Asset vulnerability repairing method, device and equipment based on large model and medium
By using large-scale models for semantic analysis and information supplementation, the problem of unstructured data processing was solved, enabling efficient and accurate association between vulnerabilities and assets, generating visual reports, and improving the accuracy and efficiency of vulnerability investigation.
Patent Information
- Application Number
- CN202511685393.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-17
- Publication Date
- 2026-02-10
AI Technical Summary
Existing technologies struggle to handle unstructured data during vulnerability investigation, leading to inefficiency and a high risk of misjudgment. Furthermore, they lack the ability to recognize diverse product names and English aliases, making it impossible to accurately link vulnerabilities with assets.
A large model is used for semantic analysis to extract vulnerability feature information and asset association clues. Information is supplemented by network resources to establish a mapping relationship between product standard names and versions. A deep semantic matching algorithm is used to calculate the association probability and generate a visual report.
It achieves efficient and accurate vulnerability and asset association, reduces manual intervention, improves the accuracy and efficiency of vulnerability investigation, and reduces the false alarm rate.
Smart Images
Figure CN121502772A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of information security, and in particular to a method, apparatus, device and medium for asset vulnerability repair based on a large model. Background Technology
[0002] In the field of information security management, vulnerability investigation is a core step for large enterprises to meet the compliance requirements of higher-level regulators, and its efficiency and accuracy directly affect the timeliness of asset security protection. Currently, two major problems are faced in the vulnerability investigation process: First, vulnerability notices issued by higher-level regulatory authorities are mostly in unstructured form, often accompanied by problems such as vague scope of vulnerability impact and missing key information, making them difficult to be directly identified by existing systems; second, the data sources of customer asset databases are mixed, including manual sorting records, data collected by endpoint security software, and software component analysis reports, resulting in problems such as non-standard product names, inconsistent version number expressions, and confusing Chinese and English aliases in asset fingerprints, further exacerbating the difficulty of associating vulnerabilities with assets.
[0003] In existing technical solutions, traditional asset management platforms and threat intelligence systems generally rely on structured data input and lack the ability to effectively process unstructured data. They require manual conversion of reported data into a standard format before vulnerability and asset association matching can be performed, which is not only inefficient but also prone to misjudgment due to human operation. In addition, existing technical solutions lack the ability to generalize the recognition of product aliases and industry slang, cannot cope with the diverse expressions of asset names, and cannot supplement the missing vulnerability information in the report, further exacerbating the difficulty of association. Summary of the Invention
[0004] In view of this, the purpose of this application is to provide a method, apparatus, device, and medium for asset vulnerability remediation based on a large model, which integrates semantic understanding of the large model and external information supplementation to achieve efficient, accurate, and low-intervention vulnerability investigation. The specific solution is as follows:
[0005] Firstly, this application provides a method for remediating asset vulnerabilities based on a large model, including:
[0006] The system receives asset vulnerability notification data, performs semantic analysis on the data using a pre-set large model, and extracts vulnerability feature information and asset association clues. The vulnerability feature information includes vulnerability number, hazard type, and affected version. The asset association clues are relevant information about potentially affected assets identified from the asset vulnerability notification data.
[0007] If there are ambiguous or missing information about a target vulnerability in the vulnerability feature information and the asset association clues, supplementary information about the target vulnerability is extracted from publicly available online resources; the supplementary information includes the actual impact of the target vulnerability on different assets;
[0008] Based on the preset product standard name, the different product names of the same product in the asset data of the customer asset library are unified, and the mapping relationship between the product standard name, product alias and corresponding version is established to obtain standardized asset data.
[0009] By using a pre-defined large model, the vulnerability feature information, asset association clues, standardized asset data, and supplementary information, the association probability between the vulnerability and the asset is determined. The association probability is then used to generate a visualized association report, which is used to repair the assets affected by the vulnerability.
