Vulnerability repair priority evaluation method, system and device and storage medium
By integrating CVSS and EPSS scores, and combining factors such as business system characteristics and asset criticality, a vulnerability remediation decision model is constructed. This model addresses the shortcomings of existing technologies in prioritizing vulnerability remediation, and enables efficient vulnerability remediation and resource allocation.
Patent Information
- Application Number
- CN202511776949.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-28
- Publication Date
- 2026-01-23
AI Technical Summary
In existing technologies, the number of vulnerabilities introduced into software systems through dependency chains is growing exponentially. Existing tools cannot determine the actual reachability and impact of vulnerabilities in a specific system, resulting in development teams lacking effective decision-making basis for prioritizing vulnerability remediation, wasting resources or delaying the remediation of high-risk vulnerabilities, and exposing critical business systems to high-risk threats.
By integrating standardized scores from CVSS and EPSS, and combining them with business system characteristics, asset criticality, historical vulnerability data, and vulnerability introduction path length, a vulnerability remediation decision model is constructed to achieve accurate mapping from general vulnerability scores to business risks, providing scientific decision support.
It achieves a precise mapping from general vulnerability scoring to specific business risks, distinguishes between critical vulnerabilities that must be addressed immediately and low-risk vulnerabilities that can be remedied later, optimizes security resource allocation, improves vulnerability remediation efficiency, and achieves the best balance between security investment and risk management.
Smart Images
Figure CN121389136A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of development security, and specifically to a method, system, device, and storage medium for prioritizing vulnerability remediation. Background Technology
[0002] CVSS (Common Vulnerability Scoring System) scores vulnerabilities based on a set of criteria, assigning each vulnerability a numerical value that indicates its severity. Cybersecurity professionals use this data to determine the level of danger posed by vulnerabilities. The final score for a vulnerability ranges from a maximum of 10 to a minimum of 0.
[0003] EPSS (Exploit Prediction Scoring System) is designed to predict the likelihood of an attacker exploiting a vulnerability within the next 30 days. The score is updated daily to help organizations focus on the highest-risk vulnerabilities. Scores range from 0 to 1. The higher the score, the greater the likelihood of exploitation.
[0004] With the widespread use of open-source components, the number of vulnerabilities introduced into software systems through dependency chains is growing exponentially. Existing technical solutions have significant limitations: Software Composition Analysis (SCA) tools can only provide a list of components and basic vulnerability information, unable to determine the actual reachability and impact of vulnerabilities in a specific system; CVSS scores mainly reflect the general severity of vulnerabilities, while EPSS focuses on assessing the probability of vulnerability exploitation, but both lack consideration of specific risk factors such as system business context and asset criticality. This situation leads development teams to face a large number of vulnerability alerts but lack effective decision-making criteria for prioritizing vulnerability remediation. This results in either a "one-size-fits-all" approach to remediation of all vulnerabilities, wasting resources, or delays in remediating high-risk vulnerabilities due to misjudgment of priorities. More seriously, the lack of accurate priority assessment may expose critical business systems to high-risk vulnerabilities that can be exploited, while limited security resources are consumed in remediating low-risk vulnerabilities. Summary of the Invention
[0005] This invention addresses the shortcomings of existing technologies by providing a vulnerability remediation priority assessment method, system, device, and storage medium. By integrating standardized scores from CVSS and EPSS and combining them with business system characteristics, a more accurate vulnerability remediation decision-making model is constructed. This method incorporates business scenarios, asset criticality, historical vulnerability data, and vulnerability introduction path length, dynamically linking general vulnerability scores with system-specific risk indicators to achieve a precise mapping from "vulnerability score" to "business risk." This method aims to provide security teams with scientific decision support, enabling them to identify high-risk vulnerabilities requiring priority handling based on the actual risk status of the system, thereby optimizing security resource allocation, improving vulnerability remediation efficiency, and achieving the optimal balance between security investment and risk management.
[0006] To achieve the above objectives, the present invention adopts the following technical solution: A vulnerability remediation priority assessment method includes the following steps: Step 1: Collect vulnerability CVSS and EPSS scores, and perform normalization and discrimination enhancement processing; Step 2: Based on the enterprise's risk appetite and asset exposure level, set the weights for CVSS and EPSS scores respectively; calculate the weighted sum to obtain the vulnerability remediation priority score; Step 3: Adaptively adjust the vulnerability remediation priority score based on the real-time impact of the vulnerability; Step 4: Based on the business scenario, asset importance, historical handling of similar vulnerabilities, and vulnerability introduction path length, adjust the overall priority of the vulnerability remediation priority score adjusted in Step 3. Step 5: Classify vulnerabilities based on the priority score of the vulnerability remediation after priority adjustment, and execute corresponding responses for vulnerabilities of different levels.
