Digital asset vulnerability detection method and system
By performing natural language processing and random forest or knowledge graph analysis on the log information of digital assets, vulnerabilities are identified, solving the problems of strong dependence and high false positive rate of traditional scanners, and achieving fast and accurate vulnerability detection.
Patent Information
- Application Number
- CN202511341387.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-09-19
- Publication Date
- 2026-01-02
AI Technical Summary
Existing digital asset vulnerability detection methods rely on scanners, which can lead to false positives, high network bandwidth consumption, and limitations imposed by network security policies. They are also not timely enough to detect vulnerabilities promptly.
By examining the log information of digital assets, natural language processing technology is used to identify asset information. A vulnerability identification model is built by combining random forests and knowledge graphs, which reduces the probability of false positives, saves network bandwidth, and enables rapid detection without being restricted by network security policies.
It enables timely vulnerability detection, reduces the probability of false positives, saves network bandwidth, avoids the limitations of traditional scanners, and improves the accuracy and efficiency of detection.
Smart Images
Figure CN121256804A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the field of vulnerability detection, in particular to a digital asset vulnerability detection method and system. BACKGROUND
[0002] Digital asset vulnerability refers to defects or weaknesses in an enterprise's computer system, application program or network protocol. These defects can be exploited by attackers to access, tamper with or destroy digital assets in an unauthorized manner, resulting in serious consequences such as data leakage, service interruption and economic loss.
[0003] Typically, enterprises need to periodically detect vulnerabilities in digital assets to ensure that digital assets meet security baselines. Traditional vulnerability detection methods usually use scanners based on feature rules to compare. The scanner sends a probe data packet containing a certain vulnerability feature at regular intervals, and then determines whether the vulnerability exists based on the comparison results returned. This approach has the following disadvantages: the effectiveness of vulnerability detection on digital assets depends entirely on the functionality of the scanner, which may result in false positives; the scanner itself consumes a large amount of network bandwidth and is easily limited by network security policies; and it is not timely, as the speed of vulnerability discovery depends on the frequency of active vulnerability scanning, and it is impossible to know whether a vulnerability has occurred between two active scans.
[0004] Therefore, there is an urgent need for a more effective digital asset vulnerability detection method that can more accurately identify vulnerabilities, complete vulnerability detection more quickly, discover vulnerabilities in a timely manner, and reduce network bandwidth usage, making vulnerability detection less susceptible to network security policies. SUMMARY
[0005] In view of the above-mentioned deficiencies in the prior art, the present application provides a digital asset vulnerability detection method that detects log information of digital assets, identifies asset information based on natural language processing technology, and then uses random forests and knowledge graphs for vulnerability detection, which can timely detect vulnerabilities and reduce the probability of false positives, while eliminating the need for scanners to send probe data packets, saving network bandwidth and making the detection method less susceptible to network security policies.
[0006] To achieve the above-mentioned objectives, embodiments of the present application use the following technical solutions:
[0007] A digital asset vulnerability detection method, comprising the following steps:
[0008] Obtaining log information of the digital asset to be detected;
[0009] Identifying asset information based on natural language processing technology according to the log information;
[0010] Constructing a vulnerability identification model based on random forests and / or knowledge graphs;
[0011] Detecting the asset information by using the vulnerability identification model to obtain a vulnerability detection result.
[0012] According to an aspect of the present application, the asset information is identified based on natural language processing technology according to the log information, and the asset information includes:
[0013] The asset information identification model is constructed based on the BERT model, semantic analysis of the log information is performed to extract entities, and the asset information is obtained.
[0014] According to an aspect of the present application, the asset information identification model is constructed based on the BERT model, and the asset information identification model includes:
[0015] The historical asset information is obtained, and the asset information identification model is trained.
[0016] The asset information database is constructed, and the asset information identification model is dynamically updated.
[0017] According to an aspect of the present application, the vulnerability identification model is constructed based on the random forest, and the vulnerability identification model includes:
[0018] The historical vulnerability information and the historical asset information are obtained.
[0019] The random forest is trained by using the historical vulnerability information and the historical asset information to obtain the vulnerability identification model.
[0020] According to an aspect of the present application, the asset information is detected by using the vulnerability identification model to obtain a vulnerability detection result, and the vulnerability detection result includes:
[0021] The asset information is detected by using the vulnerability identification model to obtain vulnerability information and a confidence level.
