Methods, systems, storage media, and electronic devices for predicting a vulnerability life stage
By acquiring basic information about vulnerabilities and changes in code size, and combining this with a vulnerability lifecycle prediction function, the lifecycle stage of a vulnerability can be accurately predicted, thus solving the problem of inaccurate vulnerability lifecycle prediction and enabling more targeted vulnerability remediation.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- JIANGNAN INFORMATION SECURITY (BEIJING) TECH CO LTD
- Filing Date
- 2025-09-19
- Publication Date
- 2026-05-19
AI Technical Summary
The inaccuracy of vulnerability lifecycle prediction in existing technologies is mainly due to the difficulty in determining the exact time when a vulnerability is introduced, which leads to insufficient accuracy of the vulnerability lifecycle prediction model.
By obtaining the initial discovery time, last patch time, number of patches, and total number of attacks on the vulnerability, as well as the amount of code at the time of initial discovery and each patch, the existence time and patch parameters of the vulnerability are calculated. Using a preset vulnerability lifecycle prediction function and distribution probability value, the lifecycle stage of the vulnerability is determined.
It improves the accuracy of vulnerability lifecycle prediction, enabling engineers to remediate vulnerabilities in a more targeted manner and reduce vulnerability spread and losses.
Smart Images
Figure CN121145219B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, and more specifically, to a method, system, storage medium, and electronic device for predicting the lifecycle of a vulnerability. Background Technology
[0002] Software flaws that can be exploited are called security vulnerabilities or vulnerabilities. One of the main goals of computer security is to reduce the number of vulnerabilities in software by discovering existing vulnerabilities and preventing the introduction of new ones (e.g., by adopting secure coding practices or formal verification techniques).
[0003] Extensive work has been done by engineers to measure software security. This research ranges from studying vulnerability characteristics to analyzing vulnerability trends across various software projects. Another area of work focuses on vulnerability discovery models, which attempt to capture the vulnerability discovery rate after a specific software product's release. Most of these models attempt to model the post-release vulnerability discovery rate as a function of time, while others model it as a function of the time elapsed, measured either by the product's market share or by the estimated cumulative user months since release. These reliability-inspired discovery models often focus on specific versions of software (static codebases), and their accuracy regarding empirical data is controversial. Specifically, empirical evidence suggests that vulnerability discovery rates may not decline, or if they do, this may be due to reduced detection rather than vulnerability depletion. Vulnerability lifetimes increase over time, but their distribution remains exponential. Vulnerability lifetimes are not dependent on their type but are closely related to the general code lifetime of the repository, and vulnerable code has a shorter lifetime than non-vulnerable code. Therefore, predicting vulnerability lifetimes based on vulnerable code becomes an effective way to address the shortcomings of current vulnerability lifetime prediction methods and systems. Summary of the Invention
[0004] To address the technical problem of inaccurate vulnerability lifecycle prediction caused by the difficulty in determining the exact time of vulnerability introduction in existing technologies, this application proposes a method, system, storage medium, and electronic device for predicting vulnerability lifecycle stages. By studying vulnerability code libraries, it is possible to better understand and quantify vulnerability lifecycles, thereby accurately predicting the lifecycle of a sufficiently large vulnerability sample.
[0005] According to one aspect of the present invention, a method for predicting the lifecycle stage of a vulnerability is provided, the method comprising:
[0006] Obtain basic information about the vulnerabilities to be predicted, including the initial discovery time and the last repair time of the vulnerabilities, the number of times the vulnerabilities were repaired and the total number of attacks, as well as the amount of code at the time of initial discovery and each repair.
[0007] Calculate the predicted duration of vulnerability based on the initial discovery time and the last repair time;
[0008] The repair parameters for the predicted vulnerability are calculated based on the vulnerability's existence time, the number of times the vulnerability has been patched, the total number of attacks, and the amount of code at the time of initial vulnerability discovery and each patch.
[0009] Based on a preset vulnerability lifecycle prediction function, the probability distribution value of the vulnerability to be predicted is calculated according to the vulnerability existence time, the repair parameters and the number of vulnerability repairs.
[0010] Based on the preset mapping relationship between vulnerability life stages and distribution probabilities, the life stage of the vulnerability to be predicted is determined according to the distribution probability value.
