A vulnerability mining method based on large models

Abstract

The present invention relates to the field of vulnerability mining, and in particular to a vulnerability mining method based on a large model. The present invention constructs a label combination library for working condition terminals, and subsequently constructs an association model for the label combination based on the trusted log fragments corresponding to each label in the label combination. Valid sub-labels are set for the label combination based on the occurrence probability of each label combination and the constrained discrete characteristics of the association model corresponding to the label combination. Subsequently, for new log records, the current label combination of the current log record is analyzed, and the log record is adaptively analyzed based on the valid sub-labels corresponding to the current label combination. The present invention considers the potential laws of the operation process of the industrial control terminal, constructs an association model for the log record under a specific label combination, and analyzes the log record based on the adaptability of the effectiveness of the label combination. When faced with massive log records, the present invention quickly marks log fragments that may represent potential abnormal vulnerabilities in the system, thereby improving the accuracy and efficiency of vulnerability mining.

Description

Technical Field

[0001] The present invention relates to the field of vulnerability mining, and in particular to a vulnerability mining method based on a large model. Background Art

[0002] Vulnerability mining refers to the process of actively searching for and identifying unknown security flaws (vulnerabilities) in software, systems, networks, or hardware. These vulnerabilities may lead to serious consequences such as information leakage, system control, service interruption, or system operation errors. Vulnerability mining is an important part of the information security field.

[0003] For example, Chinese patent publication number: CN106130966A, discloses a vulnerability mining detection method, server, device and system. The method includes: obtaining suspicious sample logs uploaded by the client; deduplicating the obtained suspicious sample logs; for each suspicious sample log remaining after deduplication, inputting the suspicious sample log into a sandbox for scanning to obtain a scan log, and determining whether the sample corresponding to the suspicious sample log has a vulnerability based on the scan log. In this solution, each client is used as a probe spread across the Internet to collect suspicious sample logs corresponding to suspicious files, which can more comprehensively mine relevant information about samples that may have vulnerabilities on the Internet; then, based on the scan log, samples that do have security vulnerabilities are determined from samples that may have vulnerabilities, clarifying the actual security status of each sample; the scanning is performed in the sandbox on the server side, providing a closed operating environment for the suspicious sample log, thereby ensuring the security of the server side during the detection process.

[0004] However, the prior art still has the following problems:

[0005] Typically, an industrial control terminal will perform several operations under normal operation. Some continuous operations have certain regularities, which will be reflected in the operation logs accordingly. When there are vulnerabilities or anomalies, the operation of the system will break this regularity. In the existing technology, the amount of data required to analyze when mining vulnerabilities in the operation logs is massive, which consumes a lot of computing power and does not utilize the regularity of the normal operation of the industrial control terminal. As a result, when the amount of operation logs is large, the accuracy of mining potential vulnerabilities is poor and the efficiency is low. Summary of the Invention

[0006] To this end, the present invention provides a vulnerability mining method based on a large model to overcome the problems in the prior art, that is, when analyzing vulnerabilities in operation logs, the amount of data required to be analyzed is massive, the computing power consumption is large, and the regularity of the normal operation of the industrial control terminal is not utilized, resulting in poor accuracy and low efficiency in mining potential vulnerabilities when the amount of operation logs is large.

[0007] To achieve the above objectives, the present invention provides a vulnerability mining method based on a large model, comprising:

[0008] Split the trusted sample log records of the industrial control terminal to obtain several trusted log fragments;

[0009] Extracting credible log segments within a time domain reference range, determining the operation type of each credible log segment, generating corresponding tags, forming tag combinations, and constructing a tag combination library for the working condition terminal;

[0010] Constructing an association model for the tag combination based on the trusted log segments corresponding to each tag in the tag combination, wherein the association model includes a temporal association constraint feature and a morphological association constraint feature, wherein the temporal association feature is determined based on the generation time of each trusted log segment, and the morphological association constraint feature is determined based on the length of each trusted log segment;

