Vulnerability processing method, electronic equipment and storage medium

Abstract

The invention provides a vulnerability processing method, electronic equipment and a storage medium, and relates to the technical field of data security transmission, and the method comprises the following steps: carrying out vulnerability scanning on a data center platform, obtaining a vulnerability information list of the data center platform, determining a preset associated parameter list of the data center platform influenced by vulnerabilities, a plurality of optimization parameter values are generated for each preset associated parameter in the preset associated parameter list, so that a combination list of all the optimization parameter values is obtained, and the security risk value of the data center platform under each combination is determined based on the combination list of the optimization parameter values. And the data center platform is optimized by using the combination corresponding to the minimum security risk value, and the vulnerability influence is reduced by optimizing the preset associated parameters.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security transmission, in particular to a vulnerability processing method, an electronic device and a storage medium. BACKGROUND

[0002] Under the background of accelerating digitalization, large-scale data training is often relied on to support the business system, and the data center platform needs to frequently accept multi-party encrypted transmission data, bearing massive data processing and transmission tasks, so the security of the data center platform is particularly important. Vulnerabilities are inherent defects in hardware, software, protocol design, configuration strategy or security management process of information system, which may be exploited by attackers, therefore, it is very important to manage and optimize the vulnerabilities of the data center platform. In the prior art, the vulnerabilities are repaired by priority sorting of CVSS, however, the vulnerability repair by CVSS is not comprehensive and efficient enough. SUMMARY

[0003] In view of the above technical problems, the technical scheme adopted by the present application is as follows: According to a first aspect of the present application, a vulnerability processing method is provided, comprising the following steps: Performing vulnerability scanning on the data center platform to obtain a vulnerability information list of the data center platform, the vulnerability information list comprising vulnerability information of a plurality of vulnerabilities, the vulnerability information at least comprising: vulnerability type, vulnerability severity score, vulnerability impact score, and vulnerability threat score; the data center platform receiving transmission data sent by a data provider; the vulnerability severity score being a base score baceScore normalized in the CVSS system, the vulnerability impact score being an impact score impactScore normalized in the CVSS system, and the vulnerability threat score being calculated by using an EPSS prediction score system; Based on the vulnerability type, a preset correlation parameter list affected by the vulnerability to the data center platform is determined, the preset correlation parameter list comprising a plurality of preset correlation parameters; For each preset correlation parameter in the preset correlation parameter list, a plurality of optimized parameter values are generated, thereby obtaining a combination list of all optimized parameter values, the combination list comprising a plurality of combinations, each combination comprising optimized parameter values corresponding to a plurality of preset correlation parameter values; Based on the combination list of optimized parameter values, a security risk value of the data center platform under each combination is determined, wherein the security risk value is equal to the product value of the base score baceScore of the CVSS system of the vulnerability of the data center platform under the current combination, the preset threat weight, and the reciprocal of the repair urgency, and the repair urgency is determined based on the influence of the vulnerability of the data center platform under the current combination on the business; The data center platform is optimized using the combination corresponding to the minimum security risk value.

[0004] According to a second aspect of the present application, a non-transitory computer readable storage medium is provided, the storage medium storing a computer program, the computer program being loaded and executed by a processor to implement the method described above.

[0005] According to a third aspect of the present application, an electronic device is provided, comprising a processor, a memory, and a computer program stored on the memory and executable on the processor, the processor implementing the method described above when executing the computer program.

[0006] The present application has at least the following beneficial effects: in summary, the data center platform is scanned for vulnerabilities, a list of vulnerability information of the data center platform is obtained, a list of preset correlation parameters of the data center platform affected by the vulnerability information is determined, a plurality of optimization parameter values are generated for each preset correlation parameter in the list of preset correlation parameters, thereby obtaining a combination list of all optimization parameter values, the security risk value of the data center platform under each combination is determined based on the combination list of optimization parameter values, the data center platform is optimized using the combination corresponding to the minimum security risk value, and the vulnerability impact is efficiently reduced by optimizing the preset correlation parameters. BRIEF DESCRIPTION OF DRAWINGS

[0007] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can be obtained without creative labor on the basis of these drawings.

