Fusion processing method, device, equipment and medium for multi-source vulnerability data

Abstract

The disclosed embodiments provide a method, apparatus, device, and medium for fusion processing of multi-source vulnerability data. The method obtains multiple vulnerability data discovered by multiple different channels, performs fusion processing on each vulnerability data in turn, and for the first vulnerability data currently being fused, if it has a corresponding first knowledge base identifier, matches the first knowledge base identifier in descending order according to the hierarchical order of pre-arranged multi-level knowledge base identifiers; when the first knowledge base identifier does not match any first-category identifier but matches one of the second-category identifiers, determines in the mapping knowledge base whether there is a first-category identifier with a mapping relationship with the first knowledge base identifier; if so, the first-category identifier with a mapping relationship is used as the target knowledge base identifier, and the first vulnerability data is assigned to the target knowledge base identifier to obtain the corresponding vulnerability fusion result. The method can effectively integrate data from multiple sources and reduce the probability of false positives or false negatives of vulnerability data.

Description

Technical Field

[0001] The present disclosure relates to the field of network security technology, and in particular to a method, apparatus, device, and medium for fusion processing of multi-source vulnerability data. Background Art

[0002] With the widespread adoption of the internet and the rapid development of computer technology, information technology has permeated every aspect of society, greatly enriching and simplifying people's lives. However, network security issues have also become increasingly prominent. Cyberattacks are constantly evolving, posing a serious threat to the information security of individuals and organizations. Therefore, accurately identifying vulnerability data is crucial to improving network security, and vulnerability data scanning is currently commonly performed through various methods.

[0003] In related technologies, due to the limitations of a single approach in vulnerability scanning, scanning of multi-source vulnerability data based on multiple different approaches has gradually become a development trend. However, since different approaches have different vulnerability scanning performances and rely on different vulnerability knowledge bases or scanning methods, the scanning results of multiple sources in the same network environment are significantly different and difficult to accurately integrate, making it impossible to effectively integrate the vulnerability data collected from multiple sources, thereby increasing the probability of false positives or omissions in vulnerability data, and ultimately reducing network security. Summary of the Invention

[0004] The main purpose of the embodiments of the present disclosure is to propose a method, device, equipment and medium for fusion processing of multi-source vulnerability data, which can effectively integrate data from multiple sources, reduce the probability of false positives or omissions of vulnerability data, and ultimately improve network security.

[0005] To achieve the above objectives, a first aspect of the embodiments of the present disclosure provides a method for fusion processing of multi-source vulnerability data, including:

[0006] Respectively obtaining a plurality of vulnerability data discovered by a plurality of different approaches, wherein, when the vulnerability data carries a knowledge base identifier of a corresponding vulnerability knowledge base, the vulnerability data carrying the knowledge base identifier is scanned by the corresponding approach based on any one of the plurality of vulnerability knowledge bases;

[0007] performing fusion processing on each vulnerability data in sequence, and for a first vulnerability data currently being fused, if the first vulnerability data has a corresponding first knowledge base identifier, matching the first knowledge base identifier in descending order according to a pre-arranged hierarchy of multi-level knowledge base identifiers, wherein the multi-level knowledge base identifier includes a plurality of first-category identifiers and a plurality of second-category identifiers, and the hierarchy of the first-category identifier is higher than that of the second-category identifier;

[0008] When the first knowledge base identifier does not match any of the first category identifiers but matches one of the second category identifiers, determining whether there is a first category identifier having a mapping relationship with the first knowledge base identifier in a preset mapping knowledge base;

[0009] When there is a first type of identifier with a mapping relationship with the first knowledge base identifier in the mapping knowledge base, the first type of identifier with a mapping relationship is used as the target knowledge base identifier, and the first vulnerability data is assigned to the target knowledge base identifier to obtain the corresponding vulnerability fusion result.

[0010] In some embodiments, after sequentially fusing the vulnerability data, and for the first vulnerability data currently being fused, the multi-source vulnerability data fusion processing method further includes:

[0011] If the first vulnerability data does not have a corresponding first knowledge base identifier, obtaining a plurality of second vulnerability data from a preset vulnerability fusion table, wherein the second knowledge base identifier of the second vulnerability data does not belong to the first category identifier or the second category identifier;

[0012] Determine vulnerability similarity between the first vulnerability data and each of the second vulnerability data to obtain a corresponding similarity value;

[0013] When any of the similarity values ​​is greater than or equal to a preset first similarity threshold, the second knowledge base identifier of the similar second vulnerability data is determined as the target knowledge base identifier, and the first vulnerability data is assigned to the target knowledge base identifier to obtain a corresponding vulnerability fusion result.

[0014] In some embodiments, determining the vulnerability similarity between the first vulnerability data and each of the second vulnerability data to obtain a corresponding similarity value includes:

[0015] Determine vulnerability attributes of multiple different attribute types under the first vulnerability data and the second vulnerability data respectively, and configure corresponding similarity algorithms for different attribute types;

[0016] For each of the first vulnerability data and each of the second vulnerability data, determining attribute similarities between the vulnerability attributes under the same attribute type in sequence using the corresponding similarity algorithm, and obtaining sub-similarity values ​​under multiple attribute types;

[0017] Based on the weights of the respective attribute types, a weighted calculation is performed on the plurality of sub-similarity values ​​to obtain a similarity value between the first vulnerability data and each of the second vulnerability data.

[0018] In some embodiments, sequentially determining the attribute similarities between the vulnerability attributes under the same attribute type to obtain sub-similarity values ​​under multiple attribute types includes:

[0019] Calculating an edit distance and a first Jaccard similarity value between the vulnerability attributes whose attribute type is component name, and determining a sub-similarity value under the component name in combination with the edit distance and the first Jaccard similarity value;

[0020] Calculating a hierarchical version splitting vector and a first cosine similarity value between the vulnerability attributes whose attribute type is component version, and determining a sub-similarity value under the component version by combining the hierarchical version splitting vector and the first cosine similarity value;

[0021] Calculating a first domain-enhanced semantic vector feature and a second cosine similarity value between the vulnerability attributes whose attribute type is vulnerability description, and determining a sub-similarity value under the vulnerability description in combination with the first domain-enhanced semantic vector feature and the second cosine similarity value;

[0022] Calculating the action and object semantic role labeling results and the third cosine similarity value between the vulnerability attributes whose attribute type is repair suggestion, and determining the sub-similarity value under the repair suggestion in combination with the labeling results and the third cosine similarity value;

[0023] Calculating the classification tree path distance or the second domain enhanced semantic vector feature between the vulnerability attributes whose attribute type is the vulnerability type, and determining the sub-similarity value under the vulnerability type in combination with the classification tree path distance or the second domain enhanced semantic vector feature;

[0024] Calculating the TF-IDF vector features and the fourth cosine similarity value between the vulnerability attributes whose attribute type is the exploitation method, and determining the sub-similarity value under the exploitation method by combining the TF-IDF vector features and the fourth cosine similarity value;

[0025] A second Jaccard similarity value of the asset type between the vulnerability attributes whose attribute type is the impact range is calculated, and a sub-similarity value under the impact range is determined based on the second Jaccard similarity value.

[0026] In some embodiments, after determining whether there is a first type identifier having a mapping relationship with the first knowledge base identifier in a preset mapping knowledge base, the multi-source vulnerability data fusion processing method further includes:

[0027] When there is no first-category identifier having a mapping relationship with the first knowledge base identifier in the mapping knowledge base, the second-category identifier matching the first knowledge base identifier is used as the target knowledge base identifier, and the first vulnerability data is assigned to the target knowledge base identifier to obtain the corresponding vulnerability fusion result.

[0028] In some embodiments, the plurality of second-category identifiers include a plurality of second-category identifiers under a first vulnerability knowledge base, and a plurality of second-category identifiers under a second vulnerability knowledge base at the same level as the first vulnerability knowledge base;

[0029] When the mapping knowledge base does not contain a first type identifier having a mapping relationship with the first knowledge base identifier, the multi-source vulnerability data fusion processing method further includes:

[0030] When the first knowledge base identifier matches the second category identifier under one of the first vulnerability knowledge bases, determining in the mapping knowledge base whether there is a second category identifier under the second vulnerability knowledge base that has a mapping relationship with the first knowledge base identifier;

[0031] When there is a second category identifier under the second vulnerability knowledge base that has a mapping relationship with the first knowledge base identifier in the mapping knowledge base, the second category identifier under the second vulnerability knowledge base that has a mapping relationship is used as the target knowledge base identifier, and the first vulnerability data is assigned to the target knowledge base identifier to obtain the corresponding vulnerability fusion result.

[0032] In some embodiments, after matching the first knowledge base identifiers in descending order according to the pre-arranged hierarchical order of the multi-level knowledge base identifiers, the multi-source vulnerability data fusion processing method further includes:

[0033] When the first knowledge base identifier matches one of the first category identifiers, the first category identifier matching the first knowledge base identifier is used as the target knowledge base identifier, and the first vulnerability data is assigned to the target knowledge base identifier to obtain a corresponding vulnerability fusion result.

[0034] In some embodiments, assigning the first vulnerability data to the target knowledge base identifier to obtain a corresponding vulnerability fusion result includes:

[0035] Determine whether there is a vulnerability storage record identified by the target knowledge base in a preset vulnerability fusion table;

[0036] When a vulnerability storage record identified by the target knowledge base exists in the vulnerability fusion table, the vulnerability storage record identified by the target knowledge base in the vulnerability fusion table is updated based on the first vulnerability data to obtain a corresponding vulnerability fusion result;

[0037] When the vulnerability storage record identified by the target knowledge base does not exist in the vulnerability fusion table, the vulnerability description information of the first vulnerability data is obtained from the vulnerability knowledge base corresponding to the target knowledge base identifier, and a vulnerability storage record identified by the target knowledge base is created in the vulnerability fusion table based on the vulnerability description information to obtain the corresponding vulnerability fusion result.

[0038] In some embodiments, the multi-source vulnerability data fusion processing method further includes:

[0039] Determine vulnerability similarity between any vulnerability data under the first category identification and any vulnerability data under the second category identification, and obtain a corresponding similarity value;

[0040] When any of the similarity values ​​is greater than or equal to a preset second similarity threshold, a corresponding mapping relationship between the first category identifier and the second category identifier is established to determine the similar vulnerability data, and is saved in a mapping knowledge base.

