An AI-based multi-source vulnerability scanning result detection method and device

Abstract

The application discloses an AI-based multi-source vulnerability scanning result detection method and device. The method comprises the following steps: extracting a vulnerability feature vector corresponding to each vulnerability based on a to-be-verified vulnerability scanning result, identifying and judging the integrity of the vulnerability feature vector, and determining the information integrity of each vulnerability; determining the number of vulnerability scanning tools for discovering the vulnerability of the measured network asset, and determining the cross-validation degree corresponding to each vulnerability; obtaining the information of the product affected by the vulnerability from the vulnerability feature vector, and determining the product asset matching degree of each vulnerability; matching the normalized global vulnerability number with the vulnerability number corresponding to the patch in the historical repair information of the measured object, and determining the vulnerability patch matching degree of each vulnerability; and determining the confidence degree of each vulnerability based on the information integrity, cross-validation degree, product asset matching degree and vulnerability patch matching degree corresponding to each vulnerability. The application provides a simple, efficient and safe technical means for vulnerability scanning result detection work.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to an AI-based method and apparatus for detecting multi-source vulnerability scanning results. Background Technology

[0002] A vulnerability is a flaw or weakness in an information system, software, or hardware. Once exploited maliciously, a vulnerability can lead to complete control of the information system, software, or hardware, leakage of sensitive data, and service disruptions, posing a serious threat to business security and user privacy. In network attack and defense confrontations, vulnerabilities have become a core resource determining victory or defeat.

[0003] As a fundamental means of discovering vulnerabilities in information systems, software, and hardware, vulnerability scanning is widely used in network security operations and maintenance, graded protection assessments, penetration testing, and attack and defense drills. By automatically detecting known security flaws in network assets such as operating systems, middleware, databases, and web applications, it proactively identifies potential attack surfaces, allowing for preemptive remediation and improving network security protection levels. In practice, a single business system often exposes hundreds or even thousands of vulnerabilities after a vulnerability scan, placing immense pressure on remediation efforts. Existing technologies prioritize remediation based on CVSS scores, vulnerability risk levels, threat intelligence, and asset value to improve efficiency. However, existing technologies generally neglect the verification of the authenticity and accuracy of the scan results themselves, leading to a large number of false positives going undetected and impacting the cost-effectiveness of vulnerability remediation.

[0004] Currently, multiple vulnerability scanning tools are used to improve the accuracy of scan results. However, due to differences in vulnerability database coverage, detection logic, fingerprinting capabilities, and recognition accuracy among these tools, the number of vulnerabilities identified when scanning the same target object by different tools can vary by several times. Some tools relax detection thresholds in pursuit of "high detection rates," leading to a large number of false alarms and causing "alarm fatigue"; other tools, due to outdated updates or insufficient detection depth, result in missed detections. Inconsistent scan results from different tools severely undermine user trust in vulnerability scan results, raising doubts about the authenticity of the identified vulnerabilities and seriously interfering with security testing. Determining the confidence level of vulnerability scan results is an unavoidable challenge in network security testing. Currently, manual review is used to assess the confidence level of vulnerability scan results, which is labor-intensive, inefficient, and lacks a mature method. Furthermore, using PoC code-based vulnerability exploitation to verify the authenticity of vulnerabilities has many drawbacks: 1) Existing information systems refuse to conduct PoC-based vulnerability verification due to operational stability factors; 2) PoC-based vulnerability verification requires high penetration skills from the testing personnel; 3) Most vulnerabilities in public vulnerability databases do not have publicly available PoC code, resulting in a limited range of vulnerabilities to which this approach is applicable.

[0005] Therefore, how to test the confidence level of vulnerability scan results is an urgent problem to be solved in network security testing. Summary of the Invention

[0006] In view of this, the present invention provides an AI-based method and apparatus for detecting multi-source vulnerability scanning results, which can solve the above-mentioned technical problems.

[0007] To solve the above-mentioned technical problems, the present invention is implemented as follows.

[0008] A multi-source vulnerability scanning result detection method based on AI includes:

[0009] Step S1: Obtain the vulnerability scan results to be verified;

[0010] Step S2: Extract the vulnerability feature vectors corresponding to each vulnerability, identify and judge the integrity of the vulnerability feature vectors, and determine the information integrity of each vulnerability;

[0011] Step S3: For each vulnerability in the vulnerability scan results to be verified: determine the network asset under test corresponding to the vulnerability, and determine the number of vulnerability scanning tools that discovered the vulnerability in the network asset under test;

[0012] Determine the cross-validation degree for each vulnerability;

[0013] Step S4: For each vulnerability in the vulnerability scan results to be verified: obtain the information of the product affected by the vulnerability from the vulnerability feature vector, and determine the matching degree between the information of the product affected by the vulnerability and the network asset information under test in the information of the object under test;

[0014] Determine the product asset matching degree for each vulnerability;

[0015] Step S5: For each vulnerability in the vulnerability scan results to be verified: obtain the normalized global vulnerability number from the vulnerability feature vector, and determine the matching degree between the normalized global vulnerability number and the vulnerability number corresponding to the patch in the historical remediation information of the tested object;

[0016] Determine the patch compatibility for each vulnerability;

[0017] Step S6: Determine the confidence level of each vulnerability based on the information completeness, cross-validation degree, product asset matching degree, and vulnerability patch matching degree. If the confidence level exceeds the threshold, the vulnerability actually exists; otherwise, the vulnerability is a false alarm.

