Security vulnerability repair priority evaluation method, device and equipment

Abstract

The invention discloses a security vulnerability repair priority evaluation method, device and equipment, and relates to the technical field of server security, and the method comprises the steps: after searching security vulnerabilities contained in each application component, determining a first vulnerability risk score corresponding to each security vulnerability by using a general vulnerability scoring system; according to the actual application scene of the system, correcting each first vulnerability risk score by using the factor value corresponding to each preset application scene influence factor of the system to obtain each second vulnerability risk score, thereby helping a user to make a vulnerability repair priority decision based on the current application scene, and solving the problems of poor applicability to different users and high vulnerability repair efficiency. The technical problem that the vulnerability repair priority decision is inaccurate due to the fact that the vulnerability repair priority decision is not accurate is solved, and the technical effects that the vulnerability repair priority decision is made by fully combining the user system application scene, the applicability to different users is improved, and the accuracy of the vulnerability repair priority decision is improved are achieved.

Description

Technical Field

[0001] The present application relates to the field of server security technology, and in particular to a method, apparatus, and device for evaluating the priority of security vulnerability repairs. Background Art

[0002] Common Vulnerabilities and Exposures (CVE) are used to describe and identify known vulnerabilities and security risks in information security. CVE is a public list or database that provides standardized names for publicly known information security vulnerabilities and risks. Each CVE identifier is unique and follows a specific format. These identifiers ensure consistency when discussing, analyzing, or remediating specific vulnerabilities.

[0003] There are many different types of components in the system, and new Common Vulnerability (CVE) vulnerabilities are constantly being exposed. System users must promptly patch these CVE vulnerabilities to ensure overall system security. Currently, vulnerability severity is typically assessed based on the Common Vulnerability Scoring System (CVSS) score of each CVE vulnerability to help users prioritize vulnerability remediation. However, the CVSS assessment system is not well-suited to different users, leading to inaccurate vulnerability remediation priority decisions. Summary of the Invention

[0004] The present application provides a method, apparatus, and device for evaluating the priority of security vulnerability repair, so as to at least solve the problem that the related technology is not suitable for different users, resulting in inaccurate vulnerability repair priority decisions.

[0005] This application provides a security vulnerability repair priority assessment method, including: Identify the system's software bill of materials and obtain each application component; Find the security vulnerabilities contained in each application component and use the common vulnerability scoring system to evaluate the first vulnerability risk score corresponding to each security vulnerability; Obtain the factor values corresponding to the impact factors of each preset application scenario of the system; Using the values of each factor to modify each first vulnerability risk score to obtain each second vulnerability risk score; The repair priority of each security vulnerability is determined according to the second vulnerability risk score.

[0006] This application also provides a security vulnerability repair priority assessment device, including: The application component acquisition module is used to identify the system's software bill of materials and obtain each application component; A first vulnerability risk scoring assessment module is used to find security vulnerabilities contained in each application component and use a common vulnerability scoring system to assess a first vulnerability risk score corresponding to each security vulnerability; A factor value acquisition module is used to obtain the factor values corresponding to the influencing factors of each preset application scenario of the system; A second vulnerability risk score obtaining module is used to modify each first vulnerability risk score using the values of each factor to obtain each second vulnerability risk score; The repair priority determination module is used to determine the repair priority of each security vulnerability according to each second vulnerability risk score.

[0007] The present application also provides an electronic device, comprising: a memory for storing a computer program; and a processor for implementing the steps of any of the above-mentioned security vulnerability repair priority assessment methods when executing the computer program.

[0008] The present application also provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned security vulnerability repair priority assessment methods are implemented.

[0009] The present application also provides a computer program product, including a computer program, which implements the steps of any of the above-mentioned security vulnerability repair priority assessment methods when executed by a processor.