[0022] The vulnerability information is screened based on a preset confidence level threshold to obtain a vulnerability detection result.
[0023] According to an aspect of the present application, the vulnerability identification model is constructed based on the knowledge graph, and the vulnerability identification model includes:
[0024] The historical vulnerability information and the historical asset information are obtained.
[0025] The asset vulnerability unified graph is constructed according to the historical vulnerability information and the historical asset information.
[0026] According to an aspect of the present application, the asset information is detected by using the vulnerability identification model to obtain a vulnerability detection result, and the vulnerability detection result includes:
[0027] The asset information is detected by using the asset vulnerability unified graph to obtain corresponding vulnerability information and a confidence level.
[0028] The vulnerability information is filtered based on a preset confidence threshold to obtain a vulnerability detection result.
[0029] According to an aspect of the present application, the vulnerability identification model is constructed based on the random forest and the knowledge graph:
[0030] The historical vulnerability information and the historical asset information are obtained.
[0031] The historical vulnerability information and the historical asset information are used to train the random forest to obtain a first vulnerability detection model.
[0032] The asset vulnerability unified graph is constructed according to the historical vulnerability information and the historical asset information.
[0033] According to an aspect of the present application, the vulnerability detection result is obtained by detecting the asset information using the vulnerability identification model, and the method comprises:
[0034] The asset information is detected using the first vulnerability detection model to obtain first vulnerability information and a first confidence.
[0035] The asset information is detected using the asset vulnerability unified graph to obtain second vulnerability information and a second confidence.
[0036] The first vulnerability information and the first confidence, the second vulnerability information and the second confidence are integrated to obtain an optimized vulnerability detection result.
[0037] A digital asset vulnerability detection system based on the digital asset vulnerability detection method described above comprises:
[0038] A log acquisition module is configured to acquire log information of a digital asset to be detected.
[0039] An asset identification module is configured to identify asset information based on natural language processing technology according to the log information.
[0040] A model construction module is configured to construct a vulnerability identification model based on a random forest or / and a knowledge graph.
[0041] A vulnerability detection module is configured to detect the asset information using the vulnerability identification model to obtain a vulnerability detection result.
[0042] The present application has the following advantages:
[0043] The present application provides a digital asset vulnerability detection method, which detects log information of a digital asset, identifies asset information based on natural language processing technology, and then detects vulnerabilities using a random forest and a knowledge graph, so that vulnerabilities can be found in time, the probability of false judgment of vulnerabilities is reduced, and the network bandwidth is saved because there is no need to send detection data packets by a scanner, so that the detection method is not limited by network security policies. BRIEF DESCRIPTION OF DRAWINGS
[0044] In order to make the technical solutions in the embodiments of the present application clearer, the drawings needed in the embodiments will be briefly introduced as follows. Obviously, the drawings described in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without any creative effort on the basis of these drawings.
[0045] Figure 1 A flowchart of a digital asset vulnerability detection method according to the first embodiment of the present application;
[0046] Figure 2 A flowchart of a digital asset vulnerability detection method according to the second embodiment of the present application;
[0047] Figure 3 A flowchart of a digital asset vulnerability detection method according to the third embodiment of the present application. DETAILED DESCRIPTION
[0048] The technical solutions in the embodiments of the present application will be described clearly and completely with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without any creative effort belong to the scope of protection of the present application.
[0049] Embodiment one
[0050] As shown in the figure, a digital asset vulnerability detection method includes the following steps: Figure 1
[0051] S1: Obtain log information of a digital asset to be detected.
[0052] The computer system, application program or network protocol of an enterprise and other digital assets will generate log information in daily work. The log information will contain corresponding asset information, and some vulnerabilities will invade the digital assets according to specific asset information and cause damage to them. According to the asset information contained in the log, the detection and identification of vulnerabilities can be performed.
[0053] S2: According to the log information, identify the asset information based on natural language processing technology.
[0054] In practical applications, the model of natural language processing technology can be used to perform semantic analysis on the log information, and extract the asset information contained therein. The specific model includes BERT, BiLSTM-CRF combination, Lattice LSTM, hidden Markov model, etc.
[0055] Preferably, step S2 can construct an asset information recognition model based on a BERT model, perform semantic analysis on the log information to extract entities, and obtain asset information.
