Internet of Things vulnerability data restoration system

Abstract

The invention relates to the technical field of Internet of Things security, in particular to an Internet of Things vulnerability data restoration system, which is used for solving the problems that in the prior art, multi-dimensional vulnerability features cannot be accurately extracted and propagated, potential vulnerabilities cannot be efficiently identified, high-risk vulnerabilities cannot be preferentially processed according to a dynamic resource adjustment strategy, and the vulnerability data restoration efficiency cannot be improved. And the accuracy, the automation level and the response efficiency of vulnerability management are reduced. According to the method, a heterogeneous relation graph between equipment and components is constructed through the vulnerability identification and positioning module, multi-dimensional vulnerability features are accurately extracted and propagated, efficient identification of potential vulnerabilities is realized, priority ranking is performed in combination with CVSS scores and equipment importance, high-risk vulnerabilities are preferentially processed through scientific scores and a dynamic resource adjustment strategy, and the efficiency of vulnerability identification is improved. And the to-be-fixed vulnerability list containing multi-aspect information is generated, so that the vulnerability management accuracy, the automation level and the response efficiency are remarkably improved.

Description

Technical Field

[0001] The present invention relates to the field of Internet of Things security technology, and more particularly to an Internet of Things vulnerability data repair system. Background Art

[0002] IoT devices are widely used in smart homes, industrial control, healthcare and other fields, and their security vulnerabilities have become a key risk point; current vulnerability repair technologies have shortcomings such as poor protocol compatibility, centralized architecture defects, low repair decision-making efficiency, and weak repair process security, making it difficult to meet real-time repair needs.

[0003] The patent application with reference publication number CN118445809A discloses a system vulnerability repair method and system based on big data, which relates to the field of data security. The method includes: obtaining big data stream data in real time; adding preset vulnerability data to the above big data stream data to form a vulnerability detection data stream, wherein the above preset vulnerability data is data that can be detected by existing security detection methods, and the above preset vulnerability data is provided with a preset identification bit. The above preset vulnerability data has no damaging effect on the system when it is not safely detected; using a detection server to detect the above vulnerability detection data stream using the current system vulnerability detection algorithm to obtain a detection result; based on the above detection result, performing vulnerability repair to update the current system vulnerability detection algorithm of the above detection server and the operation server, wherein the above operation server is a server that interacts with data when the system is operating normally, and the above detection server is a server corresponding to the system vulnerability detection algorithm upgrade;

[0004] However, the above-mentioned reference patent simulates the attack environment by injecting preset vulnerability data with identification bits to test and optimize the detection algorithm, adaptively updates the algorithm and synchronously upgrades the running server, and efficiently processes large-scale data on a dedicated detection server to improve detection efficiency and security. However, it cannot accurately extract and propagate multi-dimensional vulnerability features, cannot achieve efficient identification of potential vulnerabilities, and cannot dynamically adjust resource strategies to prioritize high-risk vulnerabilities, thereby reducing the accuracy, automation level and response efficiency of vulnerability management; at the same time, it cannot dynamically optimize the repair order and resource allocation in multiple vulnerability scenarios, cannot comprehensively evaluate vulnerability risks, repair costs and system stability, and cannot prioritize the repair of high-risk vulnerabilities and efficient resource utilization, thereby reducing repair efficiency and overall security.

[0005] To this end, we propose an IoT vulnerability data repair system to address the above problems. Summary of the Invention

[0006] The purpose of the present invention is to provide an Internet of Things vulnerability data repair system, which solves the problems that the existing technology cannot accurately extract and disseminate multi-dimensional vulnerability features, cannot achieve efficient identification of potential vulnerabilities, cannot dynamically adjust resource strategies to prioritize high-risk vulnerabilities, and reduces the accuracy, automation level and response efficiency of vulnerability management; at the same time, it cannot dynamically optimize the repair sequence and resource allocation in multiple vulnerability scenarios, cannot comprehensively evaluate vulnerability risks, repair costs and system stability, cannot achieve priority repair of high-risk vulnerabilities and efficient resource utilization, and reduces repair efficiency and overall security.

[0007] The purpose of the present invention is achieved through the following technical solutions:

[0008] An IoT vulnerability data repair system, applied to a vulnerability data management platform, includes:

[0009] The vulnerability data collection module is used to collect raw vulnerability data from IoT device log files, firmware images, runtime configuration information, and third-party vulnerability databases, and perform pre-processing operations on the collected vulnerability data;

[0010] The vulnerability identification and location module models preprocessed vulnerability data based on graph neural networks, constructs a graph of component dependencies and communication relationships between devices, extracts vulnerability-related features, identifies potential vulnerabilities through feature propagation and classification, and locates the device nodes and software components where they reside. It prioritizes vulnerabilities based on CVSS scores and device importance levels, and generates a list of vulnerabilities to be fixed.

