Multi-source vulnerability scanning result detection method and device based on AI

Abstract

The invention discloses a multi-source vulnerability scanning result detection method and device based on AI. The method comprises the following steps: extracting a vulnerability feature vector corresponding to each vulnerability based on a to-be-verified vulnerability scanning result, identifying and judging the integrity of the vulnerability feature vector, and determining the information integrity of each vulnerability; determining the number of vulnerability scanning tools for discovering vulnerabilities of the tested network assets, and determining cross validation degrees corresponding to the vulnerabilities; obtaining information of products influenced by the vulnerabilities from the vulnerability feature vectors, and determining product asset matching degrees of the vulnerabilities; performing matching degree judgment on the normalized global vulnerability number and a vulnerability number corresponding to a patch in historical repair information of the detected object, and determining a vulnerability patch matching degree of each vulnerability; and determining the confidence of each vulnerability based on the information integrity, the cross validation degree, the product asset matching degree and the vulnerability patch matching degree corresponding to each vulnerability. According to the method, a simple, efficient and safe technical means is provided for vulnerability scanning result detection work.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a multi-source vulnerability scanning result detection method and device based on AI. BACKGROUND

[0002] A vulnerability is a defect or weakness in an information system, software or hardware. Once exploited maliciously, a vulnerability can lead to complete control of the information system, software or hardware, leakage of sensitive data, interruption of services, and serious threats to business security and user privacy. In network attack and defense confrontation, vulnerabilities have become the core resources that determine the outcome.

[0003] As a basic means of discovering the vulnerability of information systems, software and hardware, vulnerability scanning is widely used in network security operation and maintenance, level protection evaluation, penetration testing, attack and defense drills and other network security detection. By automatically detecting known security defects in network assets such as operating systems, middleware, databases and web applications, potential attack surfaces can be discovered in advance, and network security protection levels can be improved by repairing them first. In actual work, a set of business systems often exposes hundreds or thousands of vulnerabilities after being scanned, causing great pressure on repair work. The existing technology sorts the repair priorities according to CVSS scores, vulnerability risk levels, threat intelligence and asset value to improve the efficiency of disposal. However, the existing technology generally ignores the verification of the authenticity and accuracy of the scanning results themselves, leading to a large number of false positives that are not identified, and thus affecting the efficiency of vulnerability disposal.

[0004] Currently, in order to improve the accuracy of scanning results, multiple vulnerability scanning tools are used for scanning. However, due to differences in vulnerability library coverage, detection logic, fingerprint recognition ability and recognition accuracy between vulnerability scanning tools, the number of vulnerabilities identified by different tools for the same target object can differ by several times. Some tools relax the detection threshold in pursuit of "high detection rate", resulting in a large number of false positives and causing "alarm fatigue"; another part of the tools causes false negatives due to outdated updates or insufficient detection depth. The inconsistency of scanning results from different scanning tools seriously weakens users' trust in vulnerability scanning results, and questions the authenticity of the scanned vulnerabilities, causing serious interference to security detection work. How to judge the confidence of vulnerability scanning results is a difficult problem that cannot be avoided in network security detection. Currently, the confidence of vulnerability scanning results is detected by manual review, which requires a large amount of manpower and is inefficient, and there is no mature method. In addition, if PoC code-based vulnerability exploitation is used to verify the authenticity of the vulnerability, there are many defects: 1) the information system in use refuses to carry out PoC-based vulnerability verification due to the need for stable operation; 2) PoC-based vulnerability verification requires high penetration skills of the detection personnel; 3) most of the vulnerabilities in the public vulnerability database do not have PoC code, limiting the scope of vulnerabilities applicable to this scheme.

[0005] Therefore, how to detect the confidence of the vulnerability scanning result is an urgent problem to be solved in network security detection. SUMMARY

[0006] Therefore, the present application provides an AI-based multi-source vulnerability scanning result detection method and device, which can solve the above technical problems.

[0007] In order to solve the above technical problems, the present application is implemented as follows.

[0008] An AI-based multi-source vulnerability scanning result detection method, comprising: Step S1: obtaining a to-be-verified vulnerability scanning result; Step S2: extracting a vulnerability feature vector corresponding to each vulnerability, identifying and judging the integrity of the vulnerability feature vector, and determining the information integrity of each vulnerability; Step S3: for each vulnerability in the to-be-verified vulnerability scanning result: determining the measured network asset corresponding to the vulnerability, and determining the number of vulnerability scanning tools that discover the vulnerability of the measured network asset; determining the cross-validation degree corresponding to each vulnerability; Step S4: for each vulnerability in the to-be-verified vulnerability scanning result: obtaining the information of the product affected by the vulnerability from the vulnerability feature vector, and matching the information of the product affected by the vulnerability with the measured network asset information in the measured object information to determine the matching degree; determining the product asset matching degree of each vulnerability; Step S5: for each vulnerability in the to-be-verified vulnerability scanning result: obtaining a normalized global vulnerability number from the vulnerability feature vector, and matching the normalized global vulnerability number with the vulnerability number corresponding to the patch in the measured object historical repair information to determine the matching degree; determining the vulnerability patch matching degree of each vulnerability; Step S6: based on the information integrity, cross-validation degree, product asset matching degree and vulnerability patch matching degree corresponding to each vulnerability, determining the confidence of each vulnerability; if the confidence exceeds a threshold, the vulnerability exists, otherwise, the vulnerability is a false alarm.

