An intelligent vulnerability feature recommendation method based on Transformer model

Abstract

The present invention provides an intelligent vulnerability feature recommendation method based on a Transformer model, which relates to the technical field of deception defense resource deployment. The method includes the following steps: obtaining initial vulnerability information based on a variety of open source vulnerability libraries, sorting and classifying the information to obtain vulnerability numbers, and supplementing the vulnerability information corresponding to the vulnerability numbers based on an automated dynamic crawler; performing a semantic relevance coarse search on the vulnerability information and the version information of the target service system based on the BM25 algorithm to obtain a retrieval knowledge base, vectorizing the retrieval knowledge base and the version information based on the Transformer model to obtain vectorized data, and performing a vector similarity fine search on the vectorized data based on the FAISS algorithm to obtain the optimal vulnerability feature. The intelligent vulnerability feature recommendation method provided by the present invention supplements the amount of vulnerability information during vulnerability simulation, and recommends the optimal vulnerability feature in combination with the version information of the target service system, thereby improving the success rate of vulnerability deception.

Description

Technical Field

[0001] The present invention relates to the field of deception defense resource deployment, and in particular to an intelligent vulnerability feature recommendation method based on a Transformer model. Background Art

[0002] Vulnerability simulation service is a network security defense method that simulates vulnerabilities and weaknesses in a real network environment to lure attackers into the simulation environment, thereby enabling monitoring, analysis, and defense against attack behaviors.

[0003] Current simulation services typically use static pages, lacking high-value targets for attackers. Even if an attack is successful, the pages offer no real benefits or access to deeper systems, making them difficult to attract sophisticated attackers. This results in a low success rate for deceiving sophisticated attackers and insufficient system protection. Therefore, a solution is urgently needed to address these issues. Summary of the Invention

[0004] The purpose of the present invention is to provide an intelligent vulnerability feature recommendation method based on the Transformer model, which improves the problems of insufficient vulnerability information and low vulnerability deception success rate during vulnerability simulation in the prior art.

[0005] The present invention provides an intelligent vulnerability feature recommendation method based on the Transformer model, which adopts the following technical solutions:

[0006] Obtaining initial vulnerability information based on multiple open source vulnerability libraries, classifying the initial vulnerability information to obtain vulnerability numbers, supplementing the initial vulnerability information corresponding to the vulnerability numbers based on an automated dynamic crawler, and storing the information in a local vulnerability knowledge base;

[0007] Based on the BM25 algorithm, a semantic relevance coarse search is performed on the vulnerability knowledge base and the version information of the target service system to obtain a retrieval knowledge base. Based on the Transformer model, the retrieval knowledge base and the version information are vectorized to obtain vectorized data. Based on the FAISS algorithm, a vector similarity fine search is performed on the vectorized data to recommend the optimal vulnerability features.

[0008] In the above-mentioned intelligent vulnerability feature recommendation method based on the Transformer model, the process of obtaining initial vulnerability information based on multiple open source vulnerability libraries includes:

[0009] Initial vulnerability information is obtained based on multiple open source vulnerability libraries, including NUCLEI, XRAY, GOBY, and PUBLIC. The initial vulnerability information includes vulnerability ID, POC link, and vulnerability hazard description.

[0010] As described above, the intelligent vulnerability feature recommendation method based on the Transformer model, wherein the process of classifying the initial vulnerability information to obtain the vulnerability number includes: classifying the initial vulnerability information into CVE and CNVD types, and obtaining the CVE and CNVD vulnerability numbers of the initial vulnerability information.

[0011] In the above-mentioned intelligent vulnerability feature recommendation method based on the Transformer model, the process of supplementing the initial vulnerability information corresponding to the vulnerability number based on the automated dynamic crawler includes:

[0012] Based on the automated dynamic crawler, the vulnerability information in CVE and CNVD is supplemented according to the vulnerability number to obtain complete vulnerability information, including the triggering conditions of the vulnerability, possible attack paths, and repair suggestions.

[0013] In the above-mentioned intelligent vulnerability feature recommendation method based on the Transformer model, the process of obtaining the retrieval knowledge base by performing a semantic relevance coarse search on the local vulnerability knowledge base and the version information of the target service system based on the BM25 algorithm includes:

[0014] Scoring and sorting are performed based on the correlation between the keywords of the version information and the vulnerability information corresponding to the vulnerability number in the local vulnerability knowledge base, and the vulnerability information is selected based on a sorting threshold, where the correlation includes word frequency, inverse document frequency, and document length.