[0011] According to another aspect of the present invention, a system for predicting the lifecycle stage of a vulnerability is provided, the system comprising:
[0012] The data acquisition module is used to acquire basic information about the vulnerabilities to be predicted. The basic information includes the initial discovery time and the last repair time of the vulnerabilities, the number of times the vulnerabilities were repaired and the total number of attacks, as well as the amount of code at the time of initial discovery and each repair.
[0013] The first calculation module is used to calculate the predicted existence time of the vulnerability based on the initial discovery time and the last repair time.
[0014] The second calculation module is used to calculate the repair parameters of the vulnerability to be predicted based on the vulnerability's existence time, the number of times the vulnerability has been repaired and the total number of attacks, as well as the amount of code at the time of initial discovery and each repair.
[0015] The third calculation module is used to calculate the distribution probability value of the vulnerability to be predicted based on a preset vulnerability lifecycle prediction function, the vulnerability existence time, the repair parameters and the number of vulnerability repairs.
[0016] The result output module is used to determine the life stage of the vulnerability to be predicted based on the preset mapping relationship between the vulnerability life stage and the distribution probability value.
[0017] According to another aspect of the present invention, a computer-readable storage medium is provided, comprising a computer program that, when executed on an electronic device, causes the electronic device to perform the method described in any of the preceding claims.
[0018] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising: a memory and a processor, the memory and the processor being coupled; the memory storing program instructions, which, when executed by the processor, cause the electronic device to perform the method described in any of the preceding claims.
[0019] The present invention discloses a method, system, storage medium, and electronic device for predicting the lifecycle stage of a vulnerability. The method involves: acquiring basic information about the vulnerability to be predicted; calculating the existence time of the vulnerability based on the initial discovery time and the last repair time in the basic information; calculating repair parameters for the vulnerability based on the vulnerability existence time, the number of vulnerability repairs and the total number of attacks in the basic information, and the amount of code at the time of initial discovery and each repair; calculating the probability distribution value of the vulnerability based on the vulnerability existence time, the repair parameters, and the number of vulnerability repairs, using a preset vulnerability lifecycle prediction function; and determining the lifecycle stage of the vulnerability based on the probability distribution value, using a preset mapping relationship between vulnerability lifecycle stages and probability distribution. The method and system establish a correlation between vulnerability lifecycle prediction and not only time but also the vulnerability's codebase to jointly construct a probability density function for predicting the vulnerability lifecycle stage. Finally, the mapping relationship between the vulnerability lifecycle stage and the probability distribution is used to determine the vulnerability's lifecycle stage, thereby enabling more accurate prediction of the vulnerability's lifecycle stage and allowing engineers to more effectively and specifically repair vulnerabilities.
[0020] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description
[0021] The above and other objects, features, and advantages of the present invention will become more apparent from the more detailed description of the embodiments of the invention in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of the invention and form part of the specification. They are used together with the embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same parts or steps.
[0022] Figure 1 This is a flowchart illustrating a method for predicting the lifecycle stage of a vulnerability according to a preferred embodiment of the present invention.
[0023] Figure 2 A schematic diagram of the structure of a system for predicting vulnerability lifecycle stages according to a preferred embodiment of the present invention; and
[0024] Figure 3 This is a schematic diagram of the structure of an electronic device according to a preferred embodiment of the present invention. Detailed Implementation
[0025] Exemplary embodiments of the invention will now be described with reference to the accompanying drawings. However, the invention may be embodied in many different forms and is not limited to the embodiments described herein. These embodiments are provided to fully and completely disclose the invention and to fully convey its scope to those skilled in the art. The terminology used in the exemplary embodiments illustrated in the drawings is not intended to limit the invention. In the drawings, the same units / elements are referred to by the same reference numerals.
[0026] Unless otherwise stated, the terms used herein (including technical terms) have their common meaning as understood by one of ordinary skill in the art. Furthermore, it is understood that terms defined in commonly used dictionaries should be understood to have a meaning consistent with the context of their relevant field, and not to be interpreted as having an idealized or overly formal meaning.