[0018] Preferably, step S1, obtaining the vulnerability scan results to be verified, includes:

[0019] The vulnerability scan results to be verified are obtained from the vulnerability scanning tool information, the tested object information, and the historical remediation information of the tested object. Among them, one tested object corresponds to several tested network assets. The vulnerability scan results to be verified refer to the summary results of the scan results containing several vulnerability information generated by several vulnerability scanning tools after scanning the same tested object.

[0020] Preferably, step S2 includes:

[0021] Step S21: Determine the vulnerability information corresponding to each vulnerability from the vulnerability scan results to be verified;

[0022] The vulnerability information includes the vulnerability name, global vulnerability number, vulnerability severity level, affected product information, and the network asset IP address of the tested object corresponding to the vulnerability; the global vulnerability number refers to the number assigned to the vulnerability in the public vulnerability database; the affected product information refers to the product information recorded in the public vulnerability database that contains the vulnerability, including the product name and product version.

[0023] Step S22: For each vulnerability, perform the following operations:

[0024] Input the global vulnerability number into the vulnerability number mapping library, and convert it into the same number through query to form a normalized global vulnerability number.

[0025] The vulnerability information and vulnerability scanning tool information corresponding to the vulnerability are integrated to generate a vulnerability feature vector. The vulnerability scanning tool information includes the vulnerability scanning tool name, vulnerability scanning tool version, and vulnerability database update time. The vulnerability feature vector includes one or more of the following: vulnerability name, normalized global vulnerability number, vulnerability risk level, product information affected by the vulnerability, IP address of the network asset under test corresponding to the vulnerability, vulnerability scanning tool name, vulnerability scanning tool version, and vulnerability database update time.

[0026] The specification regarding the completeness of vulnerability feature vectors is used as a prompt word in the large language model. The large language model judges the completeness of the vulnerability feature vectors, determines the completeness metric of the vulnerability feature vectors, and then maps the completeness metric of the vulnerability feature vectors to the corresponding information completeness value, which is an integer.

[0027] Preferably, step S3 includes:

[0028] For each vulnerability in the vulnerability scan results, perform the following operations:

[0029] Step S31: Obtain the normalized global vulnerability number and the IP address of the network asset of the object under test corresponding to the vulnerability from the vulnerability feature vector; determine candidate vulnerability scanning tools based on all vulnerability feature vectors, and the normalized global vulnerability number and the IP address of the network asset of the detected vulnerability of the candidate vulnerability scanning tool are the same as the normalized global vulnerability number and the IP address of the network asset of the object under test corresponding to the vulnerability obtained from the vulnerability feature vector.

[0030] Step S32: Based on the large language model, the candidate vulnerability scanning tools are judged and clustered according to three dimensions: vulnerability scanning tool name, vulnerability scanning tool version, and vulnerability database update time. The number of clusters is taken as the number of vulnerability scanning tools corresponding to the vulnerability.

[0031] Step S33: Based on the number of vulnerability scanning tools corresponding to the vulnerability, determine the cross-validation degree of each vulnerability. The cross-validation degree is a natural number between [0, 4]. Specifically, when the number of vulnerability scanning tools corresponding to the vulnerability is less than or equal to 3, the cross-validation degree is the number of vulnerability scanning tools corresponding to the vulnerability; when the number of vulnerability scanning tools corresponding to the vulnerability is greater than or equal to 4, the cross-validation degree is 4.

[0032] Preferably, step S4 includes:

[0033] Step S41: Determine the information of each network asset under test from the information of the object under test, including the network asset name, network asset version, and network asset IP address;

[0034] Step S42: Determine the historical repair information of the tested object from the historical repair information of the tested object. The historical repair information of the tested object includes patch information, the vulnerability name corresponding to the patch, and the vulnerability number corresponding to the patch.

[0035] Step S43: Integrate the information of the tested objects corresponding to all vulnerabilities in the vulnerability scan results to form a complete set of tested object information indexed by the IP address of the network asset under test;

[0036] Step S44: For each vulnerability, obtain the product information affected by the vulnerability from the vulnerability feature vector, and determine the first product information containing the vulnerability recorded in the third-party vulnerability database. The first product information includes the product name and product version.

[0037] Step S45: For each vulnerability, obtain the IP address of the network asset under test corresponding to the vulnerability from the vulnerability feature vector, and then use the IP address of the network asset under test as the query condition to obtain the network asset under test information of the discovered vulnerability from the full amount of tested object information. The network asset under test information of the discovered vulnerability includes the network asset name and network asset version.

[0038] Step S46: For each vulnerability, based on the large language model, determine the matching degree between the network asset name and network asset version of the network asset information of the discovered vulnerability and the product name and product version in the first product information to determine the product asset matching degree for each vulnerability; the product asset matching degree includes three cases: no match, partial match, and complete match; when there is no match, the product asset matching degree metric is 0; when there is a partial match, the product asset matching degree metric is 1; when there is a complete match, the product asset matching degree metric is 2.