[0009] Preferably, the step S1 of obtaining the to-be-verified vulnerability scanning result comprises: obtaining the vulnerability scanning tool information, the measured object information and the measured object historical repair information from the to-be-verified vulnerability scanning result; wherein one measured object corresponds to several measured network assets; the to-be-verified vulnerability scanning result refers to the summary result of several vulnerability scanning tools respectively scanning the same measured object and each generating a scanning result containing several vulnerability information.

[0010] Preferably, the step S2 comprises: Step S21: determining the vulnerability information corresponding to each vulnerability from the vulnerability scanning result to be verified; The vulnerability information includes vulnerability name, global vulnerability number, vulnerability risk level, product information affected by the vulnerability, and IP address of the network asset corresponding to the vulnerability. The global vulnerability number refers to the number of the vulnerability recorded in the Common Vulnerabilities and Exposures (CVE) database. The product information affected by the vulnerability refers to the product information recorded in the CVE database, including product name and product version. Step S22: for each vulnerability, the following operations are performed: Input the global vulnerability number into the vulnerability number mapping library, and convert it into the same number by querying to form a normalized global vulnerability number; Integrate the vulnerability information and the vulnerability scanning tool information corresponding to the vulnerability to generate a vulnerability feature vector corresponding to the vulnerability. The vulnerability scanning tool information includes vulnerability scanning tool name, vulnerability scanning tool version, and vulnerability database update time. The vulnerability feature vector includes one or more of vulnerability name, normalized global vulnerability number, vulnerability risk level, product information affected by the vulnerability, IP address of the measured network asset corresponding to the vulnerability, vulnerability scanning tool name, vulnerability scanning tool version, and vulnerability database update time. The specification of the completeness of the vulnerability feature vector is used as a prompt word for the large language model. The large language model judges the completeness of the vulnerability feature vector to determine the completeness measure value of the vulnerability feature vector. Then, the completeness measure value of the vulnerability feature vector is mapped to the value of the information completeness, and the value of the information completeness is an integer.

[0011] Preferably, the step S3 comprises: For each vulnerability in the vulnerability scanning result to be verified, the following operations are performed: Step S31: obtaining the normalized global vulnerability number and the IP address of the measured network asset corresponding to the measured object from the vulnerability feature vector; determining a candidate vulnerability scanning tool based on all vulnerability feature vectors, wherein the normalized global vulnerability number and the IP address of the measured network asset corresponding to the measured object of the candidate vulnerability scanning tool are the same as the normalized global vulnerability number and the IP address of the measured network asset corresponding to the measured object obtained from the vulnerability feature vector; Step S32: based on the large language model, performing similarity judgment and clustering on the candidate vulnerability scanning tool from three dimensions of vulnerability scanning tool name, vulnerability scanning tool version, and vulnerability database update time, and taking the number of clusters as the number of vulnerability scanning tools corresponding to the vulnerability; Step S33: determining the cross-validation degree of each vulnerability based on the number of vulnerability scanning tools corresponding to the vulnerability, the cross-validation degree being a natural number in the range of [0, 4]; wherein when the number of vulnerability scanning tools corresponding to the vulnerability is less than or equal to 3, the cross-validation degree takes the value of the number of vulnerability scanning tools corresponding to the vulnerability; and when the number of vulnerability scanning tools corresponding to the vulnerability is greater than or equal to 4, the cross-validation degree takes the value of 4.

[0012] Preferably, the step S4 comprises: Step S41: determining each network asset information of the measured object from the measured object information, including network asset name, network asset version, IP address of the network asset; Step S42: determining the measured object historical repair information from the measured object historical repair information, the measured object historical repair information including patch information, patch corresponding vulnerability name, patch corresponding vulnerability number; Step S43: integrating the measured object information and the measured object historical repair information corresponding to all vulnerabilities in the to-be-verified vulnerability scanning result to form full-amount measured object information indexed by the IP address of the measured network asset; Step S44: for each vulnerability, obtaining the product information affected by the vulnerability from the vulnerability feature vector, and determining the first product information recorded in the third-party vulnerability library and existing the vulnerability, the first product information including product name and product version; Step S45: for each vulnerability, obtaining the IP address of the measured network asset corresponding to the vulnerability from the vulnerability feature vector, and obtaining the measured network asset information of the discovered vulnerability in the full-amount measured object information by taking the IP address of the measured network asset as a query condition, the measured network asset information of the discovered vulnerability including network asset name and network asset version; Step S46: for each vulnerability, performing matching degree judgment on the network asset name and network asset version of the discovered vulnerability network asset information and the product name and product version in the first product information based on the large language model to determine the product asset matching degree of each vulnerability; the product asset matching degree includes three cases of no matching, partial matching and complete matching; when no matching, the product asset matching degree measurement value is 0; when partial matching, the product asset matching degree measurement value is 1; when complete matching, the product asset matching degree measurement value is 2.