[0010] Optionally, the receiving of asset vulnerability notification data involves performing semantic analysis on the data using a pre-defined large model, and extracting vulnerability feature information and asset association clues, including:
[0011] Receive asset vulnerability notification data, identify the asset vulnerability notification data, and determine whether there is a data segment in the asset vulnerability notification data that conforms to a preset common vulnerability data format;
[0012] If the asset vulnerability notification data contains a data segment that conforms to a preset common vulnerability data format, then the preset matching method is used to directly match the data segment to obtain a matching result;
[0013] Determine whether the confidence level of the matching result reaches a preset confidence threshold. If the confidence level of the matching result reaches the preset confidence threshold, then determine the vulnerability feature information and asset association clues corresponding to the asset vulnerability notification data based on the matching result. If the confidence level of the matching result does not reach the preset confidence threshold, then perform semantic analysis on the asset vulnerability notification data through a preset large model, and extract vulnerability feature information and asset association clues.
[0014] Optionally, the step of extracting supplementary information about the target vulnerability from publicly available network resources includes:
[0015] The web crawler technology is used to capture multi-source data related to the target vulnerability, and the multi-source data is then denoised, deduplicated, and formatted.
[0016] The credibility of the preprocessed multi-source data is evaluated based on a pre-defined large model. If the credibility evaluation result reaches the pre-defined credibility threshold, the preprocessed multi-source data will be used as supplementary information.
[0017] Optionally, the step of unifying different product names of the same product in the customer asset database based on preset product standard names, and establishing a mapping relationship between product standard names, product aliases, and corresponding versions, includes:
[0018] Merge asset data with the same product name and version number in the customer asset database;
[0019] By leveraging the semantic understanding and entity recognition capabilities of a pre-defined large model, the merged asset data is identified and normalized to map non-standard product names in the merged asset data to pre-defined standard product names.
[0020] The version numbers of different expressions in the merged asset data are unified into preset standardized version numbers. A mapping table between product standard names, product aliases and standardized version numbers is established based on product standard names and standardized version numbers.
[0021] Optionally, determining the correlation probability between the vulnerability and the asset includes:
[0022] For any vulnerability-asset combination, the association probability between the vulnerability and the asset in the vulnerability-asset combination is calculated twice to obtain two association probability values; the association probability calculation is a comprehensive evaluation based on version matching dimension, type matching dimension and case gain dimension.
[0023] The version matching dimension is used to assess whether the specific version number of the asset falls within the affected version range of the vulnerability; the type matching dimension is used to assess whether the product type of the asset is consistent with the product type targeted by the vulnerability; and the case gain dimension is used to assess whether there is supplementary information from public network resources that can confirm that the vulnerability has been exploited or attacked in a specific product or environment.
[0024] A consistency check is performed on the two associated probability values. If the difference between the two associated probability values does not exceed a preset difference threshold, the average of the two associated probability values is taken as the final associated probability of any vulnerability-asset combination.
[0025] If the difference between the two associated probability values exceeds a preset difference threshold, a third associated probability calculation is performed. If two of the three associated probability values corresponding to the three associated probability calculations are the same, then the same associated probability value is taken as the final associated probability of any vulnerability-asset combination. If the three associated probability values are not the same, then the calculation weight of at least one of the version matching dimension, the type matching dimension, and the case gain dimension is adjusted based on the preset weight correction rule, and the associated probability is recalculated using the adjusted dimension weights to obtain the final associated probability between the vulnerability and the asset.
[0026] Optionally, the asset vulnerability remediation method based on large models further includes:
[0027] Construct a vulnerability exploitation condition knowledge base that includes the conditions that must be met to trigger a vulnerability; the conditions that must be met to trigger a vulnerability include process name, open port status, command line parameter characteristics, and system configuration parameters;
[0028] Collect the actual operational status data of the target asset corresponding to the vulnerability in the asset vulnerability notification data; the actual operational status data of the asset includes process data, port status data, and system configuration file data;
[0029] The vulnerability exploitation condition knowledge base is matched and verified with the actual operating status data of the asset, and a vulnerability exploitability assessment conclusion is generated based on the matching and verification results; the vulnerability exploitability assessment conclusion is a conclusion on whether the vulnerability has the characteristics of being successfully exploited by an attacker and causing actual harm.