[0011] Based on the occurrence probability of each tag combination and the constrained discrete characteristics of the tag combination corresponding to the association model, valid sub-tags are set for the tag combination;

[0012] The current tag combination of the log record generated by the interval time domain reference range analysis is analyzed, and the log record is analyzed according to the valid sub-tags corresponding to the current tag combination, including:

[0013] Determine the association model corresponding to the tag combination, extract the log record to build a temporary model, match the temporary model with the association model, and determine whether to mark the log record;

[0014] Or, traverse and analyze the log records to see if there are any exceptions, so as to mark the corresponding abnormal fragments;

[0015] The constrained discrete features include temporal constraint discreteness and morphological constraint discreteness, and the temporary model includes temporal correlation features and morphological correlation features.

[0016] Furthermore, the process of determining the operation type of each of the trusted log segments, generating corresponding labels, and forming a label combination includes:

[0017] Extracting operation descriptions from each of the trusted log segments within a time domain reference range to determine corresponding operation types;

[0018] Generate tags based on the operation type, and sort the tags according to the time sequence of the trusted log segments to form the tag combination;

[0019] The time domain reference range is a preset time period, and each operation type corresponds to a label one by one.

[0020] Furthermore, the process of determining the characteristics of the timing association constraints includes:

[0021] Determining the generation time of the trusted log fragment corresponding to each tag in the plurality of tag combinations;

[0022] determining a plurality of generation time intervals based on the generation time of each of the tag combinations to obtain a mean value of the generation time intervals;

[0023] Determine the upper limit of the timing association constraint and the lower limit of the timing association constraint based on the mean of the generation time interval,

[0024] A constraint range is constructed based on the upper limit and the lower limit of the timing correlation constraint, and the constraint range is determined as a timing correlation constraint feature;

[0025] The variance of each time interval is determined as the timing constraint discreteness.

[0026] Furthermore, the process of determining the morphological association constraint features includes:

[0027] Determining the lengths and length variances of a plurality of credible log segments corresponding to the labels in the plurality of label combinations;

[0028] Calculate the mean length of each tag, and determine the length range of each tag based on the mean length;

[0029] Determining the length range of each tag as a morphological association constraint feature of the tag combination;

[0030] Among them, the mean value of the length variance corresponding to each label is determined as the morphological constraint dispersion.

[0031] Furthermore, the process of setting valid sub-labels for the label combinations based on the occurrence probability of each label combination and the association model corresponding to the label combination includes:

[0032] Verify whether the tag combination meets the valid conditions;

[0033] If the validity condition is met, a valid sub-tag is set for the tag combination;

[0034] Among them, the validity condition is that the occurrence probability of the label combination is greater than a predetermined occurrence probability threshold, and the temporal constraint discreteness of the association model corresponding to the label combination is less than a predetermined temporal constraint discrete threshold, and the morphological constraint discreteness of the association model corresponding to the label combination is less than a predetermined morphological constraint discrete threshold.

[0035] Furthermore, the log records are analyzed based on the valid sub-tags corresponding to the current tag combination, including:

[0036] If the tag combination is set with a valid subtag, determine the association model corresponding to the tag combination, extract the log record to build a temporary model, match the temporary model with the association model, and determine whether to mark the log record;

[0037] If the tag combination is not set with a valid subtag, the log record is traversed and analyzed to see if there is any anomaly, so as to mark the corresponding abnormal fragment.

[0038] Furthermore, the process of extracting the log records to construct a temporary model includes:

[0039] Determine the generation time of each log fragment in the log record, determine the mean time interval between the generation times, and obtain the time series correlation feature;

[0040] Determine the length of each log segment in the log record, sort the lengths according to the generation time of the log segments, and obtain the morphological correlation features.