[0041] To achieve the above objectives, a second aspect of the embodiments of the present disclosure provides a fusion processing device for multi-source vulnerability data, comprising:

[0042] a multi-source data acquisition module, configured to respectively acquire a plurality of vulnerability data discovered by a plurality of different approaches, wherein when the vulnerability data carries a knowledge base identifier of a corresponding vulnerability knowledge base, the vulnerability data carrying the knowledge base identifier is scanned by the corresponding approach based on any one of the plurality of vulnerability knowledge bases;

[0043] an identifier matching module, configured to sequentially perform fusion processing on each of the vulnerability data, and for a first vulnerability data currently being fused, if the first vulnerability data has a corresponding first knowledge base identifier, sequentially match the first knowledge base identifier in descending order according to a pre-arranged hierarchy of multi-level knowledge base identifiers, wherein the multi-level knowledge base identifier includes a plurality of first-category identifiers and a plurality of second-category identifiers, and the hierarchy of the first-category identifier is higher than that of the second-category identifier;

[0044] a mapping determination module configured to, when the first knowledge base identifier does not match any of the first category identifiers but matches one of the second category identifiers, determine whether there is a first category identifier having a mapping relationship with the first knowledge base identifier in a preset mapping knowledge base;

[0045] A result determination module is used to, when there is a first type of identifier with a mapping relationship with the first knowledge base identifier in the mapping knowledge base, use the first type of identifier with a mapping relationship as the target knowledge base identifier, and assign the first vulnerability data to the target knowledge base identifier to obtain the corresponding vulnerability fusion result.

[0046] To achieve the above-mentioned objectives, the third aspect of the embodiments of the present disclosure proposes an electronic device, which includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, it implements the multi-source vulnerability data fusion processing method described in the first aspect of the embodiments.

[0047] To achieve the above-mentioned objectives, the fourth aspect of the embodiments of the present disclosure proposes a storage medium, which is a computer-readable storage medium and stores a computer program. When the computer program is executed by a processor, it implements the multi-source vulnerability data fusion processing method described in the first aspect of the embodiment.

[0048] The disclosed embodiment can obtain multiple vulnerability data discovered by multiple different approaches by executing a fusion processing method for multi-source vulnerability data. When vulnerability data carries a knowledge base identifier of a corresponding vulnerability knowledge base, the vulnerability data carrying the knowledge base identifier is scanned by the corresponding approach based on any one of the multiple vulnerability knowledge bases. The vulnerability data are sequentially fused, and for the first vulnerability data currently being fused, if the first vulnerability data carries a corresponding first knowledge base identifier, the first knowledge base identifier of the first vulnerability data is matched in descending order according to a pre-arranged hierarchy of multi-level knowledge base identifiers, wherein the multi-level knowledge base identifier includes multiple first-category identifiers and multiple second-category identifiers, and the first-category identifier has a higher hierarchy than the second-category identifier. When the first knowledge base identifier does not match any of the first-category identifiers but matches one of the second-category identifiers, a determination is made in a preset mapping knowledge base whether there is a first-category identifier having a mapping relationship with the first knowledge base identifier. When a first-category identifier having a mapping relationship with the first knowledge base identifier exists in the mapping knowledge base, the first-category identifier with the mapping relationship is used as the target knowledge base identifier, and the first vulnerability data is assigned to the target knowledge base identifier to obtain a corresponding vulnerability fusion result.

[0049] In this way, after receiving multiple vulnerability data discovered through different channels, the embodiment of the present disclosure can separately fuse the various vulnerability data. In the process of processing the current first vulnerability data, if the first vulnerability data carries a corresponding first knowledge base identifier, since the embodiment of the present disclosure has pre-divided the hierarchical order of the multi-level knowledge base identifiers and limited the level of the first category identifier to be higher than the second category identifier, that is, the level of the vulnerability knowledge base corresponding to the first category identifier is higher than the vulnerability knowledge base corresponding to the second category identifier, in the process of matching the first knowledge base identifiers in descending order according to the hierarchical order of the multi-level knowledge base identifiers, it is possible to first determine whether the first vulnerability data belongs to the first category identifier, and then determine whether it belongs to the second category after it does not belong to the first category identifier. Identification, then, after the first vulnerability data belongs to the second category identification, determine whether there is a first category identification with a mapping relationship between the first knowledge base identification and the preset mapping knowledge base, so as to judge whether the first vulnerability data is the same as the vulnerability data indicated by the first category identification. Once a first category identification with a mapping relationship exists, it means that although the first vulnerability data is scanned by a lower-level vulnerability knowledge base corresponding to the second category identification, it is the same as the vulnerability data marked by the high-level vulnerability knowledge base corresponding to the first category identification. Then, in the fusion process, the first category identification with a mapping relationship can be used as the target knowledge base identification to realize the assignment of the first vulnerability data to the high-level target knowledge base identification and obtain the corresponding vulnerability fusion result.

[0050] Compared with the solutions in the related art, the embodiments of the present disclosure can divide the levels of different vulnerability knowledge bases. When there are differences in vulnerability data scanned through different paths, it can identify whether the vulnerability data scanned at a low level is the same as the vulnerability data identified under a high level, thereby effectively integrating multi-source vulnerability data, reducing the probability of false positives or omissions of vulnerability data due to significant differences in scanning results from different paths, and ultimately improving network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 Schematic diagram of an application environment of the multi-source vulnerability data fusion processing method provided by an embodiment of the present disclosure;

[0052] Figure 2 Schematic diagram of the process of fusion processing of multi-source vulnerability data provided by the embodiment of the present disclosure;

[0053] Figure 3 Schematic diagram of a fusion processing scenario of multi-source vulnerability data provided by an embodiment of the present disclosure;

[0054] Figure 4 yes Figure 2 A schematic diagram of a process flow further included after step 202;

[0055] Figure 5yes Figure 4 A schematic diagram of a process flow further included in step 302;

[0056] Figure 6 yes Figure 5 A schematic diagram of a process flow further included in step 402;

[0057] Figure 7 is a schematic diagram of a process further included after step 601 in an embodiment of the present disclosure;

[0058] Figure 8 yes Figure 2 Another flowchart further included after step 202;

[0059] Figure 9 yes Figure 2 Step 204 further includes a flow chart;

[0060] Figure 10 This is another flowchart of the method for fusion processing of multi-source vulnerability data provided by an embodiment of the present disclosure;

[0061] Figure 11 This is a schematic diagram of the functional modules of the multi-source vulnerability data fusion processing device provided by an embodiment of the present disclosure;

[0062] Figure 12 Schematic diagram of the hardware structure of the electronic device provided by the embodiment of the present disclosure. DETAILED DESCRIPTION

[0063] In order to enable those skilled in the art to better understand the solutions of the present disclosure, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without making any creative efforts shall fall within the scope of protection of the present disclosure.

[0064] It is understandable that in the specific implementation of the present disclosure, when it comes to retrieving initial time series data, initial sample time series data and related data, when the above embodiments of the present disclosure are applied to specific products or technologies, it is necessary to obtain the object's permission or consent, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards.

[0065] In addition, when the embodiments of the present disclosure need to retrieve initial time series data, initial sample time series data and related data, separate permission or separate consent for the initial time series data, initial sample time series data and related data will be obtained through pop-up windows or jumping to a confirmation page. After clearly obtaining separate permission or separate consent for the initial time series data, initial sample time series data and related data, the necessary initial time series data, initial sample time series data and related data for the normal operation of the embodiments of the present disclosure will be obtained.

[0066] In the embodiments of the present disclosure, the term "module" or "unit" refers to a computer program or portion of a computer program that has a predetermined function and works together with other related components to achieve a predetermined goal. The ... that can be implemented in whole or in part using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that includes the functionality of that module or unit.

[0067] Before further explaining the embodiments of the present disclosure in detail, the nouns and terms involved in the embodiments of the present disclosure are explained. The nouns and terms involved in the embodiments of the present disclosure are subject to the following interpretations:

[0068] Common Vulnerabilities & Exposures (CVE) is a global vulnerability dictionary project, a public list or database designed to assign unique identifiers to publicly disclosed cybersecurity vulnerabilities. It provides standardized names for various publicly known information security vulnerabilities and risks. CVE tags vulnerability data with identifiers called CVE IDs.

[0069] The China National Vulnerability Database of Information Security (CNNVD) is a national-level information security vulnerability data management platform established and maintained by my country to effectively perform vulnerability analysis and risk assessment functions. It aims to provide services for my country's information security. Vulnerability data in the CNNVD is labeled with a CNNVD ID.

[0070] The China National Vulnerability Database (CNVD) is a knowledge base for sharing information on information security vulnerabilities established in my country. Its primary goal is to enhance the country's overall research and prevention capabilities for security vulnerabilities, and to drive the development of related domestic security products. Vulnerability data in the CNVD is labeled with a CNVD ID.

[0071] With the widespread adoption of the internet and the rapid development of computer technology, information technology has permeated every aspect of society, greatly enriching and simplifying people's lives. However, network security issues have also become increasingly prominent. Cyberattacks are constantly evolving, posing a serious threat to the information security of individuals and organizations. Therefore, accurately identifying vulnerability data is crucial to improving network security, and vulnerability data scanning is currently commonly performed through various methods.

[0072] In related technologies, due to the limitations of a single approach in vulnerability scanning, scanning of multi-source vulnerability data based on multiple different approaches has gradually become a development trend. However, since different approaches have different vulnerability scanning performances and rely on different vulnerability knowledge bases or scanning methods, there are significant differences in the scanning results of multiple sources under the same network environment. For example, different vulnerability scanning tools rely on different vulnerability knowledge bases, which leads to differences in the scanned vulnerability data and makes it difficult to accurately integrate them. As a result, the vulnerability data collected from multiple sources cannot be effectively integrated, thereby increasing the probability of false positives or omissions in vulnerability data, and ultimately reducing network security.

[0073] To address the above-mentioned issues, the presently disclosed embodiments propose a method, apparatus, device, and medium for fusion processing of multi-source vulnerability data, which can effectively integrate data from multiple sources, reduce the probability of false positives or omissions in vulnerability data, and ultimately improve network security.

[0074] See also Figure 1 , Figure 1 A schematic diagram of a scenario of an implementation environment for the multi-source vulnerability data fusion processing method provided in an embodiment of the present disclosure includes: a terminal 101 and a server 102.

[0075] Exemplarily, the server 102 may obtain from the terminal 101 a plurality of vulnerability data items discovered by a plurality of different approaches, wherein, when the vulnerability data items carry a knowledge base identifier of a corresponding vulnerability knowledge base, the vulnerability data items carrying the knowledge base identifier are scanned by the corresponding approach based on any one of the plurality of vulnerability knowledge bases; each vulnerability data item is sequentially fused, and for the first vulnerability data currently being fused, if the first vulnerability data item carries a corresponding first knowledge base identifier, the first knowledge base identifier of the first vulnerability data item is matched sequentially from high to low according to a pre-arranged hierarchy of multi-level knowledge base identifiers, wherein the multi-level knowledge base identifier includes a plurality of first-category identifiers and a plurality of second-category identifiers, and the hierarchy of the first-category identifier is higher than that of the second-category identifier; when the first knowledge base identifier does not match any of the first-category identifiers but matches one of the second-category identifiers, it is determined in a preset mapping knowledge base whether there is a first-category identifier having a mapping relationship with the first knowledge base identifier; when a first-category identifier having a mapping relationship with the first knowledge base identifier exists in the mapping knowledge base, the first-category identifier having the mapping relationship is used as the target knowledge base identifier, and the first vulnerability data item is assigned to the target knowledge base identifier to obtain a corresponding vulnerability fusion result.