[0030] Based on the vulnerability exploitability assessment results and the probability of association between the vulnerability and the asset, a visualized association report is generated.
[0031] Optionally, the step of generating a visualized correlation report based on the vulnerability exploitability assessment conclusion and the correlation probability between the vulnerability and the asset includes:
[0032] Based on the vulnerability exploitability assessment results and the correlation probability between vulnerabilities and assets, a comprehensive risk score is determined for each vulnerability-asset combination.
[0033] Based on the comprehensive risk score, the vulnerability-asset portfolio is prioritized and a visual correlation report containing the priority ranking is generated.
[0034] Accordingly, the remediation of assets affected by the vulnerability based on the associated report includes:
[0035] Repair work orders are created based on the priority order in the visualization report, so that maintenance personnel can perform targeted repair operations on affected assets according to the priority order of the repair work orders.
[0036] Secondly, this application provides an asset vulnerability remediation device based on a large model, comprising:
[0037] The data extraction module is used to receive asset vulnerability notification data, perform semantic analysis on the asset vulnerability notification data through a preset large model, and extract vulnerability feature information and asset association clues. The vulnerability feature information includes vulnerability number, hazard type, and affected version. The asset association clues are relevant information of potentially affected assets identified from the asset vulnerability notification data.
[0038] The information acquisition module is used to extract supplementary information about the target vulnerability from publicly available network resources if there is ambiguous or missing information in the vulnerability feature information and the asset association clues; the supplementary information includes the actual impact of the target vulnerability on different assets;
[0039] The data standardization module is used to unify different product names of the same product in the asset data of the customer's asset library based on the preset product standard name, and to establish a mapping relationship between the product standard name, product alias and corresponding version to obtain standardized asset data.
[0040] The asset remediation module is used to determine the correlation probability between vulnerabilities and assets by using the vulnerability feature information, asset association clues, standardized asset data and supplementary information through a preset large model, and to generate a visualized correlation report using the correlation probability, so as to remediate the assets affected by the vulnerability based on the correlation report.
[0041] Thirdly, this application provides an electronic device, comprising:
[0042] Memory, used to store computer programs;
[0043] A processor is used to execute the computer program to implement the aforementioned asset vulnerability remediation method based on a large model.
[0044] Fourthly, this application provides a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the aforementioned asset vulnerability repair method based on a large model.
[0045] In this application, asset vulnerability notification data is received, and semantic analysis is performed on the data using a pre-defined large-scale model to extract vulnerability feature information and asset association clues. The vulnerability feature information includes vulnerability number, hazard type, and affected version. The asset association clues are relevant information about potentially affected assets identified from the vulnerability notification data. If there are ambiguous or missing information about a target vulnerability in the vulnerability feature information and asset association clues, supplementary information about the target vulnerability is extracted from publicly available online resources. The supplementary information includes the actual impact of the target vulnerability on different assets. Based on a pre-defined product standard name, different product names of the same product in the customer's asset database are unified, establishing a mapping relationship between the product standard name, product alias, and corresponding version to obtain standardized asset data. Using the pre-defined large-scale model, the vulnerability feature information, asset association clues, standardized asset data, and supplementary information are used to determine the association probability between the vulnerability and the asset. A visualized association report is generated using the association probability to repair the affected assets based on the report. As shown above, this application utilizes a large-scale model to perform semantic analysis on unstructured asset vulnerability notification data, automatically extracting vulnerability feature information and asset association clues. Leveraging the natural language processing capabilities of the large-scale model, it directly parses unstructured text without manual conversion to a standard format, avoiding the inefficiency and risk of misjudgment caused by manual intervention. Utilizing the named entity recognition and semantic understanding capabilities of the large-scale model, different names of the same product are unified into a standard name and associated with corresponding versions, solving the association difficulties caused by diverse asset name expressions and achieving accurate cross-language and cross-alias matching. For target vulnerabilities with incomplete information, supplementary information is automatically extracted from publicly available network resources, ensuring more comprehensive data support for association analysis and thus improving association accuracy. By integrating vulnerability feature information, asset association clues, standardized asset data, and supplementary information using the large-scale model, a deep semantic matching algorithm is used to calculate the association probability between vulnerabilities and assets. This process is fully automated, reducing manual operation and generating a visual association report, shortening vulnerability investigation time and reducing false positive rates. Attached Figure Description
[0046] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.
