Big model-based cvss intelligent scoring and repair decision method and system

Abstract

The application provides a large model-based CVSS intelligent scoring and repair decision method and system, relates to the technical field of large model decision, and comprises the following steps: when it is detected that a CVSS score version is missing in vulnerability data information, a large model is used to analyze a CVSS index data set and output score index options, and a corresponding CVSS score is calculated; a risk repair data set is constructed according to asset information, vulnerability data and the CVSS score, a targeted repair scheme is generated by the large model, and the repair scheme is sent to a risk device for execution. The application realizes automatic completion of vulnerability scoring and generation of a device customized repair scheme, and improves vulnerability management efficiency.

Description

TECHNICAL FIELD

[0001] The present application relates to large model decision technology, and in particular to a CVSS intelligent scoring and repair decision method and system based on a large model. BACKGROUND

[0002] With the rapid development of information technology, network security problems are increasingly prominent, and various vulnerabilities pose a serious threat to information system security. As a standardized vulnerability scoring mechanism, the Common Vulnerability Scoring System (CVSS) is widely used to assess the severity and risk level of vulnerabilities. CVSS scoring provides an objective measurement standard for vulnerability risk for security managers through quantitative analysis of multi-dimensional characteristics of vulnerabilities, which helps organizations allocate resources reasonably for vulnerability repair and risk management. With the development of CVSS from V1 version to V3 version, its scoring dimensions and index system have been continuously improved, but it has also brought differences and compatibility problems between different versions of scoring standards.

[0003] In practical applications, existing vulnerability management systems have obvious deficiencies in CVSS scoring and vulnerability repair. First, the CVSS scoring information in the vulnerability database often lacks version or is incomplete, which makes it impossible to accurately assess the vulnerability risk level and affects the scientificity of repair decisions. Due to the lack of an effective scoring completion mechanism, security managers can only determine the risk level of vulnerabilities by manually consulting relevant materials or subjective judgment, which is not only inefficient but also prone to human bias.

[0004] Secondly, the traditional vulnerability repair scheme lacks pertinence and individualization, and cannot provide customized repair recommendations according to the characteristics and business scenarios of different assets. Most systems only provide general repair guidelines without considering the specific conditions of the operating system, software version, configuration environment, etc. of specific devices, resulting in compatibility problems or new security risks in actual application of repair schemes.

[0005] Finally, there is a lack of intelligent and automated vulnerability assessment and repair decision support systems in existing technologies. Traditional methods mainly rely on manual experience for vulnerability analysis and repair decisions, and the efficiency and accuracy of manual processing are significantly reduced in the face of massive vulnerability data. At the same time, due to the lack of comprehensive consideration of asset importance and vulnerability risk, it is impossible to scientifically develop repair priority strategies, resulting in ineffective allocation of resources to the most critical security vulnerabilities. SUMMARY

[0006] The embodiments of the present application provide a CVSS intelligent scoring and repair decision method and system based on a large model, which can solve the problems in the prior art.

[0007] The first aspect of the embodiments of the present application provides a CVSS intelligent scoring and repair decision method based on a large model, comprising:

[0008] receiving vulnerability data information, collecting asset information of a risk device associated with the vulnerability data information;

[0009] when it is detected that there is a missing CVSS score version in the vulnerability data information, constructing a CVSS index data set according to the vulnerability data information, inputting the CVSS index data set into a large model, analyzing the CVSS index data set by the large model and outputting a CVSS score index option corresponding to the vulnerability data information; based on a preset CVSS score calculation rule, substituting the CVSS score index option into calculation to obtain a CVSS score of a corresponding version of the vulnerability data information;

[0010] constructing a risk repair data set according to the asset information, the vulnerability data information and the CVSS score; inputting the risk repair data set into the large model, generating a targeted repair scheme adapted to the asset information based on the risk repair data set by the large model, and sending the targeted repair scheme to the risk device for guiding the risk device to perform vulnerability repair operations.

[0011] when it is detected that there is a missing CVSS score version in the vulnerability data information, constructing a CVSS index data set according to the vulnerability data information includes:

[0012] detecting the integrity of the CVSS score version in the vulnerability data information, when there is a missing CVSS score version of the vulnerability data information, obtaining a CVSS score version identifier in the vulnerability data information, the CVSS score version identifier being used to indicate a target CVSS score version missing;

[0013] extracting basic index features from the vulnerability data information, structuring the basic index features according to the index system of the target CVSS score version to generate a CVSS index data set.

[0014] inputting the CVSS index data set into a large model, analyzing the CVSS index data set by the large model and outputting a CVSS score index option corresponding to the vulnerability data information includes:

[0015] structuring the CVSS index data set into a multi-dimensional feature matrix, inputting the multi-dimensional feature matrix into a large model, calculating the weight distribution of each feature based on the multi-dimensional feature matrix, and obtaining a feature weight value through hierarchical processing of the multi-dimensional feature matrix by the large model;

[0016] Based on the feature weight value, a score trace function is constructed by the large model, and the feature weight value is optimized by using the score trace function; the analysis result of the large model on the multi-dimensional feature matrix is calculated by the score trace function in the large model, the influence degree of the to-be-analyzed feature on the analysis result is obtained according to the optimized feature weight value, and the influence degree is integrated into the score trace function;

[0017] The optimized feature weight value, the multi-dimensional feature matrix, and the influence degree are fused by using the integrated score trace function to form a score basis; the feature data in the multi-dimensional feature matrix is combined with the context information to calculate the generation probability of each candidate indicator, and a candidate indicator set corresponding to the vulnerability data information is generated according to the processing of the large model on the score basis based on the multi-dimensional feature matrix;

[0018] The candidate indicator set is optimized based on the score trace function to generate a final CVSS score indicator option.

[0019] According to the processing of the large model on the score basis based on the multi-dimensional feature matrix, the feature data in the multi-dimensional feature matrix is combined with the context information to calculate the generation probability of each candidate indicator, which includes:

[0020] The multi-dimensional feature matrix is input into the large model, and the multi-dimensional feature matrix and the score basis are processed by the large model; a context vector is constructed based on the large model, and the context vector and the feature data in the multi-dimensional feature matrix are fused by the large model;

[0021] The generation probability of each candidate indicator in the candidate indicator set is calculated by the large model based on the result of the fusion processing;

[0022] The generation probability is calibrated by introducing a temperature parameter, and the probability distribution after the temperature parameter adjustment is normalized by the large model to generate the generation probability of the final CVSS score indicator.