[0011] The vulnerability repair strategy generation module is used to call the built-in repair strategy library based on the vulnerability identification results and automatically generate the corresponding repair plan;

[0012] The vulnerability repair optimization module uses reinforcement learning algorithms to train decision models and dynamically optimize the repair sequence and resource allocation in multi-vulnerability scenarios.

[0013] As a preferred embodiment of the present invention, the vulnerability identification and positioning module models the preprocessed vulnerability data based on a graph neural network, and the process of constructing a component dependency and communication relationship map between devices includes:

[0014] In the IoT system, each physical device, software component, service port, and known vulnerability can be abstracted as a node in a graph, and the interactions between them are abstracted as edges. The entire IoT system is modeled using a heterogeneous graph G = (V, E):

[0015] V is a node set, including device nodes, component nodes, service nodes, and vulnerability nodes. E is an edge set, representing the relationship between different nodes, including dependency edges, communication edges, call edges, and mapping edges.

[0016] In graph neural networks, the structure of a heterogeneous graph G = (V, E) is represented by the following two key matrices:

[0017] Feature matrix X∈R n×d , used to describe the characteristic information of each node in the graph, where n is the total number of nodes in the graph, d is the characteristic dimension of each node, and each row in the matrix corresponds to a node and records the eigenvalues of the node;

[0018] Adjacency matrix A∈R n×n , used to describe the connection relationship between nodes in the graph. The elements in the matrix are defined as follows:

[0019]

[0020] As a preferred embodiment of the present invention, the process of extracting vulnerability-related features and performing feature propagation by the vulnerability identification and positioning module includes:

[0021] The characteristics of each node are composed of multiple dimensions, including CVE-related characteristics, CVSS score characteristics, service and protocol characteristics, component function and location characteristics, device importance characteristics, operating status and historical attack records. All node characteristics are converted into numerical or vector inputs and formed into the node input vector x after normalization. i , the node feature matrix of the entire graph is:

[0022]

[0023] Graph neural networks are used to learn the implicit relationships between nodes and predict whether each node has a vulnerability. Graph neural networks aggregate information about neighboring nodes through graph convolution operations and then use activation functions to obtain new node representations. The specific formula is as follows:

[0024]

[0025] Among them H (0) =X is the initial node feature, represents the adjacency matrix after adding the self-loop, for The degree matrix, W (l) is the weight matrix of the lth layer, σ is the nonlinear activation function, H (l) represents the node representation of the lth layer;

[0026] After L layers of graph convolution, the final node embedding is represented as H (L) , which contains the aggregated structural information and contextual features.

[0027] As a preferred embodiment of the present invention, the process of the vulnerability identification and positioning module classifying and identifying potential vulnerabilities and locating the device nodes and software components where the vulnerabilities are located includes:

[0028] After the graph neural network completes multi-layer feature propagation, the node embedding of the last layer is used to represent H (L) To classify vulnerabilities, a linear classifier combined with a Softmax activation function is used to perform binary or multi-classification operations on each node:

[0029]

[0030] Where W (L+1) is the parameter matrix of the classification layer, is the final embedding vector of node i, is the predicted probability distribution of whether node i has a vulnerability, indicating the possibility of the node belonging to different vulnerability levels;

[0031] The final output is the label prediction results of all nodes;

[0032] After completing the node classification, the specific location of the vulnerability is determined based on the prediction results. The vulnerability location is completed through the edge relationship between the nodes in the graph:

[0033] If there is a mapping edge between a vulnerability node and a component node, it can be directly determined that the component has the vulnerability;

[0034] If there is a subordinate relationship edge between the component node and the device node, the physical or virtual device where the vulnerability is located can be further located;

[0035] If a service node is identified as having a vulnerability and is connected to multiple components, it is necessary to combine communication traffic logs, call chain information or context analysis to further trace the actual source component of the vulnerability.

[0036] As a preferred embodiment of the present invention, the process of the vulnerability identification and positioning module combining CVSS scores and device importance levels to prioritize and generate a list of vulnerabilities to be fixed includes:

[0037] After vulnerability location, prioritize the vulnerabilities and assign a priority score P to each vulnerability by combining the CVSS score and the device importance level. r , vulnerability priority P r Calculated using the following formula:

[0038] P r =α·C+(1-α)·K;

[0039] Among them, P ris the vulnerability priority score, C is the CVSS score, K is the device importance, and α is the coefficient for adjusting the CVSS weight;

[0040] All nodes predicted as “having vulnerabilities” are divided into r Scores are sorted from high to low;

[0041] Based on the identification and scoring results, the system automatically generates a list of vulnerabilities to be fixed, including the following:

[0042] Vulnerability identification, affected component and device name, predicted risk level and CVSS score, priority score, current repair status, and recommended repair method or patch link.