[0027] Exemplary methods
[0028] Figure 1 This is a flowchart illustrating a method for predicting the lifecycle stage of a vulnerability according to a preferred embodiment of the present invention. Figure 1 As shown, the method for predicting the life stage of a vulnerability according to this preferred embodiment begins at step 101.
[0029] In step 101, basic information about the vulnerability to be predicted is obtained, including the initial discovery time and the last repair time of the vulnerability, the number of times the vulnerability was repaired and the total number of attacks, as well as the amount of code at the time of initial discovery and each repair.
[0030] In this preferred embodiment, compared with the prior art which generally models vulnerability discovery models as a function of time, the present invention also considers the changes in code volume from vulnerability discovery to vulnerability repair, as well as the impact of variables such as the number of vulnerability repairs and the total number of attacks on the predicted vulnerability lifecycle stage, thereby providing another way to improve the accuracy of vulnerability lifecycle prediction.
[0031] In step 102, the existence time of the vulnerability to be predicted is calculated based on the initial discovery time and the last repair time.
[0032] Preferably, the calculation of the predicted vulnerability's existence time based on the initial discovery time and the last repair time is performed using the following formula:
[0033] day p =d p_comit -d p_begin
[0034] In the formula, day p To predict the duration of the vulnerability, d p_begin and dp_comit These represent the initial discovery time and the final fix time of the predicted vulnerability, respectively.
[0035] In step 103, the repair parameters for the predicted vulnerability are calculated based on the vulnerability's existence time, the number of times the vulnerability has been repaired, the total number of attacks, and the amount of code at the time of initial vulnerability discovery and each repair.
[0036] Preferably, the calculation of the remediation parameters for the predicted vulnerability is based on the vulnerability's existence time, the number of times the vulnerability has been patched, the total number of attacks, and the amount of code at the time of initial vulnerability discovery and each patch. The calculation formula is as follows:
[0037] day p =d p_comit -d p_begin
[0038] In the formula, day p To predict the duration of the vulnerability, d p_begin and d p_comit These represent the initial discovery time and the final fix time of the predicted vulnerability, respectively.
[0039] In step 104, based on a preset vulnerability lifecycle prediction function, the distribution probability value of the vulnerability to be predicted is calculated according to the vulnerability existence time, the repair parameters and the number of vulnerability repairs.
[0040] Preferably, the vulnerability lifecycle prediction function, based on the vulnerability existence time, the remediation parameters, and the number of vulnerability remediation attempts, calculates the probability distribution value of the vulnerability to be predicted, wherein the expression of the vulnerability lifecycle prediction function is:
[0041]
[0042] In the formula, f(day) is the probability distribution value of the vulnerability, mid is the vulnerability repair parameter, day is the existence time of the vulnerability, modify is the number of vulnerability repairs, n0 is the set threshold for the number of vulnerability repairs, and m and u are parameter values determined by approximating the probability density function based on the basic information of the publicly disclosed vulnerability.
[0043] In this preferred embodiment, by obtaining the basic information of known vulnerabilities from various publicly disclosed vulnerability collection platforms, a sufficient number of vulnerability samples are obtained. The basic information of the known vulnerabilities obtained is the same as that of the predicted vulnerability, including the initial discovery time and the last repair time of the vulnerability, the number of times the vulnerability is repaired and the total number of attacks, as well as the amount of code at the initial discovery of the vulnerability and each time it is repaired. The existence time of the known vulnerability and the calculation method of the repair parameter are also the same as those of the predicted vulnerability respectively. Then, based on the basic information of these vulnerability samples, the probability density function of the vulnerability life cycle is estimated as the vulnerability life cycle prediction function. This preferred embodiment proves through experiments that when the number of times the vulnerability is repaired exceeds a certain threshold n0, the expression of the function will be different. Therefore, the vulnerability life prediction function (vulnerability life cycle prediction function) is divided into two stages. When the number of times the vulnerability is repaired modify < n0, the overall vulnerability parameter m is used for life cycle estimation. When the number of times the vulnerability is repaired modify ≥ n0, that is, when the number of times the vulnerability is repaired is large enough, the probability density function can be approximated by the experimental data of this vulnerability to obtain the parameter u for life cycle estimation.
