Information security rapid scanning detection management system and method

Abstract

The invention discloses an information security rapid scanning detection management system and method, relates to the technical field of information security detection, and is used for solving the problems that in a traditional vulnerability management system, data acquisition and arrangement are often manual, or data sources are not uniform, and a flexible algorithm for automatically judging the number and priority of vulnerabilities does not exist. Data from different sources can be effectively integrated through automatic data acquisition, the accuracy and the real-time performance of information are improved, human errors can be avoided by automatically pulling an information packet and a vulnerability historical database, the integrity of vulnerability data in a system is ensured, the most suitable repairing algorithm can be intelligently selected by combining the number and the grade of vulnerabilities, and the repairing efficiency is improved. And even an auxiliary algorithm can be adopted according to actual requirements to improve the repair efficiency and accuracy, so that the vulnerability repair scheme is more accurate and adapts to diversified security threats, and the intelligent level of the vulnerability management system is remarkably improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security detection, more specifically, the present application relates to an information security rapid scanning detection management system and method. BACKGROUND

[0002] With the rapid development of information technology, network attack and defense war is becoming increasingly complex, and the security problem of information system has become a major challenge for various organizations, information security incidents occur frequently, such as data leakage, ransomware, etc., which seriously affects the normal operation of enterprises, and even causes economic losses, therefore, how to effectively find and eliminate security vulnerabilities in the system has become an important task in information security management. The background technology of the information security rapid scanning detection management system involves multiple fields, the intelligentization, automation and cloudization of the system have become the key factors to improve the effect of information security protection, through these technologies, organizations can realize the comprehensive monitoring and protection of information systems, effectively reduce security vulnerabilities and potential threats, and protect the security and privacy of important data.

[0003] The prior art has the following disadvantages:

[0004] In the traditional vulnerability management system, the acquisition and arrangement of data are often manual, or there is a problem of non-uniform data sources, the historical information and attack data of vulnerabilities are often scattered in different systems and formats, and there is a lack of unified and accurate data extraction method. The traditional vulnerability management system can only determine the severity of the vulnerability based on a single feature, cannot comprehensively score in multiple dimensions, and also lacks flexible algorithms to automatically determine the number and priority of vulnerabilities. The traditional vulnerability repair system is often fixed in algorithm selection, and lacks the ability to dynamically adjust according to the actual situation of the vulnerability.

[0005] In view of the above problems, the present application provides a solution. SUMMARY

[0006] In order to overcome the above-mentioned defects of the prior art, the embodiments of the present application provide an information security rapid scanning detection management system and method to solve the problems raised in the background technology.

[0007] To achieve the above-mentioned purpose, the present application provides the following technical scheme:

[0008] The information security rapid scanning detection management system and method comprises the following steps:

[0009] Step S1, obtaining the information package and vulnerability history database of the management system, obtaining the attack coefficient and influence degree coefficient of the information package;

[0010] Step S2, using the information package of the management system and the vulnerability history database to calculate the cosine similarity, using the CVSS base score to calculate the comprehensive score of the attack coefficient and the impact coefficient of the information package;

[0011] Step S3, according to the cosine similarity, the number of vulnerabilities of the management system is obtained, and according to the comprehensive score, the vulnerability level is obtained;

[0012] Step S4, combining the number of vulnerabilities and the level to determine whether to select the preferred algorithm or need auxiliary algorithm for assistance.

[0013] In a preferred embodiment, step S1 includes the following contents:

[0014] Obtain the information package of the management system, represented as a vector, each vector element represents a specific software component, configuration item or known vulnerability, and record it;

[0015] Obtain the vulnerability history database, access the existing vulnerability database as the basis of the vulnerability history database, and update the vulnerability history database according to the newly appeared vulnerabilities, represented as a multi-dimensional vector;

[0016] The attack coefficient is calculated by the attack vector (AV), attack complexity (AC), permission requirement (PR) and user interaction (UI), and scored according to the attack situation of the system, and the attack coefficient formula is represented as the product of the above attack vector, attack complexity, permission requirement and user interaction: Exploitability = 8.22 × AV × AC × PR × UI, wherein: 8.22 is an empirical constant in the vulnerability scoring model;

[0017] The impact coefficient is divided into three aspects: confidentiality impact (C), integrity (I), and availability (A), and scored according to the influence degree of each aspect, combined in a weighted manner, and the formula is represented as: Impact = 10.41 × (1-(1-C) × (1-I) × (1-A)), wherein: the constant 10.41 is set according to experience and security standards.