[0041] Furthermore, the process of matching the temporary model with the association model and determining whether to mark the log record includes:

[0042] Extracting the temporal correlation feature of the temporary model, and determining whether the temporal correlation feature is within the temporal correlation constraint feature of the correlation model;

[0043] Extracting the morphological association features of the temporary model, and determining whether the length of each label in the morphological association features is within the length range of each label in the temporal association constraint features;

[0044] If the matching condition is met, marking the log record;

[0045] The matching condition is that the temporal correlation feature is within the temporal correlation constraint feature of the correlation model, and the length of each label in the morphological correlation feature is within the length range of each label in the temporal correlation constraint feature.

[0046] Furthermore, the process of traversing and analyzing the log records to see if there are any exceptions and marking the corresponding abnormal fragments includes:

[0047] Traverse and analyze the log records to see if there are any preset abnormal character segments;

[0048] If there is an abnormal character segment, the determination mark corresponds to the abnormal character segment.

[0049] Furthermore, the method also includes storing the marked log records in a vulnerability mining reference sample library.

[0050] Compared with the prior art, the beneficial effect of the present invention lies in that the present invention divides the trusted sample log records of the industrial control terminal, extracts the trusted log fragments within the time domain reference range, and constructs a label combination library for the working condition terminal. Subsequently, an association model for the label combination is constructed based on the trusted log fragments corresponding to each label in the label combination. Based on the occurrence probability of each label combination and the constrained discrete characteristics of the association model corresponding to the label combination, a valid sub-label is set for the label combination. Subsequently, for the new log record, the current label combination of the current log record is analyzed, and the log record is adaptively analyzed according to the valid sub-label corresponding to the current label combination, including using the association model to determine whether to mark the log record and traversing and analyzing the log record to see if there is an anomaly, so as to mark the corresponding abnormal fragment. The present invention considers the potential laws of the operation process of the industrial control terminal, constructs an association model for the log record under a specific label combination, and analyzes the log record based on the adaptability of the effectiveness of the label combination. When faced with massive log records, the log fragments that may represent potential abnormal vulnerabilities in the system are quickly marked, thereby improving the accuracy and efficiency of vulnerability mining.

[0051] In particular, the present invention determines the operation type of a trusted log segment. The trusted log segment only contains a description of a single operation and can determine the corresponding operation type. In actual situations, the tasks of industrial control terminals are mostly regular, and under normal operation, certain specific operation combinations show regularity in multiple dimensions. Therefore, the present invention considers determining a label combination to characterize a specific operation combination, and subsequently constructing an association model for the label combination. The association model includes temporal association constraint features and morphological association constraint features, which respectively reflect the regularity of each operation in the temporal dimension under the corresponding operation combination, as well as the regularity of the log record code performance dimension. Based on this, an association model is constructed. Under normal system operation, the execution of a specific operation combination usually maintains this regularity. When there is a vulnerability anomaly in the system, the actual operation of the system will break this regularity. Then, based on the association model, it is convenient to adaptively select the analysis method for the log record. When faced with massive log records, log segments that may represent potential abnormal vulnerabilities in the system are quickly marked to improve the accuracy and efficiency of vulnerability mining.

[0052] In particular, the present invention constructs specific timing association constraint features and morphological association constraint features as components of the association model. In actual situations, under a specific operation combination, the timing relationship of each operation may have a certain regularity. If the system is abnormal, it may cause the timing of the actual execution of the operation to change, or the operation itself to change. Then, with the real-time generation of log records, there will be feedback on the log records. Similarly, under a specific operation combination, the system is operating normally, and the generation of log records usually maintains regularity. If the system is abnormal and the operation is executed incorrectly, resulting in additional content or missing content in the log records, the regularity will also be broken, and then there will be feedback on the log records. Based on this, the present invention selects timing association constraint features and morphological association constraint features to construct the association model, which is convenient for the subsequent construction of a temporary model to match the association model. When faced with massive log records, log fragments that may represent potential abnormal vulnerabilities in the system are quickly marked, thereby improving the accuracy and efficiency of vulnerability mining.