[0007] To optimize the above technical solution, the specific measures also include: Furthermore, in step one, the normalization and discrimination enhancement processing specifically includes: The original CVSS score was The original EPSS score was For the original CVSS score Divide by 10 to normalize it to [0,1], then use the exponential amplification method to enhance the discrimination of the normalized CVSS score and the original EPSS score. The discrimination index is calculated using the following formula: ; ; In the formula, This is the magnified CVSS score. It is the adjustment index for the CVSS score. This is the magnified EPSS score. It is an adjusted index for the EPSS score.
[0008] Furthermore, step two specifically involves: The initial scoring weights for both the amplified CVSS score and the amplified EPSS score are set to 1. The scoring weights of the amplified CVSS and EPSS scores are adjusted based on the company's risk appetite and asset exposure. Weighted summation yields vulnerability remediation priority scores :
[0009] In the formula, It is the weighted score of the magnified CVSS score. This is the magnified CVSS score. This is the weighted score of the amplified EPSS score. It is the enlarged EPSS score.
[0010] Furthermore, step three specifically involves: The system obtains in real-time the number of times the current vulnerability has been actually observed to be exploited in real network attacks, and calculates an adaptive quantity based on this. : Where C represents the number of times the vulnerability has been actually observed to be exploited. To adjust the coefficients, the adaptive vulnerability remediation priority score calculation method is as follows:
[0011] In the formula, It is an adaptive vulnerability remediation priority score.
[0012] Furthermore, step four specifically involves: Business scenarios involving customer privacy information are designated as high-risk business scenarios, and business scenario modification parameters are applied. The value can be determined as follows:
[0013] Asset Importance Adjustment Parameter The value can be determined as follows:
[0014] The vulnerability affects historical correction parameters. The calculation method is as follows ,in This indicates the historical impact of this type of vulnerability on the current system. One way to determine its value is as follows:
[0015] This indicates the historical economic losses caused to the current system by this type of vulnerability. One way to determine the value is as follows:
[0016] Vulnerability introduction path length correction parameter The value can be determined as follows: When the vulnerability introduces a path length When it is 1, The value is 1, and as the dependency path increases, The value gradually decreases; The correction coefficient is obtained by combining the results. The calculation method is as follows:
[0017] Using correction coefficients Adaptive vulnerability remediation priority scoring The overall priority is adjusted using the following formula:
[0018] In the formula, This is the priority score for the corrected vulnerability fixes.
[0019] Furthermore, step five specifically involves: Based on the revised vulnerability remediation priority scoring Vulnerabilities are classified into five priority levels, from P0 to P4, with P0 being the highest. The timeframe for fixing these vulnerabilities is within 24 hours. The corresponding response actions are: the security team immediately intervenes, initiates the emergency response process, stops affected business functions or systems, the development team suspends current development tasks, reports on the progress of the fix every 2 hours until it is resolved, and penetration testing and code auditing are conducted after the fix is completed. The timeframe for fixing P1 vulnerabilities is within 72 hours. The corresponding response actions are: hotfixes or temporary workarounds are performed during off-peak business hours, patches need to undergo compatibility verification, temporary monitoring and protection measures are implemented before the fix is completed, and the business side needs to confirm the fix time window. The timeframe for fixing a P2 level vulnerability is 14 days. The corresponding response actions are: fix it in line with the iterative update cycle, and the fix plan must be reviewed by the security team and included in the version release checklist. The timeframe for fixing P3 level vulnerabilities is 30 days. The corresponding response actions are: fix them in accordance with the iterative update cycle, integrate them with other functional optimizations, track the fix status regularly, and assess risk changes every quarter. There is no time limit for patching P4 level vulnerabilities. The corresponding response actions are: record vulnerability information to the knowledge base and regularly monitor changes in vulnerability intelligence.