[0018] In a preferred embodiment, step S2 includes the following contents:

[0019] Using the information package of the management system and the vulnerability history database to calculate the cosine similarity formula is represented as: Where: Cosine Similarity nFor the similarity of the information package and the vulnerability history database, A is the current feature vector of the information package of the management system, B is the feature vector of the vulnerability history database of the management system, A·B is the dot product of the vectors A and B (i.e. the sum of the products of the corresponding dimension elements), ‖A‖ is the feature vector length of the current information package of the management system, ‖B‖ is the feature vector length of the vulnerability history database of the management system, and n is the nth management system.

[0020] The CVSS base score is calculated by the attack coefficient and the impact coefficient of the information package, and the formula is: Base Score = round(min(Exploitability + Impact), 10), wherein: Exploitability refers to the attack coefficient of the system, and Impact refers to the impact coefficient.

[0021] In a preferred embodiment, step S3 includes the following contents:

[0022] By calculating the cosine similarity between the information package and the vulnerability history database, a threshold T is set for classification:

[0023] When Cosine Similarity n ≥T, it is considered that the information package and the vulnerability history database have strong correlation and low security;

[0024] When Cosine Similarity n <T, it is considered that the information package and the vulnerability history database have low correlation and high security;

[0025] The CVSS base score determines the risk level according to the following score range:

[0026] Low-level vulnerability: the CVSS base score is between 0 and 3.9, and the impact of the vulnerability is relatively small;

[0027] Medium vulnerability: the CVSS base score is between 4.0 and 6.9, and the vulnerability poses a certain threat to system security;

[0028] High-level vulnerability: the CVSS base score is between 7.0 and 8.9, and the vulnerability is exploited remotely or by a relatively simple method;

[0029] Serious vulnerability: the CVSS base score is between 9.0 and 10.0, and this type of vulnerability is the most serious. In a preferred embodiment, step S4 includes the following contents:

[0030] After receiving the number of vulnerabilities and the vulnerability level of the management system, the number of vulnerabilities and the vulnerability level of the management system are defined as input variables, which are divided into different fuzzy sets respectively;

[0031] Define the algorithm as an output variable, divide it into a fuzzy set;

[0032] Formulate fuzzy rules to describe the impact of the number of vulnerabilities and vulnerability level definition of the management system on the algorithm;

[0033] According to the fuzzy rules, fuzzy reasoning is carried out to determine the algorithm of the management system.

[0034] When only the preferred algorithm is selected, a static code analysis tool is selected for use, or only manual review is performed;

[0035] When the auxiliary algorithm needs to be assisted in detection, penetration testing or dynamic analysis is selected for auxiliary detection.

[0036] The information security rapid scanning detection management system comprises a data acquisition module, a data processing module, a vulnerability judgment module and an algorithm selection module:

[0037] The data acquisition module: acquires the information package and the vulnerability history database of the management system, and acquires the attack coefficient and the influence degree coefficient of the information package;

[0038] The data processing module: calculates the cosine similarity using the information package and the vulnerability history database of the management system, and calculates the comprehensive score of the attack coefficient and the influence degree coefficient of the information package using the CVSS basic score;

[0039] The vulnerability judgment module: obtains the number of vulnerabilities of the management system according to the cosine similarity, and obtains the vulnerability level according to the comprehensive score;

[0040] The algorithm selection module: decides whether the preferred algorithm or the auxiliary algorithm needs to be assisted according to the number of vulnerabilities and the level.