[0053] In particular, the present invention sets effective sub-labels for label combinations, takes into account the occurrence probability of each label combination and the constrained discrete characteristics of the association model, considers the sporadic nature of the label combination through the occurrence probability, and considers whether the log records under the corresponding label combination are relatively discrete in the time series dimension and the morphological label dimension through the constrained discrete characteristics, and it is difficult to observe regularity. Then, label combinations with strong data representativeness are screened out and used for subsequent construction of temporary models for the corresponding label combinations to verify whether the regularity of the log records corresponding to the time series dimension and the morphological expression dimension under a specific label combination is broken, and then quickly mark log fragments that may represent potential abnormal vulnerabilities in the system, thereby improving the accuracy and efficiency of vulnerability mining. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 A schematic diagram of the steps of a vulnerability mining method based on a large model according to an embodiment of the invention;

[0055] Figure 2 A logic block diagram of setting valid sub-tags according to an embodiment of the invention;

[0056] Figure 3 This is a logic block diagram of analyzing log records based on valid sub-tags corresponding to the current tag combination according to an embodiment of the invention. DETAILED DESCRIPTION

[0057] In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are merely used to explain the present invention and are not intended to limit the present invention.

[0058] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the scope of protection of the present invention.

[0059] See also Figure 1 As shown, Figure 1 The following is a schematic diagram of the steps of a vulnerability mining method based on a large model according to an embodiment of the present invention. The vulnerability mining method based on a large model according to an embodiment of the present invention includes:

[0060] Step S1: segment the trusted sample log records of the industrial control terminal to obtain several trusted log fragments;

[0061] Step S2: extracting credible log segments within a time domain reference range, determining the operation type of each credible log segment, generating corresponding tags, forming tag combinations, and constructing a tag combination library for the working condition terminal;

[0062] Step S3: constructing an association model for the tag combination based on the trusted log segments corresponding to each tag in the tag combination, wherein the association model includes a temporal association constraint feature and a morphological association constraint feature, wherein the temporal association feature is determined based on the generation time of each trusted log segment, and the morphological association constraint feature is determined based on the length of each trusted log segment;

[0063] Step S4: setting valid sub-labels for the label combination based on the occurrence probability of each label combination and the constrained discrete characteristics of the association model corresponding to the label combination;

[0064] Step S5: Analyze the current tag combination of the log record generated by the interval time domain reference range, and analyze the log record according to the valid sub-tags corresponding to the current tag combination, including:

[0065] Determine the association model corresponding to the tag combination, extract the log record to build a temporary model, match the temporary model with the association model, and determine whether to mark the log record;

[0066] Or, traverse and analyze the log records to see if there are any exceptions, so as to mark the corresponding abnormal fragments;

[0067] The constrained discrete features include temporal constraint discreteness and morphological constraint discreteness, and the temporary model includes temporal correlation features and morphological correlation features.

[0068] Specifically, there is no limitation on the method of obtaining trusted log records. Historical log records of the corresponding industrial control equipment under normal operation can be recorded in advance and used as trusted log records. The recording period is selected within 10 to 30 days, which will not be elaborated here.

[0069] Specifically, the purpose of setting the time domain reference range is to observe the combination of operations performed by the industrial control terminal within a certain period of time. The average time required for the industrial control terminal to complete a single operation can be recorded in advance. The time domain reference range is selected within 3 to 5 times the average time. Of course, it can also be other forms, which will not be repeated here.

[0070] Specifically, there is no limitation on the form of setting labels. The purpose of setting labels is to perform classification. Those skilled in the art can adopt any form of label setting, which will not be described in detail here.

[0071] Specifically, the process of determining the operation type of each of the trusted log segments, generating corresponding labels, and forming a label combination includes:

[0072] Extracting operation descriptions from each of the trusted log segments within a time domain reference range to determine corresponding operation types;

[0073] Generate tags based on the operation type, and sort the tags according to the time sequence of the trusted log segments to form the tag combination;

[0074] The time domain reference range is a preset time period, and each operation type corresponds to a label one by one.

[0075] Specifically, the trusted log fragment contains a description of the relevant operation, such as the operation execution time, the operation execution subject, the operation type, and the operation object. In actual situations, the operation type can be determined by reading the operation description in the trusted log fragment.