[0056] BERT is a pre-training language model for bidirectional context modeling. The core structure of BERT is stacked by multiple layers of bidirectional Transformer encoders, which capture the bidirectional context information of the text through self-attention mechanisms and feedforward neural networks. Traditional models (such as GPT) usually use unidirectional encoding (from left to right or from right to left), while BERT can capture the left and right context information of each word in the sentence through the self-attention mechanism of Transformer, thus more accurately understanding the semantics.
[0057] Collect historical log texts from system logs, network device logs, application logs, etc. and mark the asset information in the logs.
[0058] Split the input text into Tokens according to the BERT vocabulary (such as WordPiece). Insert [CLS] (classification mark) at the beginning of the text and [SEP] (separation mark) between sentences or paragraphs to distinguish different sentences or paragraphs. Concatenate subwords, position information, and segment information (if processing multiple sentences) into input vectors and input into the BERT model. Connect the top layer of BERT to a Token classification layer (fully connected layer + Softmax) to output the entity category of each Token.
[0059] Use the annotated historical log texts to train the BERT model and obtain a trained asset information recognition model, which can be used for asset information recognition on current log information.
[0060] Preferably, an asset information library can also be constructed to store the latest asset information in the library and dynamically update the asset information recognition model.
[0061] Preferably, the extracted asset information can also be verified using regular expressions, context rules, etc.
[0062] S3: Construct a vulnerability recognition model based on random forest.
[0063] Specifically, step S3 includes:
[0064] Obtain historical vulnerability information and historical asset information.
[0065] Train the random forest using the historical vulnerability information and historical asset information to obtain a vulnerability recognition model.
[0066] Process the historical vulnerability information and historical asset information into feature data that can be used to train the random forest.
[0067] The random forest is composed of multiple decision trees, each of which is independently trained and votes. Each tree generates a splitting rule according to asset features and vulnerability features, and finally outputs a vulnerability category by majority voting of the prediction results of all trees. The number of votes is divided by the total number of trees to obtain the probability of the vulnerability category, that is, the confidence.
[0068] S4: detecting the asset information by using the vulnerability identification model to obtain a vulnerability detection result.
[0069] Specifically, step S4 includes:
[0070] S41: detecting the asset information by using the vulnerability identification model to obtain vulnerability information and confidence;
[0071] S42: filtering the vulnerability information based on a preset confidence threshold to obtain a vulnerability detection result.
[0072] A confidence threshold can be set, for example, 50%, and when the detected vulnerability information is higher than the confidence threshold, it is considered to be credible and there is indeed a vulnerability of this category; otherwise, it is considered that there is no vulnerability, and the vulnerability information is discarded.
[0073] The beneficial effects of the embodiment are that the method detects the log information of the digital asset, identifies the asset information based on the natural language processing technology, and detects the vulnerability by using the random forest, which can timely discover the vulnerability and reduce the vulnerability misjudgment probability, and at the same time, no longer needs the scanner to send a detection data packet, saves the network bandwidth, and makes the detection method not limited by the network security policy.
[0074] Embodiment two
[0075] As shown in Figure 2 A digital asset vulnerability detection method includes the following steps:
[0076] S1: obtaining log information of a digital asset to be detected.
[0077] The digital assets such as computer systems, application programs, or network protocols of an enterprise will generate log information in daily work, and the log information will contain corresponding asset information. Some vulnerabilities will invade digital assets and cause damage according to specific asset information. According to the asset information contained in the log, the vulnerability detection and identification can be performed.
[0078] S2: identifying asset information based on natural language processing technology according to log information.
[0079] In practical applications, natural language processing models can be used to perform semantic analysis on log information and extract the asset information contained therein. Specific models include: BERT, BiLSTM-CRF combination, Lattice LSTM, Hidden Markov Model, etc.
[0080] Preferably, step S2 can be based on the BERT model to build an asset information identification model, perform semantic analysis on log information to extract entities, and obtain asset information.
[0081] BERT is a pre-trained language model that models bidirectional context. BERT's core structure consists of multiple layers of bidirectional Transformer encoders stacked together, capturing bidirectional contextual information of text through self-attention mechanisms and feedforward neural networks. Traditional models (such as GPT) typically employ unidirectional encoding (from left to right or from right to left), while BERT, through the Transformer's self-attention mechanism, can simultaneously capture the left and right contextual information of each word in a sentence, thus understanding semantics more accurately.
[0082] Historical log text is collected from sources such as system logs, network device logs, and application logs, and asset information is labeled on the logs.
