Vulnerability mining method based on large model

Abstract

The invention relates to the field of vulnerability mining, in particular to a vulnerability mining method based on a large model, and the method comprises the steps: constructing a label combination library for a working condition terminal, and subsequently constructing a correlation model for a label combination based on a credible log fragment corresponding to each label in the label combination; based on the occurrence probability of each label combination and combined with the constraint discrete features of the association model corresponding to the label combination, effective sub-labels are set for the label combination, a current label combination of a current log record is analyzed subsequently for a new log record, and adaptability analysis is performed on the log record according to the effective sub-labels corresponding to the current label combination, so that the log record is obtained. According to the method, potential laws of the operation process of the industrial control terminal are considered, the association model of the log records under the specific label combination is constructed, the log records are analyzed based on the effectiveness adaptability of the label combination, log fragments possibly representing that potential abnormal vulnerabilities exist in a system are rapidly marked when massive log records are faced, and the system reliability is improved. And the accuracy and efficiency of vulnerability mining are improved.

Description

Technical Field

[0001] The present invention relates to the field of vulnerability mining, and in particular to a vulnerability mining method based on a large model. Background Art

[0002] Vulnerability mining refers to the process of actively searching for and identifying unknown security flaws (vulnerabilities) in software, systems, networks, or hardware. These vulnerabilities may lead to serious consequences such as information leakage, system control, service interruption, or system operation errors. Vulnerability mining is an important part of the information security field.

[0003] For example, Chinese patent publication number: CN106130966A, discloses a vulnerability mining detection method, server, device and system. The method includes: obtaining suspicious sample logs uploaded by the client; deduplicating the obtained suspicious sample logs; for each suspicious sample log remaining after deduplication, inputting the suspicious sample log into a sandbox for scanning to obtain a scan log, and determining whether the sample corresponding to the suspicious sample log has a vulnerability based on the scan log. In this solution, each client is used as a probe spread across the Internet to collect suspicious sample logs corresponding to suspicious files, which can more comprehensively mine relevant information about samples that may have vulnerabilities on the Internet; then, based on the scan log, samples that do have security vulnerabilities are determined from samples that may have vulnerabilities, clarifying the actual security status of each sample; the scanning is performed in the sandbox on the server side, providing a closed operating environment for the suspicious sample log, thereby ensuring the security of the server side during the detection process.

[0004] However, the prior art still has the following problems: Typically, an industrial control terminal will perform several operations under normal operation. Some continuous operations have certain regularities, which will be reflected in the operation logs accordingly. When there are vulnerabilities or anomalies, the operation of the system will break this regularity. In the existing technology, the amount of data required to analyze when mining vulnerabilities in the operation logs is massive, which consumes a lot of computing power and does not utilize the regularity of the normal operation of the industrial control terminal. As a result, when the amount of operation logs is large, the accuracy of mining potential vulnerabilities is poor and the efficiency is low. Summary of the Invention

[0005] To this end, the present invention provides a vulnerability mining method based on a large model to overcome the problems in the prior art, that is, when analyzing vulnerabilities in operation logs, the amount of data required to be analyzed is massive, the computing power consumption is large, and the regularity of the normal operation of the industrial control terminal is not utilized, resulting in poor accuracy and low efficiency in mining potential vulnerabilities when the amount of operation logs is large.