[0044] In step 105, based on the mapping relationship between the preset vulnerability life stages and the distribution probabilities, the life stage of the predicted vulnerability is determined according to the distribution probability value.
[0045] Preferably, for determining the life stage of the predicted vulnerability based on the mapping relationship between the preset vulnerability life stages and the distribution probabilities, where the mapping relationship between the life stages and the distribution probabilities is:
[0046] When 0 < f(day) < initial, it is determined that the vulnerability is in the initial vulnerability stage;
[0047] When initial ≤ f(day) < little, it is determined that the vulnerability is in the vulnerability propagation stage;
[0048] When little ≤ f(day) < middle, it is determined that the vulnerability is in the vulnerability repair stage;
[0049] When middle ≤ f(day) < 1, it is determined that the vulnerability is in the vulnerability extinction stage.
[0050] Among them, initial, little, and middle are positive numbers less than 1 set.
[0051] In this preferred embodiment, after determining the probability distribution value of the vulnerability to be predicted based on the vulnerability lifecycle prediction function, the lifecycle development stage of the vulnerability can be determined through the preset mapping relationship between the vulnerability lifecycle stage and the probability distribution. Therefore, corresponding work can be organized according to the corresponding stage of the vulnerability. Specifically, the initial stage of a vulnerability is the initial discovery period, when people have little awareness of it and its exploitation is poor, but increased monitoring is needed to quickly discover the vulnerability's patterns and prepare adequately for patching. The propagation stage is when people become familiar with the vulnerability and its exploitation is more widespread, requiring attention and prompt patching. The patching stage occurs because the vulnerability is widely known after patching, and its exploitation gradually decreases; appropriate monitoring is sufficient. The extinction stage is when the vulnerability has essentially lost its exploitable value due to long-term patching, and therefore, public attention approaches zero, and no further action can be taken.
[0052] Identifying the lifecycle stages of a vulnerability, especially its initial stage, has the core value of "containing its spread and reducing its impact," and its importance is reflected in the following four aspects:
[0053] Reduce the scope of impact. In the early stages of vulnerability propagation, when it is still in its initial phase, the number of systems, users, or networks affected is limited. Identifying and remediating vulnerabilities at this stage can prevent them from being exploited by more attackers and prevent localized risks from escalating into large-scale security incidents (such as ransomware, which, if intercepted in its early stages, could prevent a full-network infection).
[0054] Reduce the cost of attacks. When vulnerabilities are identified in their early stages, attackers may not yet have developed sophisticated exploitation tools or attack procedures. Intervening at this time allows for the rapid release of patches and defense strategies, making it difficult for attackers to profit from large-scale attacks and reducing their incentive to continue attacking.
[0055] Reduce the difficulty of remediation. When a vulnerability first spreads, it may only cause a small amount of data leakage and system anomalies. Timely handling can prevent the accumulation of losses (such as mass leakage of user information and interruption of core business), and the subsequent remediation costs (such as data recovery and user compensation) will also be significantly reduced.
[0056] Maintaining proactive emergency response is crucial. Identifying vulnerabilities in their early stages buys valuable time for businesses and organizations to develop remediation plans, issue early warnings, and maintain control over the emergency response. Waiting until a vulnerability has spread significantly before taking action may result in a reactive approach (e.g., patch releases lag behind the peak of attacks).
[0057] The method for predicting the lifecycle stage of a vulnerability as described in this preferred embodiment not only links the vulnerability's lifecycle prediction to time but also to the vulnerability's codebase, jointly constructing a probability density function for predicting the vulnerability's lifecycle stage. Based on this probability density function, the basic information of the vulnerability whose lifecycle stage is to be predicted is calculated to determine its probability distribution value. Finally, the mapping relationship between the vulnerability's lifecycle stage and the probability distribution is used to determine the vulnerability's current lifecycle stage. This allows for a more accurate prediction of the vulnerability's lifecycle stage, enabling engineers to perform more targeted vulnerability remediation.