[0023] The risk repair data set is input into the large model, and the large model generates a targeted repair scheme adapted to the asset information based on the risk repair data set, which includes:

[0024] A repair knowledge graph is constructed, which describes the association relationship between asset risks and repair measures through entity relationship triplets, and a knowledge reasoning path is constructed using the node information of the repair knowledge graph. The knowledge reasoning path calculates the association weight based on the relationship strength between nodes to generate a node representation vector;

[0025] deduce a relationship chain for a repair case in a risk repair dataset based on the repair knowledge graph and the node representation vector, and generate a candidate repair measure set;

[0026] adjust a combination mode and an execution sequence of the repair measures based on the adaptability score, and generate a targeted repair scheme with scenario adaptability.

[0027] deduce a relationship chain for a repair case in a risk repair dataset based on the repair knowledge graph and the node representation vector, and generate a candidate repair measure set includes:

[0028] construct a relationship chain path between entities in the repair knowledge graph, the relationship chain path including an association relationship between repair nodes, map the association relationship between the repair nodes to a node representation vector, calculate an association strength between repair cases based on the repair knowledge graph, perform similarity calculation on the node representation vector according to the association strength, and generate a repair relationship chain.

[0029] perform path analysis on the repair relationship chain, determine a path expansion direction based on the association relationship in the repair knowledge graph, enrich the association attributes of the repair relationship chain, match repair cases in a risk repair dataset according to the repair relationship chain, calculate a matching degree of the repair cases based on the node representation vector, filter repair cases higher than a preset matching degree threshold, and generate a candidate repair measure set based on the repair cases.

[0030] In a second aspect of the embodiment of the application, a CVSS intelligent scoring and repair decision system based on a large model is provided, including:

[0031] A first unit is configured to receive vulnerability data information and collect asset information of a risk device associated with the vulnerability data information.

[0032] A second unit is configured to, when detecting that a CVSS score version is missing in the vulnerability data information, construct a CVSS index dataset according to the vulnerability data information, input the CVSS index dataset into a large model, analyze the CVSS index dataset by the large model, and output a CVSS score index option corresponding to the vulnerability data information; and based on a preset CVSS score calculation rule, substitute the CVSS score index option into calculation to obtain a CVSS score of a corresponding version of the vulnerability data information.

[0033] A third unit is configured to construct a risk repair dataset according to the asset information, the vulnerability data information, and the CVSS score; input the risk repair dataset into the large model, generate a targeted repair scheme adapted to the asset information based on the risk repair dataset by the large model, and send the targeted repair scheme to the risk device to guide the risk device to perform a vulnerability repair operation.

[0034] In a third aspect, an electronic device is provided, comprising:

[0035] a processor;

[0036] a memory for storing processor-executable instructions;

[0037] The processor is configured to invoke the instructions stored in the memory to execute the method described above.

[0038] In a fourth aspect, a computer-readable storage medium is provided, which stores computer program instructions, and the computer program instructions are executed by a processor to implement the method described above.

[0039] The present application has the following beneficial effects:

[0040] The CVSS intelligent scoring and repair decision method based on a large model provided by the present application can solve the problem of missing CVSS scores, automatically generate scoring index options by intelligently analyzing vulnerability data information through a large model, accurately complete missing scores, and improve the completeness and accuracy of vulnerability risk assessment.

[0041] The present application adopts a large model to combine CVSS scoring rules for scoring calculation, avoids the subjectivity and inconsistency of traditional manual scoring methods, ensures the objectivity and standardization of the scoring results, improves the scoring efficiency, and reduces the workload of technical personnel.

[0042] The present application constructs a risk repair dataset based on asset information, vulnerability data, and CVSS scores, generates a targeted repair scheme by using a large model, makes the repair scheme highly matched with the risk device environment, improves the accuracy and effectiveness of vulnerability repair, reduces compatibility problems in the repair process, and thus improves the overall network security protection level. BRIEF DESCRIPTION OF DRAWINGS

[0043] Figure 1 FIG. 1 is a flowchart of a CVSS intelligent scoring and repair decision method based on a large model according to an embodiment of the present application;

[0044] Figure 2 FIG. 2 is a core architecture diagram of a CVSS scoring and repair system based on intelligent completion and large model decision according to an embodiment of the present application. DETAILED DESCRIPTION

[0045] In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0046] The technical solutions of the present application will be described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes can not be described in some embodiments.

[0047] Figure 1 The flowchart of the method for CVSS intelligent scoring and repair decision based on a large model according to the embodiments of the present application is shown in FIG. 1, which comprises the following steps. Figure 1

[0048] receiving vulnerability data information, collecting asset information of a risk device associated with the vulnerability data information;

[0049] When it is detected that the CVSS score version in the vulnerability data information is missing, constructing a CVSS index data set according to the vulnerability data information, inputting the CVSS index data set into a large model, analyzing the CVSS index data set by the large model and outputting a CVSS score index option corresponding to the vulnerability data information; based on a preset CVSS score calculation rule, substituting the CVSS score index option into calculation to obtain the CVSS score of the corresponding version of the vulnerability data information.

[0050] constructing a risk repair data set according to the asset information, the vulnerability data information and the CVSS score; inputting the risk repair data set into the large model, generating a targeted repair scheme adapted to the asset information based on the risk repair data set by the large model, and sending the targeted repair scheme to the risk device for guiding the risk device to perform a vulnerability repair operation.

[0051] In an optional embodiment, when it is detected that the CVSS score version in the vulnerability data information is missing, constructing a CVSS index data set according to the vulnerability data information comprises:

[0052] ​detecting the completeness of the CVSS score version in the vulnerability data information, when the CVSS score version of the vulnerability data information is incomplete, obtaining a CVSS score version identifier in the vulnerability data information, the CVSS score version identifier being used to indicate a missing target CVSS score version;

[0053] extracting basic indicator features from the vulnerability data information, and structurally processing the basic indicator features according to an indicator system of the target CVSS score version to generate a CVSS indicator dataset.

[0054] In the specific embodiment, when it is detected that the CVSS score version in the vulnerability data information is incomplete, the completeness of the CVSS score version in the vulnerability data information is detected. The system scans the structured fields of the vulnerability data information to find whether the complete CVSS score version information is contained. For example, for a standard vulnerability database entry, the system checks whether the "CVSS Version " field or a similar identifier field exists. If the field is empty or does not exist, it is determined that the CVSS score version is incomplete.