[0020] This invention also proposes a vulnerability remediation priority assessment system, comprising: The score acquisition and preprocessing module is used to collect vulnerability CVSS and EPSS scores and perform normalization and discrimination enhancement processing. The weighting adjustment module is used to set the weights of CVSS and EPSS scores based on the enterprise's risk appetite and asset exposure level; the weighted sum is used to obtain the vulnerability remediation priority score. The adaptive scoring module is used to adaptively adjust the vulnerability remediation priority score based on the real-time impact of the vulnerability. The priority correction module is used to adjust the overall priority of the adaptively adjusted vulnerability remediation priority score by combining business scenarios, asset importance, historical handling of similar vulnerabilities, and vulnerability introduction path length. The classification and strategy formulation module is used to classify vulnerabilities based on the priority score of vulnerability remediation after priority adjustment, and to execute corresponding responses for vulnerabilities of different levels.
[0021] The present invention also proposes an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, it implements the vulnerability remediation priority assessment method as described above.
[0022] The present invention also proposes a computer-readable storage medium storing a computer program that causes a computer to execute the vulnerability remediation priority assessment method described above.
[0023] The beneficial effects of this invention are: (1) It achieves accurate mapping and transformation from general 'vulnerability scoring' to specific 'business risk', solving the problem that the general scoring system does not consider business context; (2) Distinguish between critical vulnerabilities that must be addressed immediately and low-risk vulnerabilities that can be remedied later, so as to achieve precise allocation of security investment; (3) A unified prioritization framework provides a common language for risk decision-making for security, operations and business teams; (4) The rapid decision matrix transforms vulnerability management from relying on experience to a scalable security engineering approach. Attached Figure Description
[0024] Figure 1 This is a flowchart illustrating a vulnerability remediation priority assessment method proposed in this invention. Detailed Implementation
[0025] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.
[0026] Example 1 This invention proposes a method for prioritizing vulnerability remediation, comprising the following steps: Step 1: Collect vulnerability CVSS and EPSS scores, and perform normalization and discrimination enhancement processing; the original CVSS score is... The original EPSS score was Because EPSS and CVSS have different dimensions, the original CVSS score... Divide by 10 to normalize it to [0,1], then use the exponential amplification method to enhance the discrimination of the normalized CVSS score and the original EPSS score. To enhance the discrimination of high-scoring vulnerabilities, the exponential amplification method can be used, as shown in the following formula: ; ; In the formula, This is the magnified CVSS score. It is the adjustment index for the CVSS score. This is the magnified EPSS score. It is an adjusted index for the EPSS score.
[0027] In vulnerability remediation priority assessment, CVSS and EPSS are two core indicators, both of which have a certain degree of authority. Step one combines the two scoring systems to calculate the risk score of the vulnerability itself. However, directly using the raw score has the problem of insufficient differentiation of high-scoring vulnerabilities in CVSS and interference from low-probability vulnerabilities in EPSS. High-threat vulnerabilities are easily overlooked. Enhancing differentiation can widen the gap between high-scoring vulnerabilities, allowing truly serious vulnerabilities (such as CVSS ≥ 9.0) to receive higher priority.
[0028] Step Two: Different companies are willing to take different levels of risk when pursuing their strategic goals; at the same time, their asset exposure levels vary, resulting in different actual risks and different inclinations towards the severity and urgency of vulnerabilities. In calculating vulnerability remediation priority scores, setting the weights for CVSS and EPSS scores based on the company's risk appetite and asset exposure level ensures that the final results better reflect the company's actual situation and avoids misjudging vulnerability risks.
[0029] Based on the enterprise's risk appetite and asset exposure level, the weights of CVSS and EPSS scores are respectively set; the weighted sum is used to obtain the vulnerability remediation priority score; specifically: The initial scoring weights for both the amplified CVSS score and the amplified EPSS score are set to 1. Enterprises with lower risk appetite may prioritize patching vulnerabilities with high CVSS scores, as these vulnerabilities typically imply higher potential harm and greater losses, thus increasing the weight of CVSS. Enterprises with higher risk appetite, however, may focus more on the probability of vulnerabilities being actually exploited, and therefore should appropriately increase the weight of EPSS. System exposure refers to how easily assets are accessed by external attackers. If a system is directly exposed to the public internet, its vulnerability increases. For such highly exposed systems, even with low CVSS scores, the weight of EPSS can be appropriately increased due to the higher risk of exploitation. Conversely, for systems on internal networks with restricted access, CVSS scores may better reflect their true risk, and their weight can be relatively higher.