[0076] In implementation, a one-to-one corresponding label is pre-set for each operation type. The label format is not limited and can be in the form of any characters, as long as the operation type and the label are in one-to-one correspondence.

[0077] In implementation, the generation time of log records is usually related to the operation execution time. It can be a synchronous log, where the log record is generated synchronously with the operation, or an asynchronous log, where the corresponding log record is generated after the operation is completed. Both synchronous logs and asynchronous logs are existing log generation forms and will not be described in detail here.

[0078] In implementation, there is a temporal relationship in the generation of trusted log segments, and tags are arranged in sequence based on the temporal relationship to form a tag combination, which will not be described in detail.

[0079] The present invention determines the operation type of a trusted log segment. The trusted log segment only contains a description of a single operation and can determine the corresponding operation type. In actual situations, the tasks of industrial control terminals are mostly regular, and under normal operation, certain specific operation combinations show regularity in multiple dimensions. Therefore, the present invention considers determining a label combination to characterize a specific operation combination, and subsequently constructs an association model for the label combination. The association model includes temporal association constraint features and morphological association constraint features, which respectively reflect the regularity of each operation in the temporal dimension under the corresponding operation combination, as well as the regularity of the log record code performance dimension. Based on this, an association model is constructed. Under normal system operation, the execution of a specific operation combination usually maintains this regularity. When there is a vulnerability anomaly in the system, the actual operation of the system will break this regularity. Then, based on the association model, it is convenient to adaptively select an analysis method for log records. When faced with massive log records, log segments that may represent potential abnormal vulnerabilities in the system are quickly marked to improve the accuracy and efficiency of vulnerability mining.

[0080] Specifically, the process of determining the characteristics of timing association constraints includes:

[0081] Determining the generation time of the trusted log fragment corresponding to each tag in the plurality of tag combinations;

[0082] determining a plurality of generation time intervals based on the generation time of each of the tag combinations to obtain a mean value of the generation time intervals;

[0083] Determine the upper limit of the timing association constraint and the lower limit of the timing association constraint based on the mean of the generation time interval,

[0084] A constraint range is constructed based on the upper limit and the lower limit of the timing correlation constraint, and the constraint range is determined as a timing correlation constraint feature;

[0085] The variance of each time interval is determined as the timing constraint discreteness.

[0086] In implementation, a first timing offset coefficient and a second timing offset coefficient are set, the upper limit of the timing association constraint is determined as the product of the mean time interval and the first timing offset coefficient, and the lower limit of the timing association constraint is determined as the product of the mean time interval and the second timing offset coefficient. The first timing offset coefficient is selected within the interval [1.25, 1.45], and the second timing offset coefficient is selected within the interval [0.65, 0.85]. The interval corresponding to the constraint range constructed based on the upper limit of the timing association constraint and the lower limit of the timing association constraint is a closed interval.

[0087] Specifically, the process of determining the morphological association constraint features includes:

[0088] Determining the lengths and length variances of a plurality of credible log segments corresponding to the labels in the plurality of label combinations;

[0089] Calculate the mean length of each tag, and determine the length range of each tag based on the mean length;

[0090] Determining the length range of each tag as a morphological association constraint feature of the tag combination;

[0091] Among them, the mean value of the length variance corresponding to each label is determined as the morphological constraint dispersion.

[0092] In implementation, since the trusted sample logs are historical log records, there may be several identical label combinations. Thus, the lengths and length variances of the trusted log segments corresponding to the identical labels in the several label combinations can be calculated.

[0093] In implementation, the length range is determined based on the mean length, the upper limit of the length range is set as the product of the mean length and the first form offset coefficient, and the lower limit of the length range is set as the product of the mean length and the second form offset coefficient. The first form offset coefficient is selected in the interval [1.45, 1.55], and the second form offset coefficient is selected in the interval [0.55, 0.65].