[0015] In the above-mentioned intelligent vulnerability feature recommendation method based on the Transformer model, the process of vectorizing the version information of the search knowledge base and the target service system based on the Transformer model includes:

[0016] Based on the Transformer model, the vulnerability information and the version information corresponding to the vulnerability number in the retrieval knowledge base are pre-trained and fine-tuned, and the vulnerability information and the version information are converted into multiple numerical vectors of fixed length, where the numerical vectors include a vector to be retrieved and a query vector.

[0017] The Transformer-based intelligent vulnerability feature recommendation method described above includes the following steps during pre-training and fine-tuning:

[0018] Randomly mask the words of the vulnerability information and the version information based on the masking language model, predict the words based on the Transformer model; and predict whether the two sentences are natural continuations based on the Transformer model.

[0019] The intelligent vulnerability feature recommendation method based on the Transformer model described above, wherein the vulnerability information and the version information are converted into multiple fixed-length numerical vectors, includes:

[0020] Perform word segmentation on the vulnerability information and the version information based on the Transformer model to obtain an initial word vector;

[0021] The multi-layer Transformer architecture based on the Transformer model encodes the word vectors and converts them into numerical vectors that can be compared in the vector space.

[0022] In the above-mentioned intelligent vulnerability feature recommendation method based on the Transformer model, the process of performing vector similarity precise search on the vectorized data based on the FAISS algorithm to recommend the optimal vulnerability feature includes:

[0023] The cosine similarity or inner product similarity between the query vector and the vector to be searched is calculated based on the FAISS algorithm to obtain a search vector most similar to the query vector, and the vulnerability number corresponding to the search vector is used as the optimal vulnerability feature.

[0024] In the above-mentioned intelligent vulnerability feature recommendation method based on the Transformer model, the process of obtaining multiple search knowledge base vectors that are most similar to the query vector includes: the cosine similarity between the query vector and the vector to be searched in the direction ranges from -1 to 1, and the vector to be searched whose cosine similarity is closest to 1 is obtained.

[0025] The beneficial effects of the intelligent vulnerability feature recommendation method based on the Transformer model proposed in this invention are:

[0026] 1. The local vulnerability knowledge base of the present invention improves the problem of insufficient vulnerability information during vulnerability simulation in the prior art.

[0027] 2. The present invention recommends version information related vulnerabilities for the target service system, which can improve the success rate of vulnerability deception. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 Flowchart of the intelligent vulnerability feature recommendation method based on the Transformer model provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0029] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be the common meanings understood by people with ordinary skills in the field to which the invention belongs. The words "including" and similar words used in this article mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0030] The embodiment of the present invention provides an intelligent vulnerability feature recommendation method based on the Transformer model, see Figure 1 ,include:

[0031] S1. Obtaining initial vulnerability information based on multiple open source vulnerability libraries, sorting and classifying the initial vulnerability information to obtain vulnerability numbers, supplementing the initial vulnerability information corresponding to the vulnerability numbers using an automated dynamic crawler, and storing the information in a local vulnerability knowledge base;

[0032] S2. Based on the BM25 algorithm, a semantic relevance coarse search is performed on the local vulnerability knowledge base and the version information of the target service system to obtain a retrieval knowledge base, based on the Transformer model, the retrieval knowledge base and the version information are vectorized to obtain vectorized data, and based on the FAISS algorithm, a vector similarity fine search is performed on the vectorized data to obtain the optimal vulnerability feature.

[0033] In some embodiments, the process of executing step S1 includes:

[0034] S1.1. Obtain initial vulnerability information based on multiple open source vulnerability libraries;

[0035] S1.2. Arrange and classify the initial vulnerability information to obtain vulnerability numbers;

[0036] S1.3. Supplement the initial vulnerability information corresponding to the vulnerability number based on the automated dynamic crawler and store it in the local vulnerability knowledge base.

[0037] Specifically, when executing step S1.1, obtaining initial vulnerability information based on multiple open source vulnerability libraries includes:

[0038] Initial vulnerability information is obtained based on multiple open source vulnerability libraries, including NUCLEI, XRAY, GOBY, and PUBLIC. The initial vulnerability information includes vulnerability ID, POC link, and vulnerability hazard description.

[0039] Specifically, when executing step S1.2, arranging and classifying the initial vulnerability information to obtain vulnerability numbers, it includes: arranging and classifying the initial vulnerability information into CVE and CNVD types, and obtaining CVE and CNVD vulnerability numbers corresponding to the initial vulnerability information.

