Vulnerability repairing method and device, medium and program product

Abstract

The embodiment of the invention provides a vulnerability repairing method and device, a medium and a program product, and relates to the technical field of system security, the method comprises the following steps: obtaining a vulnerability description file from a vulnerability disclosure database; analyzing the vulnerability description file to obtain vulnerability repair element information which comprises vulnerability feature information, influence range information and repair guidance information; determining affected equipment according to the influence range information, and acquiring system state information of the affected equipment; generating a vulnerability repair script according to the repair guidance information and the system state information of the affected device; inputting the system state information of the affected device and the vulnerability repair script into a repair risk assessment model to assess a risk generated by executing the vulnerability repair script based on the vulnerability feature information and the historical repair experience information, and instructing the affected device to execute the vulnerability repair script based on a risk assessment result. According to the method, the vulnerability can be automatically repaired, the vulnerability repairing efficiency and accuracy are improved, and meanwhile, the vulnerability repairing risk is reduced.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of system security technology, and in particular to vulnerability repair methods, devices, media and program products. Background Technology

[0002] Patching security vulnerabilities is a critical aspect of system operation and maintenance, and is fundamental to maintaining system security and service availability. An efficient vulnerability patching method is essential for ensuring normal business operations and data security. Distributed systems with a large number of nodes place even higher demands on the consistency, timeliness, and security of vulnerability patching.

[0003] However, existing vulnerability remediation methods usually rely on manual operation, which has drawbacks such as low remediation efficiency, easy to make wrong judgments and execution deviations, resulting in inaccurate vulnerability remediation, and even introducing uncontrollable risks. Summary of the Invention

[0004] The embodiments of the present invention provide vulnerability repair methods, devices, media and program products that can automatically repair vulnerabilities, improve the efficiency and accuracy of vulnerability repair, and reduce the risk of vulnerability repair.

[0005] In a first aspect, the vulnerability remediation method provided in the embodiments of the present invention includes:

[0006] The vulnerability description file is obtained from the vulnerability disclosure database; the vulnerability description file is parsed using a file parsing model to obtain vulnerability remediation element information, including vulnerability characteristic information, impact scope information, and remediation guidance information; affected devices are identified based on the impact scope information, and system status information of the affected devices is obtained; a vulnerability remediation script is generated based on the remediation guidance information and the system status information of the affected devices; the system status information of the affected devices and the vulnerability remediation script are input into a remediation risk assessment model to assess the risk of executing the vulnerability remediation script based on the vulnerability characteristic information and historical remediation experience information, and obtain a risk assessment result; based on the risk assessment result, it is determined whether to instruct the affected devices to execute the vulnerability remediation script.

[0007] Secondly, the vulnerability repair device provided in the embodiments of the present invention includes:

[0008] The acquisition module is used to obtain vulnerability description files from vulnerability disclosure databases;

[0009] The parsing module is used to parse the vulnerability description file using a file parsing model to obtain vulnerability remediation element information, which includes vulnerability characteristic information, impact scope information, and remediation guidance information.

[0010] The determination module is used to identify the affected devices based on the impact range information and obtain the system status information of the affected devices.

[0011] The generation module is used to generate vulnerability remediation scripts based on remediation guidance information and system status information of affected devices;

[0012] The assessment module is used to input the system status information of the affected devices and the vulnerability remediation scripts into the remediation risk assessment model. The remediation risk assessment model uses vulnerability feature information and historical remediation experience information to assess the risks generated by executing the vulnerability remediation scripts and obtain the risk assessment results.

[0013] The instruction module is used to determine whether to instruct affected devices to execute vulnerability remediation scripts based on the risk assessment results.

[0014] Thirdly, the electronic device provided in the embodiments of the present invention includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the vulnerability repair method as described in any embodiment of the present invention.

[0015] Fourthly, the computer-readable storage medium provided in the embodiments of the present invention stores a computer program thereon, which, when executed by a processor, implements the vulnerability repair method as described in any embodiment of the present invention.

[0016] Fifthly, the computer program product provided in the embodiments of the present invention includes a computer program that, when executed by a processor, implements the vulnerability repair method as described in any embodiment of the present invention.

[0017] In this embodiment of the invention, by obtaining vulnerability description files from a vulnerability disclosure database, the standardization and reliability of the vulnerability description files are ensured, providing a data foundation for vulnerability remediation. Parsing the vulnerability description files using a file parsing model allows for the precise extraction of key information related to vulnerability remediation, transforming it into easily processed, structured, and standardized vulnerability remediation element information, reducing interference from irrelevant information. By determining affected devices based on the impact scope information, all devices in the distributed system affected by the vulnerability are accurately located. Obtaining the system status information of the affected devices provides a crucial basis for generating subsequent vulnerability remediation scripts. By considering remediation guidance information and the system status information of affected devices when generating vulnerability remediation scripts, it is ensured that the vulnerability remediation scripts are consistent with the system status information of the affected devices. Accurate matching of system status information affecting devices increases the probability of successful vulnerability patching scripts. By inputting the system status information of affected devices and vulnerability patching scripts into the remediation risk assessment model, the risks associated with executing vulnerability patching scripts are evaluated, achieving precise quantification of the potential risks and providing a decision-making basis for vulnerability patching script execution strategies. Risk assessment is conducted through a remediation risk assessment model based on vulnerability feature information and historical remediation experience information, forming a data closed loop, so that the accuracy of risk assessment continuously improves with the accumulation of historical remediation experience information. By determining whether to instruct affected devices to execute vulnerability patching scripts based on the risk assessment results, high-risk vulnerability patching scripts are prevented from running, ensuring the stability of the production environment. Attached Figure Description