[0043] As a preferred embodiment of the present invention, the process of the vulnerability repair strategy generation module calling the built-in repair strategy library according to the vulnerability identification result and automatically generating the corresponding repair solution includes:

[0044] Obtain vulnerability identification results, including vulnerability number, vulnerability type, affected component, severity level, risk score, and remediation recommendations;

[0045] Based on the vulnerability identification results, the system matches rules in the built-in repair strategy library and selects the most suitable repair solution for the current vulnerability. The process includes the following steps:

[0046] T1: Match vulnerability labels with remediation strategy rules and select the best-suited remediation method;

[0047] T2: Replace the placeholders in the general repair policy template with the actual affected component information;

[0048] T3: Generate specific executable repair commands based on the template;

[0049] T4: Generate a complete repair plan entry;

[0050] Based on the policy library and vulnerability identification results, the system will automatically generate a remediation plan, which includes the following:

[0051] Determine the repair method based on the vulnerability type;

[0052] Call the policy template to dynamically generate repair commands based on the component information and version information provided by the identification module;

[0053] Evaluate the resource costs and dependencies of the repair process;

[0054] Output repair task details for execution module to schedule and execute.

[0055] As a preferred embodiment of the present invention, the process of the vulnerability repair optimization module using the reinforcement learning algorithm to train the decision model includes:

[0056] The entire repair process is modeled as a Markov decision process, whose elements are defined as follows:

[0057] State space S: The current security status of the system, including the set of identified vulnerabilities, system resource status, and historical repair records;

[0058] Action space A: Repair decisions, which can be to fix a vulnerability, postpone repair, or allocate resources;

[0059] State transition function T: the change in system state caused by the execution of an action;

[0060] Reward function R: evaluates the quality of the repair action based on the results of the action;

[0061] The design of the reward function requires comprehensive consideration of multiple factors. The specific expression is as follows:

[0062] R(s,a)=-λ1·XF(v)-λ2·XS(v)-λ3·XZ(a)+λ4·XT(s′);

[0063] Where XF(v) represents the risk of the vulnerability, XS(v) represents the time the vulnerability remains unrepaired, XZ(a) represents the resources required for the repair action, XT(s′) represents the stability improvement of the system after the repair, and λ1, λ2, λ3, and λ4 are all weight coefficients;

[0064] The DQN algorithm is used to train the decision model, with the goal of maximizing the long-term accumulated rewards:

[0065]

[0066] Where π is the policy function, which means that in state s t The action selected under , γ is the discount factor, which represents the weight of future rewards, and T is the maximum number of time steps for training;

[0067] Through training, the system is able to learn the best repair strategy from historical repair data.

[0068] As a preferred embodiment of the present invention, the process of the vulnerability repair optimization module dynamically optimizing the repair sequence and resource allocation in a multi-vulnerability scenario includes:

[0069] In a multi-vulnerability scenario, the system needs to consider multiple factors to optimize the repair strategy, with the goal of minimizing repair time and resource consumption while maximizing the risk reduction of repairs;

[0070] If there are n vulnerabilities, each vulnerability repair operation consumes resources r i , the risk brought by the repair is reduced to P i , then the optimization goal is:

[0071]

[0072] where x i Whether to execute the repair action of vulnerability i, P i is the profit of fixing vulnerability i, r i is the resource needed to repair i, R max is the maximum available amount of resources;

[0073] The system will dynamically decide the repair order based on the strategy given by the reinforcement learning model:

[0074] In an environment with a high concentration of high-risk vulnerabilities, prioritize remediating high-yield vulnerabilities;

[0075] When resources are limited, prioritize fixing the most cost-effective vulnerabilities.

[0076] Automatically schedule concurrent or serial repairs.

[0077] Compared with the prior art, the advantages of the present invention are:

[0078] (1) In the present invention, a heterogeneous relationship map between devices and components is constructed through the vulnerability identification and positioning module, multi-dimensional vulnerability features are accurately extracted and propagated, and potential vulnerabilities are efficiently identified. Prioritization is performed based on CVSS scores and device importance. High-risk vulnerabilities are prioritized through scientific scoring and dynamic resource adjustment strategies, and a list of vulnerabilities to be repaired containing multiple aspects of information is generated, significantly improving the accuracy, automation level, and response efficiency of vulnerability management.

[0079] (2) In the present invention, an intelligent decision-making model is constructed by using a reinforcement learning algorithm through a vulnerability repair optimization module to dynamically optimize the repair order and resource allocation in multi-vulnerability scenarios. Through Markov decision process modeling and DQN algorithm training, the system comprehensively evaluates vulnerability risks, repair costs and system stability, realizes priority repair of high-risk vulnerabilities and efficient utilization of resources, and significantly improves repair efficiency and overall security. BRIEF DESCRIPTION OF THE DRAWINGS

[0080] Figure 1 This is a system block diagram of Embodiment 1 of the present invention;

[0081] Figure 2 This is a system block diagram of Embodiment 2 of the present invention;

[0082] Figure 3 The figure is a flowchart of the steps for calling the built-in repair strategy library in the present invention. DETAILED DESCRIPTION

[0083] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making creative work shall fall within the scope of protection of the present invention.