[0047] Figure 1 This application discloses a flowchart of an asset vulnerability remediation method based on a large model.
[0048] Figure 2 This application discloses a specific asset vulnerability remediation method based on a large model.
[0049] Figure 3 This is a schematic diagram of the structure of an asset vulnerability repair device based on a large model disclosed in this application;
[0050] Figure 4 This is a schematic diagram of the structure of an electronic device disclosed in this application. Detailed Implementation
[0051] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0052] In existing technical solutions, traditional asset management platforms and threat intelligence systems lack effective processing capabilities for unstructured data. They require manual conversion of reported data into a standard format before vulnerability and asset association matching can be performed, which is not only inefficient but also prone to misjudgment due to human error. Furthermore, existing solutions lack the ability to generalize the recognition of product aliases and industry slang, failing to handle diverse asset names and struggling to supplement missing vulnerability information in reports, further exacerbating the difficulty of association. Therefore, this application provides an asset vulnerability remediation method based on a large model, integrating large model semantic understanding and external information supplementation to achieve efficient, accurate, and low-human-intervention vulnerability investigation.
[0053] See Figure 1 As shown in the figure, this application discloses an asset vulnerability remediation method based on a large model, including:
[0054] Step S11: Receive asset vulnerability notification data, perform semantic analysis on the asset vulnerability notification data using a preset large model, and extract vulnerability feature information and asset association clues; the vulnerability feature information includes vulnerability number, hazard type, and affected version; the asset association clues are relevant information of potentially affected assets identified from the asset vulnerability notification data.
[0055] In this embodiment, asset vulnerability notification data is first received and identified. The system determines whether a data segment conforms to a preset common vulnerability data format, such as vulnerability number format, standard version number format, or fixed hazard type keywords. If a data segment conforms to this format, a preset matching method can be used to directly match it, yielding a matching result. For example, if the notification contains "CVE-2023-1234 affects versions V2.0-V4.0," where "CVE-2023-1234" conforms to the vulnerability number format and "V2.0-V4.0" conforms to the version format, these two pieces of information can be directly extracted using regular expressions, resulting in the matching result: "Vulnerability Number: CVE-2023-1234, Affected Versions: V2.0-V4.0". Then, it is determined whether the confidence level of the matching result reaches the preset confidence threshold. If the confidence level of the matching result reaches the preset confidence threshold, the vulnerability feature information and asset association clues corresponding to the asset vulnerability notification data can be determined based on the matching result. If the confidence level of the matching result does not reach the preset confidence threshold, the asset vulnerability notification data can be semantically analyzed through a preset large model, and vulnerability feature information and asset association clues can be extracted.
[0056] For data that conforms to common vulnerability data formats, matching can be performed without processing through a large model. Using a large model to process data with insufficient confidence can reduce the consumption of large model tokens, which not only ensures the processing capability of unstructured data, but also avoids the overuse of large models and improves the overall processing efficiency.
[0057] For example, when receiving unstructured notification files uploaded by users, there is no need to convert the unstructured notification files into a standard format. The original data text can be obtained directly by parsing the notification files. Then, using large-scale pre-trained language models, such as GPT-4 (Generative Pre-trained Transformer 4) and subsequent iterative models, semantic analysis can be performed on the original data text to extract vulnerability feature information and asset association clues.
