Composite security vulnerability identification method, apparatus and device, storage medium and program product

Abstract

The invention provides a composite security vulnerability identification method, which is applied to the technical field of artificial intelligence. Comprising the steps of obtaining a current safety state of a target system based on initial scanning; according to a preset target Q table, reading all attack actions and reward values corresponding to the current security state, and determining a first target attack action in all the attack actions; executing the first target attack action to obtain a first attack action sequence; after the first target attack action is executed, determining a second target attack action based on the target Q table; executing a second target attack action to obtain a second attack action sequence and a corresponding composite vulnerability type; converting the plurality of second attack action sequences and the corresponding composite vulnerability types into formats which can be identified by the rule engine, and adding the formats into the rule engine; and according to the rule engine, completing the recognition of the composite vulnerability. The invention further provides a composite security vulnerability recognition device and equipment, a storage medium and a program product.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and more specifically to a composite security vulnerability identification method, apparatus, device, storage medium, and program product. Background Art

[0002] With the rapid development of information technology, network security issues are becoming increasingly serious. Various security vulnerabilities are emerging one after another, posing a huge threat to information security. Currently, the identification of security vulnerabilities mainly relies on security testing, which mainly includes manual testing and security scanning based on rule engines.

[0003] However, manual testing suffers from shortcomings such as high labor costs, long time consumption, subjective results, and difficulty covering all code paths, resulting in incomplete vulnerability detection. Security scanning based on rule engines is an automated testing tool that can quickly process large amounts of data and detect known vulnerabilities in real time. However, this method cannot identify complex security vulnerabilities and can only detect known vulnerability types. Furthermore, delayed rule updates can make it impossible to respond to new attacks. Summary of the Invention

[0004] In view of the above problems, the present application provides a composite security vulnerability identification method, apparatus, device, storage medium and program product.

[0005] According to the first aspect of the present application, a method for identifying composite security vulnerabilities is provided, comprising: obtaining the current security status of a target system based on an initial scan; reading all attack actions and reward values corresponding to the current security status according to a preset target Q table, and determining a first target attack action among all attack actions; executing the first target attack action to obtain a first attack action sequence that triggers a single vulnerability; after the first target attack action is executed, determining a second target attack action based on the target Q table; executing the second target attack action to obtain a second attack action sequence that triggers a composite vulnerability and a corresponding composite vulnerability type; converting multiple second attack action sequences and corresponding composite vulnerability types into a format that can be recognized by a rule engine, and adding them to the rule engine; completing the identification of composite vulnerabilities of the target system according to the rule engine; wherein the target Q table is constructed by reinforcement learning based on the test results and reward results of the target system security test.

[0006] According to an embodiment of the present application, a target Q table is constructed based on reinforcement learning of the test results and reward results of the security test of the target system, including: based on the initial scan, obtaining the current security status of the target system and extracting the vulnerability features in the preset vulnerability library to obtain a corresponding attack action set; in a security test that meets the preset number of training rounds, executing any attack action in the attack action set and recording the corresponding reward results to update the preset initial Q table, which is a table initialized by reinforcement learning; based on the test results and reward results of the security test, constructing a reward function for the security status of the target system and updating the initial Q table to obtain a target Q table.

[0007] According to an embodiment of the present application, a first target attack action is executed to obtain a first attack action sequence that triggers a single vulnerability, including: determining the execution result of the first target attack action; when the execution result meets the conditions for triggering a single vulnerability, updating the positive reward value of the state-action pair in the target Q table, and recording the first sub-attack action sequence that triggers the single vulnerability; repeatedly executing the first target attack action multiple times, and when the first sub-attack action sequence data reaches a threshold, generating the first attack action sequence that triggers the single vulnerability.

[0008] According to an embodiment of the present application, after the first target attack action is executed, the second target attack action is determined based on the target Q table, including: determining the single vulnerability type to be triggered in the current state of the target system and the corresponding second target attack action based on the reward function.

[0009] According to an embodiment of the present application, a second target attack action is executed to obtain a second attack action sequence that triggers a composite vulnerability and a corresponding composite vulnerability type, including: while executing the second target attack action, executing the first attack action sequence to complete the combined execution; after completing the combined execution, obtaining a second sub-attack action sequence that triggers the composite vulnerability; after multiple combined executions, combining multiple second sub-attack action sequences that trigger the composite vulnerability to obtain a second attack action sequence that triggers the composite vulnerability and a corresponding composite vulnerability type.

[0010] According to an embodiment of the present application, multiple second attack action sequences and corresponding composite vulnerability types are converted into a format that can be recognized by the rule engine and added to the rule engine, including: converting the second attack action sequences and the corresponding composite vulnerability types into a rule format to obtain initial rules; verifying the initial rules to obtain verification results; and adding them to the rule engine under the condition that the verification results pass.