[0006] To achieve the above objectives, the present invention provides a vulnerability mining method based on a large model, comprising: Segment the trusted sample logs of the industrial control terminal to obtain a number of trusted log segments; Extract the trusted log segments within the time-domain reference range, determine the operation types of each of the trusted log segments, generate corresponding tags, form a tag combination, and construct a tag combination library for the working condition terminal; Based on the trusted log segments corresponding to each tag in the tag combination, construct an association model for the tag combination, where the association model includes a time-series association constraint feature and a morphological association constraint feature, the time-series association feature is determined based on the generation time of each trusted log segment, and the morphological association constraint feature is determined based on the length of each trusted log segment; Based on the occurrence probability of each tag combination and the constraint discrete features of the association model corresponding to the tag combination, set valid sub-tags for the tag combination; Analyze the current tag combination of the log records generated at intervals within the time-domain reference range, and analyze the log records based on the valid sub-tags corresponding to the current tag combination, including, Determine the association model corresponding to the tag combination, extract the log records to construct a temporary model, match the temporary model with the association model, and determine whether to mark the log records; Or, traverse and analyze whether there are abnormalities in the log records to mark the corresponding abnormal segments; Among them, the constraint discrete features include a time-series constraint discrete degree and a morphological constraint discrete degree, and the temporary model includes a time-series association feature and a morphological association feature.

[0007] Further, the process of determining the operation types of each of the trusted log segments, generating corresponding tags, and forming a tag combination includes, Extract the operation descriptions in each of the trusted log segments within the time-domain reference range, and determine the corresponding operation types; Generate tags based on the operation types, and sort each of the tags according to the time series of the trusted log segments to form the tag combination; Among them, the time-domain reference range is a pre-set time period, and each of the operation types corresponds to a tag one by one.

[0008] Further, the process of determining the time-series association constraint feature includes, Determine the generation time of the trusted log segments corresponding to each tag in a number of the tag combinations; Based on the generation times in each of the tag combinations, determine a number of generation time intervals to obtain the mean value of the generation time intervals; Based on the mean value of the generation time intervals, determine the upper limit of the time-series association constraint and the lower limit of the time-series association constraint, Based on the upper limit of the time-series association constraint and the lower limit of the time-series association constraint, construct a constraint range, and determine the constraint range as the time-series association constraint feature; Among them, the variance of each time interval is determined as the temporal constraint dispersion degree.

[0009] Further, the process of determining the morphological association constraint features includes determining the lengths and the length variances of the corresponding several reliable log segments of the tags in several of the tag combinations; solving the length mean values for each tag, and determining the length ranges for each tag based on the length mean values; determining the length ranges for each tag as the morphological association constraint features of the tag combination; Among them, the mean value of the length variances corresponding to each tag is determined as the morphological constraint dispersion degree.

[0010] Further, the process of setting valid sub - tags for a tag combination based on the occurrence probability of each tag combination and the corresponding association model includes verifying whether the tag combination meets the valid conditions; if it meets the valid conditions, then setting valid sub - tags for the tag combination; Among them, the valid conditions are that the occurrence probability of the tag combination is greater than a predetermined occurrence probability threshold, and the temporal constraint dispersion degree of the association model corresponding to the tag combination is less than a predetermined temporal constraint dispersion threshold, and the morphological constraint dispersion degree of the association model corresponding to the tag combination is less than a predetermined morphological constraint dispersion threshold.

[0011] Further, analyzing the log record based on the valid sub - tags corresponding to the current tag combination includes if the tag combination is set with valid sub - tags, then determining the association model corresponding to the tag combination, extracting the log record to construct a temporary model, and matching the temporary model with the association model to determine whether to mark the log record; if the tag combination is not set with valid sub - tags, then traversing and analyzing whether there are anomalies in the log record to mark the corresponding abnormal segments.

[0012] Further, the process of extracting the log record to construct a temporary model includes determining the generation time of each log segment in the log record, determining the mean value of the generation time intervals, and obtaining the temporal association features; determining the lengths of each log segment in the log record, sorting the lengths according to the generation time of the log segments, and obtaining the morphological association features.

[0013] Further, the process of matching the temporary model with the association model to determine whether to mark the log record includes extracting the temporal association features of the temporary model, and determining whether the temporal association features are within the temporal association constraint features of the association model; Extract the morphological correlation features of the temporary model, and determine whether the lengths of the tags in the morphological correlation features are within the length ranges of the tags in the temporal correlation constraint features; If the matching condition is satisfied, mark the log record; Wherein, the matching condition is that the temporal correlation feature is within the temporal correlation constraint feature of the correlation model, and the lengths of the tags in the morphological correlation feature are all within the length ranges of the tags in the temporal correlation constraint feature.