[0030] The scoring weights of the amplified CVSS and EPSS scores are adjusted based on the company's risk appetite and asset exposure. Weighted summation yields vulnerability remediation priority scores :
[0031] In the formula, It is the weighted score of the magnified CVSS score. This is the magnified CVSS score. This is the weighted score of the amplified EPSS score. It is the enlarged EPSS score.
[0032] Relying solely on preset parameters for vulnerability remediation priority scoring fails to reflect real-time threat changes, leading to remediation delays and expanding the attack window. Adaptive scoring adjustments based on real-time threat intelligence focus on currently exploited vulnerabilities and optimize resource allocation.
[0033] Step 3: Adaptively adjust the vulnerability remediation priority score based on the real-time impact of the vulnerability; specifically: The system obtains in real-time the number of times the current vulnerability has been actually observed to be exploited in real network attacks, and calculates an adaptive quantity based on this. : Where C represents the number of times the vulnerability has been actually observed to be exploited. To adjust the coefficients, the adaptive vulnerability remediation priority score calculation method is as follows:
[0034] In the formula, It is an adaptive vulnerability remediation priority score.
[0035] Relying solely on standardized scoring systems such as CVSS and EPSS for remediation decisions has significant limitations. While these general scores can provide a basic risk profile of vulnerabilities, they cannot reflect the true impact of vulnerabilities in specific business environments. Therefore, prioritizing vulnerabilities based on their actual application and operational status is essential to building a vulnerability governance system that truly adapts to the risks of enterprise digital assets.
[0036] Step 4: Taking into account business scenarios, asset importance, historical handling of similar vulnerabilities, and vulnerability introduction path length, adjust the overall priority of the vulnerability remediation priority score adjusted in Step 3; specifically: Business scenarios involving customer privacy information are classified as high-risk scenarios. For example, financial institutions and telecommunications companies deal with sensitive information and customer privacy data, which may be subject to strict regulation and require a higher overall rating. (Business scenario adjustment parameters) The value can be determined as follows:
[0037] The importance of different systems within an enterprise varies. For core business systems, such as payment and advertising systems, an attack could cause direct economic losses, requiring a higher priority for remediation. However, for edge business systems, such as test sandboxes and demonstration systems, the remediation priority can be appropriately lower. (Asset importance adjustment parameters) The value can be determined as follows:
[0038] Historical performance of similar vulnerabilities is the most direct indicator of threat. In actual vulnerability remediation, it's crucial to avoid repeating past mistakes and prioritize patching vulnerability types that have already proven to pose a real threat. (Vulnerability impact history remediation parameters) The calculation method is as follows ,in This indicates the historical impact of this type of vulnerability on the current system. One way to determine its value is as follows:
[0039] This indicates the historical economic losses caused to the current system by this type of vulnerability. One way to determine the value is as follows:
[0040] The vulnerability introduction path length represents the minimum number of dependency levels required to reach the vulnerable component from the system's main program, reflecting to some extent the ease with which an attacker can exploit the vulnerability. A shorter path means it's easier for an attacker to find and exploit the vulnerability, increasing the likelihood of its exploitation. Vulnerability introduction path length adjustment parameters. The value can be determined as follows: When the vulnerability introduces a path length When it is 1, The value is 1, and as the dependency path increases, The value gradually decreases; The correction coefficient is obtained by combining the results. The calculation method is as follows:
[0041] Using correction coefficients Adaptive vulnerability remediation priority scoring The overall priority is adjusted using the following formula:
[0042] In the formula, This is the priority score for the corrected vulnerability fixes.
[0043] By establishing a deterministic mapping relationship from vulnerability remediation priority scoring to "action actions," enterprise vulnerability management can be transformed from relying on experience to a scalable "security engineering" approach.