[0041] The technical effects and advantages of the information security rapid scanning detection management system and method of the present application are as follows:

[0042] The automated data acquisition can effectively integrate data from different sources, improve the accuracy and real-time performance of information, avoid human errors by automatically pulling information packages and vulnerability history databases, and ensure the integrity of vulnerability data in the system. Combined with the CVSS score, the vulnerability assessment is more comprehensive, and the risk level of the vulnerability can be more accurately predicted. By combining similarity calculation and comprehensive scoring, the vulnerability judgment module can provide more flexible and accurate vulnerability assessment. It not only quantifies the number of vulnerabilities, but also determines the priority of vulnerabilities according to the comprehensive score of vulnerabilities, so that the security team can more effectively deal with vulnerabilities of different levels. By combining the number and level of vulnerabilities, the most suitable repair algorithm can be intelligently selected, and even auxiliary algorithms can be used according to actual needs to improve repair efficiency and accuracy. For vulnerabilities of different types or different priorities, the system can automatically adjust the repair strategy to avoid using inappropriate algorithms that result in poor repair results. Not only does it improve the efficiency of vulnerability management, but also makes the vulnerability repair scheme more accurate and adaptable to various security threats, significantly improving the intelligent level of the vulnerability management system. BRIEF DESCRIPTION OF DRAWINGS

[0043] Figure 1 The information security rapid scanning detection management method structure diagram of the present application.

[0044] Figure 2 The information security rapid scanning detection management system structure diagram of the present application. DETAILED DESCRIPTION

[0045] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of the present application.

[0046] Embodiment 1

[0047] As shown in the present application, Figure 1 The information security rapid scanning detection management method comprises the following steps:

[0048] Step S1, obtaining the information package and the vulnerability history database of the management system, obtaining the attack coefficient and the influence degree coefficient of the information package;

[0049] Step S2, calculating the cosine similarity using the information package and the vulnerability history database of the management system, and calculating the comprehensive score of the attack coefficient and the influence degree coefficient of the information package using the CVSS basic score;

[0050] Step S3, according to the cosine similarity, the number of vulnerabilities of the management system is obtained, and the vulnerability level is obtained by comprehensive score;

[0051] Step S4, combining the number of vulnerabilities and the level to determine whether to select the preferred algorithm or need auxiliary algorithm for assistance.

[0052] The specific implementation is as follows:

[0053] In step S1, the information package and the vulnerability history database of the management system are obtained, the attack coefficient and the influence degree coefficient of the information package are obtained, and the specific content includes:

[0054] The information package of the management system is obtained, which usually refers to the collection of all components, software, configurations, etc. in the system. In the management system, each information package may contain different vulnerabilities, or each information package may be associated with multiple vulnerabilities. The information package may be a collection of multiple software modules and their related security vulnerabilities. It can be represented as a vector, and each vector element represents a specific software component, configuration item or known vulnerability.

[0055] And get the vulnerability history database, which is a collection of known vulnerabilities, each vulnerability has its specific description, influence degree, attack mode, exploitation difficulty, etc. Access to existing vulnerability database as the basis of vulnerability history database, and update the vulnerability history database according to the new emerging vulnerabilities. Vulnerability can be represented as a multi-dimensional vector, and each dimension represents a different attribute of the vulnerability.

[0056] The attack coefficient is calculated by the attack vector, attack complexity, permission requirement and user interaction, and the scoring rules of the attack vector, attack complexity, permission requirement and user interaction are as follows:

[0057] 1. Attack vector, the way or method of attack launched by the attacker, denoted as AV, the score range is from Network to Physical, that is, from remote attack through network to attack method requiring physical contact:

[0058] Network (N): The attacker can launch an attack remotely through the network (score: 0.85);

[0059] Adjacent Network (A): The attacker needs to be in the same LAN or adjacent network with the target system (score: 0.62);

[0060] Local (L): The attacker needs to have local access to the target system (score: 0.55);

[0061] Physical (P): The attacker needs to physically touch the target device (score: 0.2).

[0062] 2. Attack complexity, the complexity of conditions or environment required for the attack to succeed, denoted as AC, scored on a scale of high or low.