[0076] Terminal 101 can be a mobile phone, computer, intelligent voice interaction device, smart wearable device, smart home appliance, vehicle-mounted terminal, etc., but is not limited thereto. Terminal 101 can also independently execute the multi-source vulnerability data fusion processing method. Terminal 101 and server 102 can be directly or indirectly connected via wired or wireless communication, which is not limited in this embodiment of the present disclosure.

[0077] Server 102 can be a standalone physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. Furthermore, server 102 can be a node server in a blockchain network.

[0078] It should be noted that Figure 1 The scenario diagram of the implementation environment of the multi-source vulnerability data fusion processing method shown is merely an example. The scenario described in the embodiment of the present disclosure is intended to more clearly illustrate the technical solution of the embodiment of the present disclosure and does not constitute a limitation on the technical solution provided by the embodiment of the present disclosure. Persons skilled in the art will appreciate that with the evolution of technology and the emergence of new business scenarios, the technical solution provided by the embodiment of the present disclosure is equally applicable to similar technical problems.

[0079] See also Figure 2 , Figure 2 This is a flow chart of a method for fusing and processing multi-source vulnerability data provided by an embodiment of the present disclosure. This method for fusing and processing multi-source vulnerability data can be applied to the server in the above embodiment, or performed jointly by a terminal and a server. The method for fusing and processing multi-source vulnerability data includes steps 201 to 204:

[0080] Step 201, respectively obtaining a plurality of vulnerability data discovered by a plurality of different channels;

[0081] Wherein, when the vulnerability data carries a knowledge base identifier of a corresponding vulnerability knowledge base, the vulnerability data carrying the knowledge base identifier is scanned by the corresponding approach based on any one of the multiple vulnerability knowledge bases;

[0082] Step 202: Each vulnerability data is sequentially fused. For the first vulnerability data currently being fused, if the first vulnerability data has a corresponding first knowledge base identifier, the first knowledge base identifier is matched sequentially in descending order according to the pre-arranged hierarchy of the multi-level knowledge base identifiers.

[0083] The multi-level knowledge base identification includes multiple first-class identifications and multiple second-class identifications, and the first-class identification has a higher level than the second-class identification;

[0084] Step 203: When the first knowledge base identifier does not match any of the first category identifiers but matches one of the second category identifiers, determine in a preset mapping knowledge base whether there is a first category identifier having a mapping relationship with the first knowledge base identifier;

[0085] In step 204, when there is a first type identifier with a mapping relationship with the first knowledge base identifier in the mapping knowledge base, the first type identifier with the mapping relationship is used as the target knowledge base identifier, and the first vulnerability data is assigned to the target knowledge base identifier to obtain a corresponding vulnerability fusion result.

[0086] For the above step 201, there can be multiple approaches, such as penetration testing, static and dynamic analysis, network traffic analysis, vulnerability information exchange platform, vulnerability scanning tools, etc. The subsequent embodiments of this disclosure use the vulnerability scanning tool as an example to illustrate the approach, but this does not constitute a limitation on the approach.

[0087] A vulnerability scanning tool is a software tool used to detect security vulnerabilities in computer systems, network devices, or applications. Different vulnerability scanning tools may use different scanning techniques and algorithms to discover various types of vulnerabilities. A vulnerability knowledge base is a database that stores information on various known security vulnerabilities, including detailed descriptions of the vulnerabilities, the scope of impact, and repair suggestions. Different vulnerability scanning tools may rely on different vulnerability knowledge bases for vulnerability detection. Vulnerability data is the relevant information about security vulnerabilities in the system or application discovered by the vulnerability scanning tool during the scanning process. The knowledge base identifier is a symbol or number used to uniquely identify each vulnerability knowledge base. The knowledge base identifier can be used to distinguish between different vulnerability knowledge bases on which the vulnerability data depends, facilitating the subsequent classification and processing of the vulnerability data.

[0088] It's important to note that in the field of network security, a single vulnerability scanning tool has limitations, as different tools may focus on different types of vulnerabilities or use different detection methods. By using multiple vulnerability scanning tools, a more comprehensive approach to discovering security vulnerabilities in the system can be achieved. Each vulnerability scanning tool performs its scans based on a different vulnerability knowledge base, and the acquired vulnerability data is labeled with the corresponding knowledge base. This approach provides a clear understanding of the knowledge base used to discover each vulnerability during subsequent vulnerability data processing, providing a basis for subsequent fusion processing.

[0089] For example, suppose three different vulnerability scanning tools are used to scan the terminal system for vulnerabilities, such as tool A, tool B, and tool C. Tool A scans based on the vulnerability knowledge base K1 and finds vulnerability a in the system. The vulnerability data will be marked with the knowledge base identifier K1; Tool B scans based on the vulnerability knowledge base K2 and detects vulnerability b in the system. The vulnerability data will be marked with the knowledge base identifier K2; Tool C scans based on the vulnerability knowledge base K3 and finds vulnerability c in the system. Its vulnerability data is marked with the knowledge base identifier K3.

[0090] It should be noted that each vulnerability scanning tool can deploy different vulnerability knowledge bases to perform vulnerability scanning based on actual needs, and the same vulnerability scanning tool can also perform vulnerability scanning based on multiple different vulnerability knowledge bases. The embodiments of the present disclosure are not limited to the scanning form and content of the vulnerability scanning tool. When the vulnerability data carries the knowledge base identifier of the corresponding vulnerability knowledge base, it means that the vulnerability data is a standard vulnerability scanned by a certain path based on the corresponding vulnerability knowledge base, such as a vulnerability scanned by a certain vulnerability scanning tool based on the corresponding vulnerability knowledge base.

[0091] With respect to the above-mentioned step 202, the first vulnerability data is the specific vulnerability data currently being processed when multiple vulnerability data are fused and processed, and it is the current operation object in the entire fusion processing flow. The first knowledge base identifier is the knowledge base identifier of the corresponding vulnerability knowledge base carried by the first vulnerability data, which is used to indicate which vulnerability knowledge base the vulnerability data is scanned from. It should be noted that the embodiment of the present disclosure can perform fusion processing on each vulnerability data in turn, and each processed vulnerability data can be used as the first vulnerability data, and after identifying that the first vulnerability data carries the corresponding first knowledge base identifier, the first knowledge base identifier of the first vulnerability data is matched in descending order according to the hierarchical order of the pre-arranged multi-level knowledge base identifiers.

[0092] Multi-level knowledge base identification aims to more effectively process the results of different vulnerability scanning tools based on different vulnerability knowledge bases. All relevant knowledge base identifications are pre-classified and arranged, forming a multi-level knowledge base identification system. First- and second-level identifications are two different levels within the multi-level knowledge base identification system. There are multiple first- and second-level identifications. First-level identifications correspond to higher-level vulnerability knowledge bases and have a higher priority in vulnerability data fusion processing. Second-level identifications correspond to lower-level vulnerability knowledge bases.

[0093] It should be noted that different vulnerability scanning tools rely on different vulnerability knowledge bases, which may have different authority, accuracy, and coverage. By dividing the hierarchical order of multi-level knowledge base identifiers and matching the knowledge base identifiers of vulnerability data in descending order, vulnerability data can be preferentially associated with high-level knowledge bases. The advantage of doing this is that vulnerability data can be classified and integrated more accurately, because high-level knowledge bases tend to have higher authority and accuracy. If a vulnerability data can match a high-level first-category identifier, it can be classified into the category corresponding to the high-level knowledge base, improving the accuracy and reliability of vulnerability data classification.

[0094] For example, taking the vulnerability data scanned based on CVE, CNNVD and CNVD as an example, the CVE ID, CNNVD ID and CNVD ID constitute a multi-level knowledge base identifier. Among them, since CVE is more widely used and more authoritative internationally, multiple identifiers under CVE can be defined as first-class identifiers, that is, all CVE IDs are first-class identifiers, and multiple identifiers under CNNVD and CNVD are defined as second-class identifiers, that is, all CNNVD IDs and CNVD IDs are second-class identifiers.

[0095] It should be noted that, in addition to the CVE, CNNVD and CNVD examples mentioned above, when the vulnerability data in the embodiments of the present disclosure are scanned based on other vulnerability knowledge bases, the embodiments of the present disclosure can select one or more of the multiple vulnerability knowledge bases that are more universal, unique, efficient and compatible as high-level knowledge bases, and use the identifiers under the high-level knowledge bases as first-class identifiers. On the contrary, the remaining knowledge bases are determined as low-level knowledge bases, and the identifiers under the low-level knowledge bases are all used as second-class identifiers to ensure that the vulnerability fusion is comprehensive, accurate and efficient. The embodiments of the present disclosure do not impose specific restrictions on this.

[0096] With respect to the above-mentioned step 203, the mapping knowledge base is a pre-set knowledge base that records the mapping relationship between different vulnerability knowledge base identifiers. Specifically, in the mapping knowledge base of the embodiment of the present disclosure, the mapping relationship between the second-class identifier and the first-class identifier is stored, which is used to determine whether the vulnerability data scanned by the second-class identifier is associated with the high-level vulnerability data represented by the first-class identifier. When there is a mapping relationship between a second-class identifier stored in the mapping knowledge base and a first-class identifier, it indicates that the vulnerabilities corresponding to the two are actually the same vulnerability data, but because the vulnerability knowledge bases they rely on are different, the identifiers are different, resulting in significant differences in the scanning results of different vulnerability scanning tools even for the same vulnerability data. Furthermore, the mapping knowledge base can also store the corresponding relationships between other knowledge base identifiers, that is, the mapping knowledge base is used to store the same vulnerability data but with mapping relationships between multiple different knowledge base identifiers.

[0097] When the disclosed embodiment matches the first knowledge base identifier of the first vulnerability data, it is found that it does not match any first-category identifier, but matches a second-category identifier. In other words, the first vulnerability data currently being processed was obtained by scanning the vulnerability knowledge base corresponding to a lower-level second-category identifier. After the above prerequisites are met, the disclosed embodiment will search the preset mapping knowledge base to see whether there is a first-category identifier that has a mapping relationship with the first knowledge base identifier. By searching the mapping knowledge base, it can be determined whether the vulnerability data scanned by the lower-level second-category knowledge base is essentially the same vulnerability as the vulnerability scanned by the higher-level first-category knowledge base.

[0098] It should be noted that different vulnerability scanning tools rely on different vulnerability knowledge bases, which have different coverage and focus. Although the vulnerability knowledge base corresponding to the first-level identification is higher-level and more authoritative, some vulnerability scanning tools do not necessarily perform vulnerability scans based on high-level vulnerability knowledge bases. Therefore, vulnerability data may be scanned in the vulnerability knowledge base corresponding to the lower-level second-level identification, resulting in the knowledge base identification carried by the vulnerability data belonging to the second-level identification. Through the preset mapping knowledge base, it is possible to find out whether the vulnerability data scanned in the low-level vulnerability knowledge base has a potential association with the vulnerability data marked in the high-level vulnerability knowledge base. Doing so helps to accurately classify vulnerability data that originally belonged to the high-level knowledge base but was scanned by the low-level knowledge base into the high-level knowledge base when fusing multi-source vulnerability data, thereby improving the integration effect of vulnerability data, reducing the probability of false positives and missed negatives, and improving the accuracy of network security assessments.