[0044] Step 5: Based on the revised vulnerability remediation priority score, classify vulnerabilities into different levels and execute corresponding responses for each level. Specifically: Based on the revised vulnerability remediation priority scoring Vulnerabilities are classified into five priority levels, from P0 to P4, with P0 being the highest. The timeframe for fixing these vulnerabilities is within 24 hours. The corresponding response actions are: the security team immediately intervenes, initiates the emergency response process, stops affected business functions or systems, the development team suspends current development tasks, reports on the progress of the fix every 2 hours until it is resolved, and penetration testing and code auditing are conducted after the fix is completed. The timeframe for fixing P1 vulnerabilities is within 72 hours. The corresponding response actions are: hotfixes or temporary workarounds are performed during off-peak business hours, patches need to undergo compatibility verification, temporary monitoring and protection measures are implemented before the fix is completed, and the business side needs to confirm the fix time window. The timeframe for fixing a P2 level vulnerability is 14 days. The corresponding response actions are: fix it in line with the iterative update cycle, and the fix plan must be reviewed by the security team and included in the version release checklist. The timeframe for fixing P3 level vulnerabilities is 30 days. The corresponding response actions are: fix them in accordance with the iterative update cycle, integrate them with other functional optimizations, track the fix status regularly, and assess risk changes every quarter. There is no time limit for patching Level 4 vulnerabilities. The corresponding response actions are: record vulnerability information in the knowledge base and regularly monitor changes in vulnerability intelligence. See the table below: Table 1
[0045] The scores are recalculated and the priority ranking is updated every 4 hours. After the update, P0 and P1 level vulnerabilities will not be downgraded in principle, but will still be handled according to the response actions corresponding to the original priority.
[0046] Example 2 This invention proposes a vulnerability remediation priority assessment system corresponding to the method in Embodiment 1, comprising: The score acquisition and preprocessing module is used to collect vulnerability CVSS and EPSS scores and perform normalization and discrimination enhancement processing. The weighting adjustment module is used to set the weights of CVSS and EPSS scores based on the enterprise's risk appetite and asset exposure level; the weighted sum is used to obtain the vulnerability remediation priority score. The adaptive scoring module is used to adaptively adjust the vulnerability remediation priority score based on the real-time impact of the vulnerability. The priority correction module is used to adjust the overall priority of the adaptively adjusted vulnerability remediation priority score by combining business scenarios, asset importance, historical handling of similar vulnerabilities, and vulnerability introduction path length. The classification and strategy formulation module is used to classify vulnerabilities based on the priority score of vulnerability remediation after priority adjustment, and to execute corresponding responses for vulnerabilities of different levels.
[0047] The implementation methods of each module and its function in the system are completely consistent with the steps of the method in Implementation Example 1, so they will not be repeated here.
[0048] Example 3 This invention proposes an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the vulnerability remediation priority evaluation method as described in Embodiment 1.
[0049] Example 4 This invention proposes a computer-readable storage medium storing a computer program that causes a computer to execute the vulnerability remediation priority assessment method as described in Embodiment 1.
[0050] In the embodiments disclosed in this application, a computer storage medium may be a tangible medium that may contain or store programs for use by or in conjunction with an instruction execution system, apparatus, or device. The computer storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of computer storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.
[0051] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed in this application can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.
[0052] The above are merely preferred embodiments of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should be considered within the scope of protection of the present invention.
Claims
1. A method for prioritizing vulnerability remediation, characterized in that, Includes the following steps: Step 1: Collect vulnerability CVSS and EPSS scores, and perform normalization and discrimination enhancement processing; Step 2: Based on the enterprise's risk appetite and asset exposure, set the weights for CVSS and EPSS scores respectively; The priority score for vulnerability remediation is obtained by weighted summation; Step 3: Adaptively adjust the vulnerability remediation priority score based on the real-time impact of the vulnerability; Step 4: Based on the business scenario, asset importance, historical handling of similar vulnerabilities, and vulnerability introduction path length, adjust the overall priority of the vulnerability remediation priority score adjusted in Step 3. Step 5: Classify vulnerabilities based on the priority score of the vulnerability remediation after priority adjustment, and execute corresponding responses for vulnerabilities of different levels.
2. The vulnerability remediation priority assessment method as described in claim 1, characterized in that, In step one, the normalization and discrimination enhancement processing specifically includes: The original CVSS score was The original EPSS score was For the original CVSS score Divide by 10 to normalize it to [0,1], then use the exponential amplification method to enhance the discrimination of the normalized CVSS score and the original EPSS score. The discrimination index is calculated using the following formula: ； ； In the formula, This is the magnified CVSS score. It is the adjustment index for the CVSS score. This is the magnified EPSS score. It is an adjusted index for the EPSS score.