[0010] Through this application, after finding the security vulnerabilities contained in each application component, on the basis of using the general vulnerability scoring system to determine the first vulnerability risk score corresponding to each security vulnerability, according to the actual application scenario of the system, the first vulnerability risk score is corrected using the factor values corresponding to the system's preset application scenario influencing factors to obtain each second vulnerability risk score, thereby helping users make vulnerability repair priority decisions based on the current application scenario. Therefore, it can solve the technical problem of poor applicability to different users and inaccurate vulnerability repair priority decisions, and achieve the technical effect of fully combining the user system application scenario to make vulnerability repair priority decisions, improving applicability to different users, and improving the accuracy of vulnerability repair priority decisions. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0012] Figure 1A flowchart of a security vulnerability repair priority assessment method provided in an embodiment of the present application; Figure 2 A flowchart of another method for evaluating the priority of security vulnerability repairs provided in an embodiment of the present application; Figure 3 This is a structural block diagram of a security vulnerability repair priority assessment device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0013] The following will be combined with the accompanying drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0014] It should be noted that, in the description of this application, the terms "comprises," "includes," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. The terms "first," "second," etc., in this application are used to distinguish similar objects, and are not used to describe a particular order or sequence.

[0015] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0016] The embodiments of the present application provide a security vulnerability repair priority assessment method, combined with the execution process of the security vulnerability repair priority assessment method.

[0017] See also Figure 1 , Figure 1 This is a flowchart of an implementation method for assessing the priority of security vulnerability repairs provided in an embodiment of the present application. The method may include the following steps.

[0018] S101: Identify the system's software bill of materials and obtain various application components.

[0019] The system's Software Bill of Materials (SBOM) records the components and dependencies of a Linux system. SBOM fields typically include component name, version number, license, and dependency hierarchy. Identify the system's software bill of materials, such as by obtaining it from the Linux product vendor or using automated scanning tools, to identify each application component.

[0020] S102: Find security vulnerabilities contained in each application component, and use a common vulnerability scoring system to evaluate first vulnerability risk scores corresponding to each security vulnerability.

[0021] After identifying the system's software bill of materials and obtaining each application component, search for security vulnerabilities contained in each application component. For example, you can use a CVE crawler to search for CVE vulnerabilities of components in the SBOM list from an external data platform. Based on the component name and version number in the SBOM list, determine whether they match the version number range involved in the vulnerability. This can obtain known CVE vulnerabilities for each component.

[0022] CVSS is a standardized framework for assessing the severity of software security vulnerabilities. It assigns numerical scores or qualitative representations, such as low, medium, high, and critical, based on exploitability, impact on confidentiality, integrity, availability, and required privileges. Higher scores indicate more severe vulnerabilities. CVSS provides a unified approach to assessing the impact of vulnerabilities and comparing risk across different systems and software.

[0023] After finding the security vulnerabilities contained in each application component, a common vulnerability scoring system is used to evaluate the first vulnerability risk score corresponding to each security vulnerability.

[0024] S103: Obtain factor values corresponding to each preset application scenario influencing factor of the system.

[0025] The priority of remediating security vulnerabilities is affected by the actual application scenario, such as component importance, actual deployment environment, operational implementation risk, data importance, and the number of business users. Therefore, it is possible to pre-set application scenario influencing factors, including vulnerability remediation organization implementation capability factors, component importance factors, deployment environment factors, data importance factors, and user number factors. The values of each factor vary depending on the actual application scenario.

[0026] After using the general vulnerability scoring system to evaluate the first vulnerability risk score corresponding to each security vulnerability, obtain the factor values corresponding to each preset application scenario influencing factor of the system, such as the vulnerability repair organization implementation capability factor value corresponding to each security vulnerability, the component importance factor value corresponding to each component, the system deployment environment factor value, the system data importance factor value, and the system user quantity factor value.

[0027] S104: Modify each first vulnerability risk score using the values of each factor to obtain each second vulnerability risk score.