[0099] For the above step 204, in the preset mapping knowledge base, the first type of identifier that has a mapping relationship with the first knowledge base identifier of the current first vulnerability data is called the target knowledge base identifier. It is the final attribution identifier determined for the vulnerability data when processing vulnerability data fusion, and is used to accurately assign the vulnerability data to the corresponding high-level vulnerability knowledge base category.

[0100] When a first-category identifier having a mapping relationship with a first knowledge base identifier is found in a preset mapping knowledge base, this first-category identifier is determined as a target knowledge base identifier in the embodiment of the present disclosure, and then the first vulnerability data currently being processed is assigned to the category corresponding to this target knowledge base identifier, thereby obtaining a vulnerability fusion result after fusion processing.

[0101] It should be noted that because different vulnerability scanning tools rely on different vulnerability knowledge bases, their scanning results may vary. The previous steps have determined that some vulnerability data scanned by low-level vulnerability knowledge bases is actually identical to vulnerability data marked by higher-level vulnerability knowledge bases. In this step, vulnerability data scanned by these low-level knowledge bases is reassigned to the higher-level target knowledge base. This allows all vulnerability data to be classified and managed in a more accurate and reasonable manner, thereby improving the quality and usability of vulnerability data and providing a more reliable basis for subsequent network security analysis and decision-making.

[0102] Furthermore, in the embodiment of the present disclosure, a vulnerability fusion table can be established and maintained, and the vulnerability fusion table can store each vulnerability data after determining the corresponding target knowledge base identifier, and the vulnerability fusion result finally formed. Specifically, the embodiment of the present disclosure can also record the vulnerability scanning tool corresponding to the first vulnerability data in the vulnerability fusion table, that is, under each knowledge base identifier in the vulnerability fusion table, the corresponding vulnerability scanning tool can be marked, so that by looking up the table, it can be known which vulnerability scanning tools have scanned the vulnerability data under different knowledge base identifiers, thereby facilitating subsequent network security analysis. The embodiment of the present disclosure does not impose any specific restrictions on this.

[0103] The following examples illustrate the embodiments of the present disclosure with reference to specific application scenarios:

[0104] See also Figure 3 , Figure 3 Schematic diagram of a fusion processing scenario for multi-source vulnerability data provided by an embodiment of the present disclosure. In this embodiment, three vulnerability scanning tools are provided: Tool A, Tool B, and Tool C. Tool A relies on CVE for vulnerability scanning and obtains vulnerability a (vulnerability data), Tool B relies on CNNVD for vulnerability scanning and obtains vulnerability b (vulnerability data), and Tool C relies on CNVD for vulnerability scanning and obtains vulnerability c (vulnerability data). Each vulnerability data item is accompanied by a corresponding knowledge base identifier. After all three tools send the collected vulnerability data to the fusion processing system for multi-source vulnerability data, the fusion processing system for multi-source vulnerability data can implement the fusion processing process for multi-source vulnerability data by executing the fusion processing method for multi-source vulnerability data in the above embodiment.

[0105] Specifically, the fusion processing system of multi-source vulnerability data matches each vulnerability data in the order of CVE ID to CNNVD ID or CNVD ID, and finds that the three vulnerability data are indeed scanned by different vulnerability scanning tools under different vulnerability knowledge bases. However, by finding in the mapping knowledge base that vulnerability b and vulnerability a are the same vulnerability, therefore, in the end, under the CVE ID corresponding to vulnerability a, vulnerability a and vulnerability b scanned by tool A and tool B respectively can be recorded, that is, the vulnerability under the CVE ID is marked as being scanned by tool A and tool B, and the CNVD ID corresponding to vulnerability c records vulnerability c scanned by tool C.

[0106] In summary, the embodiment of the present disclosure executes the fusion processing method of multi-source vulnerability data in steps 201 to 204. After receiving multiple vulnerability data discovered by different channels, each vulnerability data can be fused and processed separately. In the process of processing the current first vulnerability data, if the first vulnerability data has a corresponding first knowledge base identifier, since the embodiment of the present disclosure pre-divides the hierarchical order of the multi-level knowledge base identifiers and limits the level of the first category identifier to be higher than the second category identifier, that is, the level of the vulnerability knowledge base corresponding to the first category identifier is higher than the vulnerability knowledge base corresponding to the second category identifier, in the process of matching the first knowledge base identifiers in descending order according to the hierarchical order of the multi-level knowledge base identifiers, it is possible to first determine whether the first vulnerability data belongs to the first category identifier, and then, if it does not belong to the first category identifier, After the first category identification, it is determined whether it belongs to the second category identification. Then, after the first vulnerability data belongs to the second category identification, it is determined in the preset mapping knowledge base whether there is a first category identification with a mapping relationship between the first knowledge base identification and the first category identification, so as to determine whether the first vulnerability data is the same as the vulnerability data indicated by the first category identification. If a first category identification with a mapping relationship exists, it means that although the first vulnerability data is scanned by the vulnerability knowledge base with a lower level corresponding to the second category identification, it is the same as the vulnerability data marked by the high-level vulnerability knowledge base corresponding to the first category identification. Then, in the fusion process, the first category identification with a mapping relationship can be used as the target knowledge base identification to achieve the assignment of the first vulnerability data to the high-level target knowledge base identification and obtain the corresponding vulnerability fusion result. Compared with the solutions in the related art, the embodiment of the present disclosure can divide the levels of different vulnerability knowledge bases. When there are differences in vulnerability data scanned by different channels, it can identify whether the vulnerability data scanned by the low level is the same as the vulnerability data under the high level identification, thereby effectively integrating multi-source vulnerability data, reducing the probability of false positives or false negatives of vulnerability data caused by significant differences in the scanning results of different channels, and ultimately improving network security.

[0107] Next, the contents further included in step 201 to step 204 in the embodiment of the present disclosure are described in detail.

[0108] See also Figure 4 , Figure 4 yes Figure 2 In some embodiments, after fusing each vulnerability data in sequence and targeting the first vulnerability data currently being fused, the multi-source vulnerability data fusing method may include steps 301 to 303:

[0109] Step 301: if the first vulnerability data does not have a corresponding first knowledge base identifier, obtain multiple second vulnerability data from a preset vulnerability fusion table;

[0110] The second knowledge base identifier of the second vulnerability data does not belong to the first category identifier, nor does it belong to the second category identifier;

[0111] Step 302: determining vulnerability similarities between the first vulnerability data and each second vulnerability data, and obtaining corresponding similarity values;

[0112] In step 303, when any similarity value is greater than or equal to a preset first similarity threshold, the second knowledge base identifier of the similar second vulnerability data is determined as the target knowledge base identifier, and the first vulnerability data is assigned to the target knowledge base identifier to obtain a corresponding vulnerability fusion result.

[0113] In the above steps, the second vulnerability data is obtained from the preset vulnerability fusion table. Its characteristic is that the second knowledge base identifier corresponding to this vulnerability data belongs to neither the first nor the second category. Like the first vulnerability data currently being processed, this second vulnerability data is a type of vulnerability data used for subsequent comparison and analysis. The second knowledge base identifier is the corresponding knowledge base identifier carried by the second vulnerability data, indicating which specific vulnerability knowledge base the vulnerability data was scanned from.

[0114] It should be noted that if the first vulnerability data does not have a corresponding first knowledge base identifier, indicating that the vulnerability data was not scanned based on the vulnerability knowledge base in any way, then the first vulnerability data is a non-standard vulnerability. In this case, in order to more comprehensively integrate the vulnerability data, it is necessary to refer to other vulnerability data that has been integrated and whose knowledge base identifiers do not fall into the two categories. By comparing the similarities between them, the reasonable attribution of the first vulnerability data can be determined, thereby more accurately integrating the vulnerability data.

[0115] Vulnerability similarity is a metric used to measure the degree of similarity between a first vulnerability data set and each second vulnerability data set. By calculating vulnerability similarity, we can determine the similarities between these vulnerability data sets in multiple aspects, thereby determining whether they belong to the same category or the same vulnerability. The similarity value is a specific numerical value that represents vulnerability similarity. It is calculated using a specific algorithm or method. A larger value indicates a higher degree of similarity between the two vulnerability data sets.

[0116] The preset first similarity threshold is a pre-set value used as a criterion for determining whether the first vulnerability data and the second vulnerability data are sufficiently similar. If the calculated similarity value is greater than or equal to the threshold, the two vulnerability data are considered to have a high degree of similarity and can be classified into the same category.

[0117] It should be noted that after obtaining the similarity values ​​between the first vulnerability data and each second vulnerability data, the embodiment of the present disclosure needs a standard to determine whether these similarities are high enough to determine whether the first vulnerability data and a certain second vulnerability data are classified into the same category. The preset first similarity threshold is such a standard. When a certain similarity value is greater than or equal to the threshold, it means that the first vulnerability data and the corresponding second vulnerability data are very similar, and they are likely to be of the same type or the same vulnerability. Therefore, the second knowledge base identifier of the similar second vulnerability data is determined as the target knowledge base identifier, and the first vulnerability data is assigned to this identifier. Conversely, when any similarity value is less than the first similarity threshold, it means that there is no second vulnerability data similar to the first vulnerability data. In this case, the embodiment of the present disclosure can configure a corresponding custom identifier for the first vulnerability data to distinguish it from other vulnerability data in the vulnerability fusion table, and use the custom identifier as the target knowledge base identifier to assign the first vulnerability data to this identifier. Based on this, further effective integration of vulnerability data can be achieved, and the accuracy and rationality of vulnerability data management can be improved.

[0118] For example, taking vulnerability data scanned based on CVE, CNNVD, and CNVD as an example, the CVE ID, CNNVD ID, and CNVD ID constitute a multi-level knowledge base identifier, wherein multiple identifiers under CVE are defined as first-class identifiers, while multiple identifiers under CNNVD and CNVD are defined as second-class identifiers. When the first knowledge base identifier does not match any CVE ID, and the first knowledge base identifier does not match any CNNVD ID or CNVD ID, it indicates that the vulnerability is a non-standard vulnerability identified by other means, such as a non-standard vulnerability identified through penetration testing, static analysis, dynamic analysis, etc. Therefore, the disclosed embodiment calculates the similarity value between the current non-standard vulnerability and other non-standard vulnerabilities (i.e., non-CVE, non-CNNVD, non-CNVD records) in the vulnerability fusion table. Subsequently, based on whether the similarity value reaches or exceeds a preset threshold, it is decided to add the vulnerability to the vulnerability fusion table or update and modify the relevant fields such as the vulnerability scanning tool of the corresponding vulnerability record in the vulnerability fusion table.