[0014] Furthermore, the process of traversing and analyzing whether there are anomalies in the log record to mark the corresponding anomaly segments includes, Traverse and analyze whether there are preset abnormal character segments in the log record; If there are abnormal character segments, determine and mark the corresponding abnormal character segments.

[0015] Furthermore, it also includes storing the marked log records into the vulnerability mining reference sample library.

[0016] Compared with the prior art, the beneficial effects of the present invention are as follows. The present invention cuts the trusted sample log records of the industrial control terminal, extracts the trusted log segments within the time domain reference range, constructs a label combination library for the working condition terminal, and subsequently constructs a correlation model for the label combination based on the trusted log segments corresponding to each label in the label combination. Based on the occurrence probability of each label combination and the constraint discrete features of the correlation model corresponding to the label combination, valid sub-labels are set for the label combination. Subsequently, for the new log record, analyze the current label combination of the current log record, and adaptively analyze the log record according to the valid sub-labels corresponding to the current label combination, including using the correlation model to determine whether to mark the log record and traversing and analyzing whether there are anomalies in the log record to mark the corresponding anomaly segments. The present invention considers the potential rules in the operation process of the industrial control terminal, constructs a correlation model of the log record under a specific label combination, and adaptively analyzes the log record based on the effectiveness of the label combination. When facing a large number of log records, it quickly marks the log segments that may indicate potential abnormal vulnerabilities in the system, improving the accuracy and efficiency of vulnerability mining.

[0017] In particular, the present invention determines the operation type of a trusted log segment. The trusted log segment only contains the description of a single operation and can determine the corresponding operation type. In actual situations, the tasks of industrial control terminals are mostly regular. And under normal operating conditions, for certain specific operation combinations, they show regularity in multiple dimensions. Therefore, the present invention considers determining a tag combination to represent a specific operation combination. Subsequently, an association model for the tag combination is constructed. The association model includes temporal association constraint features and morphological association constraint features, which respectively reflect the regularity of each operation in the temporal dimension and the regularity in the dimension of the log record code representation under the corresponding operation combination. Based on this, an association model is constructed. When the system is operating normally, executing a specific operation combination usually maintains this regularity. When there are vulnerabilities and anomalies in the system, the actual operation of the system will break this regularity. Furthermore, based on the association model, it is convenient to subsequently adaptively select an analysis method for log records. When faced with a large number of log records, quickly mark the log segments that may indicate potential abnormal vulnerabilities in the system, improving the accuracy and efficiency of vulnerability mining.

[0018] In particular, the present invention constructs specific temporal association constraint features and morphological association constraint features as components of the association model. In actual situations, under a specific operation combination, there may be certain regularity in the temporal relationship of each operation. If the system is abnormal, it may lead to changes in the execution time sequence of the actual operation or changes in the operation itself. Furthermore, with the real-time generation of log records, it will be reflected in the log records. Similarly, under a specific operation combination, during the normal operation of the system, the generation of log records usually maintains regularity. If the system is abnormal and the operation is executed incorrectly, resulting in additional content or missing content in the log records, it will also break the regularity and be reflected in the log records. Based on this, the present invention selects temporal association constraint features and morphological association constraint features to construct an association model, which is convenient for subsequently constructing a temporary model to match the association model. When faced with a large number of log records, quickly mark the log segments that may indicate potential abnormal vulnerabilities in the system, improving the accuracy and efficiency of vulnerability mining.