[0028] After obtaining the factor values corresponding to each of the system's preset application scenario impact factors, the first vulnerability risk scores are modified using these factor values to obtain the second vulnerability risk scores. This fully incorporates the user's system application scenario into the vulnerability risk score, improving the accuracy of the resulting vulnerability risk score.

[0029] S105: Determine the repair priority of each security vulnerability according to each second vulnerability risk score.

[0030] Different vulnerability risk score ranges are pre-set to correspond to different repair priorities. After the first vulnerability risk scores are modified using the values of each factor to obtain the second vulnerability risk scores, the repair priority of each security vulnerability is determined based on the second vulnerability risk scores.

[0031] Through this application, after finding the security vulnerabilities contained in each application component, on the basis of using the general vulnerability scoring system to determine the first vulnerability risk score corresponding to each security vulnerability, according to the actual application scenario of the system, the first vulnerability risk score is corrected using the factor values corresponding to the system's preset application scenario influencing factors to obtain each second vulnerability risk score, thereby helping users make vulnerability repair priority decisions based on the current application scenario. Therefore, it can solve the technical problem of poor applicability to different users and inaccurate vulnerability repair priority decisions, and achieve the technical effect of fully combining the user system application scenario to make vulnerability repair priority decisions, improving applicability to different users, and improving the accuracy of vulnerability repair priority decisions.

[0032] See also Figure 2 , Figure 2 This is a flowchart of another implementation method for security vulnerability repair priority assessment provided in an embodiment of the present application. The method may include the following steps.

[0033] S201: Identify the system's software bill of materials to obtain various application components.

[0034] S202: Find security vulnerabilities contained in each application component, and use a common vulnerability scoring system to evaluate first vulnerability risk scores corresponding to each security vulnerability.

[0035] S203: Obtain the vulnerability repair organization implementation capability factor value corresponding to each security vulnerability.

[0036] Vulnerability remediation implementation operations may pose security risks to Linux system operations. Improper vulnerability remediation operations may cause system failures and affect the normal operation of business. Therefore, the vulnerability remediation organization implementation capability factor is used to evaluate the system's vulnerability handling capabilities. After using the common vulnerability scoring system to evaluate and obtain the first vulnerability risk score corresponding to each security vulnerability, the vulnerability remediation organization implementation capability factor value corresponding to each security vulnerability is obtained.

[0037] In a specific implementation of the present application, step S203 may include the following steps: Determine the vulnerability repair organization implementation capability factor value corresponding to each security vulnerability based on whether there is a related organization and vulnerability handling business process for each security vulnerability; Among them, when there is a relevant organization and vulnerability handling business process for the security vulnerability, the vulnerability repair organization implementation capability factor is taken as the first vulnerability repair organization implementation capability factor value; when there is no relevant organization and vulnerability handling business process for the security vulnerability, the vulnerability repair organization implementation capability factor is taken as the second vulnerability repair organization implementation capability factor value.

[0038] The vulnerability repair organization implementation capability factor values corresponding to each security vulnerability are determined based on whether there are relevant organizations and vulnerability handling business processes for each security vulnerability. When a security vulnerability exists with a relevant organization and vulnerability handling business process, the vulnerability repair organization implementation capability factor value is the first vulnerability repair organization implementation capability factor value. When a security vulnerability does not exist with a relevant organization and vulnerability handling business process, the vulnerability repair organization implementation capability factor value is the second vulnerability repair organization implementation capability factor value. For example, the first vulnerability repair organization implementation capability factor value can be set to 1.0, and the second vulnerability repair organization implementation capability factor value can be set to 2.0. By determining the vulnerability repair organization implementation capability factor values corresponding to each security vulnerability based on whether there are relevant organizations and vulnerability handling business processes for each security vulnerability, the accuracy of the determined vulnerability repair organization implementation capability factor values corresponding to each security vulnerability is improved, thereby improving the accuracy of the repair priority decisions for each security vulnerability.

[0039] S204: Obtain component importance factor values corresponding to each application component.