[0011] According to an embodiment of the present application, the method also includes: when the execution result does not meet the conditions for triggering a single vulnerability, updating the negative reward value of the state-action pair in the target Q table and determining a third target attack action; while executing the first target attack action, executing the third target attack action to generate a first attack action sequence that triggers a single vulnerability.

[0012] The second aspect of the present application provides a composite security vulnerability identification device, which includes: a scanning module for obtaining the current security status of a target system based on an initial scan; a first target attack action determination module for reading all attack actions and reward values corresponding to the current security status according to a preset target Q table, and determining the first target attack action among all attack actions; a first attack action sequence acquisition module for executing the first target attack action to obtain a first attack action sequence that triggers a single vulnerability; a second target attack action determination module for determining the second target attack action based on the target Q table after the first target attack action is executed; a second attack action sequence acquisition module for executing the second target attack action to obtain a second attack action sequence that triggers a composite vulnerability and a corresponding composite vulnerability type; a rule engine adding module for converting multiple second attack action sequences and corresponding composite vulnerability types into a format that can be recognized by the rule engine, and adding them to the rule engine; a composite vulnerability identification module for completing the composite vulnerability identification of the target system according to the rule engine; wherein the target Q table is constructed based on reinforcement learning of the test results and reward results of the target system security test.

[0013] The third aspect of the present application provides an electronic device, comprising: one or more processors; a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0014] The fourth aspect of the present application further provides a computer-readable storage medium having a computer program or instructions stored thereon, which implements the steps of the above method when the computer program or instructions are executed by a processor.

[0015] The fifth aspect of the present application further provides a computer program product, comprising a computer program or instructions, which implement the steps of the above method when executed by a processor. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The above contents and other objects, features and advantages of the present application will become more apparent through the following description of the embodiments of the present application with reference to the accompanying drawings, in which:

[0017] Figure 1 The following schematically illustrates an application scenario of the composite security vulnerability identification method according to an embodiment of the present application;

[0018] Figure 2 The following schematically illustrates a flow chart of a method for identifying a composite security vulnerability according to an embodiment of the present application;

[0019] Figure 3 Schematically shows a flow chart for obtaining a first attack action sequence according to an embodiment of the present application;

[0020] Figure 4 Schematically shows a flow chart of obtaining a second attack action sequence according to an embodiment of the present application;

[0021] Figure 5 A flowchart of converting sequences and vulnerability types and adding them to a rule engine according to an embodiment of the present application is schematically shown;

[0022] Figure 6 A schematic diagram of a structure of a composite security vulnerability identification device according to an embodiment of the present application is shown; and

[0023] Figure 7 A block diagram of an electronic device suitable for implementing a composite security vulnerability identification method according to an embodiment of the present application is schematically shown. DETAILED DESCRIPTION

[0024] Hereinafter, embodiments of the present application will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present application. In the detailed description below, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present application. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessarily confusing the concepts of the present application.

[0025] The terms used herein are only for describing specific embodiments and are not intended to limit the present application. The terms "comprise," "include," etc. used herein indicate the presence of features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0026] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0027] When expressions such as "at least one of A, B, and C, etc." are used, they should generally be interpreted in accordance with the meaning commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0028] In the technical solution of this application, the user information involved (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0029] In the scenario of using personal information for automated decision-making, the methods, devices, and systems provided in the embodiments of the present application all provide users with corresponding operation portals for users to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered. The expression "automated decision-making" here refers to the activity of automatically analyzing and evaluating an individual's behavioral habits, interests and hobbies, or economic, health, credit status, etc. through computer programs and making decisions. The expression "expert decision-making" here refers to the activity of making decisions by people who specialize in a certain field, have specialized experience, knowledge and skills, and have reached a certain level of professionalism.

[0030] An embodiment of the present application provides a method for identifying composite security vulnerabilities, including: obtaining the current security status of a target system based on an initial scan; reading all attack actions and reward values corresponding to the current security status according to a preset target Q table, and determining a first target attack action among all attack actions; executing the first target attack action to obtain a first attack action sequence that triggers a single vulnerability; after the first target attack action is executed, determining a second target attack action based on the target Q table; executing the second target attack action to obtain a second attack action sequence that triggers a composite vulnerability and a corresponding composite vulnerability type; converting multiple second attack action sequences and corresponding composite vulnerability types into a format that can be recognized by a rule engine, and adding them to the rule engine; completing the identification of composite vulnerabilities of the target system according to the rule engine; wherein the target Q table is constructed by reinforcement learning based on the test results and reward results of the target system security test.