[0055] After detecting that the CVSS score version is incomplete, the CVSS score version identifier in the vulnerability data information is obtained. The version identifier exists in the vulnerability description in various forms, such as "CVSSv2", "CVSS:3.0" and the like, or is indirectly inferred through the indicator structure. For example, if the vulnerability data contains "BaseScore" and "TemporalScore" fields but lacks "EnvironmentalScore" field, and the score value range is 0-10, it is the CVSS v2 version. The system extracts the target CVSS score version such as "2.0", "3.0" or "3.1" according to these features.

[0056] After the version identifier is obtained, the basic indicator features are extracted from the vulnerability data information. For the CVSS v2 version, the basic indicators include six dimensions such as access path (AV), access complexity (AC), authentication (Au), confidentiality impact (C), integrity impact (I) and availability impact (A). For the CVSS v3 version, the basic indicators are expanded to eight dimensions, including attack path (AV), attack complexity (AC), required privilege (PR), user interaction (UI), scope (S), confidentiality impact (C), integrity impact (I) and availability impact (A).

[0057] The intelligent text analysis technology is used to extract these indicator features from the vulnerability description text. For example, when the description "Remote attackers can exploit the vulnerability without authentication" is parsed, the system identifies and extracts the "access path" as "Network" and the "authentication" as "None" as feature values. For structured data, the system directly extracts values from the corresponding fields; for unstructured data, the system uses a pre-trained feature recognition model for extraction.

[0058] The extracted basic indicator features are then structured according to the indicator system of the target CVSS score version. If the target version is CVSS v3.1, and the current data only contains part of the indicators in CVSS v2 format, the system will perform indicator mapping and conversion. For example, the "access path (AV)" indicator values "Local", "Adjacent Network" and "Network" in CVSS v2 are mapped to "Physical", "Adjacent" and "Network" in CVSS v3 respectively. For indicators that do not exist in CVSS v2 but are added in v3 (such as "scope (S)"), the system will infer a reasonable default value based on the type of vulnerability and existing indicator values.

[0059] Specific case implementation: Suppose the system receives a vulnerability data information containing part of the CVSS score information but the version is incomplete. The data shows that the base score is 7.5, and the description text mentions "Remote attackers can exploit this vulnerability to execute arbitrary code without authentication, resulting in data leakage". The system first detects that the CVSS version field is missing, and infers that the target CVSS version is 3.0 by analyzing the existing indicator structure. Then, the system extracts the attack path (AV) as "Network", the attack complexity (AC) as "Low" (according to the description of easy to exploit), the required permissions (PR) as "None" (no authentication required), and the user interaction (UI) as "None" (no user interaction required). By further analyzing key information such as "execute arbitrary code" and "data leakage", it is inferred that the confidentiality impact (C) is "High", the integrity impact (I) is "High", and the availability impact (A) is "Low".

[0060] For the scope (S) indicator added in CVSS v3, it is set to "Unchanged" by default according to the type of vulnerability (code execution class). The system organizes these extracted and converted indicator values into a standard CVSS v3.0 data structure: {"AV":"N", "AC":"L", "PR":"N", "UI":"N", "S":"U", "C":"H", "I":"H", "A":"L"}, thereby generating a complete CVSS indicator data set.

[0061] To improve the accuracy of indicator extraction and conversion, a knowledge base containing historical vulnerability data is maintained. When encountering uncertain indicator values, the system queries similar vulnerability indicator assignment patterns and provides the most reasonable inference results based on similarity analysis. For example, for a specific web application SQL injection vulnerability, the system can refer to historical data that 80% of similar vulnerabilities are marked as "Scope (S) = Unchanged", thereby assigning the same indicator value to the current vulnerability missing the indicator.

[0062] The CVSS indicator dataset constructed by the above method retains the core security features of the original vulnerability data, while completing the version standardization, so that vulnerability data from different sources and different versions can be compared and analyzed under a unified indicator system, providing a standardized data foundation for subsequent vulnerability risk assessment and priority sorting.

[0063] In an optional implementation, the CVSS indicator dataset is input into a large model, and the large model analyzes the CVSS indicator dataset and outputs CVSS score indicator options corresponding to the vulnerability data information, including:

[0064] The CVSS indicator dataset is structured into a multi-dimensional feature matrix, the multi-dimensional feature matrix is input into a large model, and the weight distribution of each feature is calculated based on the multi-dimensional feature matrix. The weight distribution obtains feature weight values through hierarchical processing of the multi-dimensional feature matrix by the large model;

[0065] Based on the feature weight values, a score traceability function is constructed by the large model, and the feature weight values are optimized using the score traceability function. The analysis result of the large model on the multi-dimensional feature matrix is calculated in the large model through the score traceability function, the influence degree of the to-be-analyzed feature on the analysis result is obtained according to the optimized feature weight values, and the influence degree is integrated into the score traceability function;

[0066] The integrated score traceability function is used to fuse the optimized feature weight values, the multi-dimensional feature matrix, and the influence degree to form a score basis. According to the processing of the large model on the score basis based on the multi-dimensional feature matrix, the feature data in the multi-dimensional feature matrix is combined with the context information to calculate the generation probability of each candidate indicator, and a candidate indicator set corresponding to the vulnerability data information is generated;

[0067] Based on the score traceability function, the candidate indicator set is optimized to generate the final CVSS score indicator option.

[0068] When inputting the CVSS indicator dataset into the large model for analysis and outputting the corresponding CVSS score indicator options, data structuring processing is performed, and the original CVSS indicator dataset is preprocessed and converted into a multi-dimensional feature matrix. For example, for a dataset containing vulnerability descriptions, impact ranges, attack paths, and other information, each record can be converted into a feature vector, with each dimension corresponding to a feature attribute. Assuming a CVSS dataset contains 10,000 vulnerability records, each record contains 20 attribute features, and after structuring processing, a 10,000 x 20 feature matrix is formed.

[0069] The processed multi-dimensional feature matrix is input into the large model, which calculates the weight distribution of each feature through hierarchical processing. The large model uses a multi-layer attention mechanism to process the input feature matrix. In each layer, the model focuses on the mutual relationship between different features and assigns each feature a corresponding weight value. For example, attack vectors, attack complexity, required permissions, and other basic indicators obtain higher weights, while contextual information such as time indicators obtains lower weights. Through self-attention calculation, the model can obtain the weight value of each feature and form a weight distribution matrix.