[0040] If the same CVE vulnerability occurs in kernel-level software, it has a greater security impact than if it occurs in ordinary application software. Therefore, the component importance factor value corresponding to each application component can be determined based on the importance of each application component. Obtain the component importance factor value corresponding to each application component.

[0041] In a specific implementation of the present application, step S204 may include the following steps: Step 1: Determine a component type set based on the software package management system's hierarchical mechanism, including hardware resource management components, system call interface and basic service components, file system management and network protocol security policy components, general software components, and environment adaptation components. Step 2: Find the component type of each application component from the component type set; Step 3: Determine the component importance factor value corresponding to each application component according to the component type to which each application component belongs.

[0042] For the convenience of description, the above three steps can be combined for explanation.

[0043] Based on the layered mechanism of the software package management system, a component type set is determined, including hardware resource management components, components that provide system call interfaces and basic services, file system management and network protocol security policy components, general software components, and environment adaptation components. Hardware resource management components may include components for operations such as Central Processing Unit (CPU) scheduling, memory allocation, and device drivers. Components that provide system call interfaces and basic services may include the GNU toolchain and the GNU C Library (glibc). File system management and network protocol security policy components may include components that manage the Fourth Extended Filesystem (EXT4) and the eXtended File System (XFS). They may also include components that implement network protocol stacks such as the Transmission Control Protocol (TCP) and Internet Protocol (IP), and components that implement Security-Enhanced Linux (SELinux). Environment adaptation components may include those for specific domains such as cloud computing and embedded systems.

[0044] The component type of each application component is searched from the component type set. The component importance factor value corresponding to each application component is determined based on the component type. Different component types correspond to different importance levels, such as five importance levels from L0 to L4. Different importance levels correspond to different component importance factor values. By determining the component importance factor value corresponding to each application component based on its component type, the accuracy of the component importance factor value determined for each application component is greatly improved.

[0045] S205: Obtain the value of the system's deployment environment factor and the value of the data importance factor.

[0046] The actual deployment environment of the user's Linux system, including whether it is connected to a network, the type of network it is connected to, and whether security configuration hardening has been implemented. Different deployment environment factor values can be set based on whether it is connected to a network, the type of network it is connected to, and whether security configuration hardening has been implemented. Obtain the system's deployment environment factor values and the data importance factor values.

[0047] In a specific implementation of the present application, obtaining the value of the deployment environment factor of the system may include the following steps: Step 1: Obtain the actual deployment environment of the system; Step 2: Determine the system deployment environment factor value based on whether the actual deployment environment is connected to the network, the type of network access, and whether security configuration reinforcement is performed; Among them, when the actual deployment environment is that the system is connected to the public network and security configuration reinforcement is not performed, the deployment environment factor is taken as the first deployment environment factor value; when the actual deployment environment is that the system is connected to the intranet and security configuration reinforcement is not performed, the deployment environment factor is taken as the second deployment environment factor value; when the actual deployment environment is that the system is connected to the public network and security configuration reinforcement is performed, the deployment environment factor is taken as the third deployment environment factor value; when the actual deployment environment is that the system is connected to the intranet and security configuration reinforcement is performed, the deployment environment factor is taken as the fourth deployment environment factor value.

[0048] For the convenience of description, the above two steps can be combined for explanation.