[0058] Step S12: If there is a target vulnerability with ambiguous or missing information in the vulnerability feature information and the asset association clues, extract supplementary information about the target vulnerability from publicly available network resources; the supplementary information includes the actual impact of the target vulnerability on different assets.
[0059] In this embodiment, for target vulnerabilities in asset vulnerability notification data that have ambiguous or missing information, such as a vulnerability not explicitly stating supported product versions, publicly available online resources can be searched to obtain the actual impact of the vulnerability in different products and generate supplementary information. Specifically, this can include: using web crawling technology to crawl multi-source data related to the target vulnerability, and then denoising, deduplicating, and standardizing the format of the multi-source data. Then, the credibility of the preprocessed multi-source data is evaluated based on a preset large-scale model. If the credibility evaluation result reaches a preset credibility threshold, the preprocessed multi-source data is used as supplementary information. For example, relevant information can be crawled from public search engines using web crawling technology to supplement the missing data in the asset vulnerability notification data, such as the vulnerability's impact scope and product association characteristics, thereby enhancing the reasoning basis of the large-scale model.
[0060] Step S13: Based on the preset product standard name, unify the different product names of the same product in the asset data of the customer asset library, establish the mapping relationship between the product standard name, product alias and corresponding version, so as to obtain standardized asset data.
[0061] In this embodiment, asset data with the same product name and version number imported into the customer asset database can be merged, and the disordered asset data can be standardized to reduce the computational load of subsequent large model analysis and improve efficiency. Specifically, this can include: first, merging asset data with the same product name and version number in the customer asset database; then, using the semantic understanding and entity recognition capabilities of the preset large model, identifying and normalizing the merged asset data, such as identifying Chinese and English aliases and industry colloquialisms of product names, to map non-standard product names in the merged asset data to preset standard product names; next, unifying the version numbers in different expressions in the merged asset data into preset standardized version numbers, and establishing a mapping relationship table between standard product names, product aliases, and standardized version numbers based on standard product names and standardized version numbers.
[0062] Step S14: Using a preset large model, the vulnerability feature information, the asset association clues, the standardized asset data, and the supplementary information, determine the association probability between the vulnerability and the asset. Use the association probability to generate a visualized association report, and repair the assets affected by the vulnerability based on the association report.
[0063] In this embodiment, a large model can be used to combine vulnerability feature information, asset association clues, standardized asset data, and external supplementary information to calculate the association probability between vulnerabilities and assets through a deep semantic matching algorithm.
[0064] Determining the association probability between vulnerabilities and assets can include: for any vulnerability-asset combination, calculating the association probability twice between the vulnerability and the asset in that combination to obtain two association probability values; the association probability calculation is based on a comprehensive evaluation of version matching, type matching, and case gain dimensions; specifically, the version matching dimension assesses whether the specific version number of the asset falls within the affected version range of the vulnerability; the type matching dimension assesses whether the product type of the asset is consistent with the product type targeted by the vulnerability; and the case gain dimension assesses whether there is supplementary information from publicly available network resources that can confirm that the vulnerability has been exploited or attacked in a specific product or environment. A consistency check is performed on the two association probability values; if the difference between the two association probability values does not exceed a preset difference threshold, the average of the two association probability values is taken as the final association probability for any vulnerability-asset combination. If the difference between two associated probability values exceeds a preset difference threshold, a third associated probability calculation is performed. If two of the three associated probability values are identical, these identical values are used as the final associated probability for any vulnerability-asset combination. If all three associated probability values are different, the calculation weights of at least one of the version matching dimension, type matching dimension, and case gain dimension are adjusted based on preset weight correction rules. The associated probability is then recalculated using the adjusted dimension weights to obtain the final associated probability between the vulnerability and the asset. This approach avoids different results from multiple matchings of the same input in a large model and improves accuracy by performing multiple matchings and selecting the result that appears most frequently.