[0019] In particular, the present invention sets valid sub-tags for the tag combination, considering the occurrence probability of each tag combination and the constraint discrete features of the association model. The occasionality of the tag combination is considered through the occurrence probability, and whether the log records are relatively discrete in the temporal dimension and the morphological tag dimension under the corresponding tag combination and are not easy to observe regularity is considered through the constraint discrete features. Furthermore, the tag combinations with strong data representativeness are selected and used to construct a temporary model for the corresponding tag combination subsequently, to verify whether the regularity of the log records in the corresponding temporal dimension and morphological performance dimension is broken under a specific tag combination, and then quickly mark the log segments that may indicate potential abnormal vulnerabilities in the system, improving the accuracy and efficiency of vulnerability mining. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 Schematic diagram of the steps of the vulnerability mining method based on a large model according to an embodiment of the invention; Figure 2 Logic block diagram of setting valid sub - tags according to an embodiment of the invention; Figure 3 Logic block diagram of analyzing log records based on valid sub - tags corresponding to the current tag combination according to an embodiment of the invention. Detailed implementation manners

[0021] In order to make the objectives and advantages of the present invention clearer and more understandable, the present invention will be further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0022] The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. Those skilled in the art should understand that these embodiments are only used to explain the technical principles of the present invention and do not limit the protection scope of the present invention.

[0023] Please refer to Figure 1 as shown in Figure 1 Schematic diagram of the steps of the vulnerability mining method based on a large model according to an embodiment of the invention. The vulnerability mining method based on a large model according to an embodiment of the invention includes Step S1: Segment the trusted sample log records of the industrial control terminal to obtain a number of trusted log segments; Step S2: Extract the trusted log segments within the time - domain reference range, determine the operation types of each of the trusted log segments, generate corresponding tags, form a tag combination, and construct a tag combination library for the industrial condition terminal; Step S3: Based on the trusted log segments corresponding to each tag in the tag combination, construct an association model for the tag combination. Among them, the association model includes a time - series association constraint feature and a morphological association constraint feature. The time - series association feature is determined based on the generation time of each trusted log segment, and the morphological association constraint feature is determined based on the length of each trusted log segment; Step S4: Set valid sub - tags for the tag combination based on the occurrence probability of each tag combination and the constraint discrete features of the association model corresponding to the tag combination; Step S5: Analyze the current tag combination of the generated log records at intervals within the time - domain reference range, and analyze the log records based on the valid sub - tags corresponding to the current tag combination, including Determine the association model corresponding to the tag combination, extract the log records to construct a temporary model, match the temporary model with the association model, and determine whether to mark the log records; Or, traverse and analyze whether there are abnormalities in the log records to mark the corresponding abnormal segments; Among them, the constraint discrete features include the time series constraint dispersion and the morphological constraint dispersion, and the temporary model includes the time series correlation features and the morphological correlation features.

[0024] Specifically, there is no limitation on the acquisition method of the trusted log records. The historical log records under the normal operation of the corresponding industrial control equipment can be pre-recorded and used as the trusted log records. For the recording period, it is selected within 10 days to 30 days, which will not be elaborated here.

[0025] Specifically, the purpose of setting the time domain reference range is to observe the operation combinations executed by the industrial control terminal within a certain period of time. The average time required for the industrial control terminal to complete a single operation can be pre-recorded, and the time domain reference range is selected within 3 to 5 times of this average time. Of course, it can also be in other forms, which will not be elaborated here.

[0026] Specifically, there is no limitation on the form of setting the tags. The purpose of setting the tags is for classification, and those skilled in the art can adopt any form of tag setting, which will not be elaborated here.

[0027] Specifically, the process of determining the operation types of each of the trusted log segments, generating corresponding tags, and forming a tag combination includes extracting the operation descriptions in each of the trusted log segments within the time domain reference range and determining the corresponding operation types; generating tags based on the operation types and sorting each of the tags according to the time series of the trusted log segments to form the tag combination; wherein, the time domain reference range is a pre-set time period, and each of the operation types corresponds to a tag one by one.

[0028] Specifically, the trusted log segments contain descriptions of operations, such as the operation execution time, the operation execution entity, the operation type, and the operation object, etc. In actual situations, the operation type can be determined by reading the operation descriptions in the trusted log segments.

