Information security vulnerability processing method
By generating vulnerability feature vectors and environmental weight factors, calculating similarity scores, dynamically aggregating vulnerability clusters and assigning remediation priorities, the problem of inaccurate vulnerability handling and low resource utilization in existing technologies is solved, achieving efficient vulnerability management and remediation.
Patent Information
- Application Number
- CN202511392643.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-09-26
- Publication Date
- 2025-12-19
AI Technical Summary
Existing technologies fail to effectively combine asset importance, network exposure, and remediation costs during vulnerability handling, resulting in a mismatch between the aggregated vulnerability results and actual risks. They also lack a unified method for feature quantification and similarity calculation, and rely on manual judgment, leading to subjective differences in remediation priority allocation.
By obtaining the basic attribute set of vulnerabilities, feature vectors are generated, environmental weight factors, including asset value, exposure surface and remediation cost coefficients, are calculated, and vulnerabilities are aggregated based on comprehensive similarity scores to generate vulnerability clusters. Vulnerability reports are then merged and remediation priorities are assigned.
It enables accurate merging of vulnerability data and risk assessment, improves the targeting of vulnerability remediation and the efficiency of security management, ensures that resources are centrally allocated to high-risk vulnerabilities, and reduces redundant processing.
Smart Images
Figure CN121167745A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of information security, and in particular to a processing method of information security vulnerabilities. BACKGROUND
[0002] With the continuous increase of the scale and complexity of information systems, the types and quantities of potential security vulnerabilities in network environments are continuously increasing. Various vulnerability scanning tools can periodically or in real time output vulnerability detection results, including basic attribute information such as vulnerability type, affected port, and communication protocol, as well as asset operating environment information associated with the vulnerability. Due to the wide distribution and diverse attributes of vulnerabilities, operation and maintenance personnel need to face a large amount of repeated, highly correlated, or same-sourced vulnerability data in the vulnerability management process. If these data are not effectively merged and risk sorted, it will lead to scattered repair tasks, low resource utilization, and affect the overall security operation efficiency.
[0003] The existing technology has the following problems in the vulnerability processing link: first, it only relies on vulnerability basic attributes for aggregation, ignoring environmental factors such as asset importance, network exposure, and repair cost, resulting in mismatch between vulnerability aggregation results and actual risks; second, there is a lack of unified feature quantization and similarity calculation method, making it difficult to accurately identify different forms of the same risk entity; third, the vulnerability report generation and repair priority allocation process relies on manual judgment, which is prone to subjective differences. Therefore, there is an urgent need for a processing method of information security vulnerabilities to solve the above problems. SUMMARY
[0004] Based on the above purpose, the present application provides a processing method of information security vulnerabilities.
[0005] A processing method of information security vulnerabilities, comprising the following steps:
[0006] S1: obtaining original vulnerability scanning data and extracting a basic attribute set of each vulnerability;
[0007] S2: generating a feature vector of each vulnerability according to the basic attribute set, wherein the feature vector includes a static feature sub-vector and a dynamic environment sub-vector;
[0008] S3: calculating an environmental weight factor based on the attributes of the asset where the vulnerability is located, including an asset value coefficient, an exposure surface coefficient, and a repair cost coefficient;
[0009] S4: calculating a comprehensive similarity score between any two vulnerabilities according to the feature vector of S2 and the environmental weight factor of S3;
[0010] S5: dynamically aggregating the vulnerabilities based on the comprehensive similarity score to generate a plurality of vulnerability clusters;
[0011] S6: merging the vulnerabilities in each vulnerability cluster to generate a simplified vulnerability report, and assigning a repair priority according to the highest environment weight factor in the cluster.
[0012] Optionally, the S1 specifically comprises:
[0013] S11: receiving original vulnerability scanning data output by a preset security scanning tool, the security scanning tool comprising a network layer scanner and a system layer vulnerability scanner, respectively used for collecting vulnerability information in a network communication interface and a system service module;
[0014] S12: parsing each vulnerability record in the original vulnerability scanning data to extract a corresponding basic attribute set, the basic attribute set comprising a vulnerability type field, a port number field and a protocol type field.
[0015] Optionally, the S2 specifically comprises:
[0016] S21: numerically encoding the vulnerability type, the port number and the protocol type to convert them into a fixed-dimension binary vector to form a static feature sub-vector .
[0017] S22: obtaining a business level, a network exposure state and a patch update time of a vulnerability-associated asset, respectively converting them into standardized numerical values to form a dynamic environment sub-vector .