[0049] Obtain the actual deployment environment of the system and determine the value of the system's deployment environment factor based on whether the actual deployment environment is connected to the network, the type of network accessed, and whether security configuration reinforcement has been performed. When the actual deployment environment is that the system is connected to the public network and security configuration reinforcement has not been performed, the deployment environment factor value is the first deployment environment factor value; when the actual deployment environment is that the system is connected to the intranet and security configuration reinforcement has not been performed, the deployment environment factor value is the second deployment environment factor value; when the actual deployment environment is that the system is connected to the public network and security configuration reinforcement has been performed, the deployment environment factor value is the third deployment environment factor value; when the actual deployment environment is that the system is connected to the intranet and security configuration reinforcement has been performed, the deployment environment factor value is the fourth deployment environment factor value. For example, the first deployment environment factor value can be set to 1.0, the second deployment environment factor value to 0.5, the third deployment environment factor value to 0.0, and the fourth deployment environment factor value to -0.5. By determining the system's deployment environment factor value based on whether the system is connected to the network, the type of network accessed, and whether security configuration reinforcement has been performed, the accuracy of the determined deployment environment factor value is improved, thereby improving the accuracy of vulnerability remediation priority decisions.

[0050] S206: Obtain the value of the user quantity factor of the system.

[0051] The number of system users affects the vulnerability repair priority. The user number factor value can be determined based on the number of system users. Get the system user number factor value.

[0052] In a specific implementation of the present application, step S204 may include the following steps: Step 1: Obtain the number of users affected by the system's services; Step 2: Determine the value of the system's user quantity factor based on the number of users.

[0053] For the convenience of description, the above two steps can be combined for explanation.

[0054] Obtain the number of users affected by the system's services, and determine the system's user quantity factor value based on the number of users. For example, a user quantity threshold can be set. By comparing the number of users affected by the system's services with the number of users, the user quantity factor value is determined based on the comparison result. For example, when the number of users affected by the system's services is greater than the upper limit of the user quantity threshold, the user quantity factor value is a first user quantity factor value; when the number of users affected by the system's services is within the user quantity threshold range, the user quantity factor value is a second user quantity factor value; and when the number of users affected by the system's services is less than the lower limit of the user quantity threshold, the user quantity factor value is a third user quantity factor value. For example, the first user quantity factor value can be set to 1.0, the second user quantity factor value to 0.5, and the third user quantity factor value to 0.0. By determining the user quantity factor value based on the user quantity threshold, the efficiency of determining the user quantity factor value is greatly improved, and the accuracy of the determined user quantity factor value is improved. By determining the system's user quantity factor value based on the number of users affected by the system's services, the accuracy of the determined user quantity factor value is improved.

[0055] S207: Using the values of the vulnerability repair organization implementation capability factor, the values of the component importance factor, the deployment environment factor value, the data importance factor value, and the user quantity factor value, the first vulnerability risk scores are corrected to obtain the second vulnerability risk scores.

[0056] After obtaining the values of the implementation capability factors of each vulnerability repair organization, the importance factors of each component, the deployment environment factors, the data importance factors and the number of users factors, the first vulnerability risk scores are corrected using the values of the implementation capability factors of each vulnerability repair organization, the importance factors of each component, the deployment environment factors, the data importance factors and the number of users factors to obtain the second vulnerability risk scores.

[0057] The risk score of each first vulnerability can be modified using the following formula: Second vulnerability risk score = (first vulnerability risk score + component importance factor value + deployment environment factor value + vulnerability repair organization implementation capability factor value + user quantity factor value) * data importance factor value; By utilizing the values of each vulnerability repair organization's implementation capability factor, each component's importance factor, deployment environment factor, data importance factor, and user quantity factor, the first vulnerability risk scores are corrected, thereby greatly improving the accuracy of each second vulnerability risk score.

[0058] As shown in Table 1, Table 1 is a table of value settings for impact factors of various preset application scenarios.

[0059] Table 1

[0060] S208: Determine the repair priority of each security vulnerability according to each second vulnerability risk score.

[0061] S209: Generate repair suggestions corresponding to each security vulnerability according to the repair priority of each security vulnerability.

[0062] After determining the priority for each security vulnerability, a corresponding repair suggestion is generated for each security vulnerability based on the repair priority. The repair suggestion may include that the vulnerability needs to be repaired as soon as possible, that the repair can be postponed, or that the vulnerability can be left unrepaired for the time being.

[0063] S210: Outputting repair suggestions corresponding to each security vulnerability.