[0029] [[ID=2৪]]In implementation, a tag corresponding one by one to each operation type is pre-set. There is no limitation on the form of the tag, and it can be in the form of any characters, as long as the operation type and the tag can be guaranteed to correspond one by one.

[0030] In implementation, the generation time of the log records is usually related to the operation execution time. It can be synchronous logs, where the log records are generated synchronously with the operation, or asynchronous logs, where the corresponding log records are generated after the operation is completed. Both synchronous logs and asynchronous logs are existing log generation forms, which will not be elaborated here.

[0031] In implementation, there is a time series relationship in the generation of the trusted log segments, and then the tags are arranged in sequence based on the time series relationship to form a tag combination, which will not be elaborated here.

[0032] The operation of the present invention determines the operation type of the trusted log segment. The trusted log segment only contains the description of a single operation and can determine the corresponding operation type. In actual situations, the tasks of industrial control terminals are mostly regular. And under normal operation, certain specific operation combinations show regularity in multiple dimensions. Therefore, the present invention considers determining a tag combination to represent a specific operation combination. Subsequently, an association model for the tag combination is constructed. The association model includes temporal association constraint features and morphological association constraint features, which respectively reflect the regularity of each operation in the temporal dimension and the regularity of the log record code representation dimension under the corresponding operation combination. Based on this, an association model is constructed. When the system is running normally, executing a specific operation combination usually maintains this regularity. When there are vulnerabilities and anomalies in the system, the actual operation of the system will break this regularity. Furthermore, based on the association model, it is convenient to subsequently adaptively select the analysis method for log records. When faced with a large number of log records, quickly mark the log segments that may indicate potential abnormal vulnerabilities in the system, improving the accuracy and efficiency of vulnerability mining.

[0033] Specifically, the process of determining the temporal association constraint features includes Determining the generation time of the trusted log segments corresponding to each tag in several of the tag combinations; Based on the generation times in each of the tag combinations, determining several generation time intervals to obtain the mean of the generation time intervals; Based on the mean of the generation time intervals, determining the upper limit and the lower limit of the temporal association constraint Constructing a constraint range based on the upper limit and the lower limit of the temporal association constraint, and determining the constraint range as the temporal association constraint feature; Wherein, the variance of each time interval is determined as the temporal constraint dispersion.

[0034] In implementation, a first temporal offset coefficient and a second temporal offset coefficient are set. The upper limit of the temporal association constraint is determined as the product of the mean of the time intervals and the first temporal offset coefficient, and the lower limit of the temporal association constraint is determined as the product of the mean of the time intervals and the second temporal offset coefficient. The first temporal offset coefficient is selected within the interval [1.25, 1.45], and the second temporal offset coefficient is selected within the interval [0.65, 0.85]. The interval corresponding to the constraint range constructed based on the upper limit and the lower limit of the temporal association constraint is a closed interval.

[0035] Specifically, the process of determining the morphological association constraint features includes Determining the lengths and length variances of the several trusted log segments corresponding to the tags in several of the tag combinations; Solving the length mean for each tag, and determining the length range for each tag based on the length mean; Determine the length range for each tag as the morphological association constraint feature of the tag combination; Among them, determine the mean value of the length variances corresponding to each tag as the morphological constraint dispersion.

[0036] In implementation, since the trusted sample log is a historical log record, there may be several identical tag combinations. Furthermore, the lengths and length variances of the trusted log segments corresponding to the identical tags in several tag combinations can be calculated.

[0037] In implementation, the length range is determined based on the length mean. Set the upper limit of the length range as the product of the length mean and the first morphological offset coefficient, and set the lower limit of the length range as the product of the length mean and the second morphological offset coefficient. The first morphological offset coefficient is selected within the interval [1.45, 1.55], and the second morphological offset coefficient is selected within the interval [0.55, 0.65].