[0094] The present invention constructs specific timing association constraint features and morphological association constraint features as components of the association model. In actual situations, under a specific operation combination, the timing relationship of each operation may have a certain regularity. If the system is abnormal, it may cause the timing of the actual execution of the operation to change, or the operation itself to change. Then, with the real-time generation of log records, there will be feedback on the log records. Similarly, under a specific operation combination, the generation of log records usually maintains regularity during normal system operation. If the system is abnormal and the operation is executed incorrectly, resulting in additional content or missing content in the log records, the regularity will also be broken, and then there will be feedback on the log records. Based on this, the present invention selects timing association constraint features and morphological association constraint features to construct the association model, which is convenient for the subsequent construction of a temporary model to match the association model. When faced with massive log records, log fragments that may represent potential abnormal vulnerabilities in the system are quickly marked, thereby improving the accuracy and efficiency of vulnerability mining.

[0095] Specifically, see Figure 2 As shown, Figure 2 This is a logic block diagram of setting valid sub-tags according to an embodiment of the invention. The process of setting valid sub-tags for a tag combination based on the occurrence probability of each tag combination and the association model corresponding to the tag combination includes:

[0096] Verify whether the tag combination meets the valid conditions;

[0097] If the validity condition is met, a valid sub-tag is set for the tag combination;

[0098] Among them, the validity condition is that the occurrence probability of the label combination is greater than a predetermined occurrence probability threshold, and the temporal constraint discreteness of the association model corresponding to the label combination is less than a predetermined temporal constraint discrete threshold, and the morphological constraint discreteness of the association model corresponding to the label combination is less than a predetermined morphological constraint discrete threshold.

[0099] The present invention sets effective sub-labels for label combinations, considers the occurrence probability of each label combination and the constrained discrete characteristics of the association model, considers the sporadic nature of the label combination through the occurrence probability, and considers whether the log records in the time series dimension and the morphological label dimension under the corresponding label combination are relatively discrete through the constrained discrete characteristics, and whether the regularity is difficult to observe. Then, the label combinations with strong data representativeness are screened out and used for subsequent construction of a temporary model for the corresponding label combination to verify whether the regularity of the log records in the time series dimension and the morphological expression dimension under the specific label combination is broken, thereby quickly marking the log fragments that may represent the existence of potential abnormal vulnerabilities in the system, thereby improving the accuracy and efficiency of vulnerability mining.

[0100] Specifically, the occurrence probability threshold is determined based on the average occurrence probability of several tag combinations and is set to 1.15 times the average occurrence probability.

[0101] The discrete thresholds of the timing constraint and the discrete thresholds of the morphology constraint are predetermined, where:

[0102] Pre-record the discreteness of the timing constraints of each label combination and calculate the mean of the discreteness of the timing constraints;

[0103] Pre-record the morphological constraint discreteness of each label combination and calculate the mean of the morphological constraint discreteness;

[0104] The discrete threshold of the timing constraint is set as the product of the mean of the timing constraint discreteness and the error coefficient, and the discrete threshold of the morphological constraint is set as the product of the mean of the morphological constraint discreteness and the error coefficient. The error coefficient is selected in the interval [0.85, 0.95].

[0105] Specifically, see Figure 3 As shown, Figure 3 This is a logic block diagram of analyzing log records according to valid sub-tags corresponding to the current tag combination according to an embodiment of the invention. Analyzing log records according to valid sub-tags corresponding to the current tag combination includes:

[0106] If the tag combination is set with a valid subtag, determine the association model corresponding to the tag combination, extract the log record to build a temporary model, match the temporary model with the association model, and determine whether to mark the log record;

[0107] If the tag combination is not set with a valid subtag, the log records are traversed and analyzed to see if there are any exceptions, so as to mark the corresponding exception fragments.

[0108] Specifically, new log records are continuously generated. Each time domain reference range generates log record segments for several operations. By determining the label of each log record segment, the current label combination can be analyzed. This will not be repeated here.