[0119] Therefore, the embodiments of the present disclosure can systematically process scanning results from different channels, especially different vulnerability scanning tools, and realize the effective fusion of scanning results from different channels in the same network environment. This fusion process not only integrates multiple vulnerability information sources, but also significantly reduces the risk of underreporting due to differences in channels, thereby providing a more comprehensive and accurate basis for the assessment of network security status.

[0120] See also Figure 5 , Figure 5 yes Figure 4In some embodiments, the process of determining the vulnerability similarity between the first vulnerability data and each second vulnerability data and obtaining the corresponding similarity value may include steps 401 to 403:

[0121] Step 401: determining vulnerability attributes of multiple different attribute types under the first vulnerability data and the second vulnerability data, and configuring corresponding similarity algorithms for different attribute types;

[0122] Step 402: For each of the first vulnerability data and each of the second vulnerability data, the attribute similarities between vulnerability attributes of the same attribute type are determined in sequence using a corresponding similarity algorithm to obtain sub-similarity values ​​of multiple attribute types.

[0123] Step 403 : Based on the weights of the various attribute types, a weighted calculation is performed on the multiple sub-similarity values ​​to obtain a similarity value between the first vulnerability data and each second vulnerability data.

[0124] In the above steps, vulnerability attributes are the various characteristic information contained in vulnerability data. Different vulnerability attributes can describe the characteristics of the vulnerability from different perspectives. Attribute types categorize vulnerability attributes. For example, based on the technical characteristics of the vulnerability, it can be divided into attribute types such as code execution and information leakage; based on the impact of the vulnerability, it can be divided into attribute types such as severe, moderate, and mild; and based on the type of attribute, it can be divided into component name, component version range, vulnerability description, remediation suggestions, vulnerability type, exploitation method, and impact range. A similarity algorithm is a method or formula used to calculate the similarity between two vulnerability data sets under a specific attribute type. Different attribute types may require different similarity algorithms.

[0125] It's important to note that to accurately calculate the similarity between the first vulnerability data and each second vulnerability data set, multiple comparisons are required. By determining vulnerability attributes for different attribute types, we can gain a comprehensive understanding of vulnerability characteristics. Because different attribute types have distinct characteristics and measurement criteria, using a unified algorithm may not accurately reflect the degree of similarity between vulnerabilities. However, configuring a similarity algorithm tailored to each attribute type allows us to select the most appropriate calculation method based on the attributes' characteristics, thereby improving the accuracy and reliability of similarity calculations.

[0126] Attribute similarity is a numerical representation of the degree of similarity between the corresponding vulnerability attributes of the first and second vulnerability data under a specific attribute type. For example, under the attribute type of vulnerability, the attribute similarity of two vulnerabilities is the result of determining whether their vulnerability types are the same. Sub-similarity values ​​refer to the specific numerical values ​​of attribute similarity calculated under each attribute type. By sequentially calculating the attribute similarity between vulnerability attributes under the same attribute type, multiple sub-similarity values ​​can be obtained. These sub-similarity values ​​reflect the similarity between the two vulnerabilities from different perspectives and provide the basis for the subsequent comprehensive calculation of overall similarity.

[0127] Weight is a numerical value set for each attribute type, which is used to indicate the importance of the attribute type in the comprehensive similarity calculation. Different attribute types may have different importance in judging the similarity of vulnerabilities. For example, in some cases, the vulnerability type may be more important than the discovery time, so the weight of the vulnerability type can be set higher.

[0128] It should be noted that, since different attribute types have different degrees of importance in determining vulnerability similarity, simply adding or averaging the sub-similarity values ​​may not accurately reflect the actual similarity between the two vulnerabilities. The disclosed embodiment performs a weighted calculation on multiple sub-similarity values ​​based on the weights under each attribute type to obtain a similarity value between the first vulnerability data and each second vulnerability data. In this way, by setting a weight for each attribute type and performing a weighted calculation on multiple sub-similarity values, they can be reasonably integrated according to the importance of the attributes, thereby obtaining a more accurate similarity value that better reflects the true similarity between the vulnerabilities, providing a more reliable basis for subsequently determining the ownership of the vulnerability data.

[0129] In the embodiments of the present disclosure, the attribute types are component name, component version, vulnerability description, repair suggestion, vulnerability type, exploitation method, and impact range as examples. The component name refers to the specific name of the software component with the vulnerability, which is used to clearly indicate the specific part where the problem lies, such as a specific software library, module or application; the component version is the version number of the component that indicates the vulnerability. Different versions of components may have different characteristics and code logic. Clarifying the version number helps to accurately locate and distinguish problems in different versions; the vulnerability description is a detailed description of the specific situation of the vulnerability, including how the vulnerability is discovered, the manifestation of the vulnerability, the possible consequences, etc., so that relevant personnel can clearly understand the nature and harm of the vulnerability; repair suggestion It is a specific solution and measure proposed for the vulnerability, guiding technical personnel on how to repair the vulnerability to eliminate security risks; vulnerability type is to classify the vulnerability, such as common injection vulnerabilities, out-of-bounds access vulnerabilities, code execution vulnerabilities, etc., which helps to understand the nature and characteristics of the vulnerability from a macro perspective so as to adopt corresponding prevention and repair strategies; exploitation method is to describe the specific methods and ways that malicious attackers may exploit the vulnerability. Understanding the exploitation method can help security personnel better assess risks and take targeted protective measures; impact scope is to clarify the scope of systems, applications, business functions, etc. that the vulnerability may affect, and help relevant personnel comprehensively assess the degree of harm of the vulnerability so as to determine the priority of repair and take corresponding emergency measures.

[0130] See also Figure 6 , Figure 6 yes Figure 5 In some embodiments, the process of sequentially determining the attribute similarities between vulnerability attributes under the same attribute type and obtaining sub-similarity under multiple attribute types may include steps 501 to 507:

[0131] Step 501: Calculate the edit distance and the first Jaccard similarity value between vulnerability attributes whose attribute type is component name, and determine the sub-similarity value under the component name by combining the edit distance and the first Jaccard similarity value;

[0132] Step 502: Calculate the hierarchical version split vector and the first cosine similarity value between vulnerability attributes whose attribute type is component version, and determine the sub-similarity value under the component version by combining the hierarchical version split vector and the first cosine similarity value;

[0133] Step 503: Calculate the first domain enhanced semantic vector feature and the second cosine similarity value between vulnerability attributes whose attribute type is vulnerability description, and determine the sub-similarity value under the vulnerability description by combining the first domain enhanced semantic vector feature and the second cosine similarity value;

[0134] Step 504: Calculate the action and object semantic role labeling results and the third cosine similarity value between vulnerability attributes whose attribute type is repair suggestion, and determine the sub-similarity value under the repair suggestion by combining the labeling results and the third cosine similarity value;

[0135] Step 505: Calculate the classification tree path distance or the second domain enhanced semantic vector feature between vulnerability attributes whose attribute type is vulnerability type, and determine the sub-similarity value under the vulnerability type by combining the classification tree path distance or the second domain enhanced semantic vector feature;

[0136] Step 506: Calculate the TF-IDF vector features and the fourth cosine similarity between the vulnerability attributes whose attribute type is exploitation method, and determine the sub-similarity value under the exploitation method by combining the TF-IDF vector features and the fourth cosine similarity.

[0137] Step 507 : Calculate the second Jaccard similarity value of the asset type between the vulnerability attributes whose attribute type is the impact range, and determine the sub-similarity value under the impact range based on the second Jaccard similarity value.

[0138] In the above steps, the edit distance refers to the minimum number of editing operations (insertion, deletion, replacement) required to convert one string into another. When comparing component names, the edit distance can measure the degree of difference between two component names. The first Jaccard similarity value is used to measure the similarity between two sets. The calculation formula is the number of elements in the intersection of the two sets divided by the number of elements in the union. For component names, they can be split into character sets to calculate the Jaccard similarity. It should be noted that component names are an important attribute of the vulnerability, and a single measurement method may not accurately reflect its similarity. Therefore, the edit distance focuses on the differences at the character level, and the Jaccard similarity focuses on the overlap of set elements. Combining the two can more comprehensively and accurately determine the similarity of component names.

[0139] Hierarchical version split vectors break down component version numbers into vectors by level (e.g., major, minor, and revision numbers), facilitating mathematical calculations and comparisons. The first cosine similarity value measures the cosine of the angle between two vectors. Values ​​closer to 1 indicate greater similarity. When comparing component versions, the cosine similarity of the hierarchical version split vectors is calculated to determine the similarity between versions. It should be noted that component version similarity is crucial for determining whether vulnerabilities are identical or related. The hierarchical version split vector clearly represents information at each level of the version, while cosine similarity quantifies the similarity between versions. Combining these two values ​​can more accurately determine the sub-similarity value of component versions.

[0140] The first domain-enhanced (SBERT) semantic vector feature performs semantic analysis on vulnerability descriptions in the cybersecurity field, converting them into vector form and enhancing them with domain knowledge to better represent the semantic information of vulnerability descriptions. The second cosine similarity value also measures the cosine value of the angle between two vectors. Here, it is used to compare the similarity between the first domain-enhanced semantic vector features of two vulnerability descriptions. It should be noted that vulnerability descriptions often contain detailed information, and ordinary text matching cannot accurately determine their similarity. The domain-enhanced semantic vector feature can capture the semantic information of vulnerability descriptions. Combined with cosine similarity, the similarity between two vulnerability descriptions can be more accurately measured.

[0141] The action and object semantic role labeling results are semantic role labels for the actions (such as update and delete) and objects (such as components and files) in the fix suggestion, clarifying the semantic roles of each component in the sentence. The third cosine similarity value is used to compare the similarity between the action and object semantic role labeling result vectors of two fix suggestions. It should be noted that the similarity of fix suggestions can reflect the similarity of vulnerabilities. Action and object semantic role labeling can extract key semantic information about the fix suggestions. Combined with cosine similarity, the similarity of the fix suggestions can be more accurately determined.

[0142] The path distance in a classification tree (such as the CWE classification tree) is the shortest path length between two vulnerability type nodes in the vulnerability type classification tree. The shorter the path distance (shortest common ancestor distance), the more similar the two vulnerability types are. The second domain enhanced semantic vector feature is similar to the first domain enhanced semantic vector feature. It is a vector representation of the vulnerability type that is enhanced by semantic analysis and domain knowledge. It is important to note that vulnerability type is an important basis for determining vulnerability similarity. The classification tree path distance measures vulnerability type similarity structurally, while the second domain enhanced semantic vector feature measures similarity semantically. Combining the two can more comprehensively and accurately determine the sub-similarity value of vulnerability types.