[0008] Figure 1 A flowchart of a vulnerability processing method provided by the embodiments of the present application. DETAILED DESCRIPTION

[0009] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings of the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, not all embodiments. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0010] It should be noted that the terms "first", "second", and the like in the description and claims of the application and the above drawings are used to distinguish similar tasks, and do not necessarily have to be used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or server including a series of steps or units does not have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0011] The embodiment of the application provides a vulnerability processing method, as shown in the figure, the method comprises the following steps: Figure 1 S001, performing vulnerability scanning on a data center platform to obtain a vulnerability information list of the data center platform, the vulnerability information list comprising vulnerability information of a plurality of vulnerabilities, the vulnerability information at least comprising: vulnerability type, vulnerability severity score, vulnerability impact score, and vulnerability threat score; the data center platform receives transmission data sent by a data provider; the vulnerability severity score is a base score baceScore after normalization processing in a CVSS system, the vulnerability impact score is an impact score impactScore after normalization processing in the CVSS system, and the vulnerability threat score is calculated by using an EPSS prediction score system.

[0012] Specifically, the vulnerability threat score R=1 / (1+e -L ), the linear regression technology is used to evaluate the possibility of vulnerability exploitation, L=-θ0+θ1×vend+θ2×tag+θ3×exp+θ4×ref;θ0 is a preset basic offset, θ1 is a first dynamic regression coefficient, θ2 is a second dynamic regression coefficient, θ3 is a third dynamic regression coefficient, θ4 is a fourth dynamic regression coefficient, θ1, θ2, θ3 and θ4 are dynamically given based on the EPSS, vend is a vendor feature related to the vulnerability, tag is a classification label of the vulnerability, exp is a feature of whether the vulnerability is public, and ref is a reference material quantity feature. The specific calculation can be referred to patent CN115396156B.

[0013] S002, determining a preset correlation parameter list of the data center platform affected by the vulnerability based on the vulnerability type, the preset correlation parameter list comprising a plurality of preset correlation parameters.

[0014] ​Specifically, the associated parameters corresponding to the preset vulnerability types are preset in advance, for example, the associated parameters corresponding to the application layer vulnerability include: session timeout time, request rate limit, input verification rule; the associated parameters corresponding to the network layer vulnerability include: IP blacklist refresh frequency, TCP connection timeout time.

[0015] S003, generating a plurality of optimization parameter values for each preset associated parameter in the preset associated parameter list, thereby obtaining a combination list of all optimization parameter values, the combination list includes a plurality of combinations, and each combination includes a plurality of optimization parameter values corresponding to preset associated parameter values.

[0016] S004, determining the security risk value of the data center platform under each combination based on the combination list of the optimization parameter values, wherein the security risk value is equal to the product value of the base score baceScore of the CVSS system of the vulnerability of the data center platform under the current combination, the preset threat weight, and the reciprocal of the repair urgency, and the repair urgency is determined based on the influence of the vulnerability of the data center platform under the current combination on the business.

[0017] S005, optimizing the data center platform using the combination corresponding to the smallest security risk value.

[0018] In summary, the data center platform is scanned for vulnerabilities, a vulnerability information list of the data center platform is obtained, a preset associated parameter list of the data center platform affected by the vulnerability information is determined, a plurality of optimization parameter values are generated for each preset associated parameter in the preset associated parameter list, thereby obtaining a combination list of all optimization parameter values, the security risk value of the data center platform under each combination is determined based on the combination list of the optimization parameter values, and the data center platform is optimized using the combination corresponding to the smallest security risk value, thereby efficiently reducing the influence of the vulnerability by optimizing the preset associated parameters.

[0019] Specifically, after obtaining the vulnerability information list in S001, the following steps are further included: S006, obtaining the predicted threat level corresponding to the transmission data sent by the data provider to the data center platform, and determining the target threat level corresponding to the transmission data sent by the data provider to the data center platform based on the vulnerability information list.

[0020] Specifically, based on the vulnerability of the data center platform, the influence of the vulnerability on the transmission rate is considered, so that the prediction of the risk of the leaked transmission data is more accurate, that is, the target threat level is more accurate relative to the predicted threat level.

[0021] Further, the predicted threat level is determined by the following steps: S100, acquire a transmission attribute information list of transmission data sent by a data provider to a data center platform in a current time window W0, the transmission attribute information list including a plurality of transmission attribute information of a batch of transmission data, the transmission attribute information at least including: a data update period T0 of the transmission data, a size S0 of the transmission data, and an encryption strategy of the transmission data; T0 is a time interval between two continuous transmissions of the transmission data from the data provider to the data center platform.