[0018] To more clearly illustrate the technical solution of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart illustrating a vulnerability repair method provided in an embodiment of the present invention;

[0020] Figure 2 This is another flowchart illustrating the vulnerability repair method provided in this embodiment of the invention;

[0021] Figure 3 This is a schematic diagram of a vulnerability repair device provided in an embodiment of the present invention;

[0022] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0023] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0024] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0025] Figure 1 This is a flowchart illustrating a vulnerability remediation method provided in an embodiment of the present invention. The vulnerability remediation method provided in this embodiment is applicable to scenarios involving the remediation of security vulnerabilities in devices within a distributed system. This vulnerability remediation method can be executed by a vulnerability remediation device provided in this embodiment, which can be implemented using software and / or hardware. In a specific embodiment, the device can be integrated into an electronic device, such as a computer or server. The following embodiment illustrates the integration of the vulnerability remediation device into an electronic device. See also... Figure 1 The vulnerability remediation method in this embodiment may include the following steps:

[0026] Step 101: Obtain the vulnerability description file from the vulnerability disclosure database.

[0027] A vulnerability disclosure database refers to a database built and maintained by an organization or institution for collecting and disclosing vulnerability information. Vulnerability disclosure databases typically contain unique vulnerability identifiers and standardized descriptions. For example, a vulnerability disclosure database could be a Common Vulnerabilities and Exposures (CVE) database. A vulnerability description file is a document containing textual descriptions of a specific vulnerability extracted from a vulnerability disclosure database. Vulnerability description files may include: the software involved in the vulnerability, the type of vulnerability, the software versions affected by the vulnerability, the cause of the vulnerability, and official remediation recommendations. For example, after knowing the CVE identifier for vulnerability A in the CVE database, web crawler technology can be used to automatically crawl the standardized description text corresponding to the CVE identifier of A from the CVE database's application programming interface or webpage, and use this as the vulnerability description file.

[0028] In this embodiment, by obtaining vulnerability description files from a vulnerability disclosure database, the standardization and reliability of the vulnerability description files are ensured, providing a data foundation for vulnerability remediation.

[0029] Step 102: Use the file parsing model to parse the vulnerability description file to obtain vulnerability remediation element information, which includes vulnerability characteristic information, impact scope information, and remediation guidance information.

[0030] A file parsing model refers to a text processing model used to parse unstructured vulnerability description files to obtain structured vulnerability remediation information. For example, a file parsing model can be a trained large language model for processing vulnerability description text. Parsing a vulnerability description file refers to the process of using a file parsing model to extract vulnerability remediation-related information elements from the vulnerability description text and organize them into a structured data set. Vulnerability remediation information elements refer to the set of information elements related to vulnerability remediation extracted from the vulnerability description. For example, the vulnerability remediation information can be in JSON or XML format. Vulnerability feature information refers to information elements used to identify and classify the attributes of the vulnerability itself. For example, vulnerability feature information can be a vulnerability type, such as "operating system command injection". Impact scope information refers to detailed information that clearly defines the specific software components and their version ranges affected by the vulnerability. For example, it can include the name of the affected software and the affected versions of the affected software, such as nginx versions 1.18.0 to 1.20.0. The remediation guidance information refers to the specific action plan or suggestions proposed to eliminate the vulnerability. For example, it may be to upgrade the software to a secure target version, such as upgrading nginx to version 1.20.1 or higher, or to modify the contents of the configuration file, such as "set allow_url_include to off in the php.ini configuration file".

[0031] In this embodiment, by parsing the vulnerability description file using a file parsing model, key information related to vulnerability remediation can be accurately extracted and transformed into easily processed, structured, and standardized vulnerability remediation element information, reducing interference from irrelevant information.

[0032] Step 103: Determine the affected devices based on the scope of impact information and obtain the system status information of the affected devices.

[0033] Specifically, filtering conditions can be set based on the impact scope information of a specific vulnerability, filtering the information of devices in the current distributed system stored in the database of the distributed system, thereby filtering out all devices that meet the filtering conditions as affected devices.

[0034] Affected devices refer to the devices in a distributed system that are affected by a specific vulnerability, as determined by the impact scope information. For example, if the impact scope is nginx versions 1.18.0 to 1.20.0, affected devices could be all servers in the distributed system that have nginx software installed, with versions between 1.18.0 and 1.20.0. System status information for affected devices refers to a set of reference data obtained from the affected devices for developing remediation plans for the specific vulnerability. For example, system status information for affected devices could include the currently installed version of the affected software, the contents of the affected software's configuration files, the services running under the affected software and their status, the operating system version, etc.