[0038] The present invention constructs specific temporal association constraint features and morphological association constraint features as components of the association model. In actual situations, under specific operation combinations, there may be certain regularities in the temporal relationships of various operations. If the system is abnormal, it may lead to changes in the temporal sequence of the actually executed operations or changes in the operations themselves. Furthermore, with the real-time generation of log records, it is reflected in the log records. Similarly, under specific operation combinations, during the normal operation of the system, the generation of log records usually maintains regularity. If the system is abnormal and the executed operations are incorrect, resulting in additional content or missing content in the log records, it will also break the regularity and thus be reflected in the log records. Based on this, the present invention selects temporal association constraint features and morphological association constraint features to construct the association model, facilitating subsequent matching of the temporary model and the association model. When facing a large number of log records, it can quickly mark the log segments that may indicate potential abnormal vulnerabilities in the system, improving the accuracy and efficiency of vulnerability mining.

[0039] Specifically, please refer to Figure 2 as shown in Figure 2 is the logic block diagram for setting valid sub-tags in the embodiment of the invention. The process of setting valid sub-tags for a tag combination based on the occurrence probability of each tag combination and the corresponding association model of the tag combination includes, Verify whether the tag combination meets the valid conditions; If it meets the valid conditions, set valid sub-tags for the tag combination; Among them, the valid conditions are that the occurrence probability of the tag combination is greater than a predetermined occurrence probability threshold, and the temporal constraint dispersion of the association model corresponding to the tag combination is less than a predetermined temporal constraint dispersion threshold, and the morphological constraint dispersion of the association model corresponding to the tag combination is less than a predetermined morphological constraint dispersion threshold.

[0040] In the present invention, valid sub - tags are set for tag combinations. Considering the occurrence probabilities of each tag combination and the constraint discrete features of the correlation model, the occasionality of tag combinations is considered through the occurrence probabilities, and whether the log records are relatively discrete in the time - series dimension and the morphological tag dimension under the corresponding tag combinations, making it difficult to observe the regularity. Furthermore, tag combinations with strong data representativeness are selected to be used for constructing a temporary model for the corresponding tag combinations later, to verify whether the regularity of the log records in the corresponding time - series dimension and the morphological performance dimension is broken under specific tag combinations, and then quickly mark the log segments that may represent potential abnormal vulnerabilities in the system, improving the accuracy and efficiency of vulnerability mining.

[0041] Specifically, the occurrence probability threshold is determined based on the average occurrence probabilities of several tag combinations and is set to 1.15 times the average occurrence probability.

[0042] The time - series constraint discrete threshold and the morphological constraint discrete threshold are pre - determined. Among them, The time - series constraint discrete degrees of each tag combination are pre - recorded, and the average value of the time - series constraint discrete degrees is solved; The morphological constraint discrete degrees of each tag combination are pre - recorded, and the average value of the morphological constraint discrete degrees is solved; The time - series constraint discrete threshold is set as the product of the average value of the time - series constraint discrete degrees and the error coefficient, and the morphological constraint discrete threshold is set as the product of the average value of the morphological constraint discrete degrees and the error coefficient. The error coefficient is selected within the interval [0.85, 0.95].

[0043] Specifically, please refer to Figure 3 as shown Figure 3 is the logic block diagram for analyzing log records based on the valid sub - tags corresponding to the current tag combination in the embodiment of the invention. Analyzing log records based on the valid sub - tags corresponding to the current tag combination includes, If a valid sub - tag is set for the tag combination, determine the correlation model corresponding to the tag combination, extract the log records to construct a temporary model, and match the temporary model with the correlation model to determine whether to mark the log records; If no valid sub - tag is set for the tag combination, traverse and analyze whether there are abnormalities in the log records to mark the corresponding abnormal segments.

[0044] Specifically, new log records are continuously generated. Log record segments for several operations are generated every time the time - domain reference range is reached. By determining the tags of each log record segment, the current tag combination can be analyzed, which will not be elaborated here.