[0018] S23: splicing the static feature sub-vector and the dynamic environment sub-vector to generate a complete feature vector of each vulnerability .
[0019] Optionally, the S22 specifically comprises:
[0020] S221: extracting the business level, the network exposure state and the patch update time of the asset by matching with an asset database associated with the vulnerability;
[0021] S222: directly taking the business level as a numerical feature , taking the network exposure state as a binary feature , and taking a time difference between the patch update time and a current time as a third feature .
[0022] S223: standardizing the three feature values by using a Z-Score method, and splicing the three standardized results to form the dynamic environment sub-vector .
[0023] Optionally, the S3 specifically comprises:
[0024] S31: Obtain the business weight label, network topology information and system configuration list of the asset to which the vulnerability belongs;
[0025] S32: Set the asset value coefficient according to the business weight label , the value range of which is , and the preset five-level business importance level is mapped to the corresponding numerical value;
[0026] S33: Set the exposure surface coefficient according to the exposure range of the asset in the network topology , the expression is: , wherein represents the number of public networks or reachable external nodes connected by the asset, is the number of all nodes in the network;
[0027] S34: Calculate the repair cost coefficient according to the number of manual repair steps , the average repair time and the required resource level in the system configuration list, and the calculation expression is: , wherein is a normalization constant.
[0028] Optionally, the S4 specifically includes:
[0029] S41: Obtain the feature vectors of any two to-be-compared vulnerabilities, respectively represented as and ;
[0030] S42: Calculate the Euclidean distance between the feature vectors of the two to-be-compared vulnerabilities ;
[0031] S43: Extract the environment weight factor corresponding to the two vulnerabilities, and calculate the average weight coefficient ;
[0032] S44: Combine the Euclidean distance and the average environment weight coefficient to calculate the comprehensive similarity score , and the expression is: .
[0033] Optionally, the S5 specifically includes:
[0034] S51: Construct the comprehensive similarity scores between all pairs of vulnerabilities into a symmetric similarity matrix, each element in the matrix corresponding to the similarity between a pair of vulnerabilities;
[0035] S52: Set a similarity threshold, if the similarity score between two vulnerabilities is greater than the similarity threshold, they are divided into the same initial clustering group; repeat the traversal of all vulnerability pairs to obtain multiple initial clustering groups;
[0036] S53: On the basis of initial clustering, adopt a step-by-step merging strategy until all clustering groups do not overlap with each other, forming a final vulnerability cluster set;
[0037] S54: Assign a unique identifier to each generated vulnerability cluster, and use it as a representative of multiple forms of the same risk object.
[0038] Optionally, the S53 specifically includes:
[0039] S531: Traverse all initial clustering groups in turn, check whether there are the same vulnerability records in any two clustering groups, that is, judge whether the vulnerabilities appear in two different clustering groups at the same time;
[0040] S532: For the clustering groups with the same vulnerability records, merge all vulnerabilities of the two clustering groups to generate a new clustering group, and replace the original two groups;
[0041] S533: Continue to traverse and merge the new clustering results until the vulnerabilities between all clustering groups are no longer repeated, and finally obtain a vulnerability cluster set.
[0042] Optionally, the S6 specifically includes:
[0043] S61: Merge all vulnerability information in each vulnerability cluster, extract the same vulnerability attribute items, including vulnerability name, affected port range, protocol type and vulnerability cause summary;
[0044] S62: In each vulnerability cluster, extract the environment weight factor corresponding to each vulnerability and compare them, and select the vulnerability with the highest weight factor value as the representative vulnerability of the cluster;
[0045] S63: Determine the repair priority of the vulnerability cluster according to the environment weight factor of the representative vulnerability, and attach the priority label to the simplified vulnerability report;
[0046] S64: Output the simplified vulnerability report corresponding to each vulnerability cluster, including the merged information field, representative vulnerability and repair priority level.
[0047] Optionally, the S63 specifically includes:
[0048] S631: Set priority level division standards, divide the environment weight factor into three interval ranges of high, medium and low, respectively corresponding to high priority, medium priority and low priority repair labels;
[0049] S632: judging the environmental weight factor representing the vulnerability the numerical interval it belongs to, and determining the repair priority of the vulnerability cluster accordingly, specifically, if , a high priority is given; if , a medium priority is given; if , a low priority is given.