[0063] Low (L): The attack does not require special conditions or environment, and the attack is easy to implement (score: 0.77);

[0064] High (H): The attack requires specific conditions or the attacker must have specific skills to succeed (score: 0.44).

[0065] 3. Privilege requirement, the privilege level required for the attacker to perform the exploit, denoted as PR, scored on a scale from no privilege to full administrator privilege:

[0066] None (N): The attacker does not need any privilege to perform the attack (score: 0.85);

[0067] Low (L): The attacker needs a lower level of privilege, usually as a normal user (score: 0.62);

[0068] High (H): The attacker needs high privilege (usually as an administrator) to perform the attack (score: 0.27).

[0069] 4. User interaction, whether the attack requires the participation or action of the target user, denoted as UI, scored on a scale of whether user interaction is required:

[0070] None (N): The attack does not require any user interaction (score: 0.85);

[0071] Required (R): The attack requires the interaction of the target user (score: 0.62).

[0072] The exploitability formula can be expressed as the product of the above attack vector, attack complexity, privilege requirement, and user interaction: Exploitability = 8.22 x AV x AC x PR x UI, where 8.22 is an empirical constant in the vulnerability scoring model to make the calculation result of the exploitability coefficient more consistent with the actual threat situation.

[0073] It should be noted that the scoring rules in this patent can be set by the technical personnel according to the actual situation, and the empirical constant in the formula can also be re-set and adjusted by the specific implementation process, which will not be described here.

[0074] For example, assume the scores are: attack vector: 0.85 for attack through network, attack complexity: 0.77 for low complexity, privilege requirements: 0.85 for no privilege required, user interaction: 0.85 for no user interaction, according to the formula: Exploitability = 8.22 x AV x AC x PR x UI = 8.22 x 0.85 x 0.77 x 0.85 x 0.85 = 3.74, therefore, the attack coefficient is calculated as 3.74 in this case.

[0075] Impact coefficient Impact reflects the degree of damage of the vulnerability to the target system, which is divided into three aspects: confidentiality, integrity, and availability. The scoring rules for confidentiality impact, integrity impact, and availability impact are as follows:

[0076] 1. Confidentiality impact, whether the vulnerability will leak sensitive information of the system, denoted as C, with the following scoring rules:

[0077] None (N): no impact (score: 0);

[0078] Low (L): slight leakage, which will not cause substantial damage (score: 0.22);

[0079] High (H): complete leakage of sensitive information, which may cause serious consequences (score: 0.56).

[0080] 2. Integrity impact, whether the vulnerability will tamper with data or files in the target system, denoted as I, with the following scoring rules:

[0081] None (N): no impact (score: 0);

[0082] Low (L): slight tampering (score: 0.22);

[0083] High (H): complete control of system integrity, leading to data destruction or tampering (score: 0.56).

[0084] 3. Availability impact, whether the vulnerability will cause loss of system functionality or performance impairment, denoted as A, with the following scoring rules:

[0085] None (N): no impact (score: 0);

[0086] Low (L): slight impact (score: 0.22);

[0087] High (H): system completely unavailable, which may cause service interruption or inoperability (score: 0.56).

[0088] The impact calculation formula involves the impact of confidentiality, integrity and availability, which are combined in a weighted manner, and the formula is expressed as: Impact = 10.41 x (1-(1-C) x (1-I) x (1-A)), wherein: the constant 10.41 is set according to experience and security standards, and its selection makes the impact score be able to be standardized in a reasonable range, and ensures that the score can have certain accuracy and consistency in practical application.

[0089] For example: assuming that each score is: confidentiality impact: slight leakage, no substantial damage, score 0.22, integrity impact: no impact, score 0, availability impact: no impact, score 0, according to the impact calculation formula: Impact = 10.41 x (1-(1-C) x (1-I) x (1-A)) = Impact = 10.41 x (1-(1-0.22) x (1-0) x (1-0)) = 2.2902, therefore, the attack coefficient is calculated as 2.2902 in this case.