[0045] Specifically, the process of extracting the log records to construct a temporary model includes, Determine the generation time of each log segment in the log record, determine the average value of the generation time interval, and obtain the time series correlation feature; Determine the length of each log segment in the log record, sort the lengths according to the generation time of the log segments, and obtain the morphological correlation feature.

[0046] Specifically, the process of matching the temporary model with the association model and determining whether to mark the log record includes, Extract the time series correlation feature of the temporary model, and determine whether the time series correlation feature is within the time series correlation constraint feature of the association model; Extract the morphological correlation feature of the temporary model, and determine whether the length of each label in the morphological correlation feature is within the length range of each label in the time series correlation constraint feature; If the matching condition is satisfied, mark the log record; Wherein, the matching condition is that the time series correlation feature is within the time series correlation constraint feature of the association model, and the length of each label in the morphological correlation feature is within the length range of each label in the time series correlation constraint feature.

[0047] Specifically, the process of traversing and analyzing whether there is an abnormality in the log record to mark the corresponding abnormal segment includes, Traverse and analyze whether there is a preset abnormal character segment in the log record; If there is an abnormal character segment, determine and mark the corresponding abnormal character segment.

[0048] In practice, several abnormal character segments that can appear in the log record and represent abnormalities can be pre-statistically analyzed. For example, Segmentation fault (core dumped), which indicates that the program attempts to access a non-existent memory address or a memory address without permission.

[0049] Specifically, it also includes storing the marked log record in the vulnerability mining reference sample library.

[0050] Specifically, these log records have a high abnormal tendency, and the probability that the corresponding code has an abnormal vulnerability is relatively high. Therefore, the code of the industrial control terminal can be traced back according to the corresponding log record, and whether there is a vulnerability can be analyzed according to the code later, which will not be elaborated here.

[0051] Specifically, the method of tracing the code according to the log record is not limited. For example, the stack trace method can be used to find the corresponding code file for analysis. Of course, those skilled in the art can use any feasible method to budget the code, which will not be elaborated here.

[0052] If the vulnerability mining method based on the large model of the present invention is implemented in the form of software functional units and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories (ROM, Read-Only Memory), random access memories (RAM, Random Access Memory), magnetic disks, or optical discs.

[0053] So far, the technical solution of the present invention has been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will all fall within the protection scope of the present invention.

Claims

1. A vulnerability mining method based on a large model, characterized in that Including: Segmenting the trustworthy sample logs of the industrial control terminal to obtain a number of trustworthy log segments; Extracting the trustworthy log segments within the time-domain reference range, determining the operation types of the trustworthy log segments, generating corresponding tags, forming a tag combination, and constructing a tag combination library for the working condition terminal; Constructing an association model for the tag combination based on the trustworthy log segments corresponding to each tag in the tag combination. Among them, the association model includes a time-series association constraint feature and a morphological association constraint feature. The time-series association constraint feature is determined based on the generation time of each trustworthy log segment, and the morphological association constraint feature is determined based on the length of each trustworthy log segment; Setting effective sub-tags for the tag combination based on the occurrence probability of each tag combination and the constraint discrete features of the association model corresponding to the tag combination; Analyzing the current tag combination of the log records generated at intervals within the time-domain reference range, and analyzing the log records based on the effective sub-tags corresponding to the current tag combination, including Determining the association model corresponding to the tag combination, extracting the log records to construct a temporary model, matching the temporary model with the association model, and determining whether to mark the log records; Or, traversing and analyzing whether there are abnormalities in the log records to mark the corresponding abnormal segments; Among them, the constraint discrete features include a time-series constraint discrete degree and a morphological constraint discrete degree, and the temporary model includes a time-series association feature and a morphological association feature.

2. The vulnerability mining method based on a large model according to claim 1, wherein The process of determining the operation types of the trustworthy log segments, generating corresponding tags, and forming a tag combination includes Extracting the operation descriptions in each trustworthy log segment within the time-domain reference range and determining the corresponding operation types; Generating tags based on the operation types, sorting the tags according to the time series of the trustworthy log segments, and forming the tag combination; Among them, the time-domain reference range is a pre-set time period, each trustworthy log segment only contains the description of a single operation, and each operation type corresponds to a tag one by one.