[0050] S633: writing the corresponding priority label as field information into the simplified vulnerability report of the vulnerability cluster.
[0051] Advantages of the present application:
[0052] The present application combines vulnerability basic attributes with environmental factors, first uses numerical coding and standardization processing to uniformly convert vulnerability types, port numbers, protocol types, asset value coefficients, exposure surface coefficients, and repair cost coefficients into calculable feature vectors and weight factors, and then dynamically aggregates vulnerabilities based on comprehensive similarity, ensuring that different forms of the same risk entity can be accurately identified and merged, thereby reducing the redundancy and repeated processing of vulnerability data from the source.
[0053] The present application selects the vulnerability corresponding to the highest environmental weight factor in the vulnerability cluster as the representative, and assigns a repair priority to the vulnerability cluster in combination with a preset priority grading standard, thereby realizing integrated processing of vulnerability aggregation, risk assessment, and task scheduling; this method can allocate security operation and maintenance resources to vulnerabilities with the most risk impact, thereby improving the pertinence of vulnerability repair and the overall efficiency of security management. BRIEF DESCRIPTION OF DRAWINGS
[0054] In order to more clearly illustrate the technical solutions in the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are only a part of the present application, and other drawings can also be obtained by those skilled in the art without creative effort based on these drawings.
[0055] Figure 1 The information security vulnerability processing method of the present application embodiment is shown in the figure.
[0056] Figure 2 The dynamic aggregation process of the present application embodiment is shown in the figure. DETAILED DESCRIPTION
[0057] The application will be described in detail below with reference to the drawings and specific embodiments. It should be noted that in order to make the embodiments more detailed, the following embodiments are the best, preferred embodiments, and other alternative ways can also be implemented by those skilled in the art for some known technologies; and the drawings are only used to more specifically describe the embodiments, and are not intended to specifically limit the application.
[0058] It should be noted that in the specification, "one embodiment", "embodiment", "exemplary embodiment", "some embodiments" and the like indicate that the described embodiment can include a specific feature, structure or property, but not necessarily every embodiment includes the specific feature, structure or property. In addition, when a specific feature, structure or property is described in combination with an embodiment, it should be within the knowledge of those skilled in the related art to implement such a feature, structure or property in combination with other embodiments (whether or not explicitly described).
[0059] Generally, the terms can be understood at least in part from the use in context. For example, depending at least in part on the context, the term "one or more" as used herein can be used to describe any feature, structure, or characteristic in the singular or can be used to describe combinations of features, structures, or characteristics that are combinable into one or more instances. In addition, the term "based on" can be understood as not necessarily intended to convey a set of exclusive factors, but can instead, depending at least in part on the context, allow for additional factors not necessarily explicitly described.
[0060] As shown in Figures 1-2 A method for processing information security vulnerabilities, comprising the following steps:
[0061] S1: Obtain original vulnerability scanning data, and extract a basic attribute set of each vulnerability;
[0062] S1 specifically includes:
[0063] S11: Receive original vulnerability scanning data output by a preset security scanning tool, the security scanning tool including a network layer scanner and a system layer vulnerability scanner, respectively used for collecting vulnerability information in a network communication interface and a system service module, and organizing the scanning results into a structured data set according to a device dimension;
[0064] S12: Analyzing each vulnerability record in the original vulnerability scanning data, and extracting a corresponding basic attribute set, the basic attribute set including a vulnerability type field, a port number field and a protocol type field, wherein:
[0065] The vulnerability type field is used to identify the attack category to which the vulnerability belongs, based on a preset CVE standard or a vulnerability classification system built in the vulnerability scanning tool;
[0066] The port number field corresponds to the port number of the TCP / UDP listening service, and the response port thereof is recorded by the scanner;
[0067] The protocol type field is used to identify the communication protocol adopted by the service corresponding to the vulnerability, including but not limited to TCP, UDP or HTTP, etc., and the parsing mode is realized by relying on the protocol feature field matching algorithm; the above steps can ensure the integrity and accuracy of the basic attributes of the vulnerability by combining the network layer and system layer scanner to collect original vulnerability data and extracting the vulnerability type, port number and protocol type based on the structured parsing mechanism, thereby providing a stable data basis for subsequent feature modeling and clustering analysis.