[0035] In this embodiment, by determining the affected devices based on the scope of impact information, the system can accurately locate all devices affected by the vulnerability in the distributed system. Obtaining the system status information of the affected devices provides a key basis for the generation of subsequent vulnerability remediation scripts.

[0036] Step 104: Generate a vulnerability remediation script based on the remediation guidance information and the system status information of the affected devices.

[0037] A vulnerability remediation script is a sequence of executable instructions that can be executed automatically on an affected device to fix a specific vulnerability. For example, a vulnerability remediation script can be a Bash or PowerShell script file containing instructions to modify configuration files using sed or awk commands, to bring configuration files to a secure state, or to upgrade affected software on an affected device to a specified secure version using apt packages.

[0038] There are several methods for generating vulnerability remediation scripts. For example, script templates can be defined for common remediation methods, such as software upgrades and configuration file modifications. Then, based on the remediation guidance information and system status information, an executable vulnerability remediation script instance can be generated by replacing strings and selecting logical branches in the script template. Alternatively, the remediation guidance information and system status information can be used as prompts to generate vulnerability remediation scripts by calling a code generation model pre-trained on a large-scale code dataset.

[0039] In this embodiment, by taking into account the repair guidance information and the system status information of the affected device to generate the vulnerability repair script, it is possible to ensure that the vulnerability repair script and the system status information of the affected device are accurately matched, thereby increasing the probability that the vulnerability repair script will successfully repair the vulnerability.

[0040] Step 105: Input the system status information of the affected device and the vulnerability remediation script into the remediation risk assessment model, so as to use the remediation risk assessment model to assess the risk generated by executing the vulnerability remediation script based on vulnerability feature information and historical remediation experience information, and obtain the risk assessment result.

[0041] A remediation risk assessment model is a computational predictive model that, based on input system status information and vulnerability remediation scripts, comprehensively considers vulnerability characteristic information and historical remediation experience information to assess the degree of risk that executing a vulnerability remediation script on a currently affected device may cause. For example, a remediation risk assessment model can be a machine learning model trained based on vulnerability characteristic information and historical remediation experience information. Historical remediation experience information refers to a dataset accumulated and structured from historical vulnerability remediation operations. For example, historical remediation experience information may include system status information from several historical vulnerability remediation operations, the vulnerability remediation scripts and the success or failure of executing the remediation scripts, as well as other negative consequences caused by the remediation. The risk assessment result refers to the risk assessment result derived by the risk assessment model based on the current input system status information and vulnerability remediation scripts, regarding the degree of risk of executing the vulnerability remediation scripts. The risk assessment result can be a risk assessment score with a numerical value between 0 and 100, using the numerical value to quantify the degree of impact of the risk or the probability of the risk occurring, or it can be a risk level, such as "high risk," "medium risk," or "low risk."

[0042] In this embodiment, the system status information of the affected device and the vulnerability repair script are input into the repair risk assessment model to assess the risks generated by executing the vulnerability repair script. This achieves accurate quantification of the potential risks of executing the vulnerability repair script and provides a decision-making basis for the execution strategy of the vulnerability repair script. By conducting risk assessment based on vulnerability feature information and historical repair experience information, a data closed loop is formed, so that the accuracy of risk assessment continues to improve with the accumulation of historical repair experience information.

[0043] Step 106: Based on the risk assessment results, determine whether to instruct the affected devices to execute the vulnerability remediation script.

[0044] Specifically, the execution of vulnerability remediation scripts can be controlled based on the risk assessment results, with differentiated handling strategies applied to scripts with varying levels of risk. For example, if the risk assessment result is "low risk," the affected devices can execute the vulnerability remediation script; if the risk assessment result is "high risk," the script cannot be executed and is regenerated; if the risk assessment result is "medium risk," several affected devices can be selected as test devices to execute the script, and the effectiveness of the remediation on these devices can be observed. If the script successfully eliminates the vulnerability on the test devices without causing unavailability of services running on them, then the script can be executed on all affected devices.

[0045] In this embodiment, by determining whether to instruct affected devices to execute vulnerability remediation scripts based on risk assessment results, the system prevents high-risk vulnerability remediation scripts from running during the vulnerability remediation process, thus ensuring the stability of the production environment.

[0046] In this embodiment, by obtaining vulnerability description files from a vulnerability disclosure database, the standardization and reliability of the vulnerability description files are ensured, providing a data foundation for vulnerability remediation. Parsing the vulnerability description files using a file parsing model allows for the precise extraction of key information related to vulnerability remediation, transforming it into easily processed, structured, and standardized vulnerability remediation elements, reducing interference from irrelevant information. Determining affected devices based on the impact scope information enables precise location of all devices affected by the vulnerability in the distributed system. Obtaining the system status information of the affected devices provides a crucial basis for generating subsequent vulnerability remediation scripts. By considering both remediation guidance information and the system status information of the affected devices when generating vulnerability remediation scripts, it is ensured that the vulnerability remediation scripts are consistent with the affected devices. The system status information of affected devices is accurately matched to improve the probability of successful vulnerability patching by the vulnerability patching script. By inputting the system status information of affected devices and the vulnerability patching script into the patching risk assessment model, the risks arising from the execution of the vulnerability patching script are assessed, thus accurately quantifying the potential risks of vulnerability patching script execution and providing a decision-making basis for vulnerability patching script execution strategies. Risk assessment is conducted through a patching risk assessment model based on vulnerability feature information and historical patching experience information, forming a data closed loop, so that the accuracy of risk assessment continues to improve with the accumulation of historical patching experience information. By determining whether to instruct affected devices to execute vulnerability patching scripts based on the risk assessment results, high-risk vulnerability patching scripts are prevented from running, ensuring the stability of the production environment.