[0039] Preferably, step S5 includes:

[0040] For each vulnerability in the vulnerability scan results, perform the following operations:

[0041] Step S51: Obtain the IP address of the network asset under test corresponding to the vulnerability from the vulnerability feature vector, and use the IP address of the network asset under test as the query condition to obtain the patch information corresponding to the network asset under test with the discovered vulnerability from the full amount of tested object information, and determine the vulnerability number corresponding to each patch.

[0042] Step S52: Input the vulnerability number corresponding to each patch into the vulnerability number mapping library to obtain the vulnerability number corresponding to each normalized patch;

[0043] Step S53: Obtain the normalized global vulnerability number from the vulnerability feature vector, and determine whether there is a match between the normalized global vulnerability number and the vulnerability number corresponding to each normalized patch based on the large language model; if there is a match, the vulnerability patch matching degree of the vulnerability is assigned a value of 1; otherwise, the vulnerability patch matching degree of the vulnerability is assigned a value of 0.

[0044] Preferably, in step S6, the confidence level of each vulnerability is determined based on the information completeness, cross-validation degree, product asset matching degree, and vulnerability patch matching degree corresponding to each vulnerability, wherein:

[0045] The confidence level of a vulnerability is calculated using the following formula:

[0046]

[0047] ACC For vulnerability confidence, COM For information completeness, VAL For cross-validation degree, MAT For product asset matching degree, PAT For vulnerability patch matching degree; max com The maximum value within the range of information completeness values. max val The maximum value in the range of cross-validation degree. maxmat This represents the maximum value within the range of product asset matching degree values. W com As a weight for information completeness, W val The weights for cross-validation are... W mat The weighting of product asset matching degree.

[0048] This invention provides an AI-based multi-source vulnerability scanning result detection device, comprising:

[0049] Information Acquisition Module: Configured to acquire the results of vulnerability scans to be verified;

[0050] Vulnerability ID Mapping Library: Configured to collect the mapping relationship between vulnerability IDs from public vulnerability databases such as CNNVD, CNVD, or CVE;

[0051] Information integrity module: Configured to extract the vulnerability feature vectors corresponding to each vulnerability, identify and judge the integrity of the vulnerability feature vectors, and determine the information integrity of each vulnerability;

[0052] Cross-validation module: Configured to identify the network asset under test corresponding to each vulnerability in the vulnerability scan results to be verified, and determine the number of vulnerability scanning tools that discovered the vulnerability in the network asset under test;

[0053] Determine the cross-validation degree for each vulnerability;

[0054] Product Asset Degree Matching Module: Configured to obtain information about the products affected by each vulnerability from the vulnerability feature vector in the vulnerability scan results, and to determine the degree of matching between the information of the affected products and the network asset information under test in the information of the tested object;

[0055] Determine the product asset matching degree for each vulnerability;

[0056] Vulnerability Patch Matching Module: Configured to obtain the normalized global vulnerability number from the vulnerability feature vector for each vulnerability in the vulnerability scan results to be verified, and to perform a matching degree judgment between the normalized global vulnerability number and the vulnerability number corresponding to the patch in the historical repair information of the tested object;

[0057] Determine the patch compatibility for each vulnerability;

[0058] The vulnerability confidence module is configured to determine the confidence level of each vulnerability based on the completeness of the information, cross-validation, product asset matching, and vulnerability patch matching. When the confidence level exceeds the threshold, the vulnerability is considered to exist; otherwise, the vulnerability is considered a false alarm.

[0059] The present invention provides a computer-readable storage medium storing a plurality of instructions; the plurality of instructions are used by a processor to load and execute the method as described above.

[0060] The present invention provides an electronic device, characterized in that the electronic device comprises:

[0061] A processor is used to execute multiple instructions;

[0062] Memory, used to store multiple instructions;

[0063] The plurality of instructions are to be stored in the memory and loaded and executed by the processor as described above.

[0064] Beneficial effects:

[0065] (1) The present invention can determine the confidence level of vulnerability scanning results without affecting the stable operation of the tested object, and has higher security than vulnerability verification based on POC.

[0066] (2) The present invention determines the confidence level of vulnerability scanning results based on vulnerability scanning tools, vulnerability scanning results, information of the object under test and information on the repair of the object under test, providing a simple, efficient and safe technical means for vulnerability scanning result detection and providing a more sufficient basis for subsequent vulnerability repair and handling.

[0067] (3) The present invention can verify whether the vulnerabilities found by the scanning results actually exist. Attached Figure Description

[0068] Figure 1 This is a schematic diagram of the process of a multi-source vulnerability scanning result detection method based on AI according to the present invention;

[0069] Figure 2 This is a schematic diagram illustrating the process of measuring the information integrity of vulnerabilities in the vulnerability scan results to be verified according to the present invention.

[0070] Figure 3 This is a schematic diagram illustrating the process of cross-validating vulnerabilities in the vulnerability scan results to be verified according to the present invention.

[0071] Figure 4 This is a schematic diagram illustrating another implementation of the present invention for cross-validation degree measurement of vulnerabilities in the vulnerability scanning results to be verified;

[0072] Figure 5 This is a schematic diagram illustrating the process of measuring the product asset matching degree of vulnerabilities in the vulnerability scanning results to be verified according to the present invention.