[0064] After generating corresponding remediation suggestions for each security vulnerability based on their remediation priorities, the corresponding remediation suggestions are output. By outputting the remediation suggestions for each security vulnerability, users can be promptly informed of the urgency of remediating each vulnerability. Users need to be able to determine which vulnerabilities should be remediated first and which ones can be temporarily ignored, thereby improving system security and stability.

[0065] As shown in Table 2, Table 2 is a comparison table of vulnerability repair urgency scores and repair priorities.

[0066] Table 2

[0067] Based on the use of a universal vulnerability scoring system to determine vulnerability repair priority and severity, the embodiments of the present application revise and evaluate the universal vulnerability scoring system scores according to the user's actual application scenario, combined with factors such as component importance, actual deployment environment, data importance, operation implementation risk, and the number of business users. This can help users make vulnerability repair priority decisions based on the current application scenario, thereby improving the remediation efficiency of high-exploitable risk vulnerabilities in the system and the effectiveness of remediation measures.

[0068] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method.

[0069] An embodiment of the present application also provides a security vulnerability repair priority assessment device.

[0070] See also Figure 3 , Figure 3This is a structural block diagram of a security vulnerability repair priority assessment device provided in an embodiment of the present application. The device may include: The application component acquisition module 31 is used to identify the system's software bill of materials and obtain each application component; A first vulnerability risk score assessment module 32 is configured to search for security vulnerabilities contained in each application component and assess a first vulnerability risk score corresponding to each security vulnerability using a universal vulnerability scoring system; The factor value acquisition module 33 is used to obtain the factor values corresponding to the impact factors of each preset application scenario of the system; A second vulnerability risk score obtaining module 34 is configured to modify each first vulnerability risk score using the values of each factor to obtain each second vulnerability risk score; The repair priority determination module 35 is configured to determine the repair priority of each security vulnerability according to each second vulnerability risk score.

[0071] Through this application, after finding the security vulnerabilities contained in each application component, on the basis of using the general vulnerability scoring system to determine the first vulnerability risk score corresponding to each security vulnerability, according to the actual application scenario of the system, the first vulnerability risk score is corrected using the factor values corresponding to the system's preset application scenario influencing factors to obtain each second vulnerability risk score, thereby helping users make vulnerability repair priority decisions based on the current application scenario. Therefore, it can solve the technical problem of poor applicability to different users and inaccurate vulnerability repair priority decisions, and achieve the technical effect of fully combining the user system application scenario to make vulnerability repair priority decisions, improving applicability to different users, and improving the accuracy of vulnerability repair priority decisions.

[0072] In a specific embodiment of the present application, the factor value acquisition module may include: The organization implementation capability factor acquisition submodule is used to obtain the vulnerability repair organization implementation capability factor value corresponding to each security vulnerability; The component importance factor acquisition submodule is used to obtain the component importance factor value corresponding to each application component; The deployment environment factor and data importance factor acquisition submodule is used to obtain the system deployment environment factor value and the data importance factor value; The user quantity factor acquisition submodule is used to obtain the user quantity factor value of the system; The second vulnerability risk score acquisition module is specifically a module that uses the values of the vulnerability repair organization implementation capability factor, the importance factor values of each component, the deployment environment factor value, the data importance factor value and the user quantity factor value to correct the first vulnerability risk scores.

[0073] In a specific embodiment of the present application, the organization implementation capability factor acquisition submodule is specifically a module that determines the vulnerability repair organization implementation capability factor value corresponding to each security vulnerability according to whether there is a related organization and vulnerability handling business process for each security vulnerability; Among them, when there is a relevant organization and vulnerability handling business process for the security vulnerability, the vulnerability repair organization implementation capability factor is taken as the first vulnerability repair organization implementation capability factor value; when there is no relevant organization and vulnerability handling business process for the security vulnerability, the vulnerability repair organization implementation capability factor is taken as the second vulnerability repair organization implementation capability factor value.