[0040] In fact, the CVE is an internationally recognized standard for public disclosure of information security vulnerabilities, and the CNVD is a national information security vulnerability sharing platform. The CVE vulnerability number and the CNVD vulnerability number are unique. By organizing and classifying the vulnerability information and obtaining the CVE vulnerability number or CNVD vulnerability number of the vulnerability information, detailed information of the vulnerability can be effectively obtained.

[0041] Specifically, when executing step S1.3, supplementing the initial vulnerability information corresponding to the vulnerability number based on the automated dynamic crawler and storing it in the local vulnerability knowledge base includes:

[0042] S1.3.1. Automated dynamic crawlers supplement the initial vulnerability information corresponding to the vulnerability number;

[0043] S1.3.2. Store the vulnerability information in a local vulnerability knowledge base.

[0044] Specifically, when executing step S1.3.1, the automated dynamic crawler supplements the initial vulnerability information corresponding to the vulnerability number, including:

[0045] Based on the automated dynamic crawler, the initial vulnerability information is supplemented in CVE and CNVD according to the vulnerability number to obtain complete vulnerability information, including the triggering conditions of the vulnerability, possible attack paths, and repair suggestions.

[0046] Furthermore, when executing step S1.3.2 and storing the vulnerability information in the local vulnerability knowledge base, the vulnerability number is used as a key and the vulnerability information is stored as a value.

[0047] In some embodiments, the process of executing step S2 includes:

[0048] S2.1. Performing a semantic relevance coarse search on the local vulnerability knowledge base and the version information of the target service system based on the BM25 algorithm to obtain a retrieval knowledge base;

[0049] S2.2. Vectorizing the search knowledge base and the version information based on a Transformer model to obtain vectorized data;

[0050] S2.3. Based on the FAISS algorithm, perform vector similarity precise retrieval on the vectorized data to obtain the optimal vulnerability features.

[0051] Specifically, when executing step S2.1, performing a semantic relevance coarse search on the local vulnerability knowledge base and the version information of the target service system based on the BM25 algorithm to obtain a search knowledge base, the process includes:

[0052] Scoring and sorting are performed based on the correlation between the keywords of the version information and the vulnerability information corresponding to the vulnerability number in the local vulnerability knowledge base, and the vulnerability information is selected based on a sorting threshold, where the correlation includes word frequency, inverse document frequency, and document length.

[0053] Among them, the word frequency refers to the number of times the keyword appears in the vulnerability information, the inverse document frequency refers to when the keyword appears in multiple vulnerability information, the lower the inverse document frequency value, and vice versa, the document length refers to the total number of characters in the vulnerability information.

[0054] Specifically, when executing step S2.2, vectorizing the search knowledge base and the version information based on the Transformer model to obtain vectorized data, the following steps are included:

[0055] S2.2.1. Pre-training and fine-tuning the vulnerability information corresponding to the vulnerability number in the search knowledge base and the version information based on the Transformer model;

[0056] S2.2.2. Convert the vulnerability information and the version information into multiple fixed-length numerical vectors, where the numerical vectors include a vector to be retrieved and a query vector.

[0057] Specifically, when executing step S2.2.1, the words of the vulnerability information and the version information are randomly masked based on the masking language model, and the words are predicted based on the Transformer model; and whether the two sentences are natural continuations is predicted based on the Transformer model.

[0058] In fact, by randomly masking the words in the vulnerability information and the version information through the masking language model, the Transformer model can grasp the meaning of the words in different contexts. By judging whether two sentences are natural continuations, the Transformer model can improve its ability to handle the logical relationship between different sentences.

[0059] Specifically, when executing step S2.2.2, it includes: performing word segmentation processing on the vulnerability information and the version information based on the Transformer model to obtain an initial word vector;

[0060] Furthermore, a multi-layer Transformer architecture based on the Transformer model encodes the word vectors and converts them into numerical vectors that can be compared in the vector space.

[0061] The multi-layer Transformer architecture calculates the importance of each word in the sequence through a self-attention mechanism, generates an encoded representation containing contextual information, converts the version information into a query vector, and converts the vulnerability information into a vector to be retrieved.

[0062] Specifically, when executing step S2.3, performing vector similarity precise search on the vectorized data based on the FAISS algorithm to obtain the optimal vulnerability feature, the following steps are included:

[0063] The cosine similarity or inner product similarity between the query vector and the vector to be searched is calculated based on the FAISS algorithm, a search vector with the highest similarity to the query vector is obtained, and the vulnerability number corresponding to the search vector is used as the optimal vulnerability feature.

[0064] The cosine similarity measurement method is usually adopted. The cosine similarity between the query vector and the vector to be searched in the direction ranges from -1 to 1, and the vector to be searched with the cosine similarity closest to 1 is obtained.