[0073] Figure 6This is a schematic diagram illustrating the process of measuring the vulnerability patch matching degree of vulnerabilities in the vulnerability scan results to be verified according to the present invention.

[0074] Figure 7 This is a schematic diagram of the structure of an AI-based multi-source vulnerability scanning result detection device according to the present invention. Detailed Implementation

[0075] The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0076] like Figure 1 As shown, this invention proposes an AI-based multi-source vulnerability scanning result detection method, the method comprising:

[0077] Step S1: Obtain the vulnerability scan results to be verified;

[0078] Step S2: Extract the vulnerability feature vectors corresponding to each vulnerability, identify and judge the integrity of the vulnerability feature vectors, and determine the information integrity of each vulnerability;

[0079] Step S3: For each vulnerability in the vulnerability scan results to be verified: determine the network asset under test corresponding to the vulnerability, and determine the number of vulnerability scanning tools that discovered the vulnerability in the network asset under test;

[0080] Determine the cross-validation degree for each vulnerability;

[0081] Step S4: For each vulnerability in the vulnerability scan results to be verified: obtain the information of the product affected by the vulnerability from the vulnerability feature vector, and determine the matching degree between the information of the product affected by the vulnerability and the network asset information under test in the information of the object under test;

[0082] Determine the product asset matching degree for each vulnerability;

[0083] Step S5: For each vulnerability in the vulnerability scan results to be verified: obtain the normalized global vulnerability number from the vulnerability feature vector, and determine the matching degree between the normalized global vulnerability number and the vulnerability number corresponding to the patch in the historical remediation information of the tested object;

[0084] Determine the patch compatibility for each vulnerability;

[0085] Step S6: Determine the confidence level of each vulnerability based on the information completeness, cross-validation degree, product asset matching degree, and vulnerability patch matching degree. If the confidence level exceeds the threshold, the vulnerability actually exists; otherwise, the vulnerability is a false alarm.

[0086] Further, step S1, obtaining the vulnerability scan results to be verified, includes:

[0087] The vulnerability scan results to be verified are obtained from the vulnerability scanning tool information, the tested object information, and the historical remediation information of the tested object. Among them, one tested object corresponds to several tested network assets. The vulnerability scan results to be verified refer to the summary results of the scan results containing several vulnerability information generated by several vulnerability scanning tools after scanning the same tested object.

[0088] In this invention, the information of the tested objects refers to the information of all network assets to be tested that have been accurately verified in the preliminary stage. The tested objects are all the detection objects corresponding to the vulnerability scan results to be verified. The tested objects can be complex information systems composed of multiple network assets such as operating systems, databases, and web pages, or they can be single network assets, such as an operating system.

[0089] Further, step S2 includes:

[0090] Step S21: Determine the vulnerability information corresponding to each vulnerability from the vulnerability scan results to be verified;

[0091] The vulnerability information includes the vulnerability name, global vulnerability number, vulnerability severity level, affected product information, and the network asset IP address of the tested object corresponding to the vulnerability; the global vulnerability number refers to the number assigned to the vulnerability in the public vulnerability database; the affected product information refers to the product information recorded in the public vulnerability database that contains the vulnerability, including the product name and product version.

[0092] Step S22: For each vulnerability, perform the following operations:

[0093] Input the global vulnerability number into the vulnerability number mapping library, and convert it into the same number through query to form a normalized global vulnerability number.

[0094] A vulnerability number mapping library is a database that collects the correspondence between vulnerability numbers in public vulnerability databases such as CNNVD, CNVD, or CVE. The same vulnerability may have different numbers in different public vulnerability databases, but a correspondence exists. For example, it can be normalized to a CVE vulnerability number.

[0095] The vulnerability information and vulnerability scanning tool information corresponding to the vulnerability are integrated to generate a vulnerability feature vector. The vulnerability scanning tool information includes the vulnerability scanning tool name, vulnerability scanning tool version, and vulnerability database update time. The vulnerability feature vector includes one or more of the following: vulnerability name, normalized global vulnerability number, vulnerability risk level, product information affected by the vulnerability, IP address of the network asset under test corresponding to the vulnerability, vulnerability scanning tool name, vulnerability scanning tool version, and vulnerability database update time.

[0096] The specification regarding the completeness of vulnerability feature vectors is used as a prompt word in the large language model. The large language model judges the completeness of the vulnerability feature vectors, determines the completeness metric of the vulnerability feature vectors, and then maps the completeness metric of the vulnerability feature vectors to the corresponding information completeness value, which is an integer.

[0097] Among them, the dimensions of the vulnerability feature vectors corresponding to each vulnerability may be the same or different.

[0098] For example, the specification for vulnerability feature vector completeness is as follows: Each dimension of the vulnerability feature vector is compared individually to determine the completeness at the dimension level. The completeness at each dimension level is then weighted and summed to obtain the completeness metric of the vulnerability feature vector. For instance, if the completeness metric of the vulnerability feature vector is less than a threshold, the completeness metric is 0; otherwise, it is 1 (see Table 1). Each feature vector has a weight of 1, and the completeness of the vulnerability information ranges from 0 to 8 (natural numbers).