[0058] Exemplary System
[0059] Figure 2 This is a schematic diagram of the structure of a system for predicting the lifecycle of a vulnerability according to a preferred embodiment of the present invention. Figure 2 As shown, the system 200 for predicting vulnerability lifecycle stages according to this preferred embodiment includes:
[0060] The data acquisition module 201 is used to acquire basic information about the vulnerability to be predicted. The basic information includes the initial discovery time and the last repair time of the vulnerability, the number of times the vulnerability was repaired and the total number of attacks, as well as the amount of code at the time of initial discovery and each repair.
[0061] The first calculation module 202 is used to calculate the existence time of the vulnerability to be predicted based on the initial discovery time and the last repair time.
[0062] The second calculation module 203 is used to calculate the repair parameters of the vulnerability to be predicted based on the vulnerability's existence time, the number of times the vulnerability has been repaired and the total number of attacks, as well as the amount of code at the time of initial discovery of the vulnerability and at each repair.
[0063] The third calculation module 204 is used to calculate the distribution probability value of the vulnerability to be predicted based on a preset vulnerability lifecycle prediction function, the vulnerability existence time, the repair parameters and the number of vulnerability repairs.
[0064] The result output module 205 is used to determine the life stage of the vulnerability to be predicted based on the preset mapping relationship between the vulnerability life stage and the distribution probability value.
[0065] Preferably, the first calculation module 202 calculates the predicted existence time of the vulnerability based on the initial discovery time and the last repair time, and the calculation formula is as follows:
[0066] day p =d p_comit -d p_begin
[0067] In the formula, day pTo predict the duration of the vulnerability, d p_begin and d p_comit These represent the initial discovery time and the final fix time of the predicted vulnerability, respectively.
[0068] Preferably, the second calculation module 203 calculates the repair parameters for the predicted vulnerability based on the vulnerability's existence time, the number of times the vulnerability has been patched, the total number of attacks, and the amount of code at the time of initial vulnerability discovery and each patch. The calculation formula is as follows:
[0069]
[0070] In the formula, mid p For the remediation parameters of the predicted vulnerability, n and att p These represent the number of vulnerability fixes and the total number of attacks on the predicted vulnerability, respectively. When i is greater than 0, line i Let represent the amount of code during the i-th fix, where i = 0 represents the amount of code expected when the vulnerability is initially discovered.
[0071] The system for predicting the life stage of a vulnerability in this preferred embodiment and the method for predicting the life stage of a vulnerability in this invention perform the same steps as those of the system for predicting the life stage of a vulnerability based on the basic information of the vulnerability to be predicted, and then determine the life stage of the vulnerability based on the vulnerability life cycle prediction function. The technical effects achieved are also the same, and will not be repeated here.
[0072] Exemplary electronic devices
[0073] Figure 3 This is a schematic diagram of the structure of an electronic device according to a preferred embodiment of the present invention. Figure 3 As shown, the electronic device includes one or more processors 301 and memory 302.
[0074] The processor 301 may be a central processing unit (CPU) or other form of processing unit with data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device to perform desired functions.
[0075] Memory 302 may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and processor 301 may execute the program instructions to implement the methods for predicting vulnerability lifetimes of the various disclosed embodiments described above, and / or other desired functions. In one example, the electronic device may also include an input device 303 and an output device 304, these components being interconnected via a bus system and / or other forms of connection mechanisms (not shown).
[0076] In addition, the input device 303 may also include, for example, a keyboard, a mouse, etc.
[0077] The output device 304 can output various information to the outside. The output device 304 may include, for example, a display, a speaker, a printer, and a communication network and its connected remote output devices, etc.
[0078] Of course, for the sake of simplicity, Figure 3 Only some of the components of the electronic device relevant to this disclosure are shown, omitting components such as buses, input / output interfaces, etc. In addition, the electronic device may include any other suitable components depending on the specific application.
[0079] Exemplary computer program products and computer-readable storage media
[0080] In addition to the methods and apparatus described above, embodiments of this disclosure may also be computer program products comprising computer program instructions that, when executed by a processor, cause the processor to perform steps in the methods for predicting vulnerability lifecycle stages according to various embodiments of this disclosure as described in the "Exemplary Methods" section of this specification.
[0081] The computer program product can be written in any combination of one or more programming languages to perform the operations of the embodiments of this disclosure. The programming languages include object-oriented programming languages such as Java and C++, as well as conventional procedural programming languages such as C or similar languages. The program code can be executed entirely on a user's computing device, partially on a user's computing device, as a standalone software package, partially on a user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.