[0143] TF-IDF (Term Frequency-Inverse Document Frequency) is a commonly used weighting technique for information retrieval and text mining. It converts exploit text into TF-IDF vector features to represent the importance of each word in the text. The fourth cosine similarity value is used to compare the similarity between the TF-IDF vector features of two exploits. It is important to note that exploits describe how attackers exploit vulnerabilities, and their similarity is important for determining vulnerability relevance. TF-IDF vector features can highlight important words in exploit text. Combined with cosine similarity, this allows for a more accurate assessment of exploit similarity.

[0144] The second Jaccard similarity value also measures the similarity between two sets. Here, it is used to compare asset type sets within two impact scopes. It should be noted that the asset type within the impact scope is a key factor in determining vulnerability similarity. By calculating the Jaccard similarity of the asset type, we can directly measure the similarity between the two impact scopes and thus determine the sub-similarity values ​​within the impact scopes.

[0145] When calculating the sub-similarity values ​​under each attribute type, all sub-similarity values ​​need to be mapped to the range of 0 to 1. The embodiment of the present disclosure calculates the sub-similarity values ​​under these attribute types to comprehensively evaluate the similarity between vulnerability data from multiple dimensions, providing a detailed and accurate basis for the fusion of multi-source vulnerability data, helping to improve the integration effect of vulnerability data, reduce the probability of false positives and missed negatives, and improve the accuracy of network security assessment.

[0146] Furthermore, based on the importance of related attributes, we assign corresponding weights to different vulnerability attribute types, and then calculate the overall similarity by weighted average to obtain the similarity value between each vulnerability data. The similarity value calculation formula is: Similarity=0.20*Sim 组件名称 +0.15*Sim 组件版本 +0.20*Sim 漏洞描述 +0.15*Sim 修复建议 +0.10*Sim 漏洞类型 +0.10*Sim 利用方式 +0.10*Sim 影响范围 , where each Sim value is the sub-similarity value under each attribute type calculated in the above embodiment.

[0147] Through the above method, the similarity value between the current first vulnerability data and the vulnerability data of the non-standard record in the vulnerability fusion table, that is, the second vulnerability data, is calculated, which is also called the overall similarity between the two vulnerability data. If the overall similarity is greater than or equal to the set threshold, such as greater than or equal to 0.75, the second knowledge base identifier of the similar second vulnerability data is determined as the target knowledge base identifier, and the first vulnerability data is assigned to the target knowledge base identifier to obtain the corresponding vulnerability fusion result; conversely, if the overall similarity is less than the threshold, such as less than 0.75, a new vulnerability record is created according to the vulnerability details and the unified vulnerability description format, and saved in the vulnerability fusion table.

[0148] In some embodiments, after determining whether there is a first type identifier having a mapping relationship with the first knowledge base identifier in a preset mapping knowledge base, the multi-source vulnerability data fusion processing method may further include step 601:

[0149] Step 601: When there is no first-category identifier with a mapping relationship with the first knowledge base identifier in the mapping knowledge base, the second-category identifier matching the first knowledge base identifier is used as the target knowledge base identifier, and the first vulnerability data is assigned to the target knowledge base identifier to obtain the corresponding vulnerability fusion result.

[0150] It should be noted that during the multi-source vulnerability data fusion process, when matching the first knowledge base identifier of the first vulnerability data, it is found that it does not match any first-category identifier, and no first-category identifier with a mapping relationship with the first knowledge base identifier can be found in the mapping knowledge base. This means that the first vulnerability data currently being processed was obtained by scanning the vulnerability knowledge base corresponding to a low-level second-category identifier, and this vulnerability data has no association with the vulnerability data represented by the high-level first-category identifier. In this case, in order to reasonably classify and manage vulnerability data, it needs to be assigned to the appropriate knowledge base identifier.

[0151] Since it is impossible to classify it under the high-level first-category identifier at this time, the embodiment of the present disclosure uses the second-category identifier that matches the first knowledge base identifier as the target knowledge base identifier, and assigns the first vulnerability data to this target knowledge base identifier. This allows the vulnerability data to be effectively integrated, ensuring that each vulnerability data has a reasonable attribution, facilitating subsequent network security analysis and processing, and improving the availability and management efficiency of vulnerability data.

[0152] Furthermore, the multiple second-category identifications in the embodiment of the present disclosure include multiple second-category identifications under the first vulnerability knowledge base, and multiple second-category identifications under the second vulnerability knowledge base at the same level as the first vulnerability knowledge base. The first vulnerability knowledge base and the second vulnerability knowledge base both belong to low-level vulnerability knowledge bases. In this embodiment, when the high-level vulnerability knowledge base is CVE, the first vulnerability knowledge base is one of CNNVD and CNVD, and the second vulnerability knowledge base is the other one of CNNVD and CNVD. The division of the first vulnerability knowledge base and the second vulnerability knowledge base can be carried out according to actual needs, and the embodiment of the present disclosure does not impose specific restrictions on this.

[0153] See also Figure 7 , Figure 7 This is a flow chart of the steps further included after step 601 in the embodiment of the present disclosure. In some embodiments, after determining whether there is a first type of identifier that has a mapping relationship with the first knowledge base identifier in the preset mapping knowledge base, the multi-source vulnerability data fusion processing method may further include steps 701 to 702:

[0154] Step 701: When a first knowledge base identifier matches a second category identifier under one of the first vulnerability knowledge bases, it is determined in the mapping knowledge base whether there is a second category identifier under a second vulnerability knowledge base that has a mapping relationship with the first knowledge base identifier.

[0155] In step 702, when there is a second category identifier under a second vulnerability knowledge base having a mapping relationship with the first knowledge base identifier in the mapping knowledge base, the second category identifier under the second vulnerability knowledge base having the mapping relationship is used as the target knowledge base identifier, and the first vulnerability data is assigned to the target knowledge base identifier to obtain the corresponding vulnerability fusion result.

[0156] In the above steps, during the multi-source vulnerability data fusion process, when it is determined that the first knowledge base identifier does not match any first-category identifier, and no first-category identifier with a mapping relationship exists in the mapping knowledge base, the first vulnerability data is assigned to the second-category identifier (belonging to a lower-level knowledge base identifier) ​​that matches the first knowledge base identifier. However, due to the existence of multiple lower-level vulnerability knowledge bases (such as CNNVD and CNVD), some vulnerability data within these lower-level knowledge bases may be essentially identical, differing only in identifiers due to the different knowledge bases they rely on. Therefore, to further accurately integrate vulnerability data, it is necessary to determine whether the second-category identifier of the first vulnerability knowledge base to which the first vulnerability data matches has a mapping relationship with the second-category identifier of the second vulnerability knowledge base of the same level. This allows for more reasonable categorization of identical vulnerability data, improves vulnerability data integration, and avoids false positives or negatives due to differences between lower-level knowledge bases.

[0157] If a second-category identifier from a second vulnerability knowledge base that has a mapping relationship with the first knowledge base identifier is found in the mapping knowledge base, it indicates that the current first vulnerability data is essentially the same vulnerability as vulnerability data scanned from another lower-level vulnerability knowledge base (the second vulnerability knowledge base). To more rationally and accurately categorize vulnerability data, the second-category identifier from the second vulnerability knowledge base with a mapping relationship is used as the target knowledge base identifier, and the first vulnerability data is reassigned to this new target knowledge base identifier. This consolidates identical vulnerability data under the same lower-level knowledge base identifier, facilitating subsequent management, analysis, and processing of vulnerability data, reducing confusion caused by differences between lower-level knowledge bases, and improving the accuracy of network security assessments.

[0158] For example, vulnerability scanning tool X performs a vulnerability scan based on CNNVD (the first vulnerability knowledge base) and discovers vulnerability x. The first knowledge base identifier for this vulnerability data is a CNNVD ID. During the fusion process for vulnerability x, it is determined that this CNNVD ID does not match any CVE ID, and no CVE ID with a mapping relationship exists in the mapping knowledge base. Next, step 701 is executed, where the mapping knowledge base is searched for a second-category identifier (CNVD ID) under CNVD that has a mapping relationship with this CNNVD ID. If a CNVD ID with a mapping relationship to vulnerability x's CNNVD ID is found in the mapping knowledge base, this CNVD ID is used as the target knowledge base identifier, and vulnerability x is assigned to this CNVD ID, resulting in a corresponding vulnerability fusion result. In other words, vulnerability x, originally assigned to a CNNVD ID, is reclassified to the CNVD ID because it is found to be essentially the same vulnerability as that represented by a CNVD ID, completing a more accurate fusion process for vulnerability x.

[0159] See also Figure 8 , Figure 8 yes Figure 2 Another flowchart further included after step 202. In some embodiments, after matching the first knowledge base identifier in descending order according to the pre-arranged hierarchical order of the multi-level knowledge base identifiers, the multi-source vulnerability data fusion processing method may include step 801:

[0160] Step 801: When the first knowledge base identifier matches one of the first category identifiers, the first category identifier that matches the first knowledge base identifier is used as the target knowledge base identifier, and the first vulnerability data is assigned to the target knowledge base identifier to obtain a corresponding vulnerability fusion result.

[0161] In the above steps, when the first knowledge base identifier can match the first category identifier, it means that the vulnerability data comes from a high-level vulnerability knowledge base. The first category identifier that matches it is used as the target knowledge base identifier and the vulnerability data is assigned. This can more accurately classify and integrate the vulnerability data, improve the accuracy and reliability of vulnerability data classification, and provide a more reliable basis for subsequent network security analysis and decision-making.

[0162] See also Figure 9 , Figure 9 yes Figure 2 In some embodiments, the process of assigning the first vulnerability data to the target knowledge base identifier and obtaining the corresponding vulnerability fusion result may include steps 901 to 903:

[0163] Step 901: Determine whether there is a vulnerability storage record identified by the target knowledge base in a preset vulnerability fusion table;

[0164] Step 902: When a vulnerability storage record identified by the target knowledge base exists in the vulnerability fusion table, the vulnerability storage record identified by the target knowledge base in the vulnerability fusion table is updated based on the first vulnerability data to obtain a corresponding vulnerability fusion result.

[0165] Step 903: When the vulnerability storage record identified by the target knowledge base does not exist in the vulnerability fusion table, the vulnerability description information of the first vulnerability data is obtained from the vulnerability knowledge base corresponding to the target knowledge base identifier, and a vulnerability storage record identified by the target knowledge base is created in the vulnerability fusion table based on the vulnerability description information to obtain the corresponding vulnerability fusion result.

[0166] In the above steps, the vulnerability storage record refers to the relevant information about the vulnerability recorded in the vulnerability fusion table for a certain target knowledge base identifier, including but not limited to the vulnerability data under the target knowledge base identifier and the vulnerability scanning tool that scanned the vulnerability data. When assigning the first vulnerability data to the target knowledge base identifier, it is first necessary to determine whether a vulnerability storage record for the target knowledge base identifier already exists in the preset vulnerability fusion table. This is because if a record already exists, it means that the vulnerability data related to the target knowledge base identifier has been processed before, and the subsequent processing method will be different from the case where no record exists. Through this judgment, the next processing strategy for the first vulnerability data can be determined, so as to more accurately update the vulnerability fusion table and obtain the correct vulnerability fusion result.