[0022] In an embodiment of the present application, the encryption strategy of the transmission data is a plurality of initial encryption strategies of the transmission data, and the initial encryption strategy is an encryption mode. It can be understood that the transmission data can be encrypted by a combination of a plurality of initial encryption strategies, but the data provider does not want to disclose the combination mode of the initial encryption strategies due to the security of the transmission data and other reasons, and only discloses the initial encryption strategy of the transmission data.

[0023] S200, according to the transmission attribute information list, determine the predicted threat level corresponding to the transmission data sent by the data provider to the data center platform, the higher the predicted threat level, the greater the risk of the corresponding transmission data being leaked.

[0024] S300, based on the predicted threat level, pre-warning the data provider through an AI model. Specifically, the AI model is used to perform hierarchical pre-warning through the predicted threat level.

[0025] S200, according to the transmission attribute information list, determine the predicted threat level corresponding to the transmission data sent by the data provider to the data center platform, the higher the predicted threat level, the greater the risk of the corresponding transmission data being leaked. S210, acquire the product value of the normalized data update period, lg(S0+1), the transmission abnormal value and the preset weight factor C0 as the first threat V1; the transmission abnormal value is the sum of 1 and the transmission abnormal behavior value A0, A0 is the sum of the preset score corresponding to each abnormal behavior of all transmission data in W0, and lg() is the logarithmic function.

[0026] Specifically, any method for normalization in the prior art belongs to the protection scope of the present application, and will not be described here.

[0027] Specifically, the first threat quantity V1=ST0×lg(S0+1)×C0×(A0+1), ST0 is a normalized data update period, it can be understood that a rapid update behavior can mask a stealing behavior, for example, when a data provider updates transmission data, a synchronous stealing request is initiated, and because the data center platform is busy processing update traffic, the abnormal detection system can misjudge the stealing traffic as update traffic, therefore, the smaller the data update period, the greater the first threat quantity, and the greater the transmission data, the greater the harm of large batch data leakage, therefore, the greater the transmission data, the greater the first threat quantity, and lg(S0+1) is set to avoid failure when S0 is 0.

[0028] In an embodiment of the present application, a preset score corresponding to an abnormal behavior is preset, transmission abnormal behaviors in W0 are obtained, a transmission abnormal behavior value is determined, if there are multiple transmission abnormal behaviors in W0, a sum value of preset scores corresponding to the multiple transmission abnormal behaviors is obtained as the transmission abnormal behavior value.

[0029] Further, the dimensions of the abnormal behavior at least include: request rate, access rate in an irregular time period, and access proportion in an irregular region.

[0030] In S220, a security attenuation value φ(E0) is determined based on a complexity value E0 of an encryption strategy of the transmission data, a product value of φ(E0) and V1 is obtained as a second threat quantity V2, and φ(E0) is in inverse proportion to E0.

[0031] Specifically, φ(E0) is equal to a sum value of an attenuation exponential value and a preset leakage probability a, the attenuation exponential value is a negative x power of a natural constant e, x is a product value of a preset attenuation coefficient b and a specified value Y, and the specified value Y is a γ power of E0, and γ is a preset adjustment factor.

[0032] Specifically, V2=V1×φ(E0), φ(E0)=e -x +a, x=b×Y, Y=(E0) γ The security attenuation value is determined through the encryption strategy of the transmission data, when the encryption strategy of the transmission data is complex, E0 is greater, φ(E0) is smaller, at this time, V2 is smaller, that is, the second threat quantity is smaller when the encryption strategy of the transmission data is more complex.

[0033] In an embodiment of the present application, the complexity level of each initial encryption strategy is determined to determine the complexity of each initial encryption strategy, based on the encryption strategy of the transmission data, all combination modes of the initial encryption strategies are determined, the complexity of each combination mode is determined, and the maximum value in the complexity of the combination mode is taken as the complexity value E0 of the encryption strategy of the transmission data, in an embodiment of the present application, the complexity of the combination mode is equal to the product value of the complexity of all initial encryption strategies in the combination.