[0082] Furthermore, embodiments of this disclosure may also be computer-readable storage media having stored thereon computer program instructions that, when executed by a processor, cause the processor to perform steps in the methods for predicting vulnerability lifecycles according to various embodiments of this disclosure as described in the "Exemplary Methods" section above.
[0083] The computer-readable storage medium may be any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may, for example, include, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatuses, or devices, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.
[0084] The basic principles of this disclosure have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in this disclosure are merely examples and not limitations, and should not be considered as essential features of each embodiment of this disclosure. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the scope of this disclosure to the necessity of employing the aforementioned specific details for implementation.
[0085] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For system embodiments, since they largely correspond to method embodiments, the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.
[0086] The block diagrams of devices, apparatuses, devices, and systems disclosed herein are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, devices, and systems can be connected, arranged, and configured in any manner. Words such as “comprising,” “including,” “having,” etc., are open-ended terms meaning “including but not limited to,” and are used interchangeably with them. The terms “or” and “and” as used herein refer to the terms “and / or,” and are used interchangeably with them unless the context clearly indicates otherwise. The term “such as” as used herein refers to the phrase “such as but not limited to,” and is used interchangeably with it.
[0087] The methods and apparatus of this disclosure may be implemented in many ways. For example, they may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware. The above-described order of steps for the methods is for illustrative purposes only, and the steps of the methods of this disclosure are not limited to the order specifically described above unless otherwise specifically stated. Furthermore, in some embodiments, this disclosure may also be implemented as a program recorded on a recording medium, the program including machine-readable instructions for implementing the methods according to this disclosure. Thus, this disclosure also covers recording media storing programs for performing the methods according to this disclosure.
[0088] It should also be noted that in the apparatus, devices, and methods of this disclosure, the components or steps are decomposable and / or recombinable. Such decomposition and / or recombination should be considered equivalent to the present disclosure. The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use this disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein can be applied to other aspects without departing from the scope of this disclosure. Therefore, this disclosure is not intended to be limited to the aspects shown herein, but rather to be carried out within the widest scope consistent with the principles and novel features disclosed herein.
[0089] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this disclosure to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations thereof.
Claims
1. A method for predicting the lifecycle stage of a vulnerability, characterized in that, The method includes: Obtain basic information about the vulnerabilities to be predicted, including the initial discovery time and the last repair time of the vulnerabilities, the number of times the vulnerabilities were repaired and the total number of attacks, as well as the amount of code at the time of initial discovery and each repair. Based on the initial discovery time and the last remediation time, the predicted existence time of the vulnerability is calculated; wherein, the formula for calculating the predicted existence time of the vulnerability is: In the formula, To predict the duration of the vulnerability, and These are the initial discovery time and the final remediation time of the predicted vulnerability, respectively. The repair parameters for the predicted vulnerability are calculated based on the vulnerability's existence time, the number of times the vulnerability has been patched, the total number of attacks, and the amount of code at the time of initial vulnerability discovery and each patch. The formula for calculating the remediation parameters for the predicted vulnerability is as follows: In the formula, These are the parameters for remediation of the predicted vulnerability. and These represent the number of vulnerability fixes and the total number of attacks on the predicted vulnerability, respectively. When i is greater than 0, Let be the amount of code during the i-th fix, where i=0 represents the amount of code expected when the vulnerability is initially discovered; Based on a preset vulnerability lifecycle prediction function, the probability distribution value of the vulnerability to be predicted is calculated according to the vulnerability existence time, the repair parameters and the number of vulnerability repairs. The expression for the vulnerability lifecycle prediction function is as follows: In the formula, This represents the probability distribution of the vulnerability. These are the parameters for fixing the vulnerability. The duration of the vulnerability. The number of times a vulnerability has been patched. The threshold for the number of vulnerability fixes is set, where m and u are parameter values determined by approximating the probability density function based on the basic information of the disclosed vulnerabilities. Based on the preset mapping relationship between vulnerability life stages and distribution probabilities, the life stage of the vulnerability to be predicted is determined according to the distribution probability value. The mapping relationship between the life stage and the probability distribution is as follows: when At that time, it was determined that the vulnerability was in its early stages. when At that time, it was determined that the vulnerability was in the vulnerability propagation stage; when At that time, it was determined that the vulnerability was in the vulnerability remediation phase; when At that time, it was determined that the vulnerability was in the vulnerability extinction phase; in, , and It is set to a positive number less than 1.