[0167] When a vulnerability storage record for a target knowledge base identifier exists in the vulnerability fusion table, it indicates that vulnerability data related to that target knowledge base identifier has already been processed and recorded in the table. Updating the vulnerability storage record for the target knowledge base identifier in the vulnerability fusion table based on the first vulnerability data is done to supplement the existing record with the new vulnerability data, making the information in the vulnerability fusion table more complete and accurate. This ensures that all relevant vulnerability data for the same target knowledge base identifier is reflected in the vulnerability fusion table, providing more comprehensive data support for subsequent network security analysis.

[0168] Vulnerability description information refers to detailed information about the first vulnerability data obtained from the vulnerability knowledge base corresponding to the target knowledge base identifier, including a detailed description of the vulnerability, the scope of impact, repair suggestions, etc. This information is very important for accurately creating the vulnerability storage record of the target knowledge base identifier in the vulnerability fusion table.

[0169] If the vulnerability storage record for the target knowledge base identifier does not exist in the vulnerability fusion table, it is necessary to obtain the vulnerability description information of the first vulnerability data from the vulnerability knowledge base corresponding to the target knowledge base identifier and, based on this information, create a vulnerability storage record for the target knowledge base identifier in the vulnerability fusion table. This is because if there is no relevant record, a new record entry must be created in the vulnerability fusion table for this new target knowledge base identifier and its corresponding first vulnerability data to facilitate subsequent management and analysis. By obtaining the vulnerability description information, the newly created record can be made more complete and accurate, providing basic data for subsequent network security analysis.

[0170] See also Figure 10 , Figure 10 This is another flow chart of the multi-source vulnerability data fusion processing method provided by the embodiment of the present disclosure. In some embodiments, the multi-source vulnerability data fusion processing method may further include steps 1001 to 1002:

[0171] Step 1001: determine the vulnerability similarity between any vulnerability data under the first category identifier and any vulnerability data under the second category identifier, and obtain a corresponding similarity value;

[0172] Step 1002: When any similarity value is greater than or equal to a preset second similarity threshold, a mapping relationship between the first category identifier and the second category identifier is established to determine similar vulnerability data, and the mapping relationship is saved in a mapping knowledge base.

[0173] In the above steps, vulnerability similarity is an indicator used to measure the degree of similarity between any vulnerability data identified by the first category and any vulnerability data identified by the second category. It reflects the similarity between the two vulnerability data in terms of vulnerability characteristics, scope of impact, degree of harm, etc. The similarity value in this step is a specific numerical value obtained by calculating the vulnerability similarity. This numerical value can intuitively represent the degree of similarity between the two vulnerability data, with larger numerical values ​​indicating higher similarity. It should be noted that the method for calculating the similarity value in this step can refer to the method for calculating similarity values ​​based on multiple different attribute types in the above embodiment, and will not be repeated here.

[0174] In the multi-source vulnerability data fusion processing, the vulnerability data scanned by knowledge bases of different levels may be similar or even identical. Determining the vulnerability similarity between any vulnerability data under the first category identification and any vulnerability data under the second category identification and obtaining the corresponding similarity value is to find those vulnerability data that appear to come from knowledge bases of different levels but may actually be essentially the same or similar.

[0175] The preset second similarity threshold is a pre-set numerical standard for determining whether the similarity of vulnerability data is high enough. When the calculated similarity value is greater than or equal to this threshold, the two vulnerability data are considered to be similar.

[0176] When any similarity value is greater than or equal to a preset second similarity threshold, it indicates that the vulnerability data under the corresponding first-category identifier and the vulnerability data under the second-category identifier have a high degree of similarity, and are likely to be essentially the same or similar vulnerabilities, but have different identifiers due to relying on different knowledge bases; conversely, if the similarity value is less than the preset second similarity threshold, it indicates that the two vulnerability data currently being compared are not similar, and therefore the vulnerability data currently being compared is not processed. In the embodiment of the present disclosure, a mapping relationship between the corresponding first-category identifier and the second-category identifier is established to determine similar vulnerability data, and is saved in the mapping knowledge base. This can further improve the content of the mapping knowledge base.

[0177] Based on this, the mapping knowledge base in the embodiment of the present disclosure records the relationship between different knowledge base identifiers. Improving it helps to more accurately judge whether the vulnerability data scanned by the low-level knowledge base is related to the vulnerability data in the high-level knowledge base in the subsequent vulnerability data fusion processing, thereby more effectively integrating multi-source vulnerability data and reducing the probability of false alarms and missed alarms.

[0178] See also Figure 11 The present disclosure also provides a multi-source vulnerability data fusion processing device, which can implement the multi-source vulnerability data fusion processing method described above. The multi-source vulnerability data fusion processing device includes:

[0179] The multi-source data acquisition module 1101 is configured to respectively acquire a plurality of vulnerability data discovered by a plurality of different approaches. When the vulnerability data carries a knowledge base identifier of a corresponding vulnerability knowledge base, the vulnerability data with the knowledge base identifier is scanned by the corresponding approach based on any one of the plurality of vulnerability knowledge bases.

[0180] The identifier matching module 1102 is configured to sequentially fuse each vulnerability data item and, for the first vulnerability data item currently being fused, if the first vulnerability data item has a corresponding first knowledge base identifier, match the first knowledge base identifier in descending order according to a pre-arranged hierarchy of multi-level knowledge base identifiers, wherein the multi-level knowledge base identifier includes a plurality of first-category identifiers and a plurality of second-category identifiers, with the first-category identifier having a higher hierarchy than the second-category identifier.

[0181] A mapping determination module 1103 is configured to determine, when the first knowledge base identifier does not match any of the first category identifiers but matches one of the second category identifiers, whether there is a first category identifier having a mapping relationship with the first knowledge base identifier in a preset mapping knowledge base;

[0182] The result determination module 1104 is used to, when there is a first type of identifier with a mapping relationship with the first knowledge base identifier in the mapping knowledge base, use the first type of identifier with a mapping relationship as the target knowledge base identifier, and assign the first vulnerability data to the target knowledge base identifier to obtain the corresponding vulnerability fusion result.

[0183] In summary, the fusion processing device for multi-source vulnerability data can perform fusion processing on each vulnerability data separately after receiving multiple vulnerability data discovered by different channels through the fusion processing method for executing multi-source vulnerability data in the above embodiment. In the process of processing the current first vulnerability data, if the first vulnerability data carries the corresponding first knowledge base identifier, since the embodiment of the present disclosure pre-divides the hierarchical order of the multi-level knowledge base identifiers and limits the level of the first category identifier to be higher than the second category identifier, that is, the level of the vulnerability knowledge base corresponding to the first category identifier is higher than the vulnerability knowledge base corresponding to the second category identifier, in the process of matching the first knowledge base identifier in descending order according to the hierarchical order of the multi-level knowledge base identifiers, it is possible to first determine whether the first vulnerability data belongs to the first category identifier, and then, if it does not belong to the first category identifier, After the first category identification, it is determined whether it belongs to the second category identification. Then, after the first vulnerability data belongs to the second category identification, it is determined in the preset mapping knowledge base whether there is a first category identification with a mapping relationship between the first knowledge base identification and the first category identification, so as to determine whether the first vulnerability data is the same as the vulnerability data indicated by the first category identification. If a first category identification with a mapping relationship exists, it means that although the first vulnerability data is scanned by the vulnerability knowledge base with a lower level corresponding to the second category identification, it is the same as the vulnerability data marked by the high-level vulnerability knowledge base corresponding to the first category identification. Then, in the fusion process, the first category identification with a mapping relationship can be used as the target knowledge base identification to achieve the assignment of the first vulnerability data to the high-level target knowledge base identification and obtain the corresponding vulnerability fusion result. Compared with the solutions in the related art, the embodiment of the present disclosure can divide the levels of different vulnerability knowledge bases. When there are differences in vulnerability data scanned by different channels, it can identify whether the vulnerability data scanned by the low level is the same as the vulnerability data under the high level identification, thereby effectively integrating multi-source vulnerability data, reducing the probability of false positives or false negatives of vulnerability data caused by significant differences in the scanning results of different channels, and ultimately improving network security.

[0184] The specific implementation of this multi-source vulnerability data fusion processing device is essentially the same as the specific embodiment of the multi-source vulnerability data fusion processing method described above and will not be repeated here. Provided that the requirements of the disclosed embodiments are met, the multi-source vulnerability data fusion processing device may also include other functional modules to implement the multi-source vulnerability data fusion processing method described in the above embodiment.

[0185] The present disclosure also provides an electronic device comprising a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the multi-source vulnerability data fusion processing method. The electronic device can be any smart terminal, including a tablet computer and an in-vehicle computer.

[0186] See also Figure 12 , Figure 12 The hardware structure of an electronic device according to another embodiment is shown. The electronic device includes:

[0187] The processor 1201 may be implemented as a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided by the embodiments of the present disclosure.

[0188] The memory 1202 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1202 can store operating devices and other applications. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 1202 and is called by the processor 1201 to execute the multi-source vulnerability data fusion processing method of the embodiments of this disclosure;

[0189] Input / output interface 1203, used to implement information input and output;

[0190] Communication interface 1204, used to implement communication interaction between this device and other devices, which can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WiFi, Bluetooth, etc.);

[0191] Bus 1205 , which transmits information between various components of the device (e.g., processor 1201 , memory 1202 , input / output interface 1203 , and communication interface 1204 );

[0192] The processor 1201 , the memory 1202 , the input / output interface 1203 and the communication interface 1204 are connected to each other in communication within the device via the bus 1205 .

[0193] The embodiments of the present disclosure further provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the above-mentioned method for fusion processing of multi-source vulnerability data.

[0194] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0195] The embodiments described in the embodiments of the present disclosure are intended to more clearly illustrate the technical solutions of the embodiments of the present disclosure and do not constitute a limitation on the technical solutions provided by the embodiments of the present disclosure. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of the present disclosure are also applicable to similar technical problems.

[0196] Those skilled in the art will understand that the technical solutions shown in the drawings do not constitute a limitation on the embodiments of the present disclosure, and may include more or fewer steps than shown in the drawings, or a combination of certain steps, or different steps.

[0197] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, i.e., they may be located in one place or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of this embodiment.

[0198] Those skilled in the art will appreciate that all or some of the steps, devices, and functional modules / units in the methods disclosed above may be implemented as software, firmware, hardware, or appropriate combinations thereof.

[0199] The terms "first," "second," "third," "fourth," and the like (if any) in the specification of the present disclosure and the accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a particular order or sequential sequence. It should be understood that the terms used in this manner are interchangeable where appropriate so that the embodiments of the present disclosure described herein can be implemented in orders other than those illustrated or described herein. In addition, the terms "including" and "having," and any variations thereof, are intended to cover non-exclusive inclusions, e.g., a process, method, apparatus, product, or apparatus comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0200] It should be understood that in the present disclosure, "at least one (item)" refers to one or more, and "plurality" refers to two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0201] In the several embodiments provided in the present disclosure, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the above-mentioned units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0202] The units described above as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0203] In addition, the functional units in the various embodiments of the present disclosure may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0204] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present disclosure is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method of each embodiment of the present disclosure. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store programs.