[0013] Preferably, the step S5 comprises: For each vulnerability in the to-be-verified vulnerability scanning result, the following operations are performed: Step S51: obtaining the IP address of the measured network asset corresponding to the vulnerability from the vulnerability feature vector, obtaining each patch information corresponding to the measured network asset information of the discovered vulnerability in the full-amount measured object information by taking the IP address of the measured network asset as a query condition, and determining the vulnerability number corresponding to each patch. Step S52: input each patch corresponding vulnerability number into the vulnerability number mapping library query, and obtain each normalized patch corresponding vulnerability number; Step S53: obtain the normalized global vulnerability number from the vulnerability feature vector, and determine whether the normalized global vulnerability number matches each normalized patch corresponding vulnerability number based on the large language model; if matched, the vulnerability patch matching degree of the vulnerability is assigned as 1; otherwise, the vulnerability patch matching degree of the vulnerability is assigned as 0.

[0014] Preferably, in the step S6, the confidence of each vulnerability is determined based on the information completeness, cross-validation degree, product asset matching degree and vulnerability patch matching degree corresponding to each vulnerability, wherein: The confidence of the vulnerability is calculated by the following formula:

[0015] ACC For the vulnerability confidence, COM For the information completeness, VAL For the cross-validation degree, MAT For the product asset matching degree, PAT For the vulnerability patch matching degree; max com The maximum value of the information completeness value range, max val The maximum value of the cross-validation degree value range, max mat The maximum value of the product asset matching degree value range; W com The weight of the information completeness, W val The weight of the cross-validation degree, W mat The weight of the product asset matching degree.

[0016] The application provides an AI-based multi-source vulnerability scanning result detection device, comprising: An information acquisition module configured to acquire a to-be-verified vulnerability scanning result; A vulnerability number mapping library configured as a database collecting the correspondence between the numbers of vulnerabilities in CNNVD, CNVD or CVE public vulnerability library; An information completeness module configured to extract the vulnerability feature vector corresponding to each vulnerability, identify and judge the completeness of the vulnerability feature vector, and determine the information completeness of each vulnerability; A cross-validation degree module configured to determine the measured network asset corresponding to each vulnerability in the to-be-verified vulnerability scanning result, and determine the number of vulnerability scanning tools that discover the vulnerability of the measured network asset; Determine the cross-validation degree for each vulnerability; Product Asset Degree Matching Module: Configured to obtain information about the products affected by each vulnerability from the vulnerability feature vector in the vulnerability scan results, and to determine the degree of matching between the information of the affected products and the network asset information under test in the information of the tested object; Determine the product asset matching degree for each vulnerability; Vulnerability Patch Matching Module: Configured to obtain the normalized global vulnerability number from the vulnerability feature vector for each vulnerability in the vulnerability scan results to be verified, and to perform a matching degree judgment between the normalized global vulnerability number and the vulnerability number corresponding to the patch in the historical repair information of the tested object; Determine the patch compatibility for each vulnerability; The vulnerability confidence module is configured to determine the confidence level of each vulnerability based on the completeness of the information, cross-validation, product asset matching, and vulnerability patch matching. When the confidence level exceeds the threshold, the vulnerability is considered to exist; otherwise, the vulnerability is considered a false alarm.

[0017] The present invention provides a computer-readable storage medium storing a plurality of instructions; the plurality of instructions are used by a processor to load and execute the method as described above.

[0018] The present invention provides an electronic device, characterized in that the electronic device comprises: A processor is used to execute multiple instructions; Memory, used to store multiple instructions; The plurality of instructions are to be stored in the memory and loaded and executed by the processor as described above.

[0019] Beneficial effects: (1) The present invention can determine the confidence level of vulnerability scanning results without affecting the stable operation of the tested object, and has higher security than vulnerability verification based on POC.

[0020] (2) The present invention determines the confidence level of vulnerability scanning results based on vulnerability scanning tools, vulnerability scanning results, information of the object under test and information on the repair of the object under test, providing a simple, efficient and safe technical means for vulnerability scanning result detection and providing a more sufficient basis for subsequent vulnerability repair and handling.

[0021] (3) The present invention can verify whether the vulnerabilities found by the scanning results actually exist. Attached Figure Description

[0022] Figure 1 This is a schematic diagram of the process of a multi-source vulnerability scanning result detection method based on AI according to the present invention; Figure 2A flowchart of a process for measuring information integrity of vulnerabilities in a vulnerability scanning result to be verified according to the present application is shown in the figure; Figure 3 A flowchart of a process for cross-verification of vulnerabilities in a vulnerability scanning result to be verified according to the present application is shown in the figure; Figure 4 A flowchart of another embodiment of a process for measuring cross-verification degree of vulnerabilities in a vulnerability scanning result to be verified according to the present application is shown in the figure; Figure 5 A flowchart of a process for measuring product asset matching degree of vulnerabilities in a vulnerability scanning result to be verified according to the present application is shown in the figure; Figure 6 A flowchart of a process for measuring vulnerability patch matching degree of vulnerabilities in a vulnerability scanning result to be verified according to the present application is shown in the figure; Figure 7 A structural diagram of an AI-based multi-source vulnerability scanning result detection device according to the present application is shown in the figure. DETAILED DESCRIPTION

[0023] The present application will be described in detail below with reference to the accompanying drawings and embodiments.