2. The method according to claim 1, characterized in that, This also includes dividing the vulnerability lifecycle prediction function into two phases, where the number of vulnerability fixes modify < At that time, the overall vulnerability parameter m is used to estimate the lifecycle, and the number of vulnerability fixes is modified. At that time, the probability density function was approximated using the experimental data of the vulnerability to obtain the parameter u for lifetime estimation.
3. The method according to claim 1, characterized in that, It also includes obtaining vulnerability samples by acquiring basic information about known vulnerabilities from various publicly available vulnerability collection platforms.
4. The method according to claim 3, characterized in that, The basic information of the known vulnerabilities obtained is the same as the basic information of the vulnerabilities to be predicted.
5. A system for predicting the lifecycle stage of a vulnerability, characterized in that, The system includes: The data acquisition module is used to acquire basic information about the vulnerabilities to be predicted. The basic information includes the initial discovery time and the last repair time of the vulnerabilities, the number of times the vulnerabilities were repaired and the total number of attacks, as well as the amount of code at the time of initial discovery and each repair. The first calculation module is used to calculate the predicted existence time of the vulnerability based on the initial discovery time and the last repair time; wherein the formula for calculating the predicted existence time of the vulnerability is: In the formula, To predict the duration of the vulnerability, and These are the initial discovery time and the final remediation time of the predicted vulnerability, respectively. The second calculation module is used to calculate the repair parameters of the predicted vulnerability based on the vulnerability's existence time, the number of times the vulnerability has been patched, the total number of attacks, and the amount of code at the time of initial vulnerability discovery and each patch; wherein, the calculation formula for the repair parameters of the predicted vulnerability is: In the formula, These are the parameters for remediation of the predicted vulnerability. and These represent the number of vulnerability fixes and the total number of attacks on the predicted vulnerability, respectively. When i is greater than 0, Let be the amount of code during the i-th fix, where i=0 represents the amount of code expected when the vulnerability is initially discovered; The third calculation module is used to calculate the distribution probability value of the vulnerability to be predicted based on a preset vulnerability lifecycle prediction function, the vulnerability existence time, the repair parameters and the number of vulnerability repairs. The expression for the vulnerability lifecycle prediction function is as follows: In the formula, This represents the probability distribution of the vulnerability. These are the parameters for fixing the vulnerability. The duration of the vulnerability. The number of times a vulnerability has been patched. The threshold for the number of vulnerability fixes is set, where m and u are parameter values determined by approximating the probability density function based on the basic information of the disclosed vulnerabilities. The result output module is used to determine the life stage of the vulnerability to be predicted based on the preset mapping relationship between the vulnerability life stage and the distribution probability value. The mapping relationship between the life stage and the probability distribution is as follows: when At that time, it was determined that the vulnerability was in its early stages. when At that time, it was determined that the vulnerability was in the vulnerability propagation stage; when At that time, it was determined that the vulnerability was in the vulnerability remediation phase; when At that time, it was determined that the vulnerability was in the vulnerability extinction phase; in, , and It is set to a positive number less than 1.
6. The system according to claim 5, characterized in that, This also includes dividing the vulnerability lifecycle prediction function into two phases, where the number of vulnerability fixes modify < At that time, the overall vulnerability parameter m is used to estimate the lifecycle, and the number of vulnerability fixes is modified. At that time, the probability density function was approximated using the experimental data of the vulnerability to obtain the parameter u for lifetime estimation.
7. A computer-readable storage medium, characterized in that, Includes a computer program that, when run on an electronic device, causes the electronic device to perform the method as described in any one of claims 1 to 4.
8. An electronic device, characterized in that, The electronic device includes: a memory and a processor, the memory and the processor being coupled; the memory stores program instructions that, when executed by the processor, cause the electronic device to perform the method as described in any one of claims 1 to 4.