[0084] Example 1: Figure 1 and Figure 3 As shown, the present invention proposes an IoT vulnerability data repair system, which is applied to a vulnerability data management platform and includes:

[0085] The vulnerability data collection module is used to collect raw vulnerability data from IoT device log files, firmware images, runtime configuration information, and third-party vulnerability databases (such as CVE and NVD), and perform preprocessing operations on the collected vulnerability data. The preprocessing operations include but are not limited to data cleaning, data conversion, and standardization.

[0086] The vulnerability data collection module plays an important role in the IoT vulnerability repair system. It can comprehensively collect data from device logs, firmware images, operating configurations, and third-party vulnerability libraries (such as CVE and NVD), and improve data quality through pre-processing operations such as cleaning, conversion, and standardization to ensure data accuracy and consistency. This module supports flexible data processing processes and dynamic updates, reduces manual intervention, improves automation levels and processing efficiency, and facilitates large-scale data analysis. At the same time, its standardized output helps integrate with other security systems, promotes information sharing and collaborative protection. High-quality data provides a solid foundation for subsequent AI-based vulnerability identification and repair, improves the system's response speed and decision-making capabilities, and effectively reduces overall security risks.

[0087] The vulnerability identification and location module models preprocessed vulnerability data based on graph neural networks, constructs a graph of component dependencies and communication relationships between devices, extracts vulnerability-related features, identifies potential vulnerabilities through feature propagation and classification, and locates the device nodes and software components where they reside. It prioritizes vulnerabilities based on CVSS scores and device importance levels, and generates a list of vulnerabilities to be fixed.

[0088] The vulnerability identification and location module models the preprocessed vulnerability data based on a graph neural network. The process of constructing a graph of component dependencies and communication relationships between devices includes the following:

[0089] In the IoT system, each physical device, software component, service port, and known vulnerability can be abstracted as a node in a graph, and the interactions between them are abstracted as edges. The entire IoT system is modeled using a heterogeneous graph G = (V, E):

[0090] V is a node set, including device nodes (representing physical devices or virtual hosts), component nodes (representing operating systems, application services, middleware, databases, etc.), service nodes (representing running service instances, such as HTTP services, FTP services, or services on specific ports), and vulnerability nodes (representing known security vulnerabilities, such as CVE-2021-12345; these nodes are usually connected to the affected component nodes through "mapping edges"). E is an edge set, which represents the relationship between different nodes, including dependency edges (indicating that a component depends on the function or service provided by another component), communication edges (indicating that there is network communication between two devices or components), call edges (indicating that a process calls the interface or function of another component), and mapping edges (indicating that a vulnerability affects a specific component or service);

[0091] In graph neural networks, the structure of a heterogeneous graph G = (V, E) is represented by the following two key matrices:

[0092] Feature matrix X∈R n×d , used to describe the characteristic information of each node in the graph, where n is the total number of nodes in the graph, d is the characteristic dimension of each node (that is, how many attributes each node has), and each row in the matrix corresponds to a node, recording the various characteristic values of the node (such as the device's operating system, component version, open ports, security score, etc.);

[0093] Adjacency matrix A∈R n×n , which is used to describe the connection relationship between nodes in the graph (that is, which nodes are connected by edges). The elements in the matrix are defined as follows:

[0094]

[0095] The process by which the vulnerability identification and location module extracts vulnerability-related features and propagates them includes:

[0096] The characteristics of each node are composed of multiple dimensions, including CVE-related characteristics (such as whether the vulnerability is known, CVE number, vulnerability description), CVSS score characteristics (the threat level of each vulnerability, ranging from 0 to 10), service and protocol characteristics (such as the protocol used (TCP, UDP, HTTP, etc.), port information), component function and location characteristics (the device where the component is located, service layer, etc.), device importance characteristics (the degree of criticality of the device in the entire system (generally encoded using discrete values 1 to 5)) and operating status and historical attack records (including whether the component is active, whether it has been attacked, etc.). All node characteristics are converted into numerical or vector inputs and, after normalization, form the node input vector x i , the node feature matrix of the entire graph is:

[0097]

[0098] Graph neural networks are used to learn the implicit relationships between nodes and predict whether each node has vulnerabilities. Graph neural networks propagate node features through the adjacency structure of the graph to identify potential vulnerable nodes. Graph neural networks aggregate information from neighboring nodes through graph convolution operations and then use activation functions (such as ReLU) to obtain new node representations. The specific formula is as follows:

[0099]

[0100] Among them H (0) =X is the initial node feature, represents the adjacency matrix after adding the self-loop, for The degree matrix, W (l) is the weight matrix of the lth layer, σ is the nonlinear activation function, H (l) represents the node representation of the lth layer;