[0099] Table 1. Completeness measure of feature vectors

[0100]

[0101] Step S3 includes:

[0102] For each vulnerability in the vulnerability scan results, perform the following operations:

[0103] Step S31: Obtain the normalized global vulnerability number and the IP address of the network asset of the object under test corresponding to the vulnerability from the vulnerability feature vector; determine candidate vulnerability scanning tools based on all vulnerability feature vectors, and the normalized global vulnerability number and the IP address of the network asset of the detected vulnerability of the candidate vulnerability scanning tool are the same as the normalized global vulnerability number and the IP address of the network asset of the object under test corresponding to the vulnerability obtained from the vulnerability feature vector.

[0104] Step S32: Based on the large language model, the candidate vulnerability scanning tools are judged and clustered according to three dimensions: vulnerability scanning tool name, vulnerability scanning tool version, and vulnerability database update time. The number of clusters is taken as the number of vulnerability scanning tools corresponding to the vulnerability.

[0105] Step S33: Based on the number of vulnerability scanning tools corresponding to the vulnerability, determine the cross-validation degree of each vulnerability. The cross-validation degree is a natural number between [0, 4]. Specifically, when the number of vulnerability scanning tools corresponding to the vulnerability is less than or equal to 3, the cross-validation degree is the number of vulnerability scanning tools corresponding to the vulnerability; when the number of vulnerability scanning tools corresponding to the vulnerability is greater than or equal to 4, the cross-validation degree is 4.

[0106] If the same vulnerability is discovered by multiple vulnerability scanning tools on the same network asset under test, it indicates a higher confidence level that the vulnerability actually exists. However, when the number of vulnerability scanning tools reaches four or more, the effectiveness of cross-validation approaches its limit.

[0107] For example, the mapping relationship between the number of vulnerability scanning tools and the cross-validation metric is detailed in Table 2.

[0108] Table 2 Mapping Relationships

[0109]

[0110] The purpose of designing step S31 is that the same vulnerability may exist in multiple network assets in one scan result, or it may exist in different network assets in different scan results. Therefore, the vulnerability number and asset IP should be used as query conditions to find out how many tools have discovered the same vulnerability in the same asset.

[0111] In step S32, since the vulnerability scanning tool name, vulnerability scanning tool version, and vulnerability database update time are often filled in manually, there may be errors due to manual input. However, since it is actually a vulnerability scanning tool, it is necessary to judge the similarity in order to determine the number of vulnerability scanning tools that discovered the vulnerability of the network asset.

[0112] In one embodiment of this invention, the vulnerability scan results to be verified include two sets of vulnerability scan results generated by two different vulnerability scanning tools scanning the same object under test. Vulnerability scan result a contains vulnerability 1 for network asset 1 under test, and cross-verification scan result b contains vulnerability 2 for network asset 2 under test. If vulnerability 1 and vulnerability 2 have the same vulnerability number, and the IP address of network asset 1 corresponding to vulnerability 1 is the same as the IP address of network asset 2 corresponding to vulnerability 2, and the two vulnerability scanning tools are different, then it indicates that vulnerability 1 was discovered by both vulnerability scanning tools.

[0113] Further, step S4 includes:

[0114] Step S41: Determine the information of each network asset under test from the information of the object under test, including the network asset name, network asset version, and network asset IP address;

[0115] Step S42: Determine the historical repair information of the tested object from the historical repair information of the tested object. The historical repair information of the tested object includes patch information, the vulnerability name corresponding to the patch, and the vulnerability number corresponding to the patch.

[0116] Step S43: Integrate the information of the tested objects corresponding to all vulnerabilities in the vulnerability scan results to form a complete set of tested object information indexed by the IP address of the network asset under test;

[0117] Step S44: For each vulnerability, obtain the product information affected by the vulnerability from the vulnerability feature vector, and determine the first product information containing the vulnerability recorded in the third-party vulnerability database. The first product information includes the product name and product version.

[0118] Step S45: For each vulnerability, obtain the IP address of the network asset under test corresponding to the vulnerability from the vulnerability feature vector, and then use the IP address of the network asset under test as the query condition to obtain the network asset under test information of the discovered vulnerability from the full amount of tested object information. The network asset under test information of the discovered vulnerability includes the network asset name and network asset version.

[0119] Step S46: For each vulnerability, based on the large language model, determine the matching degree between the network asset name and network asset version of the network asset information of the discovered vulnerability and the product name and product version in the first product information to determine the product asset matching degree for each vulnerability; the product asset matching degree includes three cases: no match, partial match, and complete match; when there is no match, the product asset matching degree metric is 0; when there is a partial match, the product asset matching degree metric is 1; when there is a complete match, the product asset matching degree metric is 2.

[0120] Further, step S5 includes:

[0121] For each vulnerability in the vulnerability scan results, perform the following operations:

[0122] Step S51: Obtain the IP address of the network asset under test corresponding to the vulnerability from the vulnerability feature vector, and use the IP address of the network asset under test as the query condition to obtain the patch information corresponding to the network asset under test with the discovered vulnerability from the full amount of tested object information, and determine the vulnerability number corresponding to each patch.