[0065] While the embodiments of the present invention have been described in detail above, it will be apparent to those skilled in the art that various modifications and variations of these embodiments are possible. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as set forth in the claims. Furthermore, the invention described herein is susceptible to other embodiments and may be practiced or implemented in a variety of ways.

Claims

1. An intelligent vulnerability feature recommendation method based on the Transformer model, characterized in that: The following steps are involved: Obtaining initial vulnerability information based on multiple open source vulnerability libraries, sorting and classifying the initial vulnerability information to obtain vulnerability numbers, supplementing the initial vulnerability information corresponding to the vulnerability numbers based on an automated dynamic crawler, and storing the information in a local vulnerability knowledge base; Performing a coarse semantic relevance search on the local vulnerability knowledge base and the version information of the target service system based on the BM25 algorithm to obtain a retrieval knowledge base, vectorizing the retrieval knowledge base and the version information based on the Transformer model to obtain vectorized data, and performing a fine vector similarity search on the vectorized data based on the FAISS algorithm to obtain the optimal vulnerability features; The process of obtaining the retrieval knowledge base by performing a semantic relevance coarse search based on the BM25 algorithm on the local vulnerability knowledge base and the version information of the target service system includes: Scoring and sorting based on the correlation between the keywords of the version information and the vulnerability information corresponding to the vulnerability numbers in the local vulnerability knowledge base, and selecting the vulnerability information based on a sorting threshold, wherein the correlation includes word frequency, inverse document frequency, and document length; The process of vectorizing the version information of the retrieval knowledge base and the target service system based on the Transformer model includes: Based on the Transformer model, the vulnerability information and the version information corresponding to the vulnerability number in the retrieval knowledge base are pre-trained and fine-tuned, and the vulnerability information and the version information are converted into multiple numerical vectors of fixed length, where the numerical vectors include a vector to be retrieved and a query vector.

2. The intelligent vulnerability feature recommendation method based on the Transformer model according to claim 1 is characterized in that: The process of obtaining initial vulnerability information based on multiple open source vulnerability libraries includes: Initial vulnerability information is obtained based on multiple open source vulnerability libraries, including NUCLEI, XRAY, and GOBY. The initial vulnerability information includes vulnerability ID, POC link, and vulnerability hazard description.

3. The intelligent vulnerability feature recommendation method based on the Transformer model according to claim 1 is characterized in that: The process of arranging and classifying the initial vulnerability information to obtain vulnerability numbers includes: The initial vulnerability information is sorted and classified into CVE and CNVD types, and the CVE and CNVD vulnerability numbers corresponding to the initial vulnerability information are obtained.

4. The intelligent vulnerability feature recommendation method based on the Transformer model according to claim 1 is characterized in that: The process of supplementing the initial vulnerability information corresponding to the vulnerability number based on automated dynamic crawlers includes: Based on the automated dynamic crawler, the initial vulnerability information is supplemented in CVE and CNVD according to the vulnerability number to obtain complete vulnerability information, including the triggering conditions of the vulnerability, possible attack paths, and repair suggestions.

5. The intelligent vulnerability feature recommendation method based on the Transformer model according to claim 2 is characterized in that: The process of pre-training and fine-tuning includes: Randomly mask the words of the vulnerability information and the version information based on the masking language model, predict the words based on the Transformer model; and predict whether the two sentences are natural continuations based on the Transformer model.

6. The intelligent vulnerability feature recommendation method based on the Transformer model according to claim 2 is characterized in that: Convert the vulnerability information and the version information into multiple fixed-length numerical vectors, including: Perform word segmentation on the vulnerability information and the version information based on the Transformer model to obtain an initial word vector; The multi-layer Transformer architecture based on the Transformer model encodes the word vectors and converts them into numerical vectors that can be compared in the vector space.

7. The intelligent vulnerability feature recommendation method based on the Transformer model according to claim 2 is characterized in that: The process of performing vector similarity precise search on the vectorized data based on the FAISS algorithm to obtain the optimal vulnerability features includes: The cosine similarity or inner product similarity between the query vector and the vector to be searched is calculated based on the FAISS algorithm, a search vector with the highest similarity to the query vector is obtained, and the vulnerability number corresponding to the search vector is used as the optimal vulnerability feature.

8. The intelligent vulnerability feature recommendation method based on the Transformer model according to claim 7 is characterized in that: The process of obtaining the search vector most similar to the query vector includes: The cosine similarity between the query vector and the vector to be searched in the direction ranges from -1 to 1, and the vector to be searched whose cosine similarity is closest to 1 is obtained.

Images