[0090] In step S2, the cosine similarity is calculated using the information package and vulnerability history database of the management system, and the comprehensive score of the attack coefficient and the impact coefficient of the information package is calculated using the CVSS basic score, and the specific content includes:

[0091] The cosine similarity is calculated using the information package and vulnerability history database of the management system to represent the similarity of the information package and the vulnerability history database: the cosine similarity of each information package and each vulnerability in the vulnerability history database is calculated, which can determine whether a certain information package is related to the vulnerability in the history database, or whether the vulnerability exists in a specific information package. The similarity formula of the information package and the vulnerability history database can be expressed as: Wherein: Cosine Similarity n is the similarity of the information package and the vulnerability history database, A is the current feature vector of the management system information package, B is the feature vector of the management system vulnerability history database, A·B is the dot product of vectors A and B (i.e. the sum of the products of each corresponding dimension element), ‖A‖ is the current feature vector length of the management system information package, ‖B‖ is the feature vector length of the management system vulnerability history database, and n is the nth management system. The cosine similarity measures the included angle between two vectors, i.e. the directional similarity between them, rather than their size (length), and its value range is between [-1, 1]: when Cosine Similarity n =1, it means that the vectors A and B are exactly the same (i.e. their directions are consistent), when Cosine Similarity n =0, it means that the vectors A and B are mutually orthogonal and have no similarity to each other, and when Cosine Similarityn = -1, it means that the vectors A and B are completely opposite, and the directions are completely opposite.

[0092] The CVSS base score is calculated by the attack coefficient and the impact coefficient of the information package, is the core of the CVSS score, reflects the inherent characteristics of the vulnerability, the higher the base score, the more serious the vulnerability and the greater the potential risk, indicating that the vulnerability has a wide range of influence, low utilization difficulty, and may cause serious damage to confidentiality, integrity and availability. The calculation of the base score does not consider the environment and actual attack situation of the attacker, but mainly for the intrinsic characteristics of the vulnerability. The above formula is expressed as: Base Score = round(min(Exploitability + Impact), 10), wherein: Exploitability refers to the attack coefficient of the system, Impact refers to the impact coefficient, the score combines the attack coefficient and the impact, and gives a score of 0-10, indicating the overall severity of the vulnerability. If the impact is None, the base score is usually dominated by the attack vector sub-score; if the attack vector is complex and the impact is high, the base score will also be improved.

[0093] In step S3, the number of vulnerabilities of the management system is obtained according to the cosine similarity, and the vulnerability level is obtained according to the comprehensive score, and the specific content includes:

[0094] By calculating the similarity between the information package and the vulnerability history database, the correlation of a certain information package with historical vulnerabilities can be judged, so as to speculate whether the information package is susceptible to a specific vulnerability. By calculating the cosine similarity between each information package and each vulnerability in the vulnerability history database, we can determine which vulnerabilities may appear in a specific information package. For example, if the feature vector of a certain information package is similar to the feature vector of a historical vulnerability, the vulnerability may pose a threat to the information package. According to the cosine similarity, the number of vulnerabilities can be determined, and the greater the similarity between the information package and the vulnerability history database, the more vulnerabilities the management system has to a certain extent, and vice versa.

[0095] According to the similarity to determine the number of vulnerabilities and the security of the information package, a threshold T is set for the similarity to classify:

[0096] When Cosine Similarity n ≥ T, it is considered that the information package and the vulnerability history database have strong correlation, and there may be more vulnerabilities, and the security is low.

[0097] When Cosine Similarity n < T, it is considered that the correlation between the information package and the vulnerability history database is low, and the vulnerability is less, and the security is high.

[0098] It should be noted that if the vulnerabilities in the historical vulnerability library are mostly low-risk or common vulnerabilities, a lower threshold value may need to be set to enable early detection of potential high-risk vulnerabilities, and if the vulnerabilities in the historical vulnerability library are mostly serious and rare vulnerabilities, the threshold value can be set higher to avoid excessive detection of irrelevant vulnerabilities. If the security requirements of the target system are very high, a lower threshold value may need to be set to strictly screen the similarity of the information package and ensure that the system has no vulnerabilities as much as possible, and for some relatively less sensitive systems, a higher threshold value can be set to avoid excessive interference with the normal operation of the system. The threshold T can be set and adjusted by those skilled in the art according to the actual situation, and a reasonable threshold value is selected to determine the relevance of the information package and the vulnerability historical database.