[0123] Step S52: Input the vulnerability number corresponding to each patch into the vulnerability number mapping library to obtain the vulnerability number corresponding to each normalized patch;

[0124] Step S53: Obtain the normalized global vulnerability number from the vulnerability feature vector, and determine whether there is a match between the normalized global vulnerability number and the vulnerability number corresponding to each normalized patch based on the large language model; if there is a match, the vulnerability patch matching degree of the vulnerability is assigned a value of 1; otherwise, the vulnerability patch matching degree of the vulnerability is assigned a value of 0.

[0125] In this invention, if there is a match, it indicates that the vulnerability has been fixed and is a false alarm; if there is no match, it indicates that the vulnerability has not been fixed.

[0126] Further, in step S6, based on the information completeness, cross-validation degree, product asset matching degree, and vulnerability patch matching degree corresponding to each vulnerability in the vulnerability scan results to be verified, the confidence level of each vulnerability is determined, wherein:

[0127] The confidence level of a vulnerability is calculated using the following formula:

[0128]

[0129] in, ACC For vulnerability confidence, COM For information completeness, VAL For cross-validation degree, MAT For product asset matching degree, PAT For vulnerability patch matching degree; max com The maximum value within the range of information completeness values. max val The maximum value in the range of cross-validation degree. max mat This represents the maximum value within the range of product asset matching degree values. W com As a weight for information completeness, W val The weights for cross-validation are... W mat The weighting of product asset matching degree.

[0130] Furthermore, the threshold can be dynamically adjusted based on subsequent actual vulnerability exploitation verification. For example, it can be adjusted according to the value ranges of information completeness, cross-validation degree, and product asset matching degree in each of the above steps, with the weight of information completeness... W com Weights of cross-validation W val Weight of product asset matching degree W mat If all values ​​are 1, then the threshold can be set to 6.

[0131] This invention also provides an implementation method for an AI-based multi-source vulnerability scanning result detection method, the method comprising:

[0132] Step 1: Obtain the vulnerability scan results to be verified, and obtain the vulnerability scanning tool information, the tested object information, and the historical remediation information of the tested object that generated the vulnerability scan results to be verified; where one tested object corresponds to several tested network assets; the vulnerability scan results to be verified refer to the summary results of the scan results containing several vulnerability information generated by several vulnerability scanning tools after scanning the same tested object respectively.

[0133] Step 2: Extract the vulnerability feature vectors corresponding to each vulnerability from the vulnerability scan results to be verified, and identify and judge the completeness of the vulnerability feature vectors based on the large language model to determine the information completeness of each vulnerability;

[0134] Step 3: For each vulnerability in the vulnerability scan results to be verified, identify the network asset corresponding to the vulnerability; then determine the number of vulnerability scanning tools that discovered the vulnerability in that network asset.

[0135] Determine the cross-validation degree for each vulnerability;

[0136] Step 4: For each vulnerability in the vulnerability scan results to be verified, obtain the information of the product affected by the vulnerability from the vulnerability feature vector, and judge the matching degree between the information of the product affected by the vulnerability and the network asset information under test in the information of the tested object based on the large language model.

[0137] Determine the product asset matching degree for each vulnerability; the relationship between the product and the network asset under test is many-to-many.

[0138] Step 5: For each vulnerability in the vulnerability scan results to be verified, obtain the normalized global vulnerability number from the vulnerability feature vector. Based on the large language model, determine the matching degree between the normalized global vulnerability number and the vulnerability number corresponding to the patch in the historical remediation information of the tested object.

[0139] Determine the patch compatibility for each vulnerability;

[0140] Step 6: Based on the information completeness, cross-validation degree, product asset matching degree, and vulnerability patch matching degree of each vulnerability in the vulnerability scan results, determine the confidence level of each vulnerability; if the confidence level exceeds the threshold, the vulnerability is confirmed to exist; otherwise, the vulnerability is confirmed to be a false alarm.

[0141] The present invention also provides an AI-based multi-source vulnerability scanning result detection device, the device comprising:

[0142] Information Acquisition Module: Configured to acquire the results of vulnerability scans to be verified;

[0143] Vulnerability ID Mapping Library: Configured to collect the mapping relationship between vulnerability IDs in public vulnerability databases such as CNNVD, CNVD, or CVE;

[0144] Information integrity module: Configured to extract the vulnerability feature vectors corresponding to each vulnerability, identify and judge the integrity of the vulnerability feature vectors, and determine the information integrity of each vulnerability;

[0145] Cross-validation module: Configured to identify the network asset under test corresponding to each vulnerability in the vulnerability scan results to be verified, and determine the number of vulnerability scanning tools that discovered the vulnerability in the network asset under test;

[0146] Determine the cross-validation degree for each vulnerability;

[0147] Product Asset Degree Matching Module: Configured to obtain information about the products affected by each vulnerability from the vulnerability feature vector in the vulnerability scan results, and to determine the degree of matching between the information of the affected products and the network asset information under test in the information of the tested object;

[0148] Determine the product asset matching degree for each vulnerability;

[0149] Vulnerability Patch Matching Module: Configured to obtain the normalized global vulnerability number from the vulnerability feature vector for each vulnerability in the vulnerability scan results to be verified, and to perform a matching degree judgment between the normalized global vulnerability number and the vulnerability number corresponding to the patch in the historical repair information of the tested object;

[0150] Determine the patch compatibility for each vulnerability;

[0151] The vulnerability confidence module is configured to determine the confidence level of each vulnerability based on the completeness of the information, cross-validation, product asset matching, and vulnerability patch matching. When the confidence level exceeds the threshold, the vulnerability is considered to exist; otherwise, the vulnerability is considered a false alarm.