[0083] The input text is segmented into tokens according to BERT's vocabulary (e.g., WordPiece). [CLS] (classification tags) are inserted at the beginning of the text, and [SEP] (separator tags) are inserted between sentences to distinguish different sentences or paragraphs. Sub-word, positional, and paragraph information (if processing multiple sentences) are concatenated into an input vector, which is then fed into the BERT model. A token classification layer (fully connected layer + Softmax) is then connected to the top layer of BERT to output the entity category of each token.
[0084] By using labeled historical log text, the BERT model is trained to obtain a trained asset information recognition model, which can be used to identify asset information from current log information.
[0085] Preferably, an asset information database can also be constructed to store the latest asset information and dynamically update the asset information identification model.
[0086] Preferably, the extracted asset information can also be verified using regular expressions, context rules, and other methods.
[0087] S3: Building a vulnerability identification model based on knowledge graphs.
[0088] Specifically, step S3 includes:
[0089] Obtain historical vulnerability information and historical asset information;
[0090] According to historical vulnerability information and historical asset information, an asset vulnerability unified graph is constructed.
[0091] According to historical data, asset, vulnerability entities and relationships are defined, and an asset vulnerability unified graph is constructed.
[0092] Generally, the asset entity includes the following information: including unique identification (such as asset ID), IP address, operating system, software version, network area, etc.
[0093] The vulnerability entity includes the following information: including unique identification (such as number), score, vulnerability type (such as SQL injection), impact range (such as operating system version range), etc.
[0094] The relationship between assets and vulnerabilities includes:
[0095] Asset-vulnerability association: for example, asset A has vulnerability X.
[0096] Vulnerability-vulnerability dependency: for example, vulnerability X is a prerequisite for vulnerability Y.
[0097] Asset-asset relationship: for example, asset A communicates with asset B through port 22.
[0098] According to the association relationship in the asset vulnerability unified graph, the relationship between digital assets and vulnerabilities can be found, and when given new asset information, the asset vulnerability unified graph can be used to associate to the corresponding vulnerability information.
[0099] A confidence level can also be set, and a basic confidence level is set according to the distance of the association relationship. On the basis of the confidence level, a time decay factor is added, and the longer the vulnerability is found, the confidence level decays exponentially (such as 10% decay every 30 days).
[0100] S4: detecting the asset information by using the vulnerability identification model to obtain a vulnerability detection result.
[0101] Specifically, step S4 includes:
[0102] S41: detecting the asset information by using the asset vulnerability unified graph to obtain corresponding vulnerability information and a confidence level;
[0103] S42: filtering the vulnerability information based on a preset confidence level threshold to obtain a vulnerability detection result.
[0104] A confidence level threshold can be set, for example, 50%. When the detected vulnerability information is higher than the confidence level threshold, it is considered to be credible, and there is indeed a vulnerability of this category; otherwise, it is considered that there is no vulnerability, and the vulnerability information is discarded.
[0105] The embodiment has the beneficial effects that the method utilizes the knowledge graph to identify and detect the vulnerabilities, can timely find the vulnerabilities, and reduces the vulnerability misjudgment probability.
[0106] Embodiment three
[0107] As shown in Figure 1 A digital asset vulnerability detection method, comprising the following steps:
[0108] S1: Obtain the log information of the digital asset to be detected.
[0109] The digital assets such as computer systems, application programs or network protocols of enterprises will generate log information in daily work, and the log information will contain corresponding asset information. Some vulnerabilities will invade digital assets and cause damage according to specific asset information. According to the asset information contained in the log, the detection and identification of vulnerabilities can be carried out.
[0110] S2: According to the log information, the asset information is identified based on natural language processing technology.
[0111] In practical application, the model of natural language processing technology can be used to perform semantic analysis on the log information, and extract the asset information contained therein. The specific model includes BERT, BiLSTM-CRF combination, Lattice LSTM, hidden Markov model, etc.
[0112] Preferably, step S2 can construct an asset information identification model based on the BERT model, perform semantic analysis on the log information to extract entities, and obtain asset information.
[0113] BERT is a bidirectional context modeling pre-training language model. The core structure of BERT is stacked by multiple layers of bidirectional Transformer encoders, which can capture the bidirectional context information of the text through the self-attention mechanism and the feedforward neural network. Traditional models (such as GPT) usually use unidirectional encoding (from left to right or from right to left), while BERT can capture the left and right context information of each word in the sentence through the self-attention mechanism of Transformer, thereby more accurately understanding the semantics.