[0024] As shown in the figure, Figure 1 the present application proposes an AI-based multi-source vulnerability scanning result detection method, which comprises: Step S1: obtaining a vulnerability scanning result to be verified; Step S2: extracting a vulnerability feature vector corresponding to each vulnerability, identifying and judging the integrity of the vulnerability feature vector, and determining the information integrity of each vulnerability; Step S3: for each vulnerability in the vulnerability scanning result to be verified, determining a measured network asset corresponding to the vulnerability, and determining the number of vulnerability scanning tools that discover the vulnerability of the measured network asset; determining the cross-verification degree corresponding to each vulnerability; Step S4: for each vulnerability in the vulnerability scanning result to be verified, obtaining information of a product affected by the vulnerability from the vulnerability feature vector, and matching the information of the product affected by the vulnerability with the measured network asset information in the measured object information to determine the matching degree; determining the product asset matching degree of each vulnerability; Step S5: for each vulnerability in the vulnerability scanning result to be verified, obtaining a normalized global vulnerability number from the vulnerability feature vector, and matching the normalized global vulnerability number with a vulnerability number corresponding to a patch in the historical repair information of the measured object to determine the matching degree; determining the vulnerability patch matching degree of each vulnerability; Step S6: based on the information integrity, cross-verification degree, product asset matching degree, and vulnerability patch matching degree corresponding to each vulnerability, determining the confidence degree of each vulnerability; when the confidence degree exceeds a threshold, the vulnerability exists, otherwise, the vulnerability is a false positive.

[0025] Further, the step S1, obtaining the to-be-verified vulnerability scanning result, comprises: obtaining, from the to-be-verified vulnerability scanning result, vulnerability scanning tool information, measured object information and measured object historical repair information generated by the to-be-verified vulnerability scanning result; wherein one measured object corresponds to several measured network assets; the to-be-verified vulnerability scanning result refers to a summary result of several scanning results containing several pieces of vulnerability information generated by several vulnerability scanning tools respectively after scanning the same measured object.

[0026] In the application, the measured object information is the information of all the measured network assets checked in the early stage. The measured object is all the detection objects corresponding to the to-be-verified vulnerability scanning result. The measured object can be a complex information system composed of multiple network assets such as an operating system, a database and a Web page, or a single network asset such as one operating system.

[0027] Further, the step S2 comprises: Step S21: determining the vulnerability information corresponding to each vulnerability from the to-be-verified vulnerability scanning result. The vulnerability information comprises a vulnerability name, a global vulnerability number, a vulnerability danger level, product information affected by the vulnerability, and an IP address of a network asset of the measured object corresponding to the vulnerability; the global vulnerability number refers to the number of the vulnerability recorded in the public vulnerability database; the product information affected by the vulnerability refers to the product information recorded in the public vulnerability database, including a product name and a product version. Step S22: performing the following operations on each vulnerability: inputting the global vulnerability number into a vulnerability number mapping database to convert it into the same number through query to form a normalized global vulnerability number; The vulnerability number mapping database refers to a database collecting the corresponding relationship between the numbers of the vulnerabilities in the CNNVD, CNVD or CVE public vulnerability database. The numbers of the same vulnerability in different public vulnerability databases are different, and there is a corresponding relationship. For example, the normalized global vulnerability number is the CVE vulnerability number.

[0028] integrating the vulnerability information and the vulnerability scanning tool information corresponding to the vulnerability to generate a vulnerability feature vector corresponding to the vulnerability; wherein the vulnerability scanning tool information comprises a vulnerability scanning tool name, a vulnerability scanning tool version and a vulnerability database update time; the vulnerability feature vector comprises one or more of a vulnerability name, a normalized global vulnerability number, a vulnerability danger level, product information affected by the vulnerability, an IP address of a network asset of the measured object corresponding to the vulnerability, a vulnerability scanning tool name, a vulnerability scanning tool version and a vulnerability database update time. The specification about the completeness of the vulnerability feature vector is taken as a prompt word of the large language model, the completeness of the vulnerability feature vector is judged by the large language model, the completeness measure value of the vulnerability feature vector is determined, and the completeness measure value of the vulnerability feature vector is mapped to the corresponding information completeness value, and the information completeness value is an integer.

[0029] The dimensions of the vulnerability feature vectors corresponding to the vulnerabilities are the same or different.

[0030] For example, the specification about the completeness of the vulnerability feature vector is: comparing each dimension of the vulnerability feature vector separately, determining the completeness at the dimension level, and weighting and summing the completeness at the dimension level to obtain the completeness measure value of the vulnerability feature vector. For example, when the completeness measure value of the vulnerability feature vector is less than a measure threshold, the completeness measure value is 0, otherwise the completeness measure value is 1, as shown in Table 1. The weights of each feature vector are all 1, and the information completeness of the vulnerability is a natural number in the range of [0, 8].