[0152] The specific embodiments described above only illustrate the design principles of the present invention. The shapes and names of the components in this description may differ and are not limited. Therefore, those skilled in the art can modify or make equivalent substitutions to the technical solutions described in the foregoing embodiments; and these modifications and substitutions do not depart from the inventive spirit and technical solutions of the present invention, and should all fall within the protection scope of the present invention.

Claims

1. A method for detecting multi-source vulnerability scanning results based on AI, characterized in that, include: Step S1: Obtain the vulnerability scan results to be verified; Step S2: Extract the vulnerability feature vectors corresponding to each vulnerability, identify and judge the integrity of the vulnerability feature vectors, and determine the information integrity of each vulnerability; Step S3: For each vulnerability in the vulnerability scan results to be verified: determine the network asset under test corresponding to the vulnerability, and determine the number of vulnerability scanning tools that discovered the vulnerability in the network asset under test; Determine the cross-validation degree for each vulnerability; Step S4: For each vulnerability in the vulnerability scan results to be verified: obtain the information of the product affected by the vulnerability from the vulnerability feature vector, and determine the matching degree between the information of the product affected by the vulnerability and the network asset information under test in the information of the object under test; Determine the product asset matching degree for each vulnerability; Step S5: For each vulnerability in the vulnerability scan results to be verified: obtain the normalized global vulnerability number from the vulnerability feature vector, and determine the matching degree between the normalized global vulnerability number and the vulnerability number corresponding to the patch in the historical remediation information of the tested object; Determine the patch compatibility for each vulnerability; Step S6: Determine the confidence level of each vulnerability based on the information completeness, cross-validation degree, product asset matching degree, and vulnerability patch matching degree corresponding to each vulnerability; If the confidence level exceeds the threshold, the vulnerability is considered real; otherwise, the vulnerability is a false alarm. Step S3 includes: For each vulnerability in the vulnerability scan results, perform the following operations: Step S31: Obtain the normalized global vulnerability number and the IP address of the network asset of the object under test corresponding to the vulnerability from the vulnerability feature vector; determine candidate vulnerability scanning tools based on all vulnerability feature vectors, and the normalized global vulnerability number and the IP address of the network asset of the detected vulnerability of the candidate vulnerability scanning tool are the same as the normalized global vulnerability number and the IP address of the network asset of the object under test corresponding to the vulnerability obtained from the vulnerability feature vector. Step S32: Based on the large language model, the candidate vulnerability scanning tools are judged and clustered according to three dimensions: vulnerability scanning tool name, vulnerability scanning tool version, and vulnerability database update time. The number of clusters is taken as the number of vulnerability scanning tools corresponding to the vulnerability. Step S33: Based on the number of vulnerability scanning tools corresponding to the vulnerability, determine the cross-validation degree of each vulnerability. The cross-validation degree is a natural number between [0, 4]. Specifically, when the number of vulnerability scanning tools corresponding to the vulnerability is less than or equal to 3, the cross-validation degree is the number of vulnerability scanning tools corresponding to the vulnerability; when the number of vulnerability scanning tools corresponding to the vulnerability is greater than or equal to 4, the cross-validation degree is 4. The confidence level of a vulnerability is calculated using the following formula: ACC For vulnerability confidence, COM For information completeness, VAL For cross-validation degree, MAT For product asset matching degree, PAT For vulnerability patch matching degree; max com The maximum value within the range of information completeness values. max val The maximum value in the range of cross-validation degree. max mat This represents the maximum value within the range of product asset matching degree values. W com As a weight for information completeness, W val The weights for cross-validation are... W mat The weighting of product asset matching degree.

2. The method as described in claim 1, characterized in that, Step S1, obtaining the vulnerability scan results to be verified, includes: The vulnerability scan results to be verified are obtained from the vulnerability scanning tool information, the tested object information, and the historical remediation information of the tested object. Among them, one tested object corresponds to several tested network assets. The vulnerability scan results to be verified refer to the summary results of the scan results containing several vulnerability information generated by several vulnerability scanning tools after scanning the same tested object.

3. The method as described in claim 2, characterized in that, Step S2 includes: Step S21: Determine the vulnerability information corresponding to each vulnerability from the vulnerability scan results to be verified; The vulnerability information includes the vulnerability name, global vulnerability number, vulnerability severity level, affected product information, and the network asset IP address of the tested object corresponding to the vulnerability; the global vulnerability number refers to the number assigned to the vulnerability in the public vulnerability database; the affected product information refers to the product information recorded in the public vulnerability database that contains the vulnerability, including the product name and product version. Step S22: For each vulnerability, perform the following operations: Input the global vulnerability number into the vulnerability number mapping library, and convert it into the same number through query to form a normalized global vulnerability number. The vulnerability information and vulnerability scanning tool information corresponding to the vulnerability are integrated to generate a vulnerability feature vector. The vulnerability scanning tool information includes the vulnerability scanning tool name, vulnerability scanning tool version, and vulnerability database update time. The vulnerability feature vector includes one or more of the following: vulnerability name, normalized global vulnerability number, vulnerability risk level, product information affected by the vulnerability, IP address of the network asset under test corresponding to the vulnerability, vulnerability scanning tool name, vulnerability scanning tool version, and vulnerability database update time. The specification regarding the completeness of vulnerability feature vectors is used as a prompt word in the large language model. The large language model judges the completeness of the vulnerability feature vectors, determines the completeness metric of the vulnerability feature vectors, and then maps the completeness metric of the vulnerability feature vectors to the corresponding information completeness value, which is an integer.