[0114] Collect historical log texts from system logs, network device logs, application logs and other sources, and label the asset information of the logs.
[0115] The input text is segmented into Tokens according to the BERT vocabulary (such as WordPiece). A [CLS] (classification mark) is inserted at the beginning of the text, and a [SEP] (separation mark) is inserted between sentences or paragraphs to distinguish different sentences or paragraphs. The subword, position information and segment information (if processing multiple sentences) are concatenated into an input vector and input into the BERT model. The top layer of BERT is connected to a Token classification layer (fully connected layer + Softmax) to output the entity category of each Token.
[0116] The annotated historical log text is used to train the BERT model to obtain a trained asset information recognition model, which can be used for asset information recognition of current log information.
[0117] Preferably, an asset information library can also be constructed to store the latest asset information in the library and dynamically update the asset information recognition model.
[0118] Preferably, the extracted asset information can also be verified by using regular expressions, context rules, etc.
[0119] S3: Build a vulnerability recognition model based on random forest and knowledge graph.
[0120] Specifically, step S3 includes:
[0121] Obtain historical vulnerability information and historical asset information;
[0122] Train the random forest using the historical vulnerability information and the historical asset information to obtain a first vulnerability detection model;
[0123] Construct an asset vulnerability unified graph based on the historical vulnerability information and the historical asset information.
[0124] (1) Construct a first vulnerability detection model based on random forest
[0125] The historical vulnerability information and the historical asset information are processed into feature data that can be used to train the random forest.
[0126] The random forest is composed of multiple decision trees, each of which is trained independently and votes. Each tree generates a splitting rule according to asset features and vulnerability features, and finally outputs the vulnerability category obtained by majority voting of the prediction results of all trees. The number of votes is divided by the total number of trees to obtain the probability of the vulnerability category, i.e. the confidence.
[0127] (2) Construct an asset vulnerability unified graph
[0128] According to the historical data, the asset, vulnerability entity and relationship are defined to construct an asset vulnerability unified graph.
[0129] Generally, the asset entity includes the following information: containing a unique identifier (such as asset ID), IP address, operating system, software version, network area, etc.
[0130] The vulnerability entity includes the following information: containing a unique identifier (such as number), score, vulnerability type (such as SQL injection), impact range (such as operating system version range), etc.
[0131] The relationship between assets and vulnerabilities includes:
[0132] Asset-vulnerability association: for example, asset A has vulnerability X.
[0133] Vulnerability-vulnerability dependency: for example, vulnerability X is a prerequisite for exploiting vulnerability Y.
[0134] Asset-asset relationship: for example, asset A communicates with asset B through port 22.
[0135] According to the association relationship in the asset vulnerability unified graph, the relationship between digital assets and vulnerabilities can be found, and when new asset information is given, the asset vulnerability unified graph can be used to associate to the corresponding vulnerability information.
[0136] A confidence level can also be set, and a basic confidence level can be set according to the distance of the association relationship. On the basis of the confidence level, a time decay factor is added, and the longer the time of vulnerability discovery, the confidence level decays exponentially (such as 10% decay every 30 days).
[0137] S4: detecting the asset information by using the vulnerability identification model to obtain a vulnerability detection result.
[0138] Specifically, step S4 includes:
[0139] S41: detecting the asset information by using the first vulnerability detection model to obtain first vulnerability information and a first confidence level.
[0140] S42: detecting the asset information by using the asset vulnerability unified graph to obtain second vulnerability information and a second confidence level.
[0141] S43: combining the first vulnerability information and the first confidence level, the second vulnerability information and the second confidence level to obtain an optimized vulnerability detection result.
[0142] In practical applications, the vulnerability information obtained from the random forest and the knowledge graph can be sorted according to the confidence level, and provided to the customer for selection. The vulnerability information with higher confidence level is also selected as the final vulnerability detection result.
[0143] In addition, a confidence threshold, for example 50%, can be set, and when the detected vulnerability information is higher than the confidence threshold, it is considered to be credible and the vulnerability of this category actually exists, otherwise, it is considered that there is no vulnerability, and the vulnerability information is discarded.
[0144] The embodiment has the beneficial effects that the method comprehensively utilizes random forest and knowledge graph to identify and detect vulnerabilities, can timely discover vulnerabilities, and reduces the vulnerability misjudgment probability.