[0101] After L layers of graph convolution, the final node embedding is represented as H (L) , which contains the aggregated structural information and contextual features;

[0102] The vulnerability identification and location module classifies and identifies potential vulnerabilities and locates the device nodes and software components where they reside. The process includes:

[0103] After the graph neural network completes multi-layer feature propagation, the node embedding of the last layer is used to represent H (L) To classify vulnerabilities, a linear classifier combined with a Softmax activation function is used to perform binary or multi-classification operations on each node:

[0104]

[0105] Where W (L+1) is the parameter matrix of the classification layer, is the final embedding vector of node i, is the predicted probability distribution of whether node i has a vulnerability, indicating the possibility of the node belonging to different vulnerability levels;

[0106] The final output is the label prediction results of all nodes (for example: "no vulnerability", "low-risk vulnerability", "high-risk vulnerability");

[0107] After completing the node classification, the specific location of the vulnerability (i.e., which device or component the vulnerability occurs in) is determined based on the prediction results. Vulnerability location is completed through the edge relationships between nodes in the graph:

[0108] If there is a mapping edge between a vulnerability node and a component node (indicating that the vulnerability affects the component), then it can be directly determined that the component has the vulnerability;

[0109] If there is a subordinate relationship edge between the component node and the device node (indicating that the component runs on the device), the physical or virtual device where the vulnerability is located can be further located;

[0110] If a service node is identified as vulnerable and connected to multiple components, it is necessary to combine communication traffic logs, call chain information, or context analysis to further trace the actual source component of the vulnerability;

[0111] The vulnerability identification and location module prioritizes vulnerabilities based on CVSS scores and device importance levels and generates a list of vulnerabilities to be fixed. The process includes:

[0112] After vulnerability location, prioritize the vulnerabilities and assign a priority score P to each vulnerability by combining the CVSS score and the device importance level. r , vulnerability priority P r Calculated using the following formula:

[0113] P r =α·C+(1-α)·K;

[0114] Among them, P r is the vulnerability priority score, C is the CVSS score (between 0 and 10), K is the device importance (between 1 and 5, with 1 being unimportant and 5 being the most important), and α is the coefficient for adjusting the CVSS weight. It is set based on the actual security policy. The higher the score, the greater the impact of the vulnerability on system security and the higher the priority.

[0115] All nodes predicted as “having vulnerabilities” are divided into r Scores are sorted from high to low, and the system will recommend repairs from high priority to low priority, while dynamically adjusting based on repair resource availability.

[0116] Based on the identification and scoring results, the system automatically generates a list of vulnerabilities to be fixed, including the following:

[0117] Vulnerability identifier (such as CVE number), affected component and device name, predicted risk level and CVSS score, priority score, current repair status (unfixed, in progress, fixed), and recommended repair method or patch link;

[0118] The vulnerability identification and positioning module constructs a graph of component dependencies and communication relationships between devices based on graph neural networks. It extracts multi-dimensional features (including CVE-related, CVSS scores, services and protocols, component functions and locations, device importance and operating status, and historical attack records) and performs standardized processing. It uses graph convolution operations to aggregate neighbor node information to efficiently propagate features to identify potential vulnerability nodes and improve identification accuracy. After completing feature propagation, it uses a linear classifier combined with a Softmax activation function to classify nodes and accurately determine vulnerabilities and risk levels. It locates specific devices and components through edge relationships, and then assigns priority scores based on CVSS scores and device importance levels. High-risk vulnerabilities are prioritized through scientific scoring and dynamic resource adjustment strategies. The system automatically generates a list of vulnerabilities to be fixed that contains multiple information such as identification, affected objects, and risk levels to facilitate response by operation and maintenance personnel. Through the above series of operations, this module significantly improves the security and management efficiency of the Internet of Things system and enhances the automation and intelligence level of vulnerability management.

[0119] The vulnerability repair strategy generation module is used to call the built-in repair strategy library based on the vulnerability identification results and automatically generate the corresponding repair plan;

[0120] The vulnerability remediation strategy generation module calls the built-in remediation strategy library based on the vulnerability identification results and automatically generates the corresponding remediation plan. The process includes:

[0121] Obtain vulnerability identification results, including vulnerability number (such as CVE number), vulnerability type (such as code injection, permission bypass, etc.), affected components (such as a certain version of Nginx, database service, etc.), severity level (such as high risk, medium risk, low risk), risk score (such as CVSS), and remediation suggestions;

[0122] Based on the vulnerability identification results, the system matches rules in the built-in repair strategy library and selects the most suitable repair solution for the current vulnerability. The process includes the following steps:

[0123] T1: Match vulnerability labels (such as vulnerability type, affected component, CVSS score, etc.) with remediation strategy rules to select the best-suited remediation method;

[0124] T2: Replace the placeholders in the general repair policy template with the actual affected component information;

[0125] T3: Generates specific executable repair commands based on the template, such as patch deployment instructions, service restart commands, configuration parameter adjustment statements, etc.