[0205] The preferred embodiments of the present disclosure are described above with reference to the accompanying drawings, but are not intended to limit the scope of the present disclosure. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and essence of the present disclosure should be within the scope of the present disclosure.

Claims

1. A fusion processing method for multi-source vulnerability data, characterized in that: include: Respectively obtaining a plurality of vulnerability data discovered by a plurality of different approaches, wherein, when the vulnerability data carries a knowledge base identifier of a corresponding vulnerability knowledge base, the vulnerability data carrying the knowledge base identifier is scanned by the corresponding approach based on any one of the plurality of vulnerability knowledge bases; performing fusion processing on each vulnerability data in sequence, and for a first vulnerability data currently being fused, if the first vulnerability data has a corresponding first knowledge base identifier, matching the first knowledge base identifier in descending order according to a pre-arranged hierarchy of multi-level knowledge base identifiers, wherein the multi-level knowledge base identifier includes a plurality of first-category identifiers and a plurality of second-category identifiers, and the hierarchy of the first-category identifier is higher than that of the second-category identifier; When the first knowledge base identifier does not match any of the first category identifiers but matches one of the second category identifiers, determining whether there is a first category identifier having a mapping relationship with the first knowledge base identifier in a preset mapping knowledge base; When a first type identifier having a mapping relationship with the first knowledge base identifier exists in the mapping knowledge base, the first type identifier having the mapping relationship is used as the target knowledge base identifier, and the first vulnerability data is assigned to the target knowledge base identifier to obtain a corresponding vulnerability fusion result; After sequentially fusing the vulnerability data and processing the first vulnerability data currently being fused, the multi-source vulnerability data fusing method further includes: If the first vulnerability data does not have a corresponding first knowledge base identifier, obtaining a plurality of second vulnerability data from a preset vulnerability fusion table, wherein the second knowledge base identifier of the second vulnerability data does not belong to the first category identifier or the second category identifier; Determining vulnerability attributes of multiple different attribute types under the first vulnerability data and the second vulnerability data, respectively, and configuring corresponding similarity algorithms for different attribute types; determining attribute similarities between the vulnerability attributes under the same attribute type between the first vulnerability data and each second vulnerability data using the corresponding similarity algorithm, thereby obtaining sub-similarity values ​​under multiple attribute types; performing weighted calculation on the multiple sub-similarity values ​​based on weights under each attribute type, thereby obtaining a similarity value between the first vulnerability data and each second vulnerability data; When any of the similarity values ​​is greater than or equal to a preset first similarity threshold, the second knowledge base identifier of the similar second vulnerability data is determined as the target knowledge base identifier, and the first vulnerability data is assigned to the target knowledge base identifier to obtain a corresponding vulnerability fusion result.

2. The fusion processing method for multi-source vulnerability data according to claim 1 is characterized in that: The step of sequentially determining the attribute similarities between the vulnerability attributes under the same attribute type to obtain sub-similarity values ​​under multiple attribute types includes: Calculating an edit distance and a first Jaccard similarity value between the vulnerability attributes whose attribute type is component name, and determining a sub-similarity value under the component name in combination with the edit distance and the first Jaccard similarity value; Calculating a hierarchical version splitting vector and a first cosine similarity value between the vulnerability attributes whose attribute type is component version, and determining a sub-similarity value under the component version by combining the hierarchical version splitting vector and the first cosine similarity value; Calculating a first domain-enhanced semantic vector feature and a second cosine similarity value between the vulnerability attributes whose attribute type is vulnerability description, and determining a sub-similarity value under the vulnerability description in combination with the first domain-enhanced semantic vector feature and the second cosine similarity value; Calculating the action and object semantic role labeling results and the third cosine similarity value between the vulnerability attributes whose attribute type is repair suggestion, and determining the sub-similarity value under the repair suggestion in combination with the labeling results and the third cosine similarity value; Calculating the classification tree path distance or the second domain enhanced semantic vector feature between the vulnerability attributes whose attribute type is the vulnerability type, and determining the sub-similarity value under the vulnerability type in combination with the classification tree path distance or the second domain enhanced semantic vector feature; Calculating the TF-IDF vector features and the fourth cosine similarity value between the vulnerability attributes whose attribute type is the exploitation method, and determining the sub-similarity value under the exploitation method by combining the TF-IDF vector features and the fourth cosine similarity value; A second Jaccard similarity value of the asset type between the vulnerability attributes whose attribute type is the impact range is calculated, and a sub-similarity value under the impact range is determined based on the second Jaccard similarity value.

3. The fusion processing method for multi-source vulnerability data according to claim 1 is characterized in that: After determining whether there is a first type identifier having a mapping relationship with the first knowledge base identifier in the preset mapping knowledge base, the multi-source vulnerability data fusion processing method further includes: When there is no first-category identifier having a mapping relationship with the first knowledge base identifier in the mapping knowledge base, the second-category identifier matching the first knowledge base identifier is used as the target knowledge base identifier, and the first vulnerability data is assigned to the target knowledge base identifier to obtain the corresponding vulnerability fusion result.

4. The fusion processing method for multi-source vulnerability data according to claim 3 is characterized in that: The plurality of second-category identifiers include a plurality of second-category identifiers under a first vulnerability knowledge base and a plurality of second-category identifiers under a second vulnerability knowledge base at the same level as the first vulnerability knowledge base; When the mapping knowledge base does not contain a first type identifier having a mapping relationship with the first knowledge base identifier, the multi-source vulnerability data fusion processing method further includes: When the first knowledge base identifier matches the second category identifier under one of the first vulnerability knowledge bases, determining in the mapping knowledge base whether there is a second category identifier under the second vulnerability knowledge base that has a mapping relationship with the first knowledge base identifier; When there is a second category identifier under the second vulnerability knowledge base that has a mapping relationship with the first knowledge base identifier in the mapping knowledge base, the second category identifier under the second vulnerability knowledge base that has a mapping relationship is used as the target knowledge base identifier, and the first vulnerability data is assigned to the target knowledge base identifier to obtain the corresponding vulnerability fusion result.

5. The fusion processing method for multi-source vulnerability data according to claim 1 is characterized in that: After matching the first knowledge base identifiers in descending order according to the pre-arranged hierarchical order of the multi-level knowledge base identifiers, the multi-source vulnerability data fusion processing method further includes: When the first knowledge base identifier matches one of the first category identifiers, the first category identifier matching the first knowledge base identifier is used as the target knowledge base identifier, and the first vulnerability data is assigned to the target knowledge base identifier to obtain a corresponding vulnerability fusion result.

6. The fusion processing method for multi-source vulnerability data according to claim 1 is characterized in that: The assigning the first vulnerability data to the target knowledge base identifier to obtain a corresponding vulnerability fusion result includes: Determine whether there is a vulnerability storage record identified by the target knowledge base in a preset vulnerability fusion table; When a vulnerability storage record identified by the target knowledge base exists in the vulnerability fusion table, the vulnerability storage record identified by the target knowledge base in the vulnerability fusion table is updated based on the first vulnerability data to obtain a corresponding vulnerability fusion result; When the vulnerability storage record identified by the target knowledge base does not exist in the vulnerability fusion table, the vulnerability description information of the first vulnerability data is obtained from the vulnerability knowledge base corresponding to the target knowledge base identifier, and a vulnerability storage record identified by the target knowledge base is created in the vulnerability fusion table based on the vulnerability description information to obtain the corresponding vulnerability fusion result.

7. The fusion processing method for multi-source vulnerability data according to claim 1 is characterized in that: The multi-source vulnerability data fusion processing method further includes: Determine vulnerability similarity between any vulnerability data under the first category identification and any vulnerability data under the second category identification, and obtain a corresponding similarity value; When any of the similarity values ​​is greater than or equal to a preset second similarity threshold, a corresponding mapping relationship between the first category identifier and the second category identifier is established to determine the similar vulnerability data, and is saved in a mapping knowledge base.

8. A fusion processing device for multi-source vulnerability data, characterized in that: include: a multi-source data acquisition module, configured to respectively acquire a plurality of vulnerability data discovered by a plurality of different approaches, wherein when the vulnerability data carries a knowledge base identifier of a corresponding vulnerability knowledge base, the vulnerability data carrying the knowledge base identifier is scanned by the corresponding approach based on any one of the plurality of vulnerability knowledge bases; an identifier matching module, configured to sequentially perform fusion processing on each of the vulnerability data, and for a first vulnerability data currently being fused, if the first vulnerability data has a corresponding first knowledge base identifier, sequentially match the first knowledge base identifier in descending order according to a pre-arranged hierarchy of multi-level knowledge base identifiers, wherein the multi-level knowledge base identifier includes a plurality of first-category identifiers and a plurality of second-category identifiers, and the hierarchy of the first-category identifier is higher than that of the second-category identifier; a mapping determination module configured to, when the first knowledge base identifier does not match any of the first category identifiers but matches one of the second category identifiers, determine whether there is a first category identifier having a mapping relationship with the first knowledge base identifier in a preset mapping knowledge base; A result determination module is configured to, when a first type identifier having a mapping relationship with the first knowledge base identifier exists in the mapping knowledge base, use the first type identifier having the mapping relationship as a target knowledge base identifier, and assign the first vulnerability data to the target knowledge base identifier to obtain a corresponding vulnerability fusion result; After sequentially fusing the vulnerability data and performing fusion processing on the first vulnerability data currently being fused, the identification matching module is further configured to: If the first vulnerability data does not have a corresponding first knowledge base identifier, obtaining a plurality of second vulnerability data from a preset vulnerability fusion table, wherein the second knowledge base identifier of the second vulnerability data does not belong to the first category identifier or the second category identifier; Determining vulnerability attributes of multiple different attribute types under the first vulnerability data and the second vulnerability data, respectively, and configuring corresponding similarity algorithms for different attribute types; determining attribute similarities between the vulnerability attributes under the same attribute type between the first vulnerability data and each second vulnerability data using the corresponding similarity algorithm, thereby obtaining sub-similarity values ​​under multiple attribute types; performing weighted calculation on the multiple sub-similarity values ​​based on weights under each attribute type, thereby obtaining a similarity value between the first vulnerability data and each second vulnerability data; When any of the similarity values ​​is greater than or equal to a preset first similarity threshold, the second knowledge base identifier of the similar second vulnerability data is determined as the target knowledge base identifier, and the first vulnerability data is assigned to the target knowledge base identifier to obtain a corresponding vulnerability fusion result.

9. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the multi-source vulnerability data fusion processing method according to any one of claims 1 to 8 when executing the computer program.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method for fusion processing of multi-source vulnerability data according to any one of claims 1 to 8 is implemented.

Images