3. The vulnerability mining method based on a large model according to claim 1, wherein The process of determining the time-series association constraint feature includes Determining the generation time of the trustworthy log segments corresponding to each tag in a number of the tag combinations; Based on the generation times in each tag combination, determining a number of generation time intervals to obtain the mean value of the generation time intervals; Based on the mean value of the generation time intervals, determining the upper limit and lower limit of the time-series association constraint; Constructing a constraint range based on the upper limit and lower limit of the time-series association constraint, and determining the constraint range as the time-series association constraint feature; Among them, the variance of each time interval is determined as the time-series constraint discrete degree.

4. The vulnerability mining method based on a large model according to claim 3, wherein The process of determining the morphological association constraint feature includes Determining the lengths and length variances of the trustworthy log segments corresponding to the tags in a number of the tag combinations; Solving the mean length for each tag, and determining the length range for each tag based on the mean length; Determining the length range for each tag as the morphological association constraint feature of the tag combination; Among them, the mean value of the length variances corresponding to each tag is determined as the morphological constraint discrete degree.

5. The vulnerability mining method based on the large model according to claim 4, wherein The process of setting effective sub-tags for the tag combination based on the occurrence probability of each tag combination and the association model corresponding to the tag combination includes Verifying whether the tag combination meets the effective conditions; If the valid conditions are met, set valid sub-tags for the tag combination; Among them, the valid conditions are that the occurrence probability of the tag combination is greater than a predetermined occurrence probability threshold, and the temporal constraint dispersion degree of the correlation model corresponding to the tag combination is less than a predetermined temporal constraint dispersion threshold, and the morphological constraint dispersion degree of the correlation model corresponding to the tag combination is less than a predetermined morphological constraint dispersion threshold.

6. The vulnerability mining method based on a large model according to claim 1, wherein Analyzing the log record according to the valid sub-tags corresponding to the current tag combination includes If the tag combination is set with valid sub-tags, determine the correlation model corresponding to the tag combination, extract the log record to construct a temporary model, match the temporary model with the correlation model, and determine whether to mark the log record; If the tag combination is not set with valid sub-tags, traverse and analyze whether there is an abnormality in the log record to mark the corresponding abnormal segment.

7. The vulnerability mining method based on a large model according to claim 1, characterized in that The process of extracting the log record to construct a temporary model includes Determine the generation time of each log segment in the log record, determine the average value of the generation time interval, and obtain the temporal correlation feature; Determine the length of each log segment in the log record, sort the lengths according to the generation time of the log segments, and obtain the morphological correlation feature.

8. The vulnerability mining method based on a large model according to claim 7, characterized in that The process of matching the temporary model with the correlation model to determine whether to mark the log record includes Extract the temporal correlation feature of the temporary model and determine whether the temporal correlation feature is within the temporal correlation constraint feature of the correlation model; Extract the morphological correlation feature of the temporary model and determine whether the length of each tag in the morphological correlation feature is within the length range of each tag in the temporal correlation constraint feature; If the matching conditions are met, mark the log record; Among them, the matching conditions are that the temporal correlation feature is within the temporal correlation constraint feature of the correlation model, and the length of each tag in the morphological correlation feature is within the length range of each tag in the temporal correlation constraint feature.

9. The vulnerability mining method based on a large model according to claim 1, characterized in that The process of traversing and analyzing whether there is an abnormality in the log record to mark the corresponding abnormal segment includes Traverse and analyze whether there is a preset abnormal character segment in the log record; If there is an abnormal character segment, determine and mark the corresponding abnormal character segment.

10. The vulnerability mining method based on a large model according to claim 1, wherein, It also includes storing the marked log records in the vulnerability mining reference sample library.

Images