[0099] The CVSS base score gives a severity score for a vulnerability through a comprehensive evaluation of the attack coefficient and the impact coefficient. The score ranges from 0 to 10, with a higher score indicating a more severe vulnerability and a higher potential risk. By understanding the composition and calculation method of the score, security experts, system administrators and developers can better assess the risk of the vulnerability and take appropriate repair and mitigation measures. The risk level is determined by the following score range:

[0100] Low-level vulnerability: CVSS base score between 0 and 3.9, the impact of the vulnerability is relatively small, the difficulty for the attacker to exploit the vulnerability is large, or the damage to the confidentiality, integrity and availability is low. Such vulnerabilities usually do not pose a serious threat to the system, but may still affect some functions or services;

[0101] Medium vulnerability: CVSS base score between 4.0 and 6.9, the vulnerability may pose a certain threat to system security, and the attacker may be able to exploit the vulnerability under certain conditions, resulting in a certain impact on confidentiality, integrity or availability;

[0102] High-level vulnerability: CVSS base score between 7.0 and 8.9, the vulnerability may be exploited remotely or through relatively simple means, causing serious damage to the confidentiality, integrity or availability of the system. Such vulnerabilities usually need to be repaired first;

[0103] Critical vulnerability: CVSS base score between 9.0 and 10.0, this type of vulnerability is the most serious, which may allow an attacker to completely control the system, cause major data leakage, damage or system crash. Such vulnerabilities need to be repaired immediately.

[0104] In step S4, the selection of the preferred algorithm or the need for auxiliary algorithms is determined based on the number of vulnerabilities and the vulnerability level, and the specific content includes:

[0105] After receiving the number of vulnerabilities and the vulnerability level of the management system, define the number of vulnerabilities and the vulnerability level of the management system as input variables, and divide them into different fuzzy sets respectively.

[0106] For example, "Small", "Medium", "Large" for the number of vulnerabilities, and "Low", "Medium", "High" for the vulnerability level.

[0107] Define the algorithm as an output variable, and divide it into a fuzzy set, for example, "Prefferred", "Detection" for the algorithm.

[0108] Formulate a set of fuzzy rules to describe the influence of different input variables on output variables. The definition of rules can be based on professional knowledge or obtained through data analysis and experiments. For example:

[0109] Define the number of vulnerabilities as N, the vulnerability level as B, and the algorithm as Algorithm.

[0110] Rule 1: IF (N is Small) AND (B is Low) THEN (Algorithm is Prefferred)

[0111] Rule 2: IF (N is Large) AND (B is Serious) THEN (Algorithm is Detection) ...

[0113] According to the fuzzy rules, conduct fuzzy reasoning to determine the scheme of the algorithm.

[0114] It should be noted that the division of fuzzy sets can be adjusted according to actual conditions. For example, although this embodiment takes three fuzzy sets as an example, in fact, the number of vulnerabilities, vulnerability level and algorithm can be divided into more than three sets to facilitate better adjustment according to different vulnerabilities.

[0115] When only the preferred algorithm is selected, the complexity of vulnerability repair is usually not high, and it may be some common security problems or configuration errors. At this time, the detection focus is to ensure that some basic security vulnerabilities are not missed, and at the same time, avoid overcomplicated detection methods and tools. The preferred algorithm used for vulnerability detection can choose to use static code analysis tools, which are suitable for scenarios with fewer vulnerabilities and mostly low-level, can effectively identify simple and common errors, or only conduct manual audit. In this stage, some basic logic errors or code implementation that does not meet security specifications can be quickly identified, especially when the number of vulnerabilities is small, manual audit is more efficient.