[0070] Based on the feature weight values, the large model constructs a score traceability function, which is designed as a multi-layer structure to track the contribution of each feature to the final score result. The score traceability function optimizes the feature weight values through a backpropagation algorithm and adjusts the initial weight distribution. For example, if it is found that a certain feature has an impact on the final score that does not match the actual situation, the weight of that feature is adjusted through the traceability function. After the large model analyzes the multi-dimensional feature matrix, it calculates the influence degree of each feature on the final result. Assuming that for a specific vulnerability, the "permission requirement" feature has an influence degree of 0.25 on the final score, and the "attack complexity" has an influence degree of 0.35, these influence degree values will be integrated into the score traceability function to form a complete influence degree matrix.

[0071] Using the integrated score traceability function, the large model fuses the optimized feature weight values, multi-dimensional feature matrix, and influence degree. The fusion process uses weighted summation to comprehensively calculate each feature according to its weight and influence degree to form the score basis. For example, for feature A, if its optimized weight is 0.4 and its influence degree is 0.3, its contribution proportion in the final score basis is 0.12.

[0072] The large model processes the multi-dimensional feature matrix and the scoring basis, combines the feature data with the context information, and the context information includes historical vulnerability scoring patterns, scoring trends of similar vulnerabilities, etc. The model focuses on the relationship between the features and the context through the attention mechanism, and calculates the generation probability of each candidate indicator. For example, for the "attack vector" CVSS indicator, the model calculates that the probability of the "network" option is 0.75, the probability of the "adjacent network" option is 0.15, the probability of the "local" option is 0.08, and the probability of the "physical" option is 0.02. According to this, a candidate indicator set is generated, which includes different options of each CVSS indicator and their corresponding probabilities.

[0073] For the generated candidate indicator set, the large model optimizes based on the scoring trace function, and the optimization process considers multiple factors: the generation probability of each option, the logical association between options, consistency with historical similar vulnerabilities, etc. Through comprehensive evaluation, the final CVSS scoring indicator option is determined. For example, for a SQL injection vulnerability of a network application, the model finally determines the following CVSS scoring indicators: attack vector is "network", attack complexity is "low", required permission is "none", user interaction is "none", impact scope is "unchanged", confidentiality impact is "high", integrity impact is "high", and availability impact is "high".

[0074] In actual application, a specific case can be the evaluation of a web application firewall bypass vulnerability. After the model processes the related vulnerability data, it determines that the "attack vector" weight is 0.22, the "attack complexity" weight is 0.18, the "permission requirement" weight is 0.15, etc. The scoring trace function analysis shows that the "attack vector" and "confidentiality impact" of this vulnerability have the greatest impact on the final score, with an impact degree of 0.30 and 0.25, respectively. After fusion processing, the model generates a candidate indicator set, in which the probability of the attack vector option "network" is 0.82 and the probability of the attack complexity option "low" is 0.75. After optimization, the final CVSS scoring indicators of the vulnerability are determined as: attack vector is "network", attack complexity is "low", permission requirement is "low", user interaction is "none", impact scope is "unchanged", confidentiality impact is "high", integrity impact is "medium", and availability impact is "medium", corresponding to a CVSS score of 8.6 and a severity level of "high".

[0075] In an optional implementation, according to the processing of the large model on the multi-dimensional feature matrix and the scoring basis, the combination of the feature data in the multi-dimensional feature matrix and the context information, and the calculation of the generation probability of each candidate indicator include:

[0076] The multi-dimensional feature matrix is input into a large model, and the multi-dimensional feature matrix is processed with scoring basis by the large model; a context vector is constructed based on the large model, and the context vector is fused with feature data in the multi-dimensional feature matrix according to the large model;

[0077] The generation probability of each candidate index in the candidate index set is calculated by the large model based on the result of the fusion processing;

[0078] The generation probability is calibrated by introducing a temperature parameter, and the probability distribution after temperature parameter adjustment is normalized by the large model to generate the final generation probability of the CVSS score index.

[0079] A multi-dimensional feature matrix of a network security vulnerability is obtained, which includes feature data of multiple dimensions such as basic attributes, impact range, attack complexity, and utilization conditions of the vulnerability. For example, for the CVE-2023-XXXXX vulnerability, the system collects feature information such as an attack vector of "network", an attack complexity of "low", a permission requirement of "no permission required", a user interaction of "no need", and an impact range of "changeable range", and encodes these features into a 120x30 feature matrix, where 120 represents the number of features and 30 represents the vector dimension of each feature.

[0080] The constructed multi-dimensional feature matrix is input into a pre-trained large model, which is a language model specially trained for the CVSS score task and contains about 2.4 billion parameters. The large model has been trained on a large number of vulnerability descriptions and CVSS score correspondences, and can understand the complex mapping relationship between vulnerability features and score indicators. After receiving the feature matrix, the large model processes the matrix through its internal attention mechanism and multi-layer transformer architecture to generate a series of intermediate representation vectors.

[0081] During processing, the large model also processes the scoring basis, which refers to the evaluation rules of each indicator in the CVSS scoring standard, such as "if the attacker needs physical contact with the device to launch an attack, the attack vector should be rated as 'physical'". These rules are encoded as structured text and input into the large model as guidelines for the scoring process.

[0082] Based on the input vulnerability features and scoring basis, the large model constructs a context vector, which is a representation generated internally by the large model and contains key context information for the current scoring task. Specifically, the model generates a context vector with a dimension of 1024 by processing the input feature matrix and scoring basis, which encodes the key characteristics of the vulnerability and the potential relationship between these characteristics and the CVSS score indicators.

[0083] The large model fuses the context vector with the feature data in the multi-dimensional feature matrix, and the fusion process adopts an attention mechanism, enabling the model to selectively focus on different parts of the feature matrix based on the current context. Specifically, the model calculates the similarity scores between the context vector and each feature vector, and then generates a fused representation based on the weighted combination of these scores. For example, for a vulnerability with a remote network attack characteristic, the model will focus more on the feature dimensions related to network attacks, giving these dimensions higher weights.

[0084] Based on the results of the fusion process, the large model calculates the generation probability of each candidate indicator in the candidate indicator set, which includes the values of the indicators in the CVSS scoring system, such as attack vectors being "network", "adjacent network", "local", or "physical". For each value of each indicator, the model outputs a probability value representing the likelihood of that value. For example, for the aforementioned CVE-2023-XXXXX vulnerability, the model outputs a probability of 0.92 for the attack vector being "network", 0.06 for "adjacent network", 0.01 for "local", and 0.01 for "physical".