[0109] Specifically, the process of extracting the log records to construct a temporary model includes:

[0110] Determine the generation time of each log fragment in the log record, determine the mean time interval between the generation times, and obtain the time series correlation feature;

[0111] Determine the length of each log segment in the log record, sort the lengths according to the generation time of the log segments, and obtain the morphological correlation features.

[0112] Specifically, the process of matching the temporary model with the association model and determining whether to mark the log record includes:

[0113] Extracting the temporal correlation feature of the temporary model, and determining whether the temporal correlation feature is within the temporal correlation constraint feature of the correlation model;

[0114] Extracting the morphological association features of the temporary model, and determining whether the length of each label in the morphological association features is within the length range of each label in the temporal association constraint features;

[0115] If the matching condition is met, marking the log record;

[0116] The matching condition is that the temporal correlation feature is within the temporal correlation constraint feature of the correlation model, and the length of each label in the morphological correlation feature is within the length range of each label in the temporal correlation constraint feature.

[0117] Specifically, the process of traversing and analyzing the log records to see if there are any exceptions and marking the corresponding abnormal fragments includes:

[0118] Traverse and analyze the log records to see if there are any preset abnormal character segments;

[0119] If there is an abnormal character segment, the determination mark corresponds to the abnormal character segment.

[0120] During implementation, abnormal character segments that may appear in several log records and indicate abnormalities may be counted in advance, for example, Segmentation fault (core dumped), which indicates that the program attempts to access a non-existent memory address or attempts to access a memory address for which it has no permission.

[0121] Specifically, it also includes storing the marked log records in a vulnerability mining reference sample library.

[0122] Specifically, these log records have a high abnormal tendency, and the corresponding code is likely to have abnormal vulnerabilities. Therefore, the code of the industrial control terminal can be traced based on the corresponding log records, and then the code can be analyzed to see whether there are vulnerabilities. This will not be repeated here.

[0123] Specifically, there is no limitation on the method of tracing the source code based on log records. For example, the corresponding code file can be found for analysis by stack tracing. Of course, those skilled in the art can use any feasible method to estimate the code, which will not be elaborated here.

[0124] If the large-model-based vulnerability mining method of the present invention is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a mobile hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0125] Thus far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it will be readily understood by those skilled in the art that the scope of protection of the present invention is obviously not limited to these specific embodiments. Without departing from the principles of the present invention, those skilled in the art may make equivalent changes or substitutions to the relevant technical features, and the technical solutions after such changes or substitutions will fall within the scope of protection of the present invention.

Claims

1. A vulnerability mining method based on a large model, characterized in that: include: Split the trusted sample log records of the industrial control terminal to obtain several trusted log fragments; Extracting credible log segments within a time domain reference range, determining the operation type of each credible log segment, generating corresponding tags, forming tag combinations, and constructing a tag combination library for the working condition terminal; Constructing an association model for the tag combination based on the trusted log segments corresponding to each tag in the tag combination, wherein the association model includes a temporal association constraint feature and a morphological association constraint feature, wherein the temporal association constraint feature is determined based on the generation time of each trusted log segment, and the morphological association constraint feature is determined based on the length of each trusted log segment; Based on the occurrence probability of each tag combination and the constrained discrete characteristics of the tag combination corresponding to the association model, valid sub-tags are set for the tag combination; The current tag combination of the log record generated by the interval time domain reference range analysis is analyzed, and the log record is analyzed according to the valid sub-tags corresponding to the current tag combination, including: Determine the association model corresponding to the tag combination, extract the log record to build a temporary model, match the temporary model with the association model, and determine whether to mark the log record; Or, traverse and analyze the log records to see if there are any exceptions, so as to mark the corresponding abnormal fragments; The constrained discrete features include temporal constraint discreteness and morphological constraint discreteness, and the temporary model includes temporal correlation features and morphological correlation features.