[0116] When the auxiliary algorithm is needed for auxiliary detection, penetration testing or dynamic analysis can be selected for auxiliary detection. Penetration testing is a very effective detection method, which simulates hacker attacks to deeply dig potential risk points in the system and find potential advanced vulnerabilities. Penetration testing not only scans, but also includes actual utilization of vulnerabilities, analysis of attack paths, etc. It is suitable for complex attack scenarios and multi-level vulnerabilities. Dynamic analysis is to identify vulnerabilities through real-time monitoring of systems and applications. It simulates how attackers penetrate attacks through vulnerabilities, so it is more close to real attack scenarios. Compared with static analysis, dynamic analysis does not need to access the source code or internal implementation of the program, but finds vulnerabilities by testing and monitoring the running behavior of the system. Dynamic analysis usually needs to interact with the target system during vulnerability scanning and attack simulation. This includes sending different types of input (such as malicious input, boundary testing, load testing, etc.) and observing the application's response.

[0117] It should be noted that the preferred algorithm and auxiliary algorithm can be set by those skilled in the art according to the actual situation, and the patent only makes suggestions based on the content herein. The specific use can be set by the actual situation, and this will not be repeated here.

[0118] Embodiment 2

[0119] As shown in the present application Figure 2 The present application discloses a rapid scanning and detection management system for information security, comprising the following steps:

[0120] Data acquisition module: acquire the information package and vulnerability history database of the management system, and acquire the attack coefficient and influence degree coefficient of the information package;

[0121] Data processing module: calculate the cosine similarity using the information package and vulnerability history database of the management system, and calculate the comprehensive score of the attack coefficient and influence degree coefficient of the information package using the CVSS basic score;

[0122] Vulnerability judgment module: determine the number of vulnerabilities of the management system according to the cosine similarity, and determine the vulnerability level according to the comprehensive score;

[0123] Algorithm selection module: determine whether to select the preferred algorithm or need the auxiliary algorithm for assistance according to the number and level of vulnerabilities.

[0124] The above formulas are dimensionless and the numerical values are calculated. The formula is obtained by software simulation of a large amount of data to obtain the most real situation. The preset parameters in the formula are set by those skilled in the art according to the actual situation.

[0125] The above-described embodiments can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented by software, the above-described embodiments can be implemented in whole or in part in the form of a computer program product.

[0126] Those of ordinary skill in the art can realize that the modules and algorithm steps of the examples described in connection with the embodiments disclosed herein can be realized by electronic hardware, or a combination of computer software and electronic hardware. Whether the functions are performed by hardware or software depends on the specific application and design constraints of the technical solution. Those of ordinary skill in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0127] In addition, each functional module in each embodiment of the present application can be integrated into one processing module, or each module can exist physically independently, or two or more modules can be integrated into one module.

[0128] The above is merely specific embodiments of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

[0129] Finally, the above is merely preferred embodiments of the present application, and is not intended to limit the present application, and any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the protection scope of the present application.

Claims

1. A method for managing a rapid scan detection of information security, characterized by, The method comprises the steps of: Step S1, obtaining the information package and the vulnerability history database of the management system, and obtaining the attack coefficient and the impact coefficient of the information package; Step S2, calculating the cosine similarity using the information package and the vulnerability history database of the management system, and calculating the comprehensive score of the attack coefficient and the impact coefficient of the information package using the CVSS basic score; Step S3, determining the number of vulnerabilities of the management system according to the cosine similarity, and determining the vulnerability level according to the comprehensive score; Step S4, determining whether to select the preferred algorithm or to use the auxiliary algorithm for assistance in combination with the number and level of vulnerabilities.