[0031] Through the embodiments of the present application, the method uses reinforcement learning to construct a target Q table, combined with automated scanning results, to quickly obtain the current security status of the target system, significantly improving the efficiency of vulnerability identification. Not only can it effectively identify compound vulnerabilities triggered by the linkage of multiple single vulnerabilities by executing multiple attack actions and recording the reward results, overcoming the limitations of traditional methods. It can also convert the identified attack action sequence and the corresponding compound vulnerability type into a format that can be recognized by the rule engine, facilitating the implementation of subsequent security protection measures and realizing automated security management.

[0032] Figure 1 The following schematically illustrates an application scenario diagram of a composite security vulnerability identification method according to an embodiment of the present application.

[0033] like Figure 1 As shown, the application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, and a server 105. A network 104 is used as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links or optical fiber cables.

[0034] A user may use a first terminal device 101, a second terminal device 102, or a third terminal device 103 to interact with a server 105 via a network 104 to receive or send messages, etc. Various communication client applications may be installed on the first terminal device 101, the second terminal device 102, or the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (for example only).

[0035] The first terminal device 101 , the second terminal device 102 , and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0036] The server 105 may be a server that provides various services, such as a background management server (for example only) that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process received data such as user requests, and feed back processing results (e.g., web pages, information, or data obtained or generated based on user requests) to the terminal devices.

[0037] It should be noted that the composite security vulnerability identification method provided in the embodiment of the present application can generally be executed by the server 105. Accordingly, the composite security vulnerability identification device provided in the embodiment of the present application can generally be set in the server 105. The composite security vulnerability identification method provided in the embodiment of the present application can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Accordingly, the composite security vulnerability identification device provided in the embodiment of the present application can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0038] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is merely illustrative. Any number of terminal devices, networks and servers may be provided as required.

[0039] The following will be based on Figure 1 The scene described by Figures 2 to 5 A method for identifying a complex security vulnerability according to an embodiment of the present application is described in detail.

[0040] Figure 2 The flowchart of the composite security vulnerability identification method according to an embodiment of the present application is schematically shown.

[0041] like Figure 2 As shown, according to an embodiment of the present application, the composite security vulnerability identification method specifically includes operations S210 to S270.

[0042] In operation S210 , based on the initial scan, a current security status of the target system is acquired.

[0043] Exemplarily, a preliminary scan is performed on the target system to obtain the current security status of the environment, such as information including discovered vulnerabilities, environment configuration, etc.

[0044] In operation S220 , all attack actions and reward values corresponding to the current security state are read according to a preset target Q table, and a first target attack action among all the attack actions is determined.

[0045] In the embodiments of this application, a target Q-table is constructed using reinforcement learning based on the test results and reward results of the target system security test. This Q-table includes the current system state and the attack action values corresponding to the vulnerability type. The following details the construction and training of the Q-table.

[0046] According to an embodiment of the present application, a target Q table is constructed based on reinforcement learning of the test results and reward results of the security test of the target system, including: based on the initial scan, obtaining the current security status of the target system and extracting the vulnerability features in the preset vulnerability library to obtain a corresponding attack action set; in a security test that meets the preset number of training rounds, executing any attack action in the attack action set and recording the corresponding reward results to update the preset initial Q table, which is a table initialized by reinforcement learning; based on the test results and reward results of the security test, constructing a reward function for the security status of the target system and updating the initial Q table to obtain a target Q table.

[0047] Specifically, an initial scan is performed on the target system. After the scan, vulnerability signatures are extracted from a pre-defined vulnerability library. Based on these signatures, a set of attack actions is generated. Simultaneously, a Q-table is constructed and initialized based on the Q-learning algorithm used in reinforcement learning to generate an initial Q-table. The rows of the Q-table represent the current state of the system, and the columns represent the attack actions corresponding to that state.

[0048] Furthermore, during a security test that meets a preset number of training rounds (e.g., 1000 rounds), a random attack action is selected from the set of attack actions for testing. For example, in round 1, an "injection attack" is selected, executed, and the results recorded. If the attack is successful and sensitive data is obtained, a high reward (e.g., +10) is assigned for that round; otherwise, a low reward (e.g., -5) is assigned. Each time an attack action is executed, the corresponding reward result is recorded to update the initial Q table.

[0049] Based on the test results and reward outcomes of each security test, a reward function is constructed to reflect the security status of the target system. For example, a reward function is set such that a successful attack receives a positive reward (e.g., +10) while a successful defense (no exploit) receives a penalty (e.g., -1). Through multiple rounds of testing, the initial Q-table is updated using a Q-learning algorithm. Through multiple rounds of attack execution and reward recording, the initial Q-table is continuously updated. As the number of training rounds increases, the target Q-table gradually converges to a stable state, ultimately resulting in the target Q-table.