[0074] In a specific embodiment of the present application, the component importance factor acquisition submodule may include: A component type set determination unit is used to determine a component type set including a hardware resource management component, a system call interface and basic service providing component, a file system management and network protocol security policy component, a general software component, and an environment adaptation component according to a layered mechanism of a software package management system; A component type search unit, configured to search the component type to which each application component belongs from the component type set; The component importance factor determination unit is used to determine the component importance factor value corresponding to each application component according to the component type to which each application component belongs.

[0075] In a specific embodiment of the present application, the deployment environment factor and data importance factor acquisition submodule may include: An actual deployment environment acquisition unit, used to acquire the actual deployment environment of the system; A deployment environment factor determination unit is used to determine the deployment environment factor value of the system based on whether the actual deployment environment is connected to the network, the type of access network, and whether security configuration reinforcement is performed; Among them, when the actual deployment environment is that the system is connected to the public network and security configuration reinforcement is not performed, the deployment environment factor is taken as the first deployment environment factor value; when the actual deployment environment is that the system is connected to the intranet and security configuration reinforcement is not performed, the deployment environment factor is taken as the second deployment environment factor value; when the actual deployment environment is that the system is connected to the public network and security configuration reinforcement is performed, the deployment environment factor is taken as the third deployment environment factor value; when the actual deployment environment is that the system is connected to the intranet and security configuration reinforcement is performed, the deployment environment factor is taken as the fourth deployment environment factor value.

[0076] In a specific embodiment of the present application, the user quantity factor acquisition submodule may include: A user number acquisition unit, used to acquire the number of users affected by the system's business carrying; The user quantity factor determination unit is used to determine the user quantity factor value of the system according to the number of users.

[0077] In a specific embodiment of the present application, the device may further include: A repair suggestion generating module is used to generate repair suggestions corresponding to each security vulnerability according to the repair priority of each security vulnerability after determining the repair priority of each security vulnerability according to each second vulnerability risk score; The repair suggestion output module is used to output the repair suggestions corresponding to each security vulnerability.

[0078] For the description of the features in the embodiment corresponding to the security vulnerability repair priority assessment device, please refer to the relevant description of the embodiment corresponding to the security vulnerability repair priority assessment method, and will not be repeated here.

[0079] An embodiment of the present application further provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps of any of the above-mentioned security vulnerability repair priority assessment method embodiments.

[0080] An embodiment of the present application further provides a computer-readable storage medium storing a computer program, wherein the computer program is configured to execute the steps of any of the above-mentioned security vulnerability repair priority assessment method embodiments when running.

[0081] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.

[0082] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps of any of the above-mentioned security vulnerability repair priority assessment method embodiments are implemented.

[0083] An embodiment of the present application also provides another computer program product, including a non-volatile computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the steps of any of the above-mentioned security vulnerability repair priority assessment method embodiments.

[0084] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0085] The above is a detailed introduction to a method, device and equipment for assessing the priority of security vulnerability repairs provided by this application. This article uses specific examples to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method and core ideas of this application. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of this application, several improvements and modifications can be made to this application, and these improvements and modifications also fall within the scope of protection of this application.

Claims

1. A security vulnerability repair priority assessment method, characterized in that: include: Identify the system's software bill of materials and obtain each application component; Find the security vulnerabilities contained in each application component and use the common vulnerability scoring system to evaluate the first vulnerability risk score corresponding to each security vulnerability; Obtain the factor values corresponding to the impact factors of each preset application scenario of the system; Using the values of each factor to modify each first vulnerability risk score to obtain each second vulnerability risk score; The repair priority of each security vulnerability is determined according to the second vulnerability risk score.