[0031] Table 1: Completeness measure of feature vector

[0032] The step S3 comprises: For each vulnerability in the to-be-verified vulnerability scanning result, the following operations are performed: Step S31: obtaining, from the vulnerability feature vector, a normalized global vulnerability number and an IP address of a measured network asset corresponding to the vulnerability; determining a candidate vulnerability scanning tool based on all vulnerability feature vectors, wherein the normalized global vulnerability number and the IP address of the measured network asset corresponding to the detected vulnerability of the candidate vulnerability scanning tool are the same as the normalized global vulnerability number and the IP address of the measured network asset corresponding to the vulnerability obtained from the vulnerability feature vector; Step S32: performing similarity judgment and clustering on the candidate vulnerability scanning tool from three dimensions of vulnerability scanning tool name, vulnerability scanning tool version, and vulnerability library update time based on the large language model, and taking the number of clusters as the number of vulnerability scanning tools corresponding to the vulnerability; Step S33: determining a cross-validation degree of each vulnerability based on the number of vulnerability scanning tools corresponding to the vulnerability, wherein the cross-validation degree is a natural number in the range of [0, 4]; when the number of vulnerability scanning tools corresponding to the vulnerability is less than or equal to 3, the cross-validation degree takes the value of the number of vulnerability scanning tools corresponding to the vulnerability; when the number of vulnerability scanning tools corresponding to the vulnerability is greater than or equal to 4, the cross-validation degree takes the value of 4.

[0033] The same vulnerability of the same measured network asset is found by multiple vulnerability scanning tools, which indicates that the confidence of the existence of the vulnerability is higher. However, when the number of vulnerability scanning tools reaches 4 or more, the cross-validation effect approaches the limit.

[0034] For example, the mapping relationship between the number of vulnerability scanning tools and the cross-validation degree metric value is shown in Table 2.

[0035] Table 2 Mapping relationship

[0036] The purpose of the design step S31 is that the same vulnerability may exist in multiple network assets in one scanning result, or may exist in different network assets in different scanning results, so the vulnerability number and asset IP are used as query conditions to find out how many tools discover the same vulnerability of the same asset. In step S32, because the vulnerability scanning tool name, vulnerability scanning tool version and vulnerability library update time are often manually filled, manual filling may be biased, but in fact it is a kind of vulnerability scanning tool, so the similarity needs to be judged to determine the number of vulnerability scanning tools that discover the vulnerability of the network asset.

[0037] In one embodiment of the present application, the to-be-verified vulnerability scanning result includes two to-be-verified vulnerability scanning results generated after two different vulnerability scanning tools scan the same object. There is one vulnerability 1 of one measured network asset 1 in the to-be-verified vulnerability scanning result a, and there is one vulnerability 2 of one measured network asset 2 in the to-be-verified vulnerability scanning result b. If the vulnerability numbers of the vulnerability 1 and the vulnerability 2 are the same, the IP of the measured network asset 1 corresponding to the vulnerability 1 is the same as the IP of the measured network asset 2 corresponding to the vulnerability 2, and the two vulnerability scanning tools are different, then it is indicated that the vulnerability 1 is discovered by two vulnerability scanning tools.

[0038] Further, the step S4 comprises: Step S41: determining each measured network asset information from the object information, including network asset name, network asset version, network asset IP address; Step S42: determining the object historical repair information from the object historical repair information, the object historical repair information including patch information, patch corresponding vulnerability name, patch corresponding vulnerability number; Step S43: integrating all the vulnerability corresponding object information and object historical repair information in the to-be-verified vulnerability scanning result to form full-amount object information with the measured network asset IP address as the index; Step S44: for each vulnerability, obtaining the product information affected by the vulnerability from the vulnerability feature vector, and determining the first product information recorded in the third-party vulnerability library, the first product information including product name and product version; Step S45: For each vulnerability, the IP address of the measured network asset corresponding to the vulnerability is obtained from the vulnerability feature vector, and the measured network asset information of the discovered vulnerability is obtained in the full-amount measured object information by taking the measured network asset IP address as a query condition, wherein the measured network asset information of the discovered vulnerability includes a network asset name and a network asset version; Step S46: For each vulnerability, the network asset name and the network asset version of the network asset information of the discovered vulnerability are matched with the product name and the product version in the first product information based on the large language model to determine the product asset matching degree of each vulnerability; the product asset matching degree includes three cases of no matching, partial matching and complete matching; when no matching, the product asset matching degree measurement value is 0; when partial matching, the product asset matching degree measurement value is 1; when complete matching, the product asset matching degree measurement value is 2.

[0039] Further, the step S5 comprises: For each vulnerability in the to-be-verified vulnerability scanning result, the following operations are performed: Step S51: The IP address of the measured network asset corresponding to the vulnerability is obtained from the vulnerability feature vector, and each patch information corresponding to the measured network asset information of the discovered vulnerability is obtained in the full-amount measured object information by taking the measured network asset IP address as a query condition, to determine the vulnerability number corresponding to each patch; Step S52: The vulnerability number corresponding to each patch is input into the vulnerability number mapping library to obtain the vulnerability number corresponding to each normalized patch; Step S53: The normalized global vulnerability number is obtained from the vulnerability feature vector, and it is determined based on the large language model whether the normalized global vulnerability number and the vulnerability number corresponding to each normalized patch match; if matching, the vulnerability patch matching degree of the vulnerability is assigned a value of 1; otherwise, the vulnerability patch matching degree of the vulnerability is assigned a value of 0.