[0068] S2: generating a feature vector of each vulnerability according to the basic attribute set, the feature vector including a static feature sub-vector and a dynamic environment sub-vector;
[0069] S2 specifically includes:
[0070] S21: numerically encoding the vulnerability type, port number and protocol type, and converting them into a fixed-dimension binary vector to constitute the static feature sub-vector ;
[0071] The above step of constituting the static feature sub-vector is as follows:
[0072] First, a pre-defined encoding set of the vulnerability type, port number and protocol type is established, and three independent feature encoding index tables are respectively constructed to ensure that the value of each attribute corresponds to a unique position;
[0073] Then, the vulnerability type of each vulnerability is looked up in the vulnerability type index table to find its corresponding position, and the corresponding position is assigned a value of 1 and the remaining positions are assigned a value of 0 to generate a corresponding vulnerability type vector; the port number and the protocol type are processed in the same way to respectively generate a port number vector and a protocol type vector;
[0074] Finally, the three vectors are sequentially spliced into a unified static feature sub-vector, which is represented as: , wherein represents the static feature sub-vector, is the encoding vector of the vulnerability type, is the encoding vector of the port number, is the encoding vector of the protocol type, and the overall splicing constitutes a fixed-dimension binary vector.
[0075] S22: obtaining the business level, network exposure state and patch update time of the vulnerability associated asset, respectively converting them into standardized numerical values to constitute the dynamic environment sub-vector ;
[0076] S23: splicing the static feature sub-vector and the dynamic environment sub-vector to generate a complete feature vector of each vulnerability The above step quantitatively processes different types of vulnerability information through a unified vector construction method, ensures that subsequent similarity calculation has a consistent structure and clear dimension input basis, and improves the accuracy and consistency of vulnerability aggregation.
[0077] S22 specifically includes:
[0078] S221: Through matching with the asset database associated with the vulnerability, the business level, network exposure state and patch update time of the asset are extracted, wherein the business level is defined by a preset rule as a level value of 1 to 5, the network exposure state is marked as 1 (public network) or 0 (internal network) according to whether the asset is exposed to the public network, and the patch update time is recorded as the timestamp of the last patch update time;
[0079] S222: The business level is directly used as a numerical feature , the network exposure state is assigned as a binary feature , and the time difference (in days) between the patch update time and the current time is calculated as a third feature , wherein the formula is: , wherein, is the current time; is the patch update time; 86400 is the number of seconds in a day, used to convert seconds to days;
[0080] S223: The three feature values are standardized by the Z-Score method , and the three standardized results are spliced into a dynamic environment sub-vector , wherein, is the standardized business level, is the standardized network exposure state, is the standardized patch update time interval.
[0081] The calculation formula for standardization is: , wherein, is the mean of the th feature, is the standard deviation, is the standardized value; the above step introduces structured asset information extraction and unified standardization calculation process, converts different types of environment attributes into comparable numerical features, and forms a standardized dynamic environment sub-vector.
[0082] S3: Calculate the environment weight factor based on the properties of the asset where the vulnerability is located, including the asset value coefficient, the exposure surface coefficient and the repair cost coefficient.
[0083] S3 specifically includes:
[0084] S31: Obtain the business weight label of the asset to which the vulnerability belongs, network topology information, and system configuration list, wherein the business weight label identifies the criticality of the asset in the overall business process, the network topology information reflects its exposure state in the public network or intranet, and the system configuration list contains repair tool complexity and estimated time consumption information, including the number of manual repair steps, average repair time consumption, and required resource level;
[0085] S32: Set the asset value coefficient according to the business weight label , the value range of which is , and it is mapped to the corresponding numerical value according to the preset five-level business importance level;
[0086] Table 1: Five-level business importance level mapping table
[0087] Business Class Levels Typical Application Examples Asset Value Coefficient Level 1 (Highest) Financial Settlement, Core Trading System 1 Level 2 User Authentication, Order Management System 0.8 Level 3 Internal Reporting, Task Assignment System 0.6 Level 4 Training System, Forum System 0.4 Level 5 (Lowest) Test Environment, Development Environment 0.2
[0088] The above table 1 provides a clear quantitative basis for the calculation of the asset value coefficient in the vulnerability environment weight factor, which helps to realize the automation, structuring and consistency of vulnerability risk assessment.
