proportion degree value of the browsing traffic peak and the preset browsing traffic influence second weight; The traffic-bandwidth occupation analysis value is obtained by performing proportion degree analysis on the browsing bandwidth occupation rate and the preset browsing bandwidth occupation rate, and performing joint analysis on the proportion degree value of the browsing traffic peak and the preset browsing traffic influence third weight; The traffic-concurrency analysis value is obtained by performing proportion degree analysis on the maximum request concurrency connection number and the preset request concurrency connection number, and performing joint analysis on the proportion degree value of the browsing traffic peak and the preset browsing traffic influence fourth weight; The browsing exception monitoring value is obtained by performing joint analysis on the browsing traffic and the exception reflection value; The browsing exception monitoring value is used to reflect the quantitative situation of the influence degree of the browsing traffic and the exception reflection value on the user's webpage information browsing exception situation in the preset time period; The traffic and exception reflection value includes a traffic-request frequency analysis value, a traffic-same request analysis value, a traffic-bandwidth occupation analysis value, and a traffic-concurrency analysis value; The traffic-request frequency analysis value is used to reflect the comprehensive influence degree of the browsing traffic maximum value and the request frequency average value on the user's webpage information browsing exception situation; The traffic-same request analysis value is used to reflect the comprehensive influence degree of the browsing traffic maximum value and the same request number on the user's webpage information browsing exception situation; The traffic-bandwidth occupation analysis value is used to reflect the comprehensive influence degree of the browsing traffic maximum value and the browsing bandwidth occupation rate on the user's webpage information browsing exception situation; The traffic-concurrency analysis value is used to reflect the comprehensive influence degree of the browsing traffic maximum value and the maximum request concurrency connection number on the user's webpage information browsing exception situation.

4. The intelligent detection and remediation method for software vulnerabilities in network and information security as described in claim 1, characterized in that, The specific process of determining whether to perform second vulnerability repair is as follows: Compare whether the browsing exception monitoring value is less than the preset browsing exception monitoring value obtained from the database; If yes, continue to perform user end transmission exception monitoring; If not, perform second vulnerability repair; The second vulnerability repair includes second interception, second repair, and second update; The second interception means intercepting through the set browser plug-in; The second repair means automatically repairing the vulnerability through the set browser plug-in; The second update means updating the second vulnerability repair qualified data to obtain second update data; The second vulnerability repair qualified data means data after the first vulnerability repair qualified data is repaired for the second time.

5. The intelligent software vulnerability detection and repair method for network and information security as described in claim 1, characterized in that, The specific process of performing user end transmission exception monitoring and determining whether to perform third vulnerability repair is as follows: Monitor the script change rate to determine whether to perform third vulnerability repair; When the monitored script change rate is not greater than the preset script change rate obtained from the database, transmit the second update data to the user end; When the monitored script change rate is greater than the preset script change rate obtained from the database, perform third vulnerability repair; The third vulnerability repair includes a third interception, a third repair, and a third update and verification.

6. The method of claim 5, wherein the method further comprises: The third interception indicates sending a prompt to prohibit running a malicious script to a preset person; The malicious script indicates a script with a script change rate greater than a preset script change rate; The third repair indicates sending a prompt to delete the malicious script to the preset person; The third update and verification includes a third update and a script change rate verification; The third update indicates updating the third vulnerability repair qualified data to obtain third update data; The third vulnerability repair qualified data indicates data after the second vulnerability repair qualified data is repaired for the third time; The script change rate verification indicates re-monitoring the script change rate until the number of script change rate verifications reaches a preset maximum script change rate verification number.

7. The intelligent software vulnerability detection and repair method for network and information security as described in claim 5, characterized in that, The user end transmission anomaly monitoring also includes obtaining a user end transmission anomaly monitoring value, and the specific process is as follows: The loading-interruption analysis value is obtained by performing proportion degree analysis on the interruption number and the preset interruption number, and performing weighting effect joint analysis on the page loading proportion degree value and the preset user end transmission first weight value; the page loading proportion degree value is used to reflect the proportion degree of the average page loading time length relative to the preset page loading time length; The loading-interception analysis value is obtained by performing proportion degree analysis on the interception number and the preset interception number, and performing weighting effect joint analysis on the page loading proportion degree value and the preset user end transmission second weight value; The loading-crash analysis value is obtained by performing proportion degree analysis on the browser crash number and the preset browser crash number, and performing weighting effect joint analysis on the page loading proportion degree value and the preset user end transmission third weight value; The loading-request response analysis value is obtained by performing proportion degree analysis on the maximum request response time length and the preset request response time length, and performing weighting effect joint analysis on the page loading proportion degree value and the preset user end transmission fourth weight value; The user end transmission anomaly monitoring value is obtained by joint analysis on the user end transmission anomaly reflection values obtained above; The user end transmission anomaly monitoring value is used to reflect the quantitative situation of the influence degree of the user end transmission anomaly reflection values in the preset user end monitoring time period on the abnormal situation of the web page information transmission to the user end; The user end transmission anomaly reflection values include the loading-interruption analysis value, the loading-interception analysis value, the loading-crash analysis value, and the loading-request response analysis value; The loading-interruption analysis value is used to reflect the comprehensive influence degree of the interruption number and the average page loading time length on the abnormal situation of the web page information transmission to the user end; The loading-interception analysis value is used to reflect the comprehensive influence degree of the interception number and the average page loading time length on the abnormal situation of the web page information transmission to the user end; The loading-crash analysis value is used to reflect the comprehensive influence degree of the browser crash number and the average page loading time length on the abnormal situation of the web page information transmission to the user end; The loading-request response analysis value is used to reflect the comprehensive influence degree of the maximum value of request response time length and the average page loading time length on the abnormal situation of web information transmission to the user end.

8. The method of claim 7, wherein the method further comprises: The user end transmission abnormality monitoring further includes judging whether to perform user end transmission optimization, and the specific process is as follows: If the user end transmission abnormality monitoring value is greater than the preset user end transmission abnormality threshold value obtained from the database, the third updated data is transmitted to the user end; If the user end transmission abnormality monitoring value is not greater than the preset user end transmission abnormality threshold value obtained from the database, user end transmission optimization is performed; The specific steps of the user end transmission optimization are as follows: First, monitor the transmission distance and set the priority, wherein the transmission distance represents the transmission distance between the server and the user end; Second, perform update frequency optimization, wherein the update frequency optimization represents sending a prompt to the preset personnel to gradually increase the update frequency of the browser plug-in by a preset multiple.

Images