[0047] The following is combined Figure 2 The vulnerability repair method provided in the embodiments of the present invention will be further explained. Figure 2This is another flowchart illustrating the vulnerability remediation method provided in this embodiment of the invention. (See attached diagram.) Figure 2 The vulnerability remediation method in this embodiment may include:

[0048] Step 201: Obtain the vulnerability description file from the vulnerability disclosure database.

[0049] Optionally, obtaining vulnerability description files from vulnerability disclosure databases includes:

[0050] Check if any new vulnerability description files have been added to the vulnerability disclosure database;

[0051] If a new vulnerability description file is added to the vulnerability disclosure database, retrieve the new vulnerability description file from the vulnerability disclosure database.

[0052] For example, a distributed system can periodically and automatically retrieve the CVE database and obtain the vulnerability description file when a new vulnerability is disclosed in the vulnerability disclosure database.

[0053] In this embodiment, by detecting whether new vulnerability description files have been added to the vulnerability disclosure database, newly disclosed vulnerabilities can be discovered in a timely manner.

[0054] Optionally, a vulnerability description file may be obtained from a vulnerability disclosure database, including: obtaining a vulnerability description file from a vulnerability disclosure database in response to a vulnerability remediation instruction issued by the operations and maintenance department.

[0055] The operations and maintenance (O&M) client refers to the client used by O&M personnel for the operation and maintenance of distributed system hardware and software resources. For example, the O&M client can be a personal computer used by O&M personnel with specific management tools installed. A vulnerability remediation instruction refers to a command initiated by O&M personnel on the O&M client, requesting the distributed system to perform a remediation process for a specific vulnerability. The vulnerability remediation instruction clearly defines the goal of the remediation operation. For example, a vulnerability remediation instruction can be a structured request that must contain a unique identifier for the vulnerability, such as a CVE number. For example, O&M personnel can input the CVE number containing the specific vulnerability from the O&M client's interface to initiate a vulnerability remediation instruction. This causes the scheduling service in the distributed system to respond to the vulnerability remediation instruction, initiate a query request to the CVE database, and retrieve the corresponding vulnerability description file based on the CVE number.

[0056] In this embodiment, by responding to vulnerability remediation instructions issued by the operations and maintenance team, the professional judgment of operations and maintenance personnel can be used to discover critical vulnerabilities in the distributed system, which is more flexible.

[0057] Optionally, a vulnerability description file may be obtained from a vulnerability disclosure database, including: obtaining a vulnerability description file from a vulnerability disclosure database in response to a vulnerability detection tool detecting a software vulnerability.

[0058] A vulnerability detection tool can be understood as software or services that automatically identify known vulnerabilities by scanning the software configuration of devices in a distributed system. For example, a vulnerability detection tool can be a professional vulnerability scanner, such as Qualys. For instance, a distributed system can periodically call the application programming interface (API) of the vulnerability detection tool to automatically scan the device's software configuration, such as software version, configuration files, and open ports, and generate a report containing CVE numbers of potential vulnerabilities in the distributed system. Then, based on the CVE numbers in the report, the system can retrieve the corresponding vulnerability description files from a designated vulnerability disclosure database.

[0059] In this embodiment, software vulnerabilities are detected by vulnerability detection tools, which can be used to specifically discover vulnerabilities existing in the current system.

[0060] Step 202: Use the file parsing model to parse the vulnerability description file to obtain vulnerability remediation element information. The vulnerability remediation element information includes vulnerability characteristic information, impact scope information, and remediation guidance information. The impact scope information includes the affected software identifier and the affected software version.

[0061] The affected software identifier refers to the identifier used to determine the software affected by the vulnerability. For example, the affected software identifier can be a generic software name, such as nginx or Apache Struts, or a generic platform enumeration identifier. The affected software version refers to the range expression used to determine the version of the software affected by the vulnerability. For example, the affected software version can be a specific version number, such as 1.18.0, or a version range, such as 1.18.0 to 1.20.0.

[0062] Step 203: Send a data acquisition command to the candidate device to instruct the candidate device to collect the software identifier and software version of its own running software.

[0063] A data acquisition command is a command issued by a distributed system that triggers candidate devices to collect information about their own software assets. The data acquisition command can specify the types of software the candidate device needs to collect and the standardized structure of the returned collection results. A candidate device is a device in the distributed system that may have vulnerabilities and is the object receiving the data acquisition command. Devices among the candidate devices that may be affected by specific vulnerabilities can be identified as affected devices. For example, candidate devices can be several servers deployed with specific services. The software identifier of the running software refers to the unique identifier of the software installed or running on the candidate device. The software identifier of the running software is used for precise matching with the identifier of the software affected by a specific vulnerability. The software version of the running software refers to the specific version number corresponding to the software identifier of the candidate device.