[0050] It's understandable that after multiple iterations, the Q-values corresponding to each safe state and attack action in the Q-table will converge toward the optimal value, meaning that the action chosen in a given state will result in the highest expected cumulative reward. Therefore, the updated Q-table can be used to select the optimal action sequence. For each current state, the corresponding action is searched in the Q-table, and the attack action with the highest Q-value is selected to achieve the desired goal (e.g., maximizing reward).

[0051] Through the embodiments of this application, by using reinforcement learning to construct a target Q table and combining it with automated scanning results, the current security status of the target system can be quickly obtained, significantly improving the efficiency of vulnerability identification. Utilizing the feedback mechanism of Q learning, the system can adjust attack strategies in real time based on execution results, optimize the vulnerability identification process, and improve identification accuracy.

[0052] According to an embodiment of the present application, the following describes in detail how to generate detection rules for detecting compound vulnerabilities based on the target Q table, so that the rule engine has the ability to identify compound security vulnerabilities.

[0053] First, according to the preset target Q table, all attack actions and reward values corresponding to the current security state are read, and the first target attack action among all attack actions is determined.

[0054] Specifically, based on the target Q table obtained from the training, all actions and their reward values corresponding to the current state are read from the target Q table. The attack action with the highest reward value in the current state is selected, and the vulnerability type that attack action can trigger is recorded. It can be understood that this step prioritizes the attack action with the highest probability of discovering a single vulnerability to improve testing efficiency.

[0055] For example, for a discovered injection vulnerability, attack actions may include "injecting malicious statements" and "obtaining database user information." By analyzing the expected reward values of these attack actions, "injecting malicious statements" is determined to be the first target attack action.

[0056] In operation S230 , a first target attack action is executed to obtain a first attack action sequence that triggers a single vulnerability.

[0057] Figure 3 The flowchart of obtaining the first attack action sequence according to an embodiment of the present application is schematically shown.

[0058] like Figure 3 As shown, according to an embodiment of the present application, a first target attack action is executed to obtain a first attack action sequence that triggers a single vulnerability. This specific process includes operations S310 to S330.

[0059] In operation S310 , an execution result of the first target attack action is determined.

[0060] In operation S320 , when the execution result satisfies the condition of triggering a single vulnerability, the positive reward value of the state-action pair in the target Q table is updated, and the first sub-attack action sequence that triggers the single vulnerability is recorded.

[0061] In operation S330 , the first target attack action is repeatedly executed multiple times, and when the first sub-attack action sequence data reaches a threshold, a first attack action sequence that triggers a single vulnerability is generated.

[0062] According to an embodiment of the present application, the aforementioned first target attack action is executed, and the results of the attack action are recorded, including whether a vulnerability is found, the vulnerability type, and the vulnerability severity (rank in the security vulnerability database). This allows verification of whether the attack action can successfully trigger a single vulnerability. If the attack action successfully finds a vulnerability, the action and vulnerability type are recorded, the reward value for the state-action pair in the Q table is updated (positive reward), and the attack action that triggers the single vulnerability is recorded as the first sub-attack action sequence.

[0063] Furthermore, the first target attack action is repeatedly executed multiple times, generating multiple first sub-attack action sequences and corresponding single vulnerability types. When the number of generated first sub-attack action sequences reaches a preset threshold, generation stops. This allows the generation of an attack action sequence of the maximum length for a single vulnerability, namely the first attack action sequence.

[0064] It should be noted that when the execution result does not meet the conditions for triggering a single vulnerability, the negative reward value of the state-action pair in the target Q table is updated, and the third target attack action is determined; while executing the first target attack action, the third target attack action is executed to generate the first attack action sequence that triggers a single vulnerability.

[0065] As you can understand, if an attack action fails to discover a vulnerability, the reward value for that state-action pair in the Q-table is updated (negative reward). The next attack action with the highest reward (i.e., the third target attack action) is selected and combined with the current attack action (the first target attack action) to continue execution. Similarly, when the number of generated action sequences reaches a preset threshold, generation stops, thus generating the first attack action sequence that triggers a single vulnerability.

[0066] In operation S240 , after the first target attack action is performed, a second target attack action is determined based on the target Q table.

[0067] In operation S250 , a second target attack action is executed to obtain a second attack action sequence triggering a composite vulnerability and a corresponding composite vulnerability type.

[0068] Figure 4 The flowchart of obtaining the second attack action sequence according to an embodiment of the present application is schematically shown.