[0126] T4: Generate a complete repair plan entry, including the repair method, required resources, execution command, and whether a restart is required;

[0127] Based on the policy library and vulnerability identification results, the system will automatically generate a remediation plan, which includes the following:

[0128] Determine the repair method based on the vulnerability type;

[0129] Call the policy template to dynamically generate repair commands based on the component information and version information provided by the identification module;

[0130] Evaluate the resource costs and dependencies of the repair process;

[0131] Output repair task details for execution module to schedule and execute;

[0132] The vulnerability repair strategy generation module realizes an efficient vulnerability repair process by automatically matching repair strategies and dynamically generating repair commands. Based on detailed vulnerability identification results (such as CVE number, vulnerability type, affected components, severity level, risk score, etc.), the module automatically selects the best-suited repair method, replaces the placeholders in the general policy template, and generates specific executable repair commands (such as patch deployment, service restart, configuration adjustment). At the same time, the module evaluates the resource overhead and dependency conditions during the repair process to ensure that the repair operation does not affect business continuity. Finally, the system outputs a structured repair task detail, including the repair method, required resources, execution commands and restart requirements, which is convenient for scheduling and execution. This module significantly improves the efficiency, accuracy and flexibility of repair and enhances overall security.

[0133] Embodiment 2: The technical solution of this embodiment of the present invention differs from that of Embodiment 1 in that:

[0134] like Figure 2 As shown in the figure, the vulnerability repair optimization module uses reinforcement learning algorithms to train decision models and dynamically optimize the repair sequence and resource allocation in multi-vulnerability scenarios;

[0135] The vulnerability repair optimization module uses the reinforcement learning algorithm to train the decision model, including the following process:

[0136] The entire repair process is modeled as a Markov decision process, whose elements are defined as follows:

[0137] State space S: The current security status of the system, including the set of identified vulnerabilities, system resource status, and historical repair records;

[0138] Action space A: Repair decisions, which can be to fix a vulnerability, postpone repair, or allocate resources;

[0139] State transition function T: the change in system state caused by the execution of an action;

[0140] Reward function R: This function evaluates the quality of the repair action based on the results of the action. For example, if fixing a high-risk vulnerability improves system stability, the reward function will be positive. If the repair process causes system downtime, the reward function may be negative.

[0141] The design of the reward function requires comprehensive consideration of multiple factors. The specific expression is as follows:

[0142] R(s,a)=-λ1·XF(v)-λ2·XS(v)-λ3·XZ(a)+λ4·XT(s′);

[0143] Where XF(v) represents the risk of the vulnerability, which is measured by the vulnerability's CVSS score. XS(v) represents the time the vulnerability remains unpatched. The faster the patch, the higher the reward. XZ(a) represents the resources required for the patch. The more resource-efficient the patch, the higher the reward. XT(s′) represents the improved stability of the system after the patch. The better the system stability, the higher the reward. λ1, λ2, λ3, and λ4 are weight coefficients used to balance various factors.

[0144] The DQN algorithm is used to train the decision model, with the goal of maximizing the long-term accumulated rewards:

[0145]

[0146] Where π is the policy function, which means that in state s t The action selected under , γ is the discount factor, which represents the weight of future rewards, and T is the maximum number of time steps for training;

[0147] Through training, the system can learn the best repair strategy from historical repair data;

[0148] The vulnerability repair optimization module dynamically optimizes the repair sequence and resource allocation in multiple vulnerability scenarios. The process includes:

[0149] In a multi-vulnerability scenario, the system needs to consider multiple factors to optimize the repair strategy, with the goal of minimizing repair time and resource consumption while maximizing the risk reduction of repairs;

[0150] If there are n vulnerabilities, each vulnerability repair operation consumes resources r i , the risk brought by the repair is reduced to P i , then the optimization goal is:

[0151]

[0152] where x i Whether to perform the repair action of vulnerability i (1 means repair, 0 means not repair), P i is the benefit of fixing vulnerability i (such as the degree of reduction in CVSS score), ri is the resource needed to repair i, R max is the maximum available amount of resources;

[0153] The system will dynamically decide the repair order based on the strategy given by the reinforcement learning model:

[0154] In an environment with a high concentration of high-risk vulnerabilities, prioritize remediating high-yield vulnerabilities;

[0155] When resources are limited, prioritize fixing the most cost-effective vulnerabilities.

[0156] Automatically schedule concurrent or serial repairs to avoid resource conflicts and service interruptions;

[0157] After the repair task is completed, the system will collect the execution results, stability data, and business feedback to reinforce the continuous iterative optimization of the learning model and build a closed-loop adaptive repair system.