[0064] For example, the distributed system sends data collection instructions to all candidate devices. After receiving the instructions, the candidate devices will call system commands or access the local database to collect the software identifier and software version of the currently running software according to the software type specified in the data collection instructions.

[0065] Step 204: Receive the data acquisition results returned by the candidate device. The data acquisition results include the software identifier and software version of the software running on the corresponding candidate device.

[0066] Data acquisition results refer to structured data reports returned by candidate devices to the distributed system after receiving data acquisition instructions, containing information about their currently running software. Data acquisition results are the basis for determining whether a candidate device is affected by a specific vulnerability. For example, data acquisition results can be a list in JSON or XML format containing multiple entries, each containing two key fields: software identifier and software version.

[0067] Step 205: Match the software identifier and software version of the candidate device's own running software with the influencing software identifier and influencing software version.

[0068] Specifically, we can first determine whether the software identifier of the candidate device is consistent with the software identifier affected by the specific vulnerability. After confirming that the software identifiers are consistent, we can further determine whether the software version reported by the candidate device falls within the range of software versions affected by the specific vulnerability.

[0069] Step 206: Determine the affected devices from the candidate devices based on the matching results. The affected devices are candidate devices whose software identifier matches the affected software identifier and whose software version matches the affected software version.

[0070] Specifically, a candidate device can be identified as an affected device when it simultaneously meets the following conditions: the software identifier of its running software is consistent with the software identifier affected by a specific vulnerability, and the software version falls within the range of software versions affected by the specific vulnerability.

[0071] Step 207: Generate a vulnerability remediation script based on the remediation guidance information and the system status information of the affected devices.

[0072] Step 208: Input the system status information of the affected device and the vulnerability repair script into the repair risk assessment model, so as to use the repair risk assessment model to assess the risk generated by executing the vulnerability repair script based on vulnerability feature information and historical repair experience information, and obtain the risk assessment result, which includes a risk score.

[0073] A risk score is a numerical value predicted by a risk assessment model, used to quantify the probability and severity of negative consequences that may result from executing a specific vulnerability remediation script. It can provide a comprehensive risk score for the overall risk, or separate risk scores for different types of risks, such as service restart failures or service unavailability. For example, a risk score can be expressed as a percentage from 1 to 100 to quantify the probability that remediating a specific vulnerability will cause a distributed system service to become unavailable.

[0074] Step 209: If the risk score exceeds the preset value, determine that the affected device should not be instructed to execute the vulnerability remediation script.

[0075] The preset score refers to the highest risk tolerance threshold that a distributed system can withstand during the vulnerability remediation process. For example, when expressing the risk score as a percentage, a preset score of 50% means that if the probability of causing the distributed system service to become unavailable exceeds 50%, the distributed system will not execute the vulnerability remediation script.

[0076] In this embodiment, by not instructing the test device to execute the vulnerability repair script when the risk score exceeds a preset value, the execution of high-risk vulnerability repair scripts can be initially intercepted, preventing the introduction of uncontrollable risks in vulnerability repair.

[0077] Step 210: If the risk score does not exceed the preset score, instruct the test device to execute the vulnerability repair script to verify the vulnerability repair effect.

[0078] Test devices refer to the subset of devices that are preferentially selected to execute vulnerability remediation scripts and observe the actual effects of those scripts. For example, test devices can be devices that do not carry real business traffic but are configured similarly to the production environment, or they can be some devices in the production environment with relatively low business traffic. The vulnerability remediation effect refers to the overall result produced after the test devices execute the vulnerability remediation scripts. The vulnerability remediation effect can include whether the vulnerability has been eliminated and other impacts resulting from the vulnerability remediation. For example, this can be achieved by calling vulnerability scanning tools to verify whether the original vulnerability has been eliminated, by calling services running on the test devices to assess service availability, and by monitoring performance metrics such as service response latency to assess functional impact.

[0079] Specifically, a risk score not exceeding a preset value indicates that the probability or severity of negative consequences resulting from executing the vulnerability remediation script, as initially predicted by the risk assessment model, is within an acceptable range for the distributed system. Therefore, the vulnerability remediation effect can be verified on a small scale on test devices.

[0080] In this embodiment, by instructing the test device to execute the vulnerability repair script when the risk score does not exceed a preset value, the vulnerability repair effect of the vulnerability repair script is verified within a controllable range.

[0081] Step 211: If the vulnerability remediation effect meets expectations, determine the instructions to execute the vulnerability remediation script on the affected devices.

[0082] The effectiveness of vulnerability remediation can be understood as the execution result of the vulnerability remediation script on the test device meeting the preset success criteria. For example, the preset success criteria can be defined as the vulnerability remediation script being successfully executed on more than 90% of the test devices, and the scanning tool confirming that the specific vulnerability has been successfully eliminated, while the service on the test device can continue to operate normally.

[0083] Specifically, if the vulnerability remediation effect does not meet expectations, system status information, vulnerability remediation scripts and the success or failure of executing the remediation scripts, as well as other negative consequences caused by the remediation can be collected during the vulnerability remediation operation. After processing, this information can be used as historical remediation experience information to train the remediation risk assessment model.