[0069] like Figure 4 As shown, according to an embodiment of the present application, a second target attack action is executed to obtain a second attack action sequence triggering a composite vulnerability and a corresponding composite vulnerability type. This specific process includes operations S410 to S430.

[0070] In operation S410, while executing the second target attack action, the first attack action sequence is also executed to complete the combined execution.

[0071] In operation S420, after the combined execution is completed, a second sub-attack action sequence that triggers the composite vulnerability is obtained.

[0072] In operation S430 , after multiple combination executions, multiple second sub-attack action sequences that trigger the compound vulnerability are combined to obtain a second attack action sequence that triggers the compound vulnerability and a corresponding compound vulnerability type.

[0073] According to an embodiment of the present application, after the first target attack action is executed, based on the target Q table and according to the reward function, the single vulnerability type to be triggered in the current state of the target system and the corresponding second target attack action are determined.

[0074] Furthermore, while executing the second target attack action, the first attack action sequence is also executed to complete the combined execution, thus constructing the attack action sequence that triggers the composite vulnerability, which is also the second sub-attack action sequence.

[0075] Furthermore, multiple rounds of action sequence execution are completed within a limited time, and each round generates a new second sub-attack action sequence and compound vulnerability type, thereby obtaining a second attack action sequence that triggers the compound vulnerability and the corresponding compound vulnerability type.

[0076] Through the embodiments of the present application, by executing multiple attack actions and recording the reward results, it is possible to effectively identify compound vulnerabilities triggered by the linkage of multiple single vulnerabilities.

[0077] In operation S260 , the plurality of second attack action sequences and the corresponding compound vulnerability types are converted into a format recognizable by the rule engine and added to the rule engine.

[0078] In operation S270 , composite vulnerabilities of the target system are identified according to the rule engine.

[0079] Figure 5 The flowchart of converting sequences and vulnerability types and adding them to the rule engine according to an embodiment of the present application is schematically shown.

[0080] like Figure 5 As shown, according to an embodiment of the present application, multiple second attack action sequences and corresponding composite vulnerability types are converted into a format that can be recognized by the rule engine and added to the rule engine. This specific process includes operations S510 to S530.

[0081] In operation S510 , rule format conversion is performed on the second attack action sequence and the corresponding composite vulnerability type to obtain an initial rule.

[0082] In operation S520, the initial rule is verified to obtain a verification result.

[0083] In operation S530, if the verification result passes, it is added to the rule engine.

[0084] Specifically, based on the above, multiple second attack action sequences and corresponding composite vulnerability types are generated. Next, these sequences and vulnerability types need to be converted into a format that the rule engine can recognize and added to the rule engine. The specific process includes: first, converting the attack action sequence and vulnerability type into a format supported by the rule engine. For example, the attack action sequence can be converted into a regular expression or other format supported by the rule engine. Then, before adding the new rule to the rule engine, it needs to be tested to ensure that it can correctly detect the target composite vulnerability and does not generate too many false positives.

[0085] Furthermore, the rules that pass the verification are added to the rule engine, and then the rule engine will perform subsequent security scans based on these new rules to ensure that other complex vulnerabilities in the target system can be detected.

[0086] It should be noted that as new rules are added, the rule base may become large and complex. Therefore, it is necessary to regularly optimize the rule base to remove redundant rules and merge similar rules.

[0087] Through the embodiments of this application, this method not only converts the identified attack action sequences and corresponding composite vulnerability types into a format recognizable by the rule engine, facilitating the implementation of subsequent security protection measures and achieving automated security management, but also adapts to the ever-changing network environment. By continuously learning and updating the Q table, it maintains sensitivity and recognition capabilities for emerging vulnerabilities, thereby improving the overall level of network security protection.

[0088] Based on the above-mentioned composite security vulnerability identification method, the present application also provides a composite security vulnerability identification device. Figure 6 The device is described in detail.

[0089] Figure 6 The structural block diagram of the composite security vulnerability identification device according to an embodiment of the present application is schematically shown.

[0090] like Figure 6 As shown, the composite security vulnerability identification device 600 of this embodiment includes a scanning module 610, a first target attack action determination module 620, a first attack action sequence acquisition module 630, a second target attack action determination module 640, a second attack action sequence acquisition module 650, a rule engine adding module 660 and a composite vulnerability identification module 670.

[0091] The scanning module 610 is used to obtain the current security status of the target system based on the initial scan. In one embodiment, the scanning module 610 can be used to perform the operation S210 described above, which will not be repeated here.

[0092] The first target attack action determination module 620 is configured to read all attack actions and reward values corresponding to the current security state from a preset target Q table and determine the first target attack action among all attack actions. In one embodiment, the first target attack action determination module 620 can be configured to perform operation S220 described above and will not be further described here.