[0065] After determining the correlation probability between vulnerabilities and assets, if the correlation probability is not less than a preset probability threshold, a visual correlation report can be directly generated using the correlation probability without manual verification. If the correlation probability is less than the preset probability threshold, it indicates that there is uncertainty in the machine's judgment. In this case, manual review can be performed, and the results of the manual review can be fed back to the system to improve the correlation report. The generated correlation report can be exported to the asset management platform or vulnerability remediation system to guide users to quickly locate affected assets and implement remediation.
[0066] It should be noted that in this embodiment, a vulnerability exploitation condition knowledge base containing conditions such as processes and ports can be constructed and matched and verified with the collected actual operating status data of assets to accurately assess whether a vulnerability has the actual conditions to be exploited. This can help users quickly identify vulnerabilities that can be truly exploited by attackers and cause harm, reduce the cost of ineffective processing, and improve the accuracy and efficiency of vulnerability protection.
[0067] Specifically, this may include: constructing a vulnerability exploitation condition knowledge base containing the conditions that must be met to trigger a vulnerability; these conditions include, but are not limited to, process name, open port status, command-line parameter characteristics, and system configuration parameters. Then, collect the actual operational status data of the target asset corresponding to the vulnerability from asset vulnerability notification data. For example, use EDR (Endpoint Detection and Response) software to collect the actual operational status data of the server in real time; this actual operational status data includes, but is not limited to, process data, port status data, and system configuration file data. Next, match and verify the vulnerability exploitation condition knowledge base with the actual operational status data of the asset, and generate a vulnerability exploitability assessment conclusion based on the matching and verification results; this conclusion determines whether the vulnerability possesses the characteristics of being successfully exploited by an attacker and causing actual harm.
[0068] Furthermore, based on the vulnerability exploitability assessment results and the correlation probability between vulnerabilities and assets, a comprehensive risk score can be determined for each vulnerability-asset combination. Then, based on the comprehensive risk score, the vulnerability-asset combinations are prioritized, and a visual correlation report containing the priority ranking is generated. Finally, remediation work orders are created based on the priority ranking in the visual correlation report, enabling operations personnel to perform targeted remediation operations on affected assets according to the priority order of the remediation work orders.
[0069] The following is based on Figure 2 The technical solution in this embodiment will be explained using the flowchart shown as an example.
[0070] Updating asset information on the user end includes: 1. Asset data access: Collecting asset data such as component names and versions, running processes, open ports, and configuration files for each host through API (Application Programming Interface) integration and import, and saving this asset data to the customer asset database. 2. Asset data preprocessing: Grouping and merging asset data to improve the efficiency of subsequent queries and matching.
[0071] When new vulnerability notification data is available, the following operations are performed: 1. Vulnerability notification data access: Users can import or the system can automatically obtain third-party vulnerability notification data via API. User import supports various data formats, including unstructured data. Key information, such as vulnerability characteristics and asset association clues, is automatically extracted from the files using a large model. 2. Vulnerability information enrichment: When vulnerability notification data is incomplete, supplementary information is automatically extracted from publicly available online resources, including the software and version range affected by the vulnerability, and the conditions for exploiting the vulnerability, such as processes and configurations.
[0072] Then, it is determined whether the component version range format of the vulnerability is in the standard CPE (Common Platform Enumeration) format. If the component version range format is in the standard CPE format, CPE rule matching can be performed directly to obtain the matching result. If the component version range format is not in the standard CPE format, the large model is used for component name matching. That is, for each vulnerability notification data, it is matched one by one with the component names in the customer asset database to filter out the matching components. Then, the large model is used for component version matching to determine which component versions are within the scope of the vulnerability's impact, obtaining the matching result. Next, consistency analysis is performed, and the above matching process is repeated until two identical matching results are obtained. In the process of using the large model for component name matching, the large model can effectively identify software aliases and conceptual categories by utilizing the software RAG (Retrieval-Augmented Generation) knowledge base, thereby accurately locating the assets affected by the vulnerability and reducing association errors caused by name or concept confusion.