[0084] In this embodiment, by determining that the affected devices should execute the vulnerability repair script when the vulnerability repair effect meets expectations, the uncontrollable risk of the vulnerability repair script running can be avoided from causing a large-scale impact on the production environment, thus ensuring the stability of the production environment.

[0085] In this embodiment, by detecting whether new vulnerability description files have been added to the vulnerability disclosure database, newly disclosed vulnerabilities can be discovered in a timely manner; by responding to vulnerability remediation instructions issued by the operations and maintenance (O&M) side, the professional judgment of O&M personnel can be used to discover critical vulnerabilities in the distributed system, providing greater flexibility; by using vulnerability detection tools to detect software vulnerabilities, vulnerabilities existing in the current system can be discovered in a targeted manner; by obtaining vulnerability description files from the vulnerability disclosure database, the standardization and reliability of the vulnerability description files are ensured, providing a data foundation for vulnerability remediation; by parsing the vulnerability description files using a file parsing model, key information related to vulnerability remediation can be accurately extracted and transformed into easily processed, structured, and standardized vulnerability remediation element information, reducing interference from irrelevant information; by determining the affected devices based on the impact scope information, all devices in the distributed system affected by the vulnerability can be accurately located; by obtaining the system status information of the affected devices, a key basis for the subsequent generation of vulnerability remediation scripts is provided; by generating vulnerability remediation scripts by considering remediation guidance information and the system status information of the affected devices, the vulnerability remediation scripts and the system status information of the affected devices can be ensured. Precise matching increases the probability of successful vulnerability patching by remediation scripts. By inputting the system status information of affected devices and the vulnerability patching script into the remediation risk assessment model, the risks arising from the execution of the vulnerability patching script are evaluated, achieving precise quantification of the potential risks of vulnerability patching script execution and providing a decision-making basis for vulnerability patching script execution strategies. Risk assessment is conducted through a remediation risk assessment model based on vulnerability feature information and historical remediation experience information, forming a data closed loop, so that the accuracy of risk assessment continuously improves with the accumulation of historical remediation experience information. By not instructing test devices to execute vulnerability patching scripts when the risk score exceeds a preset value, high-risk vulnerability patching script execution can be initially intercepted, preventing uncontrollable risks from being introduced during vulnerability patching. By instructing test devices to execute vulnerability patching scripts when the risk score does not exceed a preset value, the vulnerability patching effect of the script can be verified within a controllable range. By determining whether to instruct affected devices to execute vulnerability patching scripts when the vulnerability patching effect meets expectations, the uncontrollable risks of vulnerability patching script operation can be avoided from causing large-scale impacts on the production environment, ensuring the stability of the production environment.

[0086] Figure 3 This is a schematic diagram of a vulnerability repair device provided in an embodiment of the present invention, as shown below. Figure 3 As shown, the device includes:

[0087] Module 301 is used to obtain vulnerability description files from the vulnerability disclosure database;

[0088] The parsing module 302 is used to parse the vulnerability description file using the file parsing model to obtain vulnerability remediation element information, which includes vulnerability characteristic information, impact scope information, and remediation guidance information.

[0089] The determination module 303 is used to determine the affected devices based on the impact range information and obtain the system status information of the affected devices.

[0090] Module 304 is used to generate vulnerability remediation scripts based on remediation guidance information and system status information of affected devices.

[0091] The assessment module 305 is used to input the system status information of the affected device and the vulnerability remediation script into the remediation risk assessment model, so as to use the remediation risk assessment model to assess the risk generated by executing the vulnerability remediation script based on vulnerability feature information and historical remediation experience information, and obtain the risk assessment result.

[0092] Instruction module 306 is used to determine, based on the risk assessment results, whether to instruct the affected device to execute a vulnerability remediation script.

[0093] In one embodiment, the acquisition module 301 acquires a vulnerability description file from a vulnerability disclosure database, including:

[0094] Check if any new vulnerability description files have been added to the vulnerability disclosure database;

[0095] If a new vulnerability description file is added to the vulnerability disclosure database, retrieve the new vulnerability description file from the vulnerability disclosure database.

[0096] In one embodiment, the acquisition module 301 acquires a vulnerability description file from a vulnerability disclosure database, including: in response to a vulnerability remediation instruction issued by the operation and maintenance terminal, acquiring a vulnerability description file from the vulnerability disclosure database.

[0097] In one embodiment, the acquisition module 301 acquires a vulnerability description file from a vulnerability disclosure database, including: in response to a vulnerability detection tool detecting a software vulnerability, acquiring a vulnerability description file from the vulnerability disclosure database.

[0098] In one embodiment, the scope of impact information includes the affected software identifier and the affected software version; the determining module 303 determines the affected devices based on the scope of impact information, including:

[0099] Send data acquisition instructions to candidate devices to instruct them to collect the software identifier and software version of their own running software;

[0100] Receive data acquisition results returned by candidate devices. The data acquisition results include the software identifier and software version of the software running on the corresponding candidate device.