4. The method as described in claim 3, characterized in that, Step S4 includes: Step S41: Determine the information of each network asset under test from the information of the object under test, including the network asset name, network asset version, and network asset IP address; Step S42: Determine the historical repair information of the tested object from the historical repair information of the tested object. The historical repair information of the tested object includes patch information, the vulnerability name corresponding to the patch, and the vulnerability number corresponding to the patch. Step S43: Integrate the information of the tested objects corresponding to all vulnerabilities in the vulnerability scan results to form a complete set of tested object information indexed by the IP address of the network asset under test; Step S44: For each vulnerability, obtain the product information affected by the vulnerability from the vulnerability feature vector, and determine the first product information containing the vulnerability recorded in the third-party vulnerability database. The first product information includes the product name and product version. Step S45: For each vulnerability, obtain the IP address of the network asset under test corresponding to the vulnerability from the vulnerability feature vector, and then use the IP address of the network asset under test as the query condition to obtain the network asset under test information of the discovered vulnerability from the full amount of tested object information. The network asset under test information of the discovered vulnerability includes the network asset name and network asset version. Step S46: For each vulnerability, based on the large language model, determine the matching degree between the network asset name and network asset version of the network asset information of the discovered vulnerability and the product name and product version in the first product information to determine the product asset matching degree for each vulnerability; the product asset matching degree includes three cases: no match, partial match, and complete match; when there is no match, the product asset matching degree metric is 0; when there is a partial match, the product asset matching degree metric is 1; when there is a complete match, the product asset matching degree metric is 2.

5. The method as described in claim 4, characterized in that, Step S5 includes: For each vulnerability in the vulnerability scan results, perform the following operations: Step S51: Obtain the IP address of the network asset under test corresponding to the vulnerability from the vulnerability feature vector, and use the IP address of the network asset under test as the query condition to obtain the patch information corresponding to the network asset under test with the discovered vulnerability from the full amount of tested object information, and determine the vulnerability number corresponding to each patch. Step S52: Input the vulnerability number corresponding to each patch into the vulnerability number mapping library to obtain the vulnerability number corresponding to each normalized patch; Step S53: Obtain the normalized global vulnerability number from the vulnerability feature vector, and determine whether there is a match between the normalized global vulnerability number and the vulnerability number corresponding to each normalized patch based on the large language model; if there is a match, the vulnerability patch matching degree of the vulnerability is assigned a value of 1; otherwise, the vulnerability patch matching degree of the vulnerability is assigned a value of 0.

6. An AI-based multi-source vulnerability scanning result detection device, used to execute the method of any one of claims 1-5, characterized in that, include: Information Acquisition Module: Configured to acquire the results of vulnerability scans to be verified; Vulnerability ID Mapping Library: Configured to collect the mapping relationship between vulnerability IDs from public vulnerability databases such as CNNVD, CNVD, or CVE; Information integrity module: Configured to extract the vulnerability feature vectors corresponding to each vulnerability, identify and judge the integrity of the vulnerability feature vectors, and determine the information integrity of each vulnerability; Cross-validation module: Configured to identify the network asset under test corresponding to each vulnerability in the vulnerability scan results to be verified, and determine the number of vulnerability scanning tools that discovered the vulnerability in the network asset under test; Determine the cross-validation degree for each vulnerability; Product Asset Degree Matching Module: Configured to obtain information about the products affected by each vulnerability from the vulnerability feature vector in the vulnerability scan results, and to determine the degree of matching between the information of the affected products and the network asset information under test in the information of the tested object; Determine the product asset matching degree for each vulnerability; Vulnerability Patch Matching Module: Configured to obtain the normalized global vulnerability number from the vulnerability feature vector for each vulnerability in the vulnerability scan results to be verified, and to perform a matching degree judgment between the normalized global vulnerability number and the vulnerability number corresponding to the patch in the historical repair information of the tested object; Determine the patch compatibility for each vulnerability; The confidence level module for vulnerabilities is configured to determine the confidence level of each vulnerability based on the completeness of the information, the degree of cross-validation, the matching degree of the product assets, and the matching degree of the vulnerability patch. If the confidence level exceeds the threshold, the vulnerability is considered real; otherwise, it is a false alarm.

7. A computer-readable storage medium, characterized in that, The storage medium stores a plurality of instructions; the plurality of instructions are loaded by a processor and executed as described in any one of claims 1-5.

8. An electronic device, characterized in that, The electronic device includes: A processor is used to execute multiple instructions; Memory, used to store multiple instructions; The plurality of instructions are to be stored in the memory and loaded by the processor and executed as described in any one of claims 1-5.

Images