[0040] In the present application, if matching, it indicates that the vulnerability has been repaired, which is a false alarm; if no matching, it indicates that the vulnerability has not been repaired.

[0041] Further, in the step S6, the confidence degree of each vulnerability is determined based on the information completeness, the cross-validation degree, the product asset matching degree and the vulnerability patch matching degree corresponding to each vulnerability in the to-be-verified vulnerability scanning result, wherein: The confidence degree of the vulnerability is calculated by the following formula:

[0042] wherein, ACC the confidence degree of the vulnerability, COM the information completeness, VAL the cross-validation degree, MAT the product asset matching degree,PAT For vulnerability patch matching degree; max com The maximum value within the range of information completeness values. max val The maximum value in the range of cross-validation degree. max mat This represents the maximum value within the range of product asset matching degree values. W com As a weight for information completeness, W val The weights for cross-validation are... W mat The weighting of product asset matching degree.

[0043] Furthermore, the threshold can be dynamically adjusted based on subsequent actual vulnerability exploitation verification. For example, it can be adjusted according to the value ranges of information completeness, cross-validation degree, and product asset matching degree in each of the above steps, with the weight of information completeness... W com Weights of cross-validation W val Weight of product asset matching degree W mat If all values ​​are 1, then the threshold can be set to 6.

[0044] This invention also provides an implementation method for an AI-based multi-source vulnerability scanning result detection method, the method comprising: Step 1: Obtain the vulnerability scan results to be verified, and obtain the vulnerability scanning tool information, the tested object information, and the historical remediation information of the tested object that generated the vulnerability scan results to be verified; where one tested object corresponds to several tested network assets; the vulnerability scan results to be verified refer to the summary results of the scan results containing several vulnerability information generated by several vulnerability scanning tools after scanning the same tested object respectively. Step 2: Extract the vulnerability feature vectors corresponding to each vulnerability from the vulnerability scan results to be verified, and identify and judge the completeness of the vulnerability feature vectors based on the large language model to determine the information completeness of each vulnerability; Step 3: For each vulnerability in the vulnerability scan results to be verified, identify the network asset corresponding to the vulnerability; then determine the number of vulnerability scanning tools that discovered the vulnerability in that network asset. Determine the cross-validation degree for each vulnerability; Step 4: For each vulnerability in the vulnerability scan results to be verified, obtain the information of the product affected by the vulnerability from the vulnerability feature vector, and judge the matching degree between the information of the product affected by the vulnerability and the network asset information under test in the information of the tested object based on the large language model. Determine the product asset matching degree for each vulnerability; the relationship between the product and the network asset under test is many-to-many. Step 5: For each vulnerability in the to-be-verified vulnerability scanning result, a normalized global vulnerability number is obtained from the vulnerability feature vector, and the normalized global vulnerability number is matched with the vulnerability number corresponding to the patch in the historical repair information of the measured object based on the large language model to determine the vulnerability patch matching degree. The vulnerability patch matching degree of each vulnerability is determined. Step 6: Based on the information completeness, cross-validation degree, product asset matching degree and vulnerability patch matching degree corresponding to each vulnerability in the to-be-verified vulnerability scanning result, the confidence of each vulnerability is determined. When the confidence exceeds the threshold, it is determined that the vulnerability exists, otherwise, it is determined that the vulnerability is a false positive.

[0045] The application also provides a device for determining the authenticity of a vulnerability scanning result, which comprises: An information acquisition module configured to acquire a to-be-verified vulnerability scanning result; A vulnerability number mapping library configured as a database collecting the corresponding relationship between the numbers of vulnerabilities in public vulnerability libraries such as CNNVD, CNVD or CVE; An information completeness module configured to extract the vulnerability feature vector corresponding to each vulnerability, identify and judge the completeness of the vulnerability feature vector, and determine the information completeness of each vulnerability; A cross-validation degree module configured to determine the measured network asset corresponding to each vulnerability in the to-be-verified vulnerability scanning result, and determine the number of vulnerability scanning tools that discover the vulnerability of the measured network asset; The cross-validation degree corresponding to each vulnerability is determined. A product asset matching module configured to, for each vulnerability in the to-be-verified vulnerability scanning result: obtain the information of the product affected by the vulnerability from the vulnerability feature vector, and determine the matching degree between the information of the product affected by the vulnerability and the measured network asset information in the measured object information; The product asset matching degree of each vulnerability is determined. A vulnerability patch matching degree module configured to, for each vulnerability in the to-be-verified vulnerability scanning result: obtain a normalized global vulnerability number from the vulnerability feature vector, and determine the matching degree between the normalized global vulnerability number and the vulnerability number corresponding to the patch in the historical repair information of the measured object; The vulnerability patch matching degree of each vulnerability is determined. A vulnerability confidence module configured to determine the confidence of each vulnerability based on the information completeness, cross-validation degree, product asset matching degree and vulnerability patch matching degree corresponding to each vulnerability. When the confidence exceeds the threshold, the vulnerability exists, otherwise, the vulnerability is a false positive.

[0046] The above specific embodiments only describe the design principles of the present application, and the shapes and names of the components in the description can be different and are not limited. Therefore, those skilled in the art of the present application can modify or equivalently replace the technical solutions described in the foregoing embodiments; and these modifications and replacements do not deviate from the purpose and technical solutions of the present application, and should all belong to the protection scope of the present application.