[0034] S230, determine a predicted threat level of the transmission data sent by the data provider to the data center platform based on V2, wherein the predicted threat level ranges from 0 to 1.

[0035] In summary, the transmission attribute information list of the transmission data in the current time window W0 is obtained, the predicted threat level of the transmission data leakage of the data provider is determined based on the transmission attribute information list in W0, and the data provider is warned through the AI model based on the predicted threat level of the transmission data leakage of the data provider, wherein the product value of the normalized data update period, the transmission risk value, the preset weight factor C0 and the transmission abnormal value is obtained as the first threat V1, the security attenuation value φ(E0) is determined based on the complexity value E0 of the encryption strategy of the transmission data, and the product value of φ(E0) and V1 is obtained as the second threat V2, the predicted threat level of the transmission data leakage of the data provider is determined based on V2, and the threat level of the transmission data leakage is more accurately determined by the transmission data update period, the data size and other dimensions.

[0036] Specifically, S200 further comprises, after determining the predicted threat level of the transmission data leakage of the data provider: S201, obtain the real threat level of the transmission data leakage of the data provider, and the real threat level ranges from 0 to 1. In an embodiment of the present application, the real threat level of the transmission data leakage of the data provider is determined by expert opinions.

[0037] S202, construct a cross-entropy loss function based on the predicted threat level and the real threat level, update the preset parameters by minimizing the cross-entropy loss function, and the preset parameters at least include: a preset weight factor, a preset leakage probability, a preset attenuation coefficient, and a preset adjustment factor.

[0038] Further, after determining the predicted threat level of the transmission data leakage of the data provider in W0, it further comprises: If the predicted threat level of the transmission data leakage of the data provider in W0 is greater than the preset threat threshold, and the predicted threat levels of the transmission data sent by the data provider to the data center platform in the y adjacent time windows before W0 are all greater than the preset threat threshold, the length of the time window is updated, and the length of the new time window is obtained.

[0039] Further, the length of the new time window is equal to the length of the current time window divided by the quotient of the preset proportion value, and the preset proportion value is equal to the sum of 1 and y times η, and the time proportion value η is equal to the quotient of the length of the current time window divided by T0. It can be understood that when the prediction threat levels of y+1 adjacent time windows are all greater than the preset threat threshold, it is considered that the threat level of the current transmission data leakage is high, and therefore the length of the observed time window is shortened and the observation is closely performed.

[0040] Further, the preset threat threshold is obtained by the following steps: S010, a historical data attribute list set of historical data is obtained, the historical data attribute list set includes historical data attribute information lists of historical data sent by a data provider to a data center platform in a plurality of historical time windows, each historical data attribute information list includes a plurality of historical data attribute information of a batch of historical data, and the historical data attribute information at least includes: a data update period T1 of the historical data, a size S1 of the historical data, and an encryption strategy of the historical data; and the length of the historical time window is equal to the length of W0. T1 is the time interval between two consecutive times of sending historical data by the data provider to the data center platform.

[0041] S020, for a historical time window, a product value of the normalized data update period T1, lg(S1+1), a preset weight factor and a historical anomaly value is obtained as a historical threat amount Z1; the historical anomaly value is the sum of 1 and a historical abnormal behavior value A1, and A1 is the sum of preset scores corresponding to each abnormal behavior of the historical data in the historical time window.

[0042] Specifically, Z1=ST1×lg(S1+1)×C0×(A1+1), and ST1 is the normalized data update period.

[0043] S030, for a historical time window, a security attenuation value φ(E1) is determined based on the complexity E1 of the encryption strategy of the historical data, and a product value of φ(E1) and the historical threat amount is obtained as a specified threat amount, and φ(E1) is inversely proportional to E1. Z2=Z1×φ(E1), φ(E1)=e -p +a, p=b×Y, P=(E1) γ It can be understood that the method of calculating φ(E1) is the same as that of calculating φ(E0).

[0044] S040, for a historical time window, a historical threat level of historical data leakage is determined based on the specified threat amount, and the value range of the historical threat level is 0 to 1. Specifically, the method of determining the historical threat level of the historical data leakage based on the specified threat amount is the same as the method of determining the prediction threat level of the transmission data leakage based on the second threat amount.

[0045] S050, determining the preset threat threshold based on the mean and standard deviation of the historical threat levels corresponding to all historical time windows.