[0093] The first attack action sequence acquisition module 630 is configured to execute the first target attack action to obtain the first attack action sequence that triggers a single vulnerability. In one embodiment, the first attack action sequence acquisition module 630 may be configured to execute the operation S230 described above, which will not be described in detail herein.

[0094] The second target attack action determination module 640 is configured to determine a second target attack action based on the target Q table after the first target attack action is executed. In one embodiment, the second target attack action determination module 640 may be configured to execute the operation S240 described above, which will not be described in detail here.

[0095] The second attack action sequence acquisition module 650 is used to execute the second target attack action to obtain the second attack action sequence that triggers the composite vulnerability and the corresponding composite vulnerability type. In one embodiment, the second attack action sequence acquisition module 650 can be used to execute the operation S250 described above, which will not be repeated here.

[0096] The rule engine adding module 660 is used to convert the plurality of second attack action sequences and the corresponding composite vulnerability types into a format recognizable by the rule engine and add them to the rule engine. In one embodiment, the rule engine adding module 660 can be used to perform the operation S260 described above, which will not be repeated here.

[0097] The composite vulnerability identification module 670 is used to complete composite vulnerability identification of the target system according to the rule engine. In one embodiment, the composite vulnerability identification module 670 can be used to perform the operation S270 described above, which will not be repeated here.

[0098] According to an embodiment of the present application, the target Q table is constructed based on reinforcement learning of the test results and reward results of the target system safety test.

[0099] In the embodiment of the present application, the first attack action sequence acquisition module 630 includes an execution result determination unit, an updating unit and a first attack action sequence generation unit.

[0100] The execution result determination unit is configured to determine the execution result of the first target attack action. In one embodiment, the execution result determination unit may be configured to execute the operation S310 described above, which will not be described in detail herein.

[0101] An updating unit is configured to update the positive reward value of the state-action pair in the target Q table when the execution result satisfies the conditions for triggering a single vulnerability, and to record the first sub-attack action sequence that triggers the single vulnerability. In one embodiment, the updating unit can be configured to perform operation S320 described above, which will not be further described here.

[0102] The first attack action sequence generation unit is configured to repeatedly execute the first target attack action multiple times. When the first sub-attack action sequence data reaches a threshold, a first attack action sequence is generated to trigger a single vulnerability. In one embodiment, the first attack action sequence generation unit can be configured to execute operation S330 described above, which will not be further described here.

[0103] In the embodiment of the present application, the second attack action sequence acquisition module 650 includes a combination execution unit, a second sub-attack action sequence generation unit, and a second attack action sequence generation unit.

[0104] The combined execution unit is configured to execute the first attack action sequence while executing the second target attack action to complete the combined execution. In one embodiment, the combined execution unit may be configured to execute the operation S410 described above, which will not be described in detail herein.

[0105] The second sub-attack action sequence generation unit is configured to obtain a second sub-attack action sequence that triggers the composite vulnerability after completing the combined execution. In one embodiment, the second sub-attack action sequence generation unit may be configured to perform the aforementioned operation S420, which will not be described in detail herein.

[0106] The second attack action sequence generation unit is configured to combine, after multiple combined executions, multiple second sub-attack action sequences that trigger the composite vulnerability to obtain a second attack action sequence that triggers the composite vulnerability and a corresponding composite vulnerability type. In one embodiment, the second attack action sequence generation unit can be configured to perform operation S430 described above, which will not be further described here.

[0107] In an embodiment of the present application, the rule engine adding module 660 includes a conversion unit, a verification unit and an adding unit.

[0108] The conversion unit is configured to convert the second attack action sequence and the corresponding composite vulnerability type into a rule format to obtain an initial rule. In one embodiment, the conversion unit may be configured to execute the operation S510 described above, which will not be described in detail herein.

[0109] The verification unit is used to verify the initial rule and obtain a verification result. In one embodiment, the verification unit can be used to perform the operation S520 described above, which will not be repeated here.

[0110] The adding unit is used to add the result to the rule engine under the condition that the verification result passes. In one embodiment, the adding unit can be used to perform the operation S530 described above, which will not be repeated here.