[0158] The vulnerability repair optimization module uses reinforcement learning algorithms to train decision models and dynamically optimize the repair order and resource allocation in multi-vulnerability scenarios. Through Markov decision process (MDP) modeling, the system comprehensively considers vulnerability risk (CVSS score), unrepaired time, resources required for repair, and system stability after repair to design a reward function, and adopts the deep Q network (DQN) algorithm to maximize long-term cumulative rewards and realize intelligent repair decision-making. The module can dynamically adjust the repair order, give priority to high-risk or most cost-effective vulnerabilities, and automatically schedule concurrent or serial repairs to avoid resource conflicts and service interruptions. After the repair is completed, the system collects execution results and feedback data, continuously iterates and optimizes the model to form a closed-loop adaptive repair system. This not only improves repair efficiency and resource utilization, but also significantly enhances overall security, reduces the need for manual intervention, and can flexibly respond to complex environments to ensure that system risks are minimized to the maximum extent under limited resources. Therefore, this module greatly improves the overall level of vulnerability management and builds an efficient and intelligent adaptive repair system.

[0159] The above are only preferred specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes based on the technical solutions and improved concepts of the present invention within the technical scope disclosed by the present invention, and they should be covered by the scope of protection of the present invention.

Claims

1. An Internet of Things vulnerability data repair system, applied to a vulnerability data management platform, characterized in that: include: The vulnerability data collection module is used to collect raw vulnerability data from IoT device log files, firmware images, runtime configuration information, and third-party vulnerability databases, and perform pre-processing operations on the collected vulnerability data; The vulnerability identification and location module models preprocessed vulnerability data based on graph neural networks, constructs a graph of component dependencies and communication relationships between devices, extracts vulnerability-related features, identifies potential vulnerabilities through feature propagation and classification, and locates the device nodes and software components where they reside. It prioritizes vulnerabilities based on CVSS scores and device importance levels, and generates a list of vulnerabilities to be fixed. The vulnerability repair strategy generation module is used to call the built-in repair strategy library based on the vulnerability identification results and automatically generate the corresponding repair plan; The vulnerability repair optimization module uses reinforcement learning algorithms to train decision models and dynamically optimize the repair sequence and resource allocation in multi-vulnerability scenarios.

2. The IoT vulnerability data repair system according to claim 1, characterized in that: The vulnerability identification and positioning module models the pre-processed vulnerability data based on a graph neural network, and the process of constructing a component dependency and communication relationship map between devices includes: In the IoT system, each physical device, software component, service port, and known vulnerability can be abstracted as a node in a graph, and the interactions between them are abstracted as edges. The entire IoT system is modeled using a heterogeneous graph G = (V, E): V is a node set, including device nodes, component nodes, service nodes, and vulnerability nodes. E is an edge set, representing the relationship between different nodes, including dependency edges, communication edges, call edges, and mapping edges. In graph neural networks, the structure of a heterogeneous graph G = (V, E) is represented by the following two key matrices: Feature matrix X∈R n×d , used to describe the characteristic information of each node in the graph, where n is the total number of nodes in the graph, d is the characteristic dimension of each node, and each row in the matrix corresponds to a node and records the eigenvalues of the node; Adjacency matrix A∈R n×n , used to describe the connection relationship between nodes in the graph. The elements in the matrix are defined as follows:

3. The IoT vulnerability data repair system according to claim 2, characterized in that: The process of extracting vulnerability-related features and propagating features by the vulnerability identification and positioning module includes: The characteristics of each node are composed of multiple dimensions, including CVE-related characteristics, CVSS score characteristics, service and protocol characteristics, component function and location characteristics, device importance characteristics, operating status and historical attack records. All node characteristics are converted into numerical or vector inputs and formed into the node input vector x after normalization. i , the node feature matrix of the entire graph is: Graph neural networks are used to learn the implicit relationships between nodes and predict whether each node has a vulnerability. Graph neural networks aggregate information about neighboring nodes through graph convolution operations and then use activation functions to obtain new node representations. The specific formula is as follows: Among them H (0) =X is the initial node feature, represents the adjacency matrix after adding the self-loop, for The degree matrix, W (l) is the weight matrix of the lth layer, σ is the nonlinear activation function, H (l) represents the node representation of the lth layer; After L layers of graph convolution, the final node embedding is represented as H (L) , which contains the aggregated structural information and contextual features.

4. The IoT vulnerability data repair system according to claim 3, characterized in that: The process of the vulnerability identification and location module classifying and identifying potential vulnerabilities and locating the device nodes and software components where the vulnerabilities are located includes: After the graph neural network completes multi-layer feature propagation, the node embedding of the last layer is used to represent H (L) To classify vulnerabilities, a linear classifier combined with a Softmax activation function is used to perform binary or multi-classification operations on each node: Where W (L+1) is the parameter matrix of the classification layer, is the final embedding vector of node i, is the predicted probability distribution of whether node i has a vulnerability, indicating the possibility of the node belonging to different vulnerability levels; The final output is the label prediction results of all nodes; After completing the node classification, the specific location of the vulnerability is determined based on the prediction results. The vulnerability location is completed through the edge relationship between the nodes in the graph: If there is a mapping edge between a vulnerability node and a component node, it can be directly determined that the component has the vulnerability; If there is a subordinate relationship edge between the component node and the device node, the physical or virtual device where the vulnerability is located can be further located; If a service node is identified as having a vulnerability and is connected to multiple components, it is necessary to combine communication traffic logs, call chain information or context analysis to further trace the actual source component of the vulnerability.