Claims

1. An AI-based multi-source vulnerability scan result detection method, characterized in that, The method comprises the following steps: Step S1: obtaining a to-be-verified vulnerability scanning result; Step S2: extracting a vulnerability feature vector corresponding to each vulnerability, identifying and judging the integrity of the vulnerability feature vector, and determining the information integrity of each vulnerability; Step S3: for each vulnerability in the to-be-verified vulnerability scanning result, determining a measured network asset corresponding to the vulnerability, determining the number of vulnerability scanning tools that discover the vulnerability of the measured network asset; determining the cross-validation degree corresponding to each vulnerability; Step S4: for each vulnerability in the to-be-verified vulnerability scanning result: obtaining information of a product affected by the vulnerability from the vulnerability feature vector, and matching the information of the product affected by the vulnerability with the measured network asset information in the measured object information to determine the matching degree; determining the product asset matching degree of each vulnerability; Step S5: for each vulnerability in the to-be-verified vulnerability scanning result: obtaining a normalized global vulnerability number from the vulnerability feature vector, and matching the normalized global vulnerability number with the vulnerability number corresponding to the patch in the measured object historical repair information to determine the patch matching degree of the vulnerability; determining the patch matching degree of each vulnerability; Step S6: determining the confidence degree of each vulnerability based on the information integrity, cross-validation degree, product asset matching degree and patch matching degree corresponding to each vulnerability; When the confidence degree exceeds a threshold value, the vulnerability exists, otherwise, the vulnerability is a false alarm.

2. The method of claim 1, wherein, The step S1 comprises: obtaining, from the to-be-verified vulnerability scanning result, vulnerability scanning tool information, measured object information and measured object historical repair information generated by the to-be-verified vulnerability scanning result; wherein one measured object corresponds to a plurality of measured network assets; the to-be-verified vulnerability scanning result is the aggregation result of a plurality of scanning results containing a plurality of vulnerability information generated by a plurality of vulnerability scanning tools respectively scanning the same measured object.

3. The method of claim 2, wherein, The step S2 comprises: Step S21: determining the vulnerability information corresponding to each vulnerability from the to-be-verified vulnerability scanning result; wherein the vulnerability information comprises a vulnerability name, a global vulnerability number, a vulnerability risk level, product information affected by the vulnerability, and an IP address of a network asset of a measured object corresponding to the vulnerability; the global vulnerability number refers to the number of a vulnerability recorded by a public vulnerability database; the product information affected by the vulnerability refers to the product information recorded by the public vulnerability database, including a product name and a product version; Step S22: for each vulnerability, the following operations are performed: inputting the global vulnerability number into a vulnerability number mapping library to convert it into the same number by querying, thereby forming a normalized global vulnerability number; integrating the vulnerability information and the vulnerability scanning tool information corresponding to the vulnerability to generate a vulnerability feature vector corresponding to the vulnerability; wherein the vulnerability scanning tool information comprises a vulnerability scanning tool name, a vulnerability scanning tool version and a vulnerability database update time; the vulnerability feature vector comprises one or more of a vulnerability name, a normalized global vulnerability number, a vulnerability risk level, product information affected by the vulnerability, an IP address of a network asset corresponding to the vulnerability, a vulnerability scanning tool name, a vulnerability scanning tool version and a vulnerability database update time; The specification about the completeness of the vulnerability feature vector is taken as a prompt word of the large language model, the completeness of the vulnerability feature vector is judged by the large language model, the completeness of the vulnerability feature vector is determined, the completeness of the vulnerability feature vector is mapped to a corresponding information completeness value, and the information completeness value is an integer.

4. The method of claim 3, wherein, The step S3 comprises: For each vulnerability in the to-be-verified vulnerability scanning result, the following operations are performed: Step S31: obtaining the normalized global vulnerability number and the IP address of the measured network asset corresponding to the vulnerability from the vulnerability feature vector; determining a candidate vulnerability scanning tool based on all the vulnerability feature vectors, wherein the normalized global vulnerability number and the IP address of the measured network asset corresponding to the detected vulnerability of the candidate vulnerability scanning tool are the same as the normalized global vulnerability number and the IP address of the measured network asset corresponding to the vulnerability obtained from the vulnerability feature vector; Step S32: performing similarity judgment and clustering on the candidate vulnerability scanning tool from three dimensions of vulnerability scanning tool name, vulnerability scanning tool version and vulnerability database update time based on the large language model, and taking the number of clusters as the number of vulnerability scanning tools corresponding to the vulnerability; Step S33: determining the cross-validation degree of each vulnerability based on the number of vulnerability scanning tools corresponding to the vulnerability, wherein the cross-validation degree is a natural number in the range of [0, 4]; when the number of vulnerability scanning tools corresponding to the vulnerability is less than or equal to 3, the cross-validation degree takes the value of the number of vulnerability scanning tools corresponding to the vulnerability; when the number of vulnerability scanning tools corresponding to the vulnerability is greater than or equal to 4, the cross-validation degree takes the value of 4.