[0111] According to an embodiment of the present application, any multiple modules among the scanning module 610, the first target attack action determination module 620, the first attack action sequence acquisition module 630, the second target attack action determination module 640, the second attack action sequence acquisition module 650, the rule engine addition module 660, and the composite vulnerability identification module 670 can be combined into a single module for implementation, or any one of these modules can be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules can be combined with at least part of the functionality of other modules and implemented in a single module. According to an embodiment of the present application, at least one of the scanning module 610, the first target attack action determination module 620, the first attack action sequence acquisition module 630, the second target attack action determination module 640, the second attack action sequence acquisition module 650, the rule engine addition module 660, and the composite vulnerability identification module 670 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented in hardware or firmware by any other reasonable means of circuit integration or packaging, or implemented in any one of the three implementation methods of software, hardware, and firmware, or in any appropriate combination of any of them. Alternatively, at least one of the scanning module 610, the first target attack action determination module 620, the first attack action sequence acquisition module 630, the second target attack action determination module 640, the second attack action sequence acquisition module 650, the rule engine addition module 660, and the composite vulnerability identification module 670 can be at least partially implemented as a computer program module, which can perform the corresponding function when executed.

[0112] Figure 7 A block diagram of an electronic device suitable for implementing a composite security vulnerability identification method according to an embodiment of the present application is schematically shown.

[0113] like Figure 7As shown, an electronic device 700 according to an embodiment of the present application includes a processor 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage unit 708 into a random access memory (RAM) 703. The processor 701 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 701 may also include onboard memory for caching purposes. The processor 701 may include a single processing unit or multiple processing units for performing different actions of the method flow according to the embodiment of the present application.

[0114] Various programs and data required for the operation of the electronic device 700 are stored in the RAM 703. The processor 701, ROM 702, and RAM 703 are connected to each other via a bus 704. The processor 701 performs various operations of the method flow according to the embodiment of the present application by executing the programs in the ROM 702 and / or RAM 703. It should be noted that the programs may also be stored in one or more memories other than the ROM 702 and the RAM 703. The processor 701 may also perform various operations of the method flow according to the embodiment of the present application by executing the programs stored in one or more memories.

[0115] According to an embodiment of the present application, electronic device 700 may further include an input / output (I / O) interface 705, which is also connected to bus 704. Electronic device 700 may also include one or more of the following components connected to I / O interface 705: an input section 706 including a keyboard, mouse, etc.; an output section 707 including devices such as a cathode ray tube (CRT), liquid crystal display (LCD), and speakers; a storage section 708 including a hard disk; and a communication section 709 including a network interface card such as a LAN card or modem. Communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to I / O interface 705 as needed. Removable media 711, such as a magnetic disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed in drive 710 as needed, so that computer programs read from the removable media can be installed into storage section 708 as needed.

[0116] This application also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments, or may exist independently and not be incorporated into the device / apparatus / system. The computer-readable storage medium carries one or more programs, and when the one or more programs are executed, the method according to the embodiments of this application is implemented.

[0117] According to an embodiment of the present application, a computer-readable storage medium may be a non-volatile computer-readable storage medium, and may include, for example, but not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present application, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction change execution system, apparatus, or device. For example, according to an embodiment of the present application, a computer-readable storage medium may include the ROM 702 and / or RAM 703 described above and / or one or more memories other than ROM 702 and RAM 703.

[0118] The embodiments of the present application also include a computer program product, which includes a computer program containing program code for executing the method shown in the flowchart. When the computer program product is executed in a computer system, the program code is used to enable the computer system to implement the composite security vulnerability identification method provided in the embodiments of the present application.

[0119] The computer program executes the above functions defined in the system / device of the embodiment of the present application when the computer program is executed by the processor 701. According to the embodiment of the present application, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0120] In one embodiment, the computer program may be stored on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may be transmitted and distributed in the form of a signal on a network medium, downloaded and installed via the communication portion 709, and / or installed from a removable medium 711. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to wireless, wired, or any suitable combination thereof.

[0121] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 709, and / or installed from a removable medium 711. When the computer program is executed by the processor 701, the above-described functions defined in the system of the embodiment of the present application are performed. According to the embodiment of the present application, the systems, devices, means, modules, units, etc. described above can be implemented by computer program modules.

[0122] According to an embodiment of the present application, the program code for executing the computer program provided by the embodiment of the present application can be written in any combination of one or more programming languages. Specifically, these computer programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages include, but are not limited to, languages such as Java, C++, Python, "C" or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect via the Internet).

[0123] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the above-mentioned module, program segment, or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of the boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0124] Those skilled in the art will appreciate that the features described in the various embodiments of this application may be combined and / or coupled in various ways, even if such combinations or couplings are not explicitly described in this application. In particular, the features described in the various embodiments of this application may be combined and / or coupled in various ways without departing from the spirit and teachings of this application. All such combinations and / or couplings fall within the scope of this application.

[0125] The embodiments of the present application have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of the present application. Although each embodiment has been described separately above, this does not mean that the measures in each embodiment cannot be advantageously used in combination. Without departing from the scope of the present application, those skilled in the art may make various substitutions and modifications, and these substitutions and modifications should all fall within the scope of the present application.