[0089] S33: According to the exposure range of the asset in the network topology, set the exposure surface coefficient , the value of which is calculated according to the number of external nodes connected by the network boundary, and the expression is: , wherein represents the number of public networks or reachable external nodes connected by the asset, is the number of all nodes in the network;
[0090] S34: According to the number of manual repair steps , the average repair time , and the required resource level in the system configuration list, calculate the repair cost coefficient , the calculation expression of which is: , wherein is a normalization constant for normalizing the repair cost coefficient to the interval ; finally, , , is output as the environment weight factor for vulnerability comprehensive assessment and repair priority allocation; the above steps form a structured environment weight factor set by combining the business importance of the asset, the network exposure degree, and the repair resource consumption, so that the vulnerability can fully reflect its potential impact on the business in subsequent similarity calculation and risk clustering, improving the accuracy and difference recognition ability of the vulnerability assessment model.
[0091] S4: According to the feature vector of S2 and the environment weight factor of S3, calculate the comprehensive similarity score between any two vulnerabilities;
[0092] S4 specifically comprises:
[0093] S41: Obtain the feature vectors of any two vulnerabilities to be compared, respectively denoted as and The feature vector is composed of a static feature sub-vector and a dynamic environment sub-vector, and has consistent dimensions;
[0094] S42: Calculate the Euclidean distance between the feature vectors of the two vulnerabilities to be compared , which represents the difference in basic attributes, and the formula is: wherein, is the vector distance between the i-th and j-th vulnerabilities, and represent the values of the two vectors in the i-th dimension, is the total dimension of the feature vector; S43: Extract the environment weight factors corresponding to the two vulnerabilities, respectively denoted as and , and calculate the average weight coefficient
[0095] , the expression is: ; wherein each weight factor is composed of an asset value coefficient , an exposure coefficient , and a repair cost coefficient S44: Combine the Euclidean distance and the average environment weight coefficient to calculate the comprehensive similarity score , the expression is:
[0096] ; the above steps consider both attribute similarity and risk impact by combining feature space distance and environment weight factor to measure the similarity between vulnerabilities, improve the accuracy of risk assessment and the rationality of subsequent vulnerability merging and repair sorting. S5: Based on the comprehensive similarity score, dynamically aggregate the vulnerabilities to generate multiple vulnerability clusters, each representing different forms of the same risk entity;
[0097] S5 specifically comprises:
[0098] S51: Construct the comprehensive similarity scores between all pairs of vulnerabilities into a symmetric similarity matrix, each element in the matrix corresponding to the similarity between a pair of vulnerabilities;
[0099] S51: Construct the comprehensive similarity scores between all pairs of vulnerabilities into a symmetric similarity matrix, each element in the matrix corresponding to the similarity between a pair of vulnerabilities;
[0100] S52: Set a similarity threshold, if the similarity score between two vulnerabilities is greater than the similarity threshold, they are divided into the same initial clustering group; repeat the traversal of all vulnerability pairs to obtain multiple initial clustering groups;
[0101] S53: On the basis of initial clustering, adopt a step-by-step merging strategy until all clustering groups do not overlap with each other, forming a final vulnerability cluster set;
[0102] S54: Assign a unique identifier to each generated vulnerability cluster, and use it as a representative of multiple forms of the same risk object for subsequent report merging and repair scheduling processing; the above steps dynamically aggregate based on the comprehensive similarity score, and introduce a similarity threshold control and cross-member merging mechanism, so that vulnerabilities with high correlation can be grouped into the same clustering cluster, realizing the centralized merging and management of homologous and high-risk vulnerabilities, and improving the concentration and effectiveness of vulnerability management strategies.
[0103] S53 specifically includes:
[0104] S531: Traverse all initial clustering groups in turn, check whether there are the same vulnerability records in any two clustering groups, that is, judge whether a vulnerability appears in two different clustering groups at the same time;
[0105] S532: For clustering groups with the same vulnerability records, merge all vulnerabilities of the two clustering groups to generate a new clustering group, and replace the original two groups;
[0106] S533: Continue to traverse and merge the new clustering results until the vulnerabilities between all clustering groups are no longer repeated, and finally obtain a set of independent and non-overlapping vulnerability clusters; the above steps can effectively eliminate the cross problem between clustering boundaries by merging clustering groups containing repeated vulnerabilities, ensuring that each vulnerability belongs to only one determined vulnerability cluster, and enhancing the independence of clustering results and the clarity of vulnerability merging.