5. The method of claim 4, wherein, The step S4 comprises: Step S41: determining each measured network asset information from the measured object information, including network asset name, network asset version and IP address of the network asset; Step S42: determining the measured object historical repair information from the measured object historical repair information, wherein the measured object historical repair information includes patch information, patch corresponding vulnerability name and patch corresponding vulnerability number; Step S43: integrating the measured object information and the measured object historical repair information corresponding to all vulnerabilities in the to-be-verified vulnerability scanning result to form full-amount measured object information indexed by the IP address of the measured network asset; Step S44: for each vulnerability, obtaining the product information affected by the vulnerability from the vulnerability feature vector, and determining the first product information recorded in the third-party vulnerability database that has the vulnerability, wherein the first product information includes product name and product version; Step S45: for each vulnerability, obtaining the IP address of the measured network asset corresponding to the vulnerability from the vulnerability feature vector, and obtaining the measured network asset information of the discovered vulnerability in the full-amount measured object information by taking the IP address of the measured network asset as a query condition, wherein the measured network asset information of the discovered vulnerability includes network asset name and network asset version; Step S46: For each vulnerability, the network asset name and the network asset version of the discovered vulnerability information are matched with the product name and the product version in the first product information based on the large language model to determine the product asset matching degree of each vulnerability; the product asset matching degree includes three cases of no matching, partial matching and complete matching; when there is no matching, the product asset matching degree measurement value is 0; when there is partial matching, the product asset matching degree measurement value is 1; when there is complete matching, the product asset matching degree measurement value is 2.

6. The method of claim 5, wherein, The step S5 comprises: For each vulnerability in the to-be-verified vulnerability scanning result, the following operations are performed: Step S51: The IP address of the measured network asset corresponding to the vulnerability is obtained from the vulnerability feature vector; each patch information corresponding to the measured network asset information of the discovered vulnerability is obtained in the full-amount measured object information by taking the IP address of the measured network asset as a query condition; and the vulnerability numbers corresponding to the patches are determined; Step S52: The vulnerability numbers corresponding to the patches are input into the vulnerability number mapping library for query to obtain the vulnerability numbers corresponding to the normalized patches; Step S53: The normalized global vulnerability number is obtained from the vulnerability feature vector; and it is determined based on the large language model whether the normalized global vulnerability number matches the vulnerability numbers corresponding to the normalized patches; if yes, the vulnerability patch matching degree of the vulnerability is assigned a value of 1; otherwise, the vulnerability patch matching degree of the vulnerability is assigned a value of 0.

7. The method of any one of claims 1-6, wherein, In the step S6, the confidence degree of each vulnerability is determined based on the information completeness degree, the cross-validation degree, the product asset matching degree and the vulnerability patch matching degree of each vulnerability, wherein: The confidence degree of the vulnerability is calculated by the following formula: ACC a vulnerability confidence, COM an information completeness, VAL a cross-validation, MAT a product asset match, PAT a vulnerability patch match; max com a maximum value of the information completeness, max val a maximum value of the cross-validation, max mat a maximum value of the product asset match; W com a weight of the information completeness, W val a weight of the cross-validation, W mat a weight of the product asset match.

8. An AI-based multi-source vulnerability scan result detection device, characterized by, comprises: An information acquisition module configured to acquire a to-be-verified vulnerability scanning result; A vulnerability number mapping library configured as a database collecting the correspondence between the numbers of vulnerabilities in the CNNVD, the CNVD or the CVE public vulnerability library; An information completeness module configured to extract a vulnerability feature vector corresponding to each vulnerability, identify and judge the completeness of the vulnerability feature vector, and determine the information completeness degree of each vulnerability; A cross-validation degree module configured to determine, for each vulnerability in the to-be-verified vulnerability scanning result, a measured network asset corresponding to the vulnerability, and a number of vulnerability scanning tools discovering the vulnerability of the measured network asset; determine the cross-validation degree corresponding to each vulnerability; A product asset matching module configured to, for each vulnerability in the to-be-verified vulnerability scanning result: obtain information of a product affected by the vulnerability from a vulnerability feature vector, and perform matching degree judgment on the information of the product affected by the vulnerability and measured network asset information in measured object information; determine the product asset matching degree of each vulnerability; A vulnerability patch matching degree module configured to, for each vulnerability in the to-be-verified vulnerability scanning result: obtain a normalized global vulnerability number from a vulnerability feature vector, and perform matching degree judgment on the normalized global vulnerability number and a vulnerability number corresponding to a patch in measured object historical repair information; determine the vulnerability patch matching degree of each vulnerability; A confidence degree module of the vulnerability is configured to determine the confidence degree of each vulnerability based on information completeness, cross-validation degree, product asset matching degree and vulnerability patch matching degree corresponding to each vulnerability. When the confidence degree exceeds the threshold, the vulnerability actually exists, otherwise, the vulnerability is a false alarm.

9. A computer-readable storage medium, characterized in that, The storage medium has a plurality of instructions stored therein; the plurality of instructions are used to be loaded by a processor and to execute the method according to any one of claims 1-7.

10. An electronic device, comprising: The electronic device comprises: a processor configured to execute a plurality of instructions; a memory configured to store the plurality of instructions; wherein the plurality of instructions are used to be stored by the memory, loaded by the processor and executed to perform the method according to any one of claims 1-7.

Images