2. The security vulnerability repair priority assessment method according to claim 1, characterized in that: Obtain the factor values corresponding to each preset application scenario impact factor of the system, including: Obtain the vulnerability repair organization implementation capability factor value corresponding to each security vulnerability; Obtain the component importance factor value corresponding to each application component; Obtain the system's deployment environment factor value and the data importance factor value; Get the user quantity factor value of the system; Accordingly, the first vulnerability risk scores are modified using the values of each factor, including: Each first vulnerability risk score is corrected using the values of the vulnerability repair organization implementation capability factors, the values of the component importance factors, the deployment environment factors, the data importance factors, and the user quantity factors.

3. The security vulnerability repair priority assessment method according to claim 2, characterized in that: Obtain the vulnerability repair organization implementation capability factor value corresponding to each security vulnerability, including: Determine the vulnerability repair organization implementation capability factor value corresponding to each security vulnerability based on whether there is a related organization and vulnerability handling business process for each security vulnerability; Among them, when there is a relevant organization and vulnerability handling business process for a security vulnerability, the vulnerability repair organization implementation capability factor is taken as the first vulnerability repair organization implementation capability factor value; when there is no relevant organization and vulnerability handling business process for a security vulnerability, the vulnerability repair organization implementation capability factor is taken as the second vulnerability repair organization implementation capability factor value.

4. The security vulnerability repair priority assessment method according to claim 2, characterized in that: Obtain the component importance factor values corresponding to each application component, including: According to the hierarchical mechanism of the software package management system, a component type set including hardware resource management components, system call interface and basic service components, file system management and network protocol security policy components, general software components, and environment adaptation components is determined; Searching for the component type to which each application component belongs from the component type set; The component importance factor value corresponding to each application component is determined according to the component type to which each application component belongs.

5. The security vulnerability repair priority assessment method according to claim 2, characterized in that: Get the system's deployment environment factor values, including: Obtain the actual deployment environment of the system; Determine the deployment environment factor value of the system based on whether the actual deployment environment is connected to the network, the type of access network, and whether security configuration reinforcement is performed; Among them, when the actual deployment environment is that the system is connected to the public network and security configuration reinforcement is not performed, the deployment environment factor takes the first deployment environment factor value; when the actual deployment environment is that the system is connected to the intranet and security configuration reinforcement is not performed, the deployment environment factor takes the second deployment environment factor value; when the actual deployment environment is that the system is connected to the public network and security configuration reinforcement is performed, the deployment environment factor takes the third deployment environment factor value; when the actual deployment environment is that the system is connected to the intranet and security configuration reinforcement is performed, the deployment environment factor takes the fourth deployment environment factor value.

6. The security vulnerability repair priority assessment method according to claim 2, characterized in that: Get the system's user quantity factor value, including: Obtain the number of users affected by the services carried by the system; A value of a user quantity factor of the system is determined according to the number of users.

7. The security vulnerability repair priority assessment method according to any one of claims 1 to 6, characterized in that: After determining the repair priority of each security vulnerability based on the second vulnerability risk score, it also includes: Generate repair suggestions for each security vulnerability based on the repair priority of each security vulnerability; Output the repair suggestions corresponding to each security vulnerability.

8. A security vulnerability repair priority assessment device, characterized in that: include: The application component acquisition module is used to identify the system's software bill of materials and obtain each application component; A first vulnerability risk scoring assessment module is used to find security vulnerabilities contained in each application component and use a common vulnerability scoring system to assess a first vulnerability risk score corresponding to each security vulnerability; A factor value acquisition module is used to obtain the factor values corresponding to the influencing factors of each preset application scenario of the system; A second vulnerability risk score obtaining module is used to modify each first vulnerability risk score using the values of each factor to obtain each second vulnerability risk score; The repair priority determination module is used to determine the repair priority of each security vulnerability according to each second vulnerability risk score.

9. An electronic device, characterized in that: include: memory for storing computer programs; A processor, configured to implement the steps of the security vulnerability repair priority assessment method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the steps of the security vulnerability repair priority assessment method according to any one of claims 1 to 7 are implemented.

Images