[0145] Embodiment four
[0146] A digital asset vulnerability detection system based on the digital asset vulnerability detection method of embodiments one, two or three, comprising:
[0147] A log acquisition module for acquiring log information of the digital asset to be detected;
[0148] An asset identification module for identifying asset information based on natural language processing technology according to the log information;
[0149] A model construction module for constructing a vulnerability identification model based on random forest or / and knowledge graph;
[0150] A vulnerability detection module for detecting the asset information by using the vulnerability identification model to obtain a vulnerability detection result.
[0151] Embodiment five
[0152] A computer program product containing a computer program, which, when executed, implements the steps of the digital asset vulnerability detection method of embodiments one, two or three.
[0153] Embodiment six
[0154] A readable storage medium having the computer program of embodiment four stored thereon, which, when executed, implements the steps of the digital asset vulnerability detection method of embodiments one, two or three.
[0155] The above is only a specific embodiment of the present application, but the protection scope of the present application is not limited thereto, any person skilled in the art can easily think of changes or replacements within the technical scope disclosed by the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.
Claims
1. A method for detecting vulnerabilities in digital assets, characterized in that, Includes the following steps: Obtain log information of the digital assets being inspected; Based on log information, asset information was identified using natural language processing technology; Building vulnerability identification models based on random forests and / or knowledge graphs; The vulnerability detection model is used to detect asset information and obtain vulnerability detection results.
2. The digital asset vulnerability detection method according to claim 1, characterized in that, The process of identifying asset information based on log information and natural language processing technology includes: An asset information identification model is built based on the BERT model. Semantic analysis is performed on log information to extract entities and obtain asset information.
3. The digital asset vulnerability detection method according to claim 2, characterized in that, The asset information identification model based on the BERT model includes: Obtain historical asset information and train the asset information recognition model; Build an asset information database and dynamically update the asset information identification model.
4. The digital asset vulnerability detection method according to claim 1, characterized in that, The vulnerability identification model based on random forest includes: Obtain historical vulnerability information and historical asset information; A vulnerability identification model is obtained by training a random forest using historical vulnerability and asset information.
5. The digital asset vulnerability detection method according to claim 4, characterized in that, The method of using a vulnerability identification model to detect asset information and obtain vulnerability detection results includes: Vulnerability identification models are used to detect asset information and obtain vulnerability information and confidence levels; Based on a preset confidence threshold, vulnerability information is filtered to obtain vulnerability detection results.
6. The digital asset vulnerability detection method according to claim 1, characterized in that, The vulnerability identification model based on knowledge graphs includes: Obtain historical vulnerability information and historical asset information; A unified asset vulnerability map is constructed based on historical vulnerability information and historical asset information.
7. The digital asset vulnerability detection method according to claim 6, characterized in that, The method of using a vulnerability identification model to detect asset information and obtain vulnerability detection results includes: By utilizing a unified asset vulnerability graph, asset information can be detected to obtain corresponding vulnerability information and confidence levels. Based on a preset confidence threshold, vulnerability information is filtered to obtain vulnerability detection results.
8. The digital asset vulnerability detection method according to claim 1, characterized in that, The vulnerability identification model is constructed based on random forest and knowledge graph: Obtain historical vulnerability information and historical asset information; The first vulnerability detection model is obtained by training a random forest using historical vulnerability information and historical asset information. A unified asset vulnerability map is constructed based on historical vulnerability information and historical asset information.
9. The digital asset vulnerability detection method according to claim 8, characterized in that, The method of using a vulnerability identification model to detect asset information and obtain vulnerability detection results includes: The first vulnerability detection model is used to detect asset information and obtain the first vulnerability information and the first confidence level. By utilizing a unified asset vulnerability graph, asset information is detected to obtain secondary vulnerability information and secondary confidence levels. By combining the first vulnerability information and the first confidence level, the second vulnerability information and the second confidence level, optimized vulnerability detection results are obtained.
10. A digital asset vulnerability detection system, characterized in that, The digital asset vulnerability detection method according to any one of claims 1 to 9 includes: The log acquisition module is used to acquire log information of the digital assets being tested. The asset identification module is used to identify asset information based on log information and natural language processing technology. The model building module is used to build vulnerability identification models based on random forests and / or knowledge graphs; The vulnerability detection module is used to detect asset information using a vulnerability identification model and obtain vulnerability detection results.