[0101] Match the software identifier and software version of the candidate device's own running software with the influencing software identifier and influencing software version;

[0102] The affected devices are determined from the candidate devices based on the matching results. The affected devices are candidate devices whose software identifier matches the affected software identifier and whose software version matches the affected software version.

[0103] In one embodiment, the risk assessment result includes a risk score; the instruction module 306 includes an instruction pause module and an instruction execution module, wherein:

[0104] The pause instruction module is used to determine whether to instruct affected devices to execute vulnerability remediation scripts if the risk score exceeds a preset value.

[0105] The instruction execution module is used to determine whether to instruct the affected device to execute a vulnerability remediation script if the risk score does not exceed a preset value.

[0106] In one embodiment, the instruction execution module determines that instructing the affected device to execute a vulnerability remediation script includes:

[0107] Instruct the test device to execute the vulnerability patching script to verify the effectiveness of the vulnerability patching;

[0108] If the vulnerability remediation is effective as expected, instruct the affected devices to execute the vulnerability remediation script.

[0109] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional modules is merely an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. The specific working process of the functional modules described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0110] The apparatus of this invention ensures the standardization and reliability of vulnerability description files by obtaining them from a vulnerability disclosure database, providing a data foundation for vulnerability remediation. By parsing the vulnerability description files using a file parsing model, it accurately extracts key information related to vulnerability remediation and transforms it into easily processed, structured, and standardized vulnerability remediation element information, reducing interference from irrelevant information. By determining affected devices based on the impact scope information, it accurately locates all devices affected by the vulnerability in the distributed system. Obtaining the system status information of the affected devices provides a crucial basis for generating subsequent vulnerability remediation scripts. By considering remediation guidance information and the system status information of affected devices in the generation of vulnerability remediation scripts, it ensures that the vulnerability remediation scripts and... Accurate matching of system status information of affected devices increases the probability of successful vulnerability patching by the vulnerability patching script. By inputting the system status information of affected devices and the vulnerability patching script into the patching risk assessment model, the risks arising from the execution of the vulnerability patching script are evaluated, achieving precise quantification of the potential risks of vulnerability patching script execution and providing a decision-making basis for vulnerability patching script execution strategies. Risk assessment is conducted through a patching risk assessment model based on vulnerability feature information and historical patching experience information, forming a data closed loop, so that the accuracy of risk assessment continues to improve with the accumulation of historical patching experience information. By determining whether to instruct affected devices to execute vulnerability patching scripts based on the risk assessment results, high-risk vulnerability patching scripts are prevented from running, ensuring the stability of the production environment.

[0111] The following is for reference. Figure 4 It shows a schematic diagram of the structure of a computer system 400 suitable for implementing an electronic device according to embodiments of the present invention. Figure 4 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments of the present invention.

[0112] like Figure 4 As shown, the computer system 400 includes a central processing unit (CPU) 401, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 402 or programs loaded from storage section 408 into random access memory (RAM) 403. The RAM 403 also stores various programs and data required for the operation of the computer system 400. The CPU 401, ROM 402, and RAM 403 are interconnected via a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0113] The following components are connected to I / O interface 405: input section 406 including keyboard, mouse, etc.; output section 407 including cathode ray tube, liquid crystal display, etc., and speakers, etc.; storage section 408 including hard disk, etc.; and communication section 409 including network interface card, such as modem, etc. Communication section 409 performs communication processing via a network such as the Internet. Drive 410 is also connected to I / O interface 405 as needed. Removable media 411, such as disk, optical disk, magneto-optical disk, semiconductor memory, etc., are installed on drive 410 as needed so that computer programs read from them can be installed into storage section 408 as needed.

[0114] In particular, according to the embodiments disclosed in this invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 409, and / or installed from removable medium 411. When the computer program is executed by central processing unit (CPU) 401, it performs the functions defined above in the system of this invention.

[0115] It should be noted that the computer-readable medium shown in this invention can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, a random access memory, a read-only memory, an erasable programmable read-only memory, an optical fiber, a portable compact disk read-only memory, an optical storage device, a magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this invention, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, etc., or any suitable combination thereof.

[0116] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0117] The modules and / or units described in the embodiments of the present invention can be implemented in software or hardware. The described modules and / or units can also be housed in a processor; for example, a processor can be described as including an acquisition module, a parsing module, a determining module, a generating module, an evaluation module, and an indicating module. The names of these modules do not necessarily limit the module itself.

[0118] In another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiments; or it may exist independently and not assembled into the device. The computer-readable medium carries one or more programs, which, when executed by the device, cause the device to include:

[0119] The vulnerability description file is obtained from the vulnerability disclosure database; the vulnerability description file is parsed using a file parsing model to obtain vulnerability remediation element information, including vulnerability characteristic information, impact scope information, and remediation guidance information; affected devices are identified based on the impact scope information, and system status information of the affected devices is obtained; a vulnerability remediation script is generated based on the remediation guidance information and the system status information of the affected devices; the system status information of the affected devices and the vulnerability remediation script are input into a remediation risk assessment model to assess the risk of executing the vulnerability remediation script based on the vulnerability characteristic information and historical remediation experience information, and obtain a risk assessment result; based on the risk assessment result, it is determined whether to instruct the affected devices to execute the vulnerability remediation script.