[0107] S6: Merge the vulnerabilities in each vulnerability cluster to generate a simplified vulnerability report, and assign a repair priority according to the highest environment weight factor in the cluster;
[0108] S6 specifically includes:
[0109] S61: Merge all vulnerability information in each vulnerability cluster, extract the same vulnerability attribute items, including vulnerability name, affected port range, protocol type and vulnerability cause summary, and integrate them into the representative information of the vulnerability cluster in a unified format, remove redundant descriptions, and generate structured simplified vulnerability content;
[0110] S62: In each vulnerability cluster, extract the environmental weight factor corresponding to each vulnerability, compare them, and select the vulnerability with the highest weight factor value as the representative vulnerability of the corresponding cluster.
[0111] S63: Determine the remediation priority of vulnerability clusters based on the environmental weight factors representing vulnerabilities, and attach priority tags to the simplified vulnerability report as the basis for remediation scheduling and resource allocation;
[0112] S64: Output a simplified vulnerability report for each vulnerability cluster, including merged information fields, representative vulnerabilities, and remediation priority levels. The above steps avoid duplicate remediation and resource waste by merging and uniformly extracting information within the same vulnerability cluster. At the same time, the order of remediation is determined based on the highest environmental weight factor, which enhances the pertinence and efficiency of vulnerability response and enables a more refined risk management strategy.
[0113] S63 specifically includes:
[0114] S631: Set priority level classification standards, divide environmental weight factors into three ranges: high, medium and low, which correspond to high priority, medium priority and low priority repair labels respectively;
[0115] S632: Determine the environmental weighting factor representing the vulnerability The numerical range in which it falls, and based on this, the priority of patching the vulnerability clusters is determined. Specifically, if... If it is, then it is given high priority; if If it is, then assign it medium priority; if If so, assign it a lower priority;
[0116] Environmental weighting factor The mathematical expression is: ,in, Environmental weighting factor, with a range of values. ; These are the weight parameters corresponding to the three types of coefficients, and they satisfy... ;
[0117] S633: Write the corresponding priority label as field information into the simplified vulnerability report of the vulnerability cluster; the above steps, by setting clear weight classification thresholds, automatically mark vulnerability clusters as different remediation priorities according to risk level, which helps to achieve risk-oriented task allocation based on limited resources in actual operation and maintenance, and improve the scientificity and timeliness of vulnerability response.
[0118] The present application encompasses any alternatives, modifications, equivalent methods and solutions made to the essence and scope of the present application. In order to make the public have a thorough understanding of the present application, specific details are described in the following preferred embodiments of the present application, and the present application can also be fully understood without the description of these details to those skilled in the art. In addition, in order to avoid unnecessary confusion to the essence of the present application, well-known methods, processes, procedures, elements and circuits, etc. are not described in detail.
[0119] The above is only the preferred embodiment of the present application, and it should be pointed out that for ordinary skilled in the art, without departing from the principles of the present application, a number of improvements and refinements can also be made, which should be considered as the protection scope of the present application.
Claims
1. A method of handling information security vulnerabilities, characterized by, The method comprises the following steps: S1: obtaining original vulnerability scanning data and extracting a basic attribute set of each vulnerability; S2: generating a feature vector of each vulnerability according to the basic attribute set, wherein the feature vector comprises a static feature sub-vector and a dynamic environment sub-vector; S3: calculating an environment weight factor based on the attributes of the asset where the vulnerability is located, wherein the environment weight factor comprises an asset value coefficient, an exposure surface coefficient and a repair cost coefficient; S4: calculating a comprehensive similarity score between any two vulnerabilities according to the feature vector of S2 and the environment weight factor of S3; S5: dynamically aggregating the vulnerabilities based on the comprehensive similarity score to generate a plurality of vulnerability clusters; S6: merging the vulnerabilities in each vulnerability cluster to generate a simplified vulnerability report, and assigning a repair priority according to the highest environment weight factor in the cluster.
2. The method of claim 1, wherein, The S1 specifically comprises: S11: receiving original vulnerability scanning data output by a preset security scanning tool, wherein the security scanning tool comprises a network layer scanner and a system layer vulnerability scanner, which are respectively used to collect vulnerability information in a network communication interface and a system service module; S12: analyzing each vulnerability record in the original vulnerability scanning data to extract a corresponding basic attribute set, wherein the basic attribute set comprises a vulnerability type field, a port number field and a protocol type field.