[0085] To improve the accuracy and reliability of the score, a temperature parameter is introduced to calibrate the generation probability, which is a real number greater than 0 that controls the smoothness of the probability distribution. A lower temperature value (such as 0.5) will make the probability distribution more concentrated, strengthening high-probability options; a higher temperature value (such as 1.5) will make the distribution more even, increasing diversity. In practical applications, the system uses a temperature parameter of 0.7 to adjust the initial generation probability. The adjustment method is to divide each probability value by the temperature parameter and take the exponential, for example, for the original probability of 0.92 for the attack vector "network", after adjusting by the temperature parameter 0.7, the new probability becomes 0.92 raised to the power of (1 / 0.7), which is approximately 0.96.

[0086] The large model normalizes the probability distribution after adjusting the temperature parameter, ensuring that the sum of the probabilities of all values is 1, generating the final generation probability of the CVSS scoring indicator. The normalization process is to divide each adjusted probability value by the sum of all adjusted probability values. Continuing the previous example, assuming the adjusted probabilities of the four attack vector options are 0.96, 0.02, 0.01, and 0.01, the total sum is 1.00, and the normalized probabilities are still 0.96, 0.02, 0.01, and 0.01. The system finally selects the option with the highest probability as the scoring result of the indicator, in this case, the scoring result of the attack vector is "network".

[0087] Through the above process, the system can select the most appropriate value for each CVSS score indicator, ultimately generating a complete CVSS score result, providing a scientific basis for vulnerability risk assessment and repair priority ranking.

[0088] In an optional implementation, the risk repair dataset is input into the large model, and the large model generates a targeted repair scheme suitable for the asset information based on the risk repair dataset.

[0089] A repair knowledge graph is constructed, which depicts the correlation between asset risks and repair measures through entity relationship triplets. Node information of the repair knowledge graph is used to construct a knowledge reasoning path. The knowledge reasoning path calculates correlation weights based on the relationship strength between nodes and generates node representation vectors.

[0090] Based on the repair knowledge graph and the node representation vectors, a relationship chain is derived for repair cases in the risk repair dataset to generate a candidate repair measure set. The repair measures in the candidate repair measure set are adaptively evaluated, and the repair knowledge graph is used to calculate the coverage and impact of the repair measures on the current asset to generate an adaptability score.

[0091] Based on the adaptability score, the combination mode and execution order of the repair measures are adjusted to generate a targeted repair scheme with scene adaptability.

[0092] Before inputting the risk repair dataset into the large model, a repair knowledge graph needs to be constructed, which depicts the correlation between asset risks and repair measures through entity relationship triplets. Entity relationship triplets take the form of "head entity-relation-tail entity", such as "SQL injection vulnerability-needs repair measures-parameterized query", "unauthorized access-repair scheme includes-access control mechanism implementation", etc. Entities in the knowledge graph include risk types, asset types, vulnerability characteristics, repair measures, repair effects, etc., and the relationships between entities include "cause", "correlation", "repair", "apply to", etc. In practical applications, the knowledge graph contains more than 100,000 entity nodes and 500,000 relationship edges, covering mainstream IT asset types and their common risks.

[0093] After the knowledge graph is constructed, the node information of the repaired knowledge graph is used to construct a knowledge reasoning path. For each node, a depth-first search is performed in the graph, and the nodes and relationships passed during the traversal are recorded to form a reasoning path set. For example, for the risk node "Web application firewall misconfiguration", the constructed reasoning path includes "Web application firewall misconfiguration → leads to → cross-site scripting attack → can be passed through → input validation enhancement → implementation → content security policy implementation". For each reasoning path, the association weight is calculated based on the relationship strength between nodes. The relationship strength is determined by the co-occurrence frequency in historical repair cases. The higher the co-occurrence frequency, the greater the relationship strength. For example, "SQL injection vulnerability" and "parameterized query" co-occur 300 times in historical repair cases, and their relationship strength value is 0.85.

[0094] Based on the calculated association weight, a node representation vector is generated for each node in the knowledge graph. The dimension of the representation vector is usually set to 128 or 256, and each element in the vector reflects the characteristics of the node in a specific semantic dimension. The vector generation process considers the attribute information of the node and the information of the associated nodes, and uses an information aggregation mechanism to make nodes with similar semantics closer in the vector space. For example, the representation vectors of "SQL injection" and "XSS attack" are closer in space because they both belong to web application security vulnerabilities and have similar repair ideas.

[0095] When generating a risk repair scheme, the repair knowledge graph and node representation vector are used to derive the relationship chain of the repair cases in the risk repair dataset to generate a candidate repair measure set. For a given asset risk, the corresponding risk node is found in the knowledge graph, and from this node, the directly associated repair measure nodes are found along the "repair", "prevent", "mitigate" and other relationship edges. At the same time, the similarity of the node representation vector is used to find semantically similar risk nodes and their corresponding repair measures. For example, for the "permission configuration too wide" risk of a database server, the directly associated "principle of least privilege implementation" repair measure can be found, as well as the "file access control list optimization" measure associated through the similar risk "inappropriate file system permission setting". Combining these two sources, a preliminary candidate repair measure set is formed, containing 10-20 repair measures.

[0096] Adaptive evaluation is performed on the repair measures in the candidate repair measure set, the coverage and influence of the repair measures on the current asset are calculated through the repair knowledge graph to generate an adaptability score, the coverage evaluates the matching degree of the risk range that can be solved by the repair measures and the current asset risk, and the influence evaluates the influence degree of implementing the repair measures on the normal function of the asset. Specifically, for each candidate repair measure, the asset type, application scenario, repair effect and other information associated with it are extracted from the knowledge graph, and the matching degree is calculated with the attribute information of the current asset. For example, for a database server running a key business application, when evaluating the repair measure "database real-time backup", if the knowledge graph shows that the measure is strongly associated with "high-availability database" and "key business system", the coverage score is high, which is 0.92; if it is found that the measure is associated with "medium performance impact" at the same time, the influence score is 0.75. Integrating the coverage and influence, the adaptability score of this repair measure is 0.85.

[0097] Based on the adaptability score, the combination mode and execution order of the repair measures are adjusted, a scenario-adaptive targeted repair scheme is generated, the candidate repair measures are sorted according to the adaptability score, and the top 5-10 measures with the highest scores are selected. Considering the dependency and complementarity between repair measures, the optimal combination is determined through the "precondition" and "enhancement effect" relationships in the knowledge graph. For example, for the security reinforcement of a Web application server, the determined repair scheme combination is: "1. Implement content security policy (adaptability score 0.93); 2. Configure Web Application Firewall rules (adaptability score 0.91); 3. Update server component version (adaptability score 0.88); 4. Enable HTTPS forced jump (adaptability score 0.85)". According to the repair urgency, implementation difficulty and resource demand, the execution order is further adjusted to form the final targeted repair scheme.