2. The vulnerability mining method based on a large model according to claim 1 is characterized in that: The process of determining the operation type of each of the trusted log segments, generating corresponding labels, and forming a label combination includes: Extracting operation descriptions from each of the trusted log segments within a time domain reference range to determine corresponding operation types; Generate tags based on the operation type, and sort the tags according to the time sequence of the trusted log segments to form the tag combination; The time domain reference range is a preset time period, each of the trusted log segments only contains a description of a single operation, and each of the operation types corresponds to a label one-to-one.

3. The vulnerability mining method based on a large model according to claim 1 is characterized in that: The process of determining the characteristics of timing correlation constraints includes: Determining the generation time of the trusted log fragment corresponding to each tag in the plurality of tag combinations; determining a plurality of generation time intervals based on the generation time of each of the tag combinations to obtain a mean value of the generation time intervals; Determine the upper limit of the timing association constraint and the lower limit of the timing association constraint based on the mean of the generation time interval, A constraint range is constructed based on the upper limit and the lower limit of the timing correlation constraint, and the constraint range is determined as a timing correlation constraint feature; The variance of each time interval is determined as the timing constraint discreteness.

4. The vulnerability mining method based on a large model according to claim 3 is characterized in that: The process of determining the morphological association constraint features includes: Determining the lengths and length variances of a plurality of credible log segments corresponding to the labels in the plurality of label combinations; Calculate the mean length of each tag, and determine the length range of each tag based on the mean length; Determining the length range of each tag as a morphological association constraint feature of the tag combination; Among them, the mean value of the length variance corresponding to each label is determined as the morphological constraint dispersion.

5. The vulnerability mining method based on a large model according to claim 4 is characterized in that: The process of setting valid sub-labels for the label combinations based on the occurrence probability of each label combination and the association model corresponding to the label combination includes: Verify whether the tag combination meets the valid conditions; If the validity condition is met, a valid sub-tag is set for the tag combination; Among them, the validity condition is that the occurrence probability of the label combination is greater than a predetermined occurrence probability threshold, and the temporal constraint discreteness of the association model corresponding to the label combination is less than a predetermined temporal constraint discrete threshold, and the morphological constraint discreteness of the association model corresponding to the label combination is less than a predetermined morphological constraint discrete threshold.

6. The vulnerability mining method based on a large model according to claim 1 is characterized in that: Analyze log records based on the valid sub-tags corresponding to the current tag combination, including: If the tag combination is set with a valid subtag, determine the association model corresponding to the tag combination, extract the log record to build a temporary model, match the temporary model with the association model, and determine whether to mark the log record; If the tag combination is not set with a valid subtag, the log records are traversed and analyzed to see if there are any exceptions, so as to mark the corresponding exception fragments.

7. The vulnerability mining method based on a large model according to claim 1 is characterized in that: The process of extracting the log records and constructing a temporary model includes: Determine the generation time of each log fragment in the log record, determine the mean time interval between the generation times, and obtain the time series correlation feature; Determine the length of each log segment in the log record, sort the lengths according to the generation time of the log segments, and obtain the morphological correlation features.

8. The vulnerability mining method based on a large model according to claim 7 is characterized in that: The process of matching the temporary model with the associated model and determining whether to mark the log record includes: Extracting the temporal correlation feature of the temporary model, and determining whether the temporal correlation feature is within the temporal correlation constraint feature of the correlation model; Extracting the morphological association features of the temporary model, and determining whether the length of each label in the morphological association features is within the length range of each label in the temporal association constraint features; If the matching condition is met, marking the log record; The matching condition is that the temporal correlation feature is within the temporal correlation constraint feature of the correlation model, and the length of each label in the morphological correlation feature is within the length range of each label in the temporal correlation constraint feature.

9. The vulnerability mining method based on a large model according to claim 1, characterized in that: The process of traversing and analyzing log records to see if there are any exceptions and marking the corresponding abnormal fragments includes: Traverse and analyze the log records to see if there are any preset abnormal character segments; If there is an abnormal character segment, the determination mark corresponds to the abnormal character segment.

10. The vulnerability mining method based on a large model according to claim 1, characterized in that: It also includes storing the marked log records in a vulnerability mining reference sample library.

Images