[0120] The technical solution of this invention ensures the standardization and reliability of vulnerability description files by obtaining them from a vulnerability disclosure database, providing a data foundation for vulnerability remediation. By parsing the vulnerability description files using a file parsing model, key information related to vulnerability remediation can be accurately extracted and transformed into easily processed, structured, and standardized vulnerability remediation element information, reducing interference from irrelevant information. By determining affected devices based on the impact scope information, all devices affected by the vulnerability in the distributed system can be accurately located. Obtaining the system status information of the affected devices provides a crucial basis for generating subsequent vulnerability remediation scripts. By considering remediation guidance information and the system status information of affected devices when generating vulnerability remediation scripts, the vulnerability remediation scripts can be ensured to be standardized and reliable. Precise matching with the system status information of affected devices increases the probability of successful vulnerability patching scripts. By inputting the system status information of affected devices and vulnerability patching scripts into the remediation risk assessment model, the risks arising from the execution of vulnerability patching scripts are evaluated, achieving precise quantification of the potential risks of vulnerability patching script execution and providing a decision-making basis for vulnerability patching script execution strategies. Risk assessment is conducted through a remediation risk assessment model based on vulnerability feature information and historical remediation experience information, forming a data closed loop, so that the accuracy of risk assessment continuously improves with the accumulation of historical remediation experience information. By determining whether to instruct affected devices to execute vulnerability patching scripts based on the risk assessment results, high-risk vulnerability patching scripts are prevented from running, ensuring the stability of the production environment.

[0121] This invention also provides a computer program product, including a computer program that, when executed by a processor, implements the vulnerability repair method provided in any embodiment of this invention.

[0122] In the implementation of a computer program product, computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof. Programming languages ​​include object-oriented programming languages ​​as well as conventional procedural programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including local area networks (LANs) or wide area networks (WANs), or it can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0123] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0124] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can occur depending on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method of patching a vulnerability, the method comprising: The method comprises the following steps: obtaining a vulnerability description file from a vulnerability disclosure database; parsing the vulnerability description file by using a file parsing model to obtain vulnerability repair element information, wherein the vulnerability repair element information comprises vulnerability characteristic information, influence range information and repair guidance information; determining an affected device according to the influence range information and obtaining system state information of the affected device; generating a vulnerability repair script according to the repair guidance information and the system state information of the affected device; inputting the system state information of the affected device and the vulnerability repair script into a repair risk assessment model to assess the risk of executing the vulnerability repair script based on the vulnerability characteristic information and historical repair experience information by using the repair risk assessment model, and obtaining a risk assessment result; determining whether to instruct the affected device to execute the vulnerability repair script based on the risk assessment result.

2. The method of claim 1, wherein, The risk assessment result comprises a risk score, and determining whether to instruct the affected device to execute the vulnerability repair script based on the risk assessment result comprises: in a case where the risk score exceeds a preset score value, determining not to instruct the affected device to execute the vulnerability repair script; in a case where the risk score does not exceed the preset score value, determining to instruct the affected device to execute the vulnerability repair script.

3. The method of claim 2, wherein, Determining to instruct the affected device to execute the vulnerability repair script comprises: instructing a test device to execute the vulnerability repair script to verify the vulnerability repair effect; in a case where the vulnerability repair effect meets an expectation, determining to instruct the affected device to execute the vulnerability repair script.

4. The method of claim 1, wherein, The influence range information comprises an affected software identifier and an affected software version, and determining the affected device according to the influence range information comprises: issuing a data collection instruction to a candidate device to instruct the candidate device to collect a software identifier and a software version of a software running on the candidate device; receiving a data collection result returned by the candidate device, wherein the data collection result comprises the software identifier and the software version of the software running on the candidate device; matching the software identifier and the software version of the software running on the candidate device with the affected software identifier and the affected software version; and determining the affected device from the candidate device according to a matching result, wherein the affected device is a candidate device whose software identifier matches the affected software identifier and whose software version matches the affected software version.

5. The method of claim 1, wherein, Obtaining the vulnerability description file from the vulnerability disclosure database comprises: detecting whether a new vulnerability description file is added to the vulnerability disclosure database; in a case where a new vulnerability description file is added to the vulnerability disclosure database, obtaining the new vulnerability description file from the vulnerability disclosure database.

6. The method of claim 1, wherein, Obtaining the vulnerability description file from the vulnerability disclosure database comprises: in response to a vulnerability repair instruction issued by an operation and maintenance end, obtaining the vulnerability description file from the vulnerability disclosure database.

7. The method of claim 1, wherein, Obtaining the vulnerability description file from the vulnerability disclosure database comprises: in response to a software vulnerability detected by a vulnerability detection tool, obtaining the vulnerability description file from the vulnerability disclosure database.

8. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the program to implement the vulnerability repair method in any one of claims 1 to 7.

9. A computer-readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the vulnerability repair method in any one of claims 1 to 7.

10. A computer program product, characterised in that, The computer program product comprises a computer program, and the computer program is executed by the processor to implement the vulnerability repair method in any one of claims 1 to 7.

Images