[0098] Through the above method, the present application can generate a scenario-adaptive targeted repair scheme for different types of asset risks based on a large model and a repair knowledge graph, and improve the pertinence and effectiveness of risk repair.

[0099] In an optional implementation, based on the repair knowledge graph and the node representation vector, a relationship chain of repair cases in a risk repair dataset is derived to generate a candidate repair measure set, which includes:

[0100] A relationship chain path between entities in the repair knowledge graph is constructed, the relationship chain path includes the association relationship between repair nodes, and the association relationship between the repair nodes is mapped to a node representation vector; the association strength between repair cases is calculated based on the repair knowledge graph, the similarity of the node representation vector is calculated according to the association strength, and a repair relationship chain is generated;

[0101] The repair relationship chain is path analyzed, a path expansion direction is determined based on the association relationship in the repair knowledge graph, and the association attribute of the repair relationship chain is enriched; the repair cases in the risk repair dataset are matched according to the repair relationship chain, the matching degree of the repair cases is calculated based on the node representation vector, the repair cases higher than a preset matching degree threshold are screened, and a candidate repair measure set is generated based on the repair cases.

[0102] A repair knowledge graph is constructed, which is composed of multiple repair nodes and the association relationships between them. Each repair node represents a specific risk repair entity, such as device failure, repair tool, repair skill, maintenance personnel, etc. The association relationship between repair nodes represents their interaction in the repair process, such as "applicable to", "need", "solve" and other relationship types. Taking power equipment failure repair as an example, the repair knowledge graph can include nodes such as "circuit breaker failure", "relay detection", "insulation test tool", and association relationships such as "relay detection applicable to circuit breaker failure" and "circuit breaker failure needs insulation test tool".

[0103] After constructing the repair knowledge graph, the nodes in the graph are represented by vectors, and deep learning methods such as TransE, RotatE or ComplEx algorithms are used to map each repair node in the graph to a vector in a low-dimensional dense vector space. For example, the "circuit breaker failure" node in the repair knowledge graph can be mapped to a 128-dimensional vector [0.21, 0.45, -0.67,..., 0.33]. These vectors can capture the semantic relationship between nodes and retain the structural information of nodes in the knowledge graph.

[0104] Based on the constructed repair knowledge graph, the association relationship between repair nodes is identified, and a relationship chain path is constructed. The relationship chain path refers to a sequence of association relationships from a starting repair node to a target repair node. For example, the relationship chain path from "circuit breaker failure" to "maintenance technician A" is "circuit breaker failure → needs → relay detection → by → maintenance technician A performs". The nodes in these relationship chain paths are mapped to the corresponding representation vectors to form the vector representation of the path.

[0105] When calculating the association strength between repair cases, the topological structure information in the repair knowledge graph is used. Specifically, for two repair cases, the connectivity, path number, path length and other indicators in the knowledge graph are calculated to quantify the association strength. For example, there are 3 different association paths between case A and case B, with an average path length of 2.5, and the association strength between them can be calculated as 0.78. The higher the association strength, the stronger the correlation between the two repair cases.

[0106] Based on the calculated correlation strength, similarity calculation is performed on the node representation vectors. Methods such as cosine similarity are used to calculate the similarity between different repair case node vectors. For example, the cosine similarity between the node vector of case A and the node vector of case B is 0.92, indicating that they are very close in semantic space. Through similarity calculation, the most similar historical repair case to the current risk situation can be identified, thereby generating a repair relationship chain.

[0107] Path analysis is performed on the generated repair relationship chain to determine the path expansion direction. Path analysis includes path length analysis, key node identification, and path reliability evaluation. By analyzing the path structure in the repair relationship chain, the optimal expansion direction is determined, such as expanding to a specific type of repair tool node or expanding to a maintenance personnel node with specific professional skills. Taking a circuit breaker failure as an example, path analysis finds that the path expanding to the "insulation test" related node has a higher repair success rate.

[0108] Based on the determined path expansion direction, the correlation relationship in the repair knowledge graph is used to enrich the correlation attributes of the repair relationship chain. Correlation attributes include relationship type, relationship weight, time constraints, and other information. For example, the "device downtime required" attribute is added to the repair relationship chain with a value of "2 hours"; the "repair difficulty" attribute is added with a value of "medium". These correlation attributes can provide more rich semantic information for subsequent repair case matching.

[0109] According to the enriched repair relationship chain, historical repair cases in the risk repair dataset are matched. The matching process is based on node representation vector to calculate the matching degree of repair cases. Specifically, the similarity between the vector representation of the current risk situation and the vector representation of historical repair cases is calculated as a quantitative indicator of matching degree. For example, the vector representation of the current circuit breaker failure situation has a similarity of 0.88 with the vector representation of historical case 123 and a similarity of 0.65 with the vector representation of historical case 456.

[0110] A preset matching degree threshold is set, such as 0.75, and repair cases higher than the threshold are screened. In the above example, only historical case 123 with a matching degree of 0.88 higher than the threshold of 0.75 is screened as a candidate repair case. For each screened historical repair case, extract the repair measures contained therein, such as "replace the relay", "adjust the contact spacing of the circuit breaker", "clean the insulation components", etc.

[0111] Based on the screened repair cases, a set of candidate repair measures is generated. For historical cases with high similarity and good repair effect, their repair measures are extracted as candidate repair measures. At the same time, considering the characteristics of the current risk situation, these repair measures are appropriately adjusted and optimized. For example, for the screened circuit breaker fault repair case 123, the repair measure "replace the relay and clean the contact" is extracted, and combined with the current situation, it is adjusted to "replace the X-type relay and clean the contact with anhydrous ethanol", as one of the candidate repair measures. Finally, the generated set of candidate repair measures contains multiple repair schemes for the current risk situation, for the decision maker to choose the optimal scheme for implementation.

[0112] As shown in Figure 2 The method further comprises:

[0113] The CVSS score calculator adopts a modular design, and a CVSS version library containing multiple version standards is created in the implementation process. The version library covers all officially released versions from CVSS 2.0 to CVSS 4.0, and each version record includes score indicator definition, indicator value range and semantic interpretation. The version library structure adopts a lightweight design, only storing standard score indicators and calculation methods, with a data volume controlled within 10MB, so that it can run efficiently even in resource-limited environments.