Claims

1. A composite security vulnerability identification method, characterized in that: The method comprises: Based on the initial scan, obtain the current security status of the target system; According to a preset target Q table, read all attack actions and reward values corresponding to the current security state, and determine the first target attack action among all the attack actions; Executing the first target attack action to obtain a first attack action sequence that triggers a single vulnerability; After the first target attack action is executed, determining a second target attack action based on the target Q table; Executing the second target attack action to obtain a second attack action sequence triggering the composite vulnerability and a corresponding composite vulnerability type; Converting the plurality of second attack action sequences and the corresponding composite vulnerability types into a format recognizable by a rule engine, and adding the converted data to the rule engine; According to the rule engine, complete the identification of composite vulnerabilities of the target system; The target Q table is constructed based on reinforcement learning of the test results and reward results of the target system safety test.

2. The method for identifying a composite security vulnerability according to claim 1, wherein: The target Q table is constructed based on the test results and reward results of the target system security test through reinforcement learning, and includes: Based on the initial scan, the current security status of the target system is obtained and vulnerability features in the preset vulnerability library are extracted to obtain the corresponding attack action set; In a security test that meets a preset number of training rounds, executing any attack action in the attack action set and recording the corresponding reward result to update a preset initial Q table, wherein the initial Q table is a table initialized by reinforcement learning; According to the test results and reward results of the safety test, a reward function of the safety state of the target system is constructed and the initial Q table is updated to obtain a target Q table.

3. The method for identifying a complex security vulnerability according to claim 1, wherein: The executing the first target attack action to obtain a first attack action sequence that triggers a single vulnerability includes: Determining the execution result of the first target attack action; When the execution result satisfies the condition of triggering a single vulnerability, updating the positive reward value of the state-action pair in the target Q table, and recording the first sub-attack action sequence that triggers the single vulnerability; The first target attack action is repeatedly executed multiple times, and when the first sub-attack action sequence data reaches a threshold, a first attack action sequence that triggers a single vulnerability is generated.

4. The method for identifying a composite security vulnerability according to claim 1 or 2, wherein: After the first target attack action is executed, determining a second target attack action based on the target Q table includes: According to the reward function, a single vulnerability type to be triggered in the current state of the target system and a corresponding second target attack action are determined.

5. The method for identifying a composite security vulnerability according to claim 1 or 3, wherein: The executing the second target attack action to obtain a second attack action sequence triggering a composite vulnerability and a corresponding composite vulnerability type includes: While executing the second target attack action, execute the first attack action sequence to complete the combined execution; After completing the combined execution, a second sub-attack action sequence that triggers the composite vulnerability is obtained; After the combination is executed multiple times, multiple second sub-attack action sequences that trigger the composite vulnerability are combined to obtain a second attack action sequence that triggers the composite vulnerability and a corresponding composite vulnerability type.

6. The method for identifying a complex security vulnerability according to claim 1, wherein: The converting the plurality of second attack action sequences and the corresponding composite vulnerability types into a format recognizable by a rule engine and adding the converted data to the rule engine includes: Performing rule format conversion on the second attack action sequence and the corresponding composite vulnerability type to obtain an initial rule; Verifying the initial rules to obtain a verification result; Add to the rule engine under the condition that the verification result passes.

7. The method for identifying a complex security vulnerability according to claim 3, wherein: The method further comprises: When the execution result does not meet the condition for triggering a single vulnerability, updating the negative reward value of the state-action pair in the target Q table and determining a third target attack action; While executing the first target attack action, the third target attack action is executed to generate a first attack action sequence that triggers a single vulnerability.

8. A composite security vulnerability identification device, characterized in that: The device comprises: A scanning module is used to obtain the current security status of the target system based on the initial scan; A first target attack action determination module is configured to read all attack actions and reward values corresponding to the current security state according to a preset target Q table, and determine a first target attack action among all the attack actions; A first attack action sequence acquisition module, configured to execute the first target attack action to obtain a first attack action sequence that triggers a single vulnerability; A second target attack action determination module, configured to determine a second target attack action based on the target Q table after the first target attack action is executed; A second attack action sequence acquisition module is used to execute the second target attack action to obtain a second attack action sequence that triggers a composite vulnerability and a corresponding composite vulnerability type; A rule engine adding module, configured to convert the plurality of second attack action sequences and corresponding composite vulnerability types into a format recognizable by the rule engine, and add the converted data to the rule engine; A composite vulnerability identification module, configured to identify composite vulnerabilities of the target system according to the rule engine; The target Q table is constructed based on reinforcement learning of the test results and reward results of the target system safety test.

9. An electronic device comprising: one or more processors; a memory for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program or instruction stored thereon, characterized in that: When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

11. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images