5. The IoT vulnerability data repair system according to claim 4, characterized in that: The vulnerability identification and location module prioritizes and generates a list of vulnerabilities to be fixed by combining CVSS scores and device importance levels, including: After vulnerability location, prioritize the vulnerabilities and assign a priority score P to each vulnerability by combining the CVSS score and the device importance level. r , vulnerability priority P r Calculated using the following formula: P r =α·C+(1-α)·K; Among them, P r is the vulnerability priority score, C is the CVSS score, K is the device importance, and α is the coefficient for adjusting the CVSS weight; All nodes predicted as "having vulnerabilities" are divided into two groups according to P r Scores are sorted from high to low; Based on the identification and scoring results, the system automatically generates a list of vulnerabilities to be fixed, including the following: Vulnerability identification, affected component and device name, predicted risk level and CVSS score, priority score, current repair status, and recommended repair method or patch link.

6. The IoT vulnerability data repair system according to claim 1, characterized in that: The process of the vulnerability repair strategy generation module calling the built-in repair strategy library according to the vulnerability identification result and automatically generating the corresponding repair plan includes: Obtain vulnerability identification results, including vulnerability number, vulnerability type, affected component, severity level, risk score, and remediation recommendations; Based on the vulnerability identification results, the system matches rules in the built-in repair strategy library and selects the most suitable repair solution for the current vulnerability. The process includes the following steps: T1: Match vulnerability labels with remediation strategy rules and select the best-suited remediation method; T2: Replace the placeholders in the general repair policy template with the actual affected component information; T3: Generate specific executable repair commands based on the template; T4: Generate a complete repair plan entry; Based on the policy library and vulnerability identification results, the system will automatically generate a remediation plan, which includes the following: Determine the repair method based on the vulnerability type; Call the policy template to dynamically generate repair commands based on the component information and version information provided by the identification module; Evaluate the resource costs and dependencies of the repair process; Output repair task details for execution module to schedule and execute.

7. The IoT vulnerability data repair system according to claim 1, characterized in that: The process of using the reinforcement learning algorithm to train the decision model in the vulnerability repair optimization module includes: The entire repair process is modeled as a Markov decision process, whose elements are defined as follows: State space S: The current security status of the system, including the set of identified vulnerabilities, system resource status, and historical repair records; Action space A: Repair decisions, which can be to fix a vulnerability, postpone repair, or allocate resources; State transition function T: the change in system state caused by the execution of an action; Reward function R: evaluates the quality of the repair action based on the results of the action; The design of the reward function requires comprehensive consideration of multiple factors. The specific expression is as follows: R(s,a)=-λ1·XF(v)-λ2·XS(v)-λ3·XZ(a)+λ4·XT(s′); Where XF(v) represents the risk of the vulnerability, XS(v) represents the time the vulnerability remains unrepaired, XZ(a) represents the resources required for the repair action, XT(s′) represents the stability improvement of the system after the repair, and λ1, λ2, λ3, and λ4 are all weight coefficients; The DQN algorithm is used to train the decision model, with the goal of maximizing the long-term accumulated rewards: Where π is the policy function, which means that in state s t The action selected under , γ is the discount factor, which represents the weight of future rewards, and T is the maximum number of time steps for training; Through training, the system is able to learn the best repair strategy from historical repair data.

8. The IoT vulnerability data repair system according to claim 7, characterized in that: The process of dynamically optimizing the repair sequence and resource allocation in a multi-vulnerability scenario by the vulnerability repair optimization module includes: In a multi-vulnerability scenario, the system needs to consider multiple factors to optimize the repair strategy, with the goal of minimizing repair time and resource consumption while maximizing the risk reduction of repairs; If there are n vulnerabilities, each vulnerability repair operation consumes resources r i , the risk brought by the repair is reduced to P i , then the optimization goal is: where x i Whether to execute the repair action of vulnerability i, P i is the profit of fixing vulnerability i, r i is the resource needed to repair i, R max is the maximum available amount of resources; The system will dynamically decide the repair order based on the strategy given by the reinforcement learning model: In an environment with a high concentration of high-risk vulnerabilities, prioritize remediating high-yield vulnerabilities; When resources are limited, prioritize fixing the most cost-effective vulnerabilities. Automatically schedule concurrent or serial repairs.

Images