2. The information security rapid scanning detection management method according to claim 1, characterized in that: The information package of the management system is represented as a vector, and each vector element represents a specific software component, configuration item or known vulnerability, and is recorded; The vulnerability history database is obtained by accessing an existing vulnerability database as the basis of the vulnerability history database, and updating the vulnerability history database according to newly emerged vulnerabilities, and is represented as a multi-dimensional vector; The attack coefficient is calculated by the attack vector (AV), the attack complexity (AC), the permission requirement (PR) and the user interaction (UI), and is scored according to the attack conditions of the system, and the attack coefficient formula is represented as the product of the above attack vector, attack complexity, permission requirement and user interaction: Exploitability = 8.22 x AV x AC x PR x UI, wherein 8.22 is an empirical constant in the vulnerability scoring model; The impact coefficient is divided into three aspects: confidentiality impact (C), integrity (I) and availability (A), and is scored according to the impact degree of each aspect, and is combined in a weighted manner, and the formula is represented as: Impact = 10.41 x (1-(1-C) x (1-I) x (1-A)), wherein the constant 10.41 is set according to experience and security standards.

3. The information security rapid scanning detection management method according to claim 1, characterized in that: The cosine similarity formula is calculated using the information package and the vulnerability history database of the management system and is expressed as: wherein: Cosine Similarity n is the similarity of the information package and the vulnerability history database, A is the current feature vector of the management system information package, B is the feature vector of the management system vulnerability history database, A B is the dot product of the vectors A and B (i.e., the sum of the products of the corresponding dimension elements), ||A|| is the feature vector length of the current management system information package, ||B|| is the feature vector length of the management system vulnerability history database, and n is the nth management system. The CVSS basic score is calculated by the attack coefficient and the impact coefficient of the information package, and the formula is represented as: Base Score = round(min(Exploitability + Impact), 10), wherein Exploitability refers to the attack coefficient of the system, and Impact refers to the impact coefficient.

4. The information security rapid scanning detection management method according to claim 1, characterized in that: The cosine similarity between the information package and the vulnerability history database is calculated, and a threshold T is set for classification: When Cosine Similarity n When Cosine Similarity n When Cosine Similarity n When Cosine Similarity n When Cosine Similarity n When Cosine Similarity n When Cosine Similarity When Cosine Similarity n If T < T < T, then it is considered that the information packet and the vulnerability history database have low relevance, and the security is high; The CVSS basic score determines the risk level according to the following score range: Low-level vulnerability: the CVSS basic score is between 0 and 3.9, and the impact of the vulnerability is relatively small; Medium-level vulnerability: the CVSS basic score is between 4.0 and 6.9, and the vulnerability poses a certain threat to system security; High-level vulnerability: the CVSS basic score is between 7.0 and 8.9, and the vulnerability is exploited remotely or by a relatively simple method; Critical: CVSS Base Score between 9.0-10.0, these vulnerabilities are the most severe.

5. The information security rapid scanning detection management method according to claim 1, characterized in that: After receiving the number of vulnerabilities and the vulnerability level of the management system, the number of vulnerabilities and the vulnerability level of the management system are defined as input variables, and are divided into different fuzzy sets respectively; The algorithm is defined as an output variable and is divided into a fuzzy set; Fuzzy rules are developed to describe the impact of the definition of the number of vulnerabilities and the vulnerability level of the management system on the algorithm; According to the fuzzy rules, the algorithm of the management system is determined through fuzzy reasoning; When only the preferred algorithm is selected, a static code analysis tool is used, or only manual review is performed; When an auxiliary algorithm is needed for auxiliary detection, penetration testing or dynamic analysis is used for auxiliary detection.

6. An information security rapid scanning detection management system for implementing the information security rapid scanning detection management method according to any one of claims 1-5, characterized in that, It includes a data acquisition module, a data processing module, a vulnerability judgment module, and an algorithm selection module; The data acquisition module: acquires the information package and the vulnerability history database of the management system, and acquires the attack coefficient and the impact coefficient of the information package; The data processing module: calculates the cosine similarity using the information package and the vulnerability history database of the management system, and calculates the comprehensive score of the attack coefficient and the impact coefficient of the information package using the CVSS basic score; The vulnerability judgment module: obtains the number of vulnerabilities of the management system according to the cosine similarity, and obtains the vulnerability level according to the comprehensive score; The algorithm selection module: decides whether to select the preferred algorithm or need the auxiliary algorithm for assistance according to the number of vulnerabilities and the level.

Images