[0114] The calculator module implements independent calculation logic based on version library data for different version standards, ensuring that the calculation process strictly follows the corresponding version specifications and avoiding cross-version mixing. For example, for the CVSS 3.1 version, the calculator calculates the base score, time score and environment score based on the base indicator set, time indicator set and environment indicator set, respectively, and then obtains the final score through a comprehensive algorithm, while mapping to the corresponding level (low, medium, high, severe). The calculator supports API calling mode, which can return the score result in milliseconds after inputting the indicator values.

[0115] The CVSS score completion mechanism includes manual completion and intelligent completion. Manual completion is realized through an interactive interface, and users can select the target CVSS version (such as CVSS 3.1) and select the score indicator values one by one. The interface design follows the principle of intuitiveness, using a drop-down selection box to limit the range of available values for each indicator, while providing indicator description prompts to ensure that users understand the meaning of each indicator. After selecting the indicators, the calculator immediately performs score calculation, and the result includes the numerical score and the risk level, which is automatically written into the score field of the related vulnerability record. The intelligent completion mechanism is designed for the default scenario of the knowledge base, and the implementation process includes two key links: data set construction and large model evaluation.

[0116] In the dataset construction phase, vulnerability information (including vulnerability identifier, description, impact scope, attack vector, etc.) is extracted from existing databases and integrated into a structured dataset. For target vulnerabilities, the system constructs a joint dataset containing vulnerability details and the CVSS index system, which is passed into the large model processing pipeline. In the large model evaluation phase, DeepSeek large model receives data, calls internal semantic understanding capabilities, analyzes the mapping relationship between vulnerability characteristics and CVSS index definitions, and infers the reasonable values of each index. Actual tests show that on a test set containing 500 typical vulnerability records, the consistency of this method with manual scoring reaches 92.7%, which is much higher than the baseline method of 78.3%, and the average time to process each vulnerability is controlled within 1.2 seconds.

[0117] In the asset information collection phase, a multi-source data fusion strategy is used to extract device basic information (such as device identifier, IP address, device name) from the asset management database, detailed configuration data (such as operating system type and version, installed software list and version number, open service and port information) from the configuration management system, and risk information (such as vulnerability identifier, vulnerability type) from the security scanning engine. These data are preprocessed to form a device risk asset portrait containing sufficient environmental context information. In the solution generation phase, the system passes the device risk asset portrait and vulnerability details into the DeepSeek large model, which analyzes the matching degree of vulnerability exploitation conditions and asset environment, considers the specific configuration and software and hardware version information of the device, and generates targeted repair recommendations. The generated repair plan includes detailed operation steps, necessary tool instructions, precautions, and potential impact assessment.

[0118] In practical applications, for the discovered CVE-2025-0170 vulnerability (a cross-site scripting vulnerability existing in a specific version of the WordPress theme), the asset information collected by the system shows that the target device is a virtual machine running the Windows Server operating system, and the DWT Directory&Listing WordPress theme version 3.3.2 is installed. By calling the large model, the system generates repair recommendations that explicitly indicate the need to upgrade the theme to version 3.3.4 or higher, and recommends strict filtering of user input sort by and token parameters, and recommends specific filtering functions (such as esc js or htmlspecialchars). The repair recommendations also include deploying a web application firewall to block XSS attacks and using a security plugin for full-site scanning and other auxiliary measures. This precise recommendation directly corresponds to the actual situation of the device, which is significantly better than the general repair recommendations generated by traditional methods, significantly reducing the decision-making cost and repair time of security and operation personnel.

[0119] Compared with the traditional method, the embodiment has significant improvement in scoring accuracy and repair efficiency. In terms of scoring accuracy, through version differentiation and intelligent completion, the independence and integrity of different CVSS version scores are ensured, and the evaluation deviation caused by mixed version standards and data loss is solved. In terms of knowledge base update cost, the intelligent completion mechanism reduces the dependence on commercial knowledge base. For a typical database containing 5000 vulnerability records, the traditional method needs to spend about 50000 yuan of annual subscription fee to obtain complete scoring data, while the method can reduce this cost to about 15% of the original. In terms of repair decision efficiency, the accurate repair suggestion reduces the average repair decision time from 35 minutes of the traditional method to 12 minutes, and the repair success rate is increased from 78% to 94%, which is particularly significant in large-scale vulnerability repair scenarios.

[0120] In actual deployment, the method can be implemented as an independent service or integrated into an existing vulnerability management platform, providing services through standardized API interfaces. For high-frequency use scenarios, result caching strategies can be used to store calculation results in cache, further improving response speed. In addition, by regularly updating the CVSS version library and optimizing the large model parameters, the system can maintain high-precision evaluation ability for a long time, adapting to the changing network security environment. This combined application enables enterprises to achieve high-quality vulnerability assessment and repair decisions under limited resources.

[0121] The second aspect of the embodiment of the application provides a CVSS intelligent scoring and repair decision system based on a large model, which comprises:

[0122] The first unit is configured to receive vulnerability data information and collect asset information of a risk device associated with the vulnerability data information.

[0123] The second unit is configured to, when detecting that a CVSS score version in the vulnerability data information is missing, construct a CVSS index data set according to the vulnerability data information, input the CVSS index data set into a large model, analyze the CVSS index data set by the large model and output a CVSS score index option corresponding to the vulnerability data information, and based on a preset CVSS score calculation rule, substitute the CVSS score index option into calculation to obtain a CVSS score of a corresponding version of the vulnerability data information.

[0124] The third unit is configured to construct a risk repair dataset according to the asset information, the vulnerability data information, and the CVSS score; input the risk repair dataset into the large model; generate, by the large model, a targeted repair scheme adapted to the asset information based on the risk repair dataset; and send the targeted repair scheme to the risk device to guide the risk device to perform a vulnerability repair operation.

[0125] In a third aspect, an electronic device is provided, comprising:

[0126] a processor;

[0127] a memory for storing processor-executable instructions;

[0128] The processor is configured to invoke the instructions stored in the memory to execute the method described above.

[0129] In a fourth aspect, a computer-readable storage medium is provided, which stores computer program instructions. When the computer program instructions are executed by a processor, the method described above is implemented.