3. The vulnerability remediation priority assessment method as described in claim 1, characterized in that, Step two is as follows: The initial scoring weights for both the amplified CVSS score and the amplified EPSS score are set to 1. The scoring weights of the amplified CVSS and EPSS scores are adjusted based on the company's risk appetite and asset exposure. Weighted summation yields vulnerability remediation priority scores : In the formula, It is the weighted score of the magnified CVSS score. This is the magnified CVSS score. This is the weighted score of the amplified EPSS score. It is the enlarged EPSS fraction.
4. The vulnerability remediation priority assessment method as described in claim 1, characterized in that, Step three specifically involves: The system obtains in real-time the number of times the current vulnerability has been actually observed to be exploited in real network attacks, and calculates an adaptive quantity based on this. : Where C represents the number of times the vulnerability has been actually observed to be exploited. To adjust the coefficients, the adaptive vulnerability remediation priority score calculation method is as follows: In the formula, It is an adaptive vulnerability remediation priority score.
5. The vulnerability remediation priority assessment method as described in claim 1, characterized in that, Step four is as follows: Business scenarios involving customer privacy information are designated as high-risk business scenarios, and business scenario adjustment parameters are applied. The value can be determined as follows: Asset Importance Adjustment Parameter The value can be determined as follows: The vulnerability affects historical correction parameters. The calculation method is as follows ,in This indicates the historical impact of this type of vulnerability on the current system. One way to determine its value is as follows: This indicates the historical economic losses caused to the current system by this type of vulnerability. One way to determine the value is as follows: Vulnerability introduction path length correction parameter The value can be determined as follows: When the vulnerability introduces a path length When it is 1, The value is 1, and as the dependency path increases, The value gradually decreases; The correction coefficient is obtained by combining the results. The calculation method is as follows: Using correction coefficients Adaptive vulnerability remediation priority scoring The overall priority is adjusted using the following formula: In the formula, This is the priority score for the corrected vulnerability fixes.
6. The vulnerability remediation priority assessment method as described in claim 1, characterized in that, Step five is as follows: Based on the revised vulnerability remediation priority scoring The vulnerabilities are classified into five priorities from P0 to P4, with P0 being the highest. The time limit for fixing the vulnerabilities is within 24 hours. The corresponding response actions are: the security team should intervene immediately, initiate the emergency response process, stop the affected business functions or systems, the development team should suspend the current development tasks, report the progress of the fix every 2 hours until the problem is resolved, and conduct penetration testing and code auditing after the fix is completed. The time limit for fixing P1 level vulnerabilities is 72 hours. The corresponding response actions are: hotfix or temporary workaround during off-peak hours, patch compatibility verification, temporary monitoring and protection measures before fixing, and confirmation of the fixing time window by the business party. The timeframe for fixing a P2 level vulnerability is 14 days. The corresponding response actions are: fix it in line with the iterative update cycle, and the fix plan must be reviewed by the security team and included in the version release checklist. The timeframe for fixing P3 level vulnerabilities is 30 days. The corresponding response actions are: fix them in accordance with the iterative update cycle, integrate them with other functional optimizations, track the fix status regularly, and assess risk changes every quarter. There is no time limit for patching P4 level vulnerabilities. The corresponding response actions are: record vulnerability information to the knowledge base and regularly monitor changes in vulnerability intelligence.
7. A vulnerability remediation priority assessment system, characterized in that, include: The score acquisition and preprocessing module is used to collect vulnerability CVSS and EPSS scores and perform normalization and discrimination enhancement processing. The weighting adjustment module is used to set the weights for CVSS and EPSS scores based on the company's risk appetite and asset exposure. The priority score for vulnerability remediation is obtained by weighted summation; The adaptive scoring module is used to adaptively adjust the vulnerability remediation priority score based on the real-time impact of the vulnerability. The priority correction module is used to adjust the overall priority of the adaptively adjusted vulnerability remediation priority score by combining business scenarios, asset importance, historical handling of similar vulnerabilities, and vulnerability introduction path length. The classification and strategy formulation module is used to classify vulnerabilities based on the priority score of vulnerability remediation after priority adjustment, and to execute corresponding responses for vulnerabilities of different levels.
8. An electronic device, characterized in that, include: The memory, the processor, and the computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, it implements the vulnerability remediation priority assessment method as described in any one of claims 1-6.
9. A computer-readable storage medium storing a computer program, characterized in that, The computer program causes the computer to execute the vulnerability remediation priority assessment method as described in any one of claims 1-6.