[0046] Specifically, the preset threat threshold is equal to the sum of the mean of the historical threat levels corresponding to all historical time windows, the standard deviation of the historical threat levels corresponding to all historical time windows multiplied by β, and the exponential smoothing value multiplied by α, wherein β is a preset sensitivity, α is a preset weight coefficient, and the exponential smoothing value is a weighted sum of the transmission abnormal behavior value of the historical time window and the transmission abnormal behavior value of the previous time window of the historical time window.

[0047] Further, the weight of the transmission abnormal behavior value of the historical time window is 0.2.

[0048] In summary, the obtained historical data attribute list set of the historical data, for a historical time window, obtains the product value of the normalized data update period T1, lg(S1+1), the preset weight factor and the historical abnormal behavior value as the historical threat amount Z1, for a historical time window, determines the security attenuation value φ(E1) based on the complexity of the encryption strategy of the historical data, and obtains the product value of φ(E1) and the historical threat amount as the specified threat amount Z2, for a historical time window, determines the historical threat level of the historical data leakage based on the specified threat amount, and determines the preset threat threshold based on the mean and standard deviation of the historical threat levels corresponding to all historical time windows, and the present application determines the preset threat level more accurately through the mean and standard deviation of the specified threat amount of the historical data.

[0049] The embodiment of the present application also provides a non-transitory computer readable storage medium, which can be arranged in an electronic device to save a computer program related to a method in the method embodiment, and the computer program is loaded and executed by the processor to realize the method provided by the above-mentioned embodiment.

[0050] The embodiment of the present application also provides an electronic device, which comprises a processor, a memory and a computer program stored on the memory and executable on the processor, and the processor realizes the method provided by the above-mentioned embodiment when executing the computer program.

[0051] The embodiment of the present application also provides a computer program product, which comprises program code, and when the program product is executed on an electronic device, the program code is used to make the electronic device execute the steps in the method according to various exemplary embodiments of the present application described in the specification.

[0052] While certain specific embodiments of the application have been described in detail herein for the purposes of exemplification, it will be understood by those skilled in the art that the examples are for illustration only and are not intended to limit the scope of the application. It will be further understood by those skilled in the art that various modifications can be made to the embodiments without departing from the scope and spirit of the application.

Claims

1. A vulnerability handling method, characterized in that, The method includes the following steps: A vulnerability scan is performed on the data center platform to obtain a vulnerability information list. The vulnerability information list includes vulnerability information for several vulnerabilities, and the vulnerability information includes at least: vulnerability type, vulnerability severity score, vulnerability impact score, and vulnerability threat score. The data center platform receives transmission data sent by the data provider. The vulnerability severity score is the base score (baceScore) after normalization in the CVSS system, the vulnerability impact score is the impact score (impactScore) after normalization in the CVSS system, and the vulnerability threat score is calculated using the Predictive Scoring System (EPSS). Based on the vulnerability type, a list of preset associated parameters that the vulnerability affects the data center platform is determined. The list of preset associated parameters includes several preset associated parameters. For each preset associated parameter in the preset associated parameter list, generate several optimized parameter values ​​to obtain a combination list of all optimized parameter values. The combination list includes several combinations, and each combination includes several optimized parameter values ​​corresponding to the preset associated parameter values. Based on the list of combinations of optimized parameter values, the security risk value of the data center platform under each combination is determined. The security risk value is equal to the product of the base score of the vulnerability in the CVSS system, the preset threat weight, and the reciprocal of the repair urgency of the vulnerability in the current combination of the data center platform. The repair urgency is determined based on the impact of the vulnerability in the current combination of the data center platform on the business. Optimize the data center platform using the combination that corresponds to the minimum security risk value.

2. The vulnerability handling method according to claim 1, characterized in that, After obtaining the vulnerability information list, it also includes: Obtain the predicted threat level of the data transmitted from the data provider to the data center platform, and determine the target threat level of the data transmitted from the data provider to the data center platform based on the vulnerability information list.