[0130] The present application can be a method, apparatus, system and / or computer program product. The computer program product can include a computer-readable storage medium having stored thereon computer-readable program instructions that, when executed by a computer, cause the computer to carry out various aspects of the present application.

[0131] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for CVSS intelligent scoring and repair decision based on large models, characterized in that, The method comprises the following steps: receiving vulnerability data information, collecting asset information of a risk device associated with the vulnerability data information; when it is detected that there is a missing CVSS score version in the vulnerability data information, constructing a CVSS index data set according to the vulnerability data information, inputting the CVSS index data set into a large model, analyzing the CVSS index data set by the large model and outputting a CVSS score index option corresponding to the vulnerability data information; based on a preset CVSS score calculation rule, substituting the CVSS score index option into calculation to obtain a CVSS score of a corresponding version of the vulnerability data information; constructing a risk repair data set according to the asset information, the vulnerability data information and the CVSS score; inputting the risk repair data set into the large model, generating a targeted repair scheme adapted to the asset information based on the risk repair data set by the large model, and sending the targeted repair scheme to the risk device for guiding the risk device to perform a vulnerability repair operation.

2. The method of claim 1, wherein, When it is detected that there is a missing CVSS score version in the vulnerability data information, constructing a CVSS index data set according to the vulnerability data information comprises: detecting the integrity of the CVSS score version in the vulnerability data information, and when there is a missing CVSS score version in the vulnerability data information, obtaining a CVSS score version identifier in the vulnerability data information, the CVSS score version identifier being used to indicate a target CVSS score version that is missing; extracting basic index features from the vulnerability data information, structuring the basic index features according to the index system of the target CVSS score version to generate a CVSS index data set.

3. The method of claim 1, wherein, Inputting the CVSS index data set into a large model, analyzing the CVSS index data set by the large model and outputting a CVSS score index option corresponding to the vulnerability data information comprises: structurally processing the CVSS index data set into a multi-dimensional feature matrix, inputting the multi-dimensional feature matrix into a large model, calculating the weight distribution of each feature based on the multi-dimensional feature matrix, and obtaining a feature weight value through hierarchical processing of the multi-dimensional feature matrix by the large model; based on the feature weight value, constructing a scoring traceability function by the large model, and optimizing the feature weight value by using the scoring traceability function; calculating the analysis result of the large model on the multi-dimensional feature matrix by the scoring traceability function in the large model, obtaining the influence degree of the to-be-analyzed feature on the analysis result according to the optimized feature weight value, and integrating the influence degree into the scoring traceability function; The integrated score traceability function is used for fusion processing of the optimized feature weight value, the multi-dimensional feature matrix and the influence degree, to form a scoring basis; the multi-dimensional feature matrix is combined with context information to calculate the generation probability of each candidate indicator, and a candidate indicator set corresponding to the vulnerability data information is generated based on the multi-dimensional feature matrix and processing of the scoring basis by the large model; The scoring traceability function is used for optimization of the candidate indicator set, to generate a final CVSS scoring indicator option.

4. The method of claim 3, wherein, The multi-dimensional feature matrix is input into the large model, and the multi-dimensional feature matrix and the scoring basis are processed by the large model; a context vector is constructed based on the large model, and the context vector and feature data in the multi-dimensional feature matrix are fused based on the large model; The generation probability of each candidate indicator in the candidate indicator set is calculated by the large model based on the fusion processing result; The generation probability is calibrated by introducing a temperature parameter, and the probability distribution after temperature parameter adjustment is normalized by the large model, to generate the generation probability of the final CVSS scoring indicator. The risk repair data set is input into the large model, and a targeted repair scheme suitable for the asset information is generated by the large model based on the risk repair data set, which includes:

5. The method of claim 1, wherein, A repair knowledge graph is constructed, which describes the correlation between asset risks and repair measures through entity relationship triples, and a knowledge reasoning path is constructed using node information of the repair knowledge graph; the correlation weight is calculated based on the relationship between nodes, and a node representation vector is generated; Based on the repair knowledge graph and the node representation vector, a relationship chain of repair cases in the risk repair data set is deduced to generate a candidate repair measure set; the adaptability of the repair measures in the candidate repair measure set is evaluated, and the coverage and influence of the repair measures on the current asset are calculated through the repair knowledge graph to generate an adaptability score; Based on the adaptability score, the combination mode and execution sequence of the repair measures are adjusted to generate a targeted repair scheme with scene adaptability. Based on the repair knowledge graph and the node representation vector, a relationship chain of repair cases in the risk repair data set is deduced to generate a candidate repair measure set, which includes:

6. The method of claim 5, wherein, A relationship chain path between entities in the repair knowledge graph is constructed, which contains the correlation between repair nodes; the correlation between repair nodes is mapped into a node representation vector; the correlation strength between repair cases is calculated based on the repair knowledge graph, and the similarity of the node representation vector is calculated based on the correlation strength to generate a repair relationship chain. ​ The repair relationship chain is subjected to path analysis, a path expansion direction is determined based on an association relationship in the repair knowledge graph, and an association attribute of the repair relationship chain is enriched; a repair case in a risk repair dataset is matched according to the repair relationship chain, a matching degree of the repair case is calculated based on the node representation vector, a repair case higher than a preset matching degree threshold is screened, and a candidate repair measure set is generated based on the repair case.

7. A large model-based CVSS intelligent scoring and remediation decision system for implementing the method of any of the preceding claims 1-6, characterized in that, Comprise: A first unit configured to receive vulnerability data information and collect asset information of a risk device associated with the vulnerability data information; A second unit configured to, when detecting that a CVSS score version in the vulnerability data information is missing, construct a CVSS index dataset according to the vulnerability data information, input the CVSS index dataset into a large model, parse the CVSS index dataset by the large model, and output a CVSS score index option corresponding to the vulnerability data information; based on a preset CVSS score calculation rule, substitute the CVSS score index option into calculation to obtain a CVSS score of a corresponding version of the vulnerability data information; A third unit configured to construct a risk repair dataset according to the asset information, the vulnerability data information, and the CVSS score; Input the risk repair dataset into the large model, generate a targeted repair scheme adapted to the asset information based on the risk repair dataset by the large model, and send the targeted repair scheme to the risk device to guide the risk device to perform a vulnerability repair operation.

8. An electronic device, comprising: Comprise: A processor; A memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the method of any one of claims 1 to 6.

9. A computer-readable storage medium having stored thereon computer program instructions, wherein, The computer program instructions are executed by the processor to implement the method of any one of claims 1 to 6.

Images