3. The method of claim 1, wherein the method further comprises: The S2 specifically comprises: S21: Numerical encoding is performed on the vulnerability type, port number, and protocol type to convert them into a fixed-dimension binary vector to form a static feature sub-vector ; S22: Obtain the business level, network exposure state and patch update time of the vulnerability associated asset, respectively convert them into standardized numerical values to form a dynamic environment sub-vector ; S23: splice the static feature sub-vector and the dynamic environment sub-vector feature to generate a complete feature vector of each vulnerability .
4. The method of claim 3, wherein, The S22 specifically comprises: S221: extracting the business level, network exposure state and patch update time of the asset by matching with an asset database associated with the vulnerability; S222: directly taking the service level as a numerical feature , and taking the network exposure state as a binary feature , and taking the time difference between the patch update time and the current time as a third feature ; S223: Standardize the three eigenvalues by Z-Score method The three standardized results are spliced into the dynamic environment sub-vector .
5. The method of claim 1, wherein, The S3 specifically comprises: S31: obtaining a business weight label, network topology information and system configuration list of the asset to which the vulnerability belongs; S32: setting asset value coefficient according to business weight label , the value range of which is , and is mapped to corresponding numerical value according to preset five-level business importance grade. S33: Set the exposure surface coefficient according to the exposure range of the asset in the network topology , the expression is: , wherein, represents the number of public networks or reachable external nodes connected by the asset, is the number of all nodes in the network; S34: Number of manual repair steps according to the system configuration checklist , average repair duration and required resource level , a repair cost coefficient is calculated , whose calculation expression is: , wherein is a normalization constant.
6. The method of claim 1, wherein, The S4 specifically comprises: S41: Obtain the feature vectors of any two vulnerabilities to be compared, respectively denoted as and ; S42: Calculate the Euclidean distance between two vulnerability feature vectors to be compared ; S43: Extract the environmental weight factors corresponding to the two vulnerabilities, and calculate the average weight coefficient thereof ; S44: Combining the Euclidean distance with the average environmental weight coefficients to calculate the comprehensive similarity score The expression is: .
7. The method of claim 1, wherein the method further comprises: The S5 specifically comprises: S51: constructing the comprehensive similarity scores between all pairs of vulnerabilities into a symmetric similarity matrix, wherein each element in the matrix corresponds to the similarity between a pair of vulnerabilities; S52: setting a similarity threshold, and if the similarity score between two vulnerabilities is greater than the similarity threshold, the two vulnerabilities are divided into the same initial clustering group; all pairs of vulnerabilities are repeatedly traversed to obtain a plurality of initial clustering groups; S53: based on the initial clustering, a step-by-step merging strategy is adopted until all clustering groups do not overlap with each other, forming a final vulnerability cluster set; S54: assigning a unique identifier to each generated vulnerability cluster, and using the unique identifier as a plurality of forms representing the same risk object.
8. The method of claim 7, wherein the method further comprises: The S53 specifically comprises: S531: traversing all initial clustering groups in turn to check whether there are the same vulnerability records in any two clustering groups, that is, to determine whether a vulnerability appears in two different clustering groups at the same time; S532: for the clustering groups with the same vulnerability records, all vulnerabilities of the two clustering groups are merged to generate a new clustering group, which replaces the original two groups; S533: the new clustering result is continuously traversed and merged until the vulnerabilities in all clustering groups are no longer repeated, and finally a vulnerability cluster set is obtained.
9. The method of claim 1, wherein, The S6 specifically comprises: S61: merging all vulnerability information in each vulnerability cluster to extract the same vulnerability attribute items, including vulnerability name, affected port range, protocol type and vulnerability cause summary; S62: In each vulnerability cluster, the environmental weight factor corresponding to each vulnerability is extracted respectively, compared, and the vulnerability with the highest weight factor value is selected as the representative vulnerability of the corresponding cluster; S63: According to the environmental weight factor of the representative vulnerability, the repair priority of the vulnerability cluster is determined, and the priority label is attached to the simplified vulnerability report; S64: Output the corresponding simplified vulnerability report of each vulnerability cluster, including the merged information field, the representative vulnerability and the repair priority level.
10. The method of claim 9, wherein, The S63 specifically comprises: S631: Set the priority level division standard, divide the environmental weight factor into three interval ranges corresponding to high, medium and low priority repair labels respectively; S632: judging the environmental weight factor representing the vulnerability the numerical interval, and determining the repair priority of the vulnerability cluster according to the numerical interval. Specifically, if , a high priority is given; if , a medium priority is given; if , a low priority is given. S633: The corresponding priority label is written into the simplified vulnerability report of the vulnerability cluster as field information.