3. The vulnerability handling method according to claim 2, characterized in that, To obtain the predicted threat level of data leakage from a data provider, follow these steps: Obtain a list of transmission attribute information for the data sent by the data provider to the data center platform within the current time window W0. The list of transmission attribute information includes several transmission attribute information for a batch of transmission data. The transmission attribute information includes at least: the data update period T0 of the transmission data, the size S0 of the transmission data, and the encryption strategy of the transmission data; T0 is the time interval between two consecutive transmission data sent by the data provider to the data center platform. Based on the list of transmission attribute information, the predicted threat level of the transmission data sent by the data provider to the data center platform is determined. The higher the predicted threat level, the greater the risk of the corresponding transmission data being leaked.

4. The vulnerability handling method according to claim 3, characterized in that, Based on the list of transmission attribute information, the predicted threat level of the data transmitted from the data provider to the data center platform is determined, including: Obtain the product of the normalized data update period, lg(S0+1), transmission anomaly value and preset weight factor as the first threat quantity V1; the transmission anomaly value is the sum of 1 and the transmission anomaly behavior value A0, where A0 is the sum of the preset scores corresponding to each anomaly behavior of all transmitted data within W0, and lg() is the logarithmic function. The security attenuation value φ(E0) is determined based on the complexity value E0 of the encryption strategy for transmitted data, and the product of φ(E0) and V1 is obtained as the second threat value V2, where φ(E0) and E0 are inversely proportional. Based on V2, the predicted threat level of the transmitted data sent by the data provider to the data center platform is determined, where the value of the predicted threat level ranges from 0 to 1.

5. The vulnerability handling method according to claim 3, characterized in that, After determining the predicted threat level of data leakage from the data provider within W0, the following is also included: If the predicted threat level of the data provider's transmitted data leakage within W0 is greater than the preset threat threshold, and the predicted threat level of the transmitted data sent by the data provider to the data center platform within the y adjacent time windows before W0 is greater than the preset threat threshold, the length of the time window is updated to obtain the new length of the time window.

6. The vulnerability handling method according to claim 5, characterized in that, The length of the new time window is equal to the quotient of the length of the current time window divided by a preset ratio value, where the preset ratio value is equal to the sum of 1 and η times y, and the time ratio value η is equal to the quotient of the length of the current time window divided by T0.

7. The vulnerability handling method according to claim 5, characterized in that, Obtain the preset threat threshold by following these steps: Obtain a list of historical data attributes, which includes a list of historical data attribute information sent by the data provider to the data center platform under several historical time windows. The list of historical data attribute information includes several historical data attribute information of a batch of historical data. The historical data attribute information includes at least: the data update period T1 of the historical data, the size S1 of the historical data, and the encryption strategy of the historical data; the length of the historical time window is equal to the length of W0; and T1 is the time interval between two consecutive historical data transmissions from the data provider to the data center platform. For a historical time window, the product of the normalized data update period T1, lg(S1+1), preset weight factor and historical outlier is obtained as the historical threat quantity; the historical outlier is the sum of 1 and the historical outlier behavior value A1, where A1 is the sum of the preset scores corresponding to each outlier behavior in the historical data within the historical time window. For a given historical time window, the security attenuation value φ(E1) is determined based on the complexity E1 of the encryption strategy for historical data, and the product of φ(E1) and the historical threat level is obtained as the specified threat level. φ(E1) and E1 are inversely proportional. For a given historical time window, the historical threat level of the historical data breach is determined based on a specified threat level, where the value of the historical threat level ranges from 0 to 1. The preset threat threshold is determined based on the mean and standard deviation of the historical threat levels corresponding to all historical time windows.

8. The vulnerability handling method according to claim 7, characterized in that, The preset threat threshold is equal to the sum of the mean of the historical threat levels corresponding to all historical time windows, β times the standard deviation of the historical threat levels corresponding to all historical time windows, and α times the exponential smoothing value, where β is the preset sensitivity, α is the preset weighting coefficient, and the exponential smoothing value is the weighted sum of the transmission anomaly behavior values ​​of the historical time window and the transmission anomaly behavior values ​​of the previous time window.

9. A non-transitory computer-readable storage medium, characterized in that, The storage medium stores a computer program, which is loaded and executed by a processor to implement the vulnerability handling method as described in any one of claims 1-8.

10. An electronic device, comprising: A processor, a memory, and a computer program stored in the memory and executable on the processor, characterized in that, when the processor executes the computer program, it implements the vulnerability handling method as described in any one of claims 1-8.

Images