[0073] Furthermore, the exploitability of the vulnerability is verified, which involves checking whether the vulnerability meets the conditions for exploitation, such as whether the relevant processes are running, whether the port can be accessed from the outside, and whether any configuration items that can be exploited are enabled. This process ultimately generates a vulnerability exploitability assessment conclusion. Finally, the vulnerability exploitability assessment conclusion and the above matching results are used to output a visual correlation report. This report includes the basis for determining the existence of the vulnerability, the original data, and the exploitability analysis.
[0074] As shown above, this embodiment utilizes the natural language processing capabilities of a large-scale model to directly parse unstructured text without manual conversion to a standard format, avoiding the inefficiency and risk of misjudgment caused by manual intervention, while improving processing efficiency. Through the semantic understanding capabilities of the large-scale model, it identifies product aliases and non-standard expressions, solving the problem of missed matches caused by inconsistent names in traditional technologies, and improving the accuracy of vulnerability investigation. For target vulnerabilities with incomplete information, it automatically extracts supplementary information from public network resources, ensuring more comprehensive data support for correlation analysis, thereby improving correlation accuracy and enhancing the ability to handle ambiguous information. By integrating vulnerability feature information, asset association clues, standardized asset data, and supplementary information using the large-scale model, it supports accurate matching in complex semantic environments.
[0075] See Figure 3 As shown in the embodiments, this application also discloses an asset vulnerability remediation device based on a large model, including:
[0076] The data extraction module 11 is used to receive asset vulnerability notification data, perform semantic analysis on the asset vulnerability notification data through a preset large model, and extract vulnerability feature information and asset association clues; the vulnerability feature information includes vulnerability number, hazard type, and affected version; the asset association clues are relevant information of potentially affected assets identified from the asset vulnerability notification data.
[0077] The information acquisition module 12 is used to extract supplementary information about the target vulnerability from publicly available network resources if there is a target vulnerability with ambiguous or missing information in the vulnerability feature information and the asset association clues; the supplementary information includes the actual impact of the target vulnerability on different assets;
[0078] The data standardization module 13 is used to unify different product names of the same product in the asset data of the customer asset library based on the preset product standard name, and to establish a mapping relationship between the product standard name, product alias and corresponding version to obtain standardized asset data.
[0079] The asset remediation module 14 is used to determine the correlation probability between vulnerabilities and assets by using the vulnerability feature information, asset association clues, standardized asset data and supplementary information through a preset large model, and to generate a visualized correlation report using the correlation probability, so as to remediate the assets affected by the vulnerability according to the correlation report.
[0080] In some specific embodiments, the data extraction module 11 includes:
[0081] The data identification unit is used to receive asset vulnerability notification data, identify the asset vulnerability notification data, and determine whether there is a data segment in the asset vulnerability notification data that conforms to a preset common vulnerability data format.
[0082] The data matching unit is used to directly match the data segment using a preset matching method if the asset vulnerability notification data contains a data segment that conforms to a preset common vulnerability data format, and obtain a matching result.
[0083] The confidence level determination unit is used to determine whether the confidence level of the matching result reaches a preset confidence level threshold. If the confidence level of the matching result reaches the preset confidence level threshold, the vulnerability feature information and asset association clues corresponding to the asset vulnerability notification data are determined based on the matching result. If the confidence level of the matching result does not reach the preset confidence level threshold, the asset vulnerability notification data is semantically analyzed through a preset large model, and vulnerability feature information and asset association clues are extracted.
[0084] In some specific embodiments, the information acquisition module 12 includes:
[0085] The data acquisition unit is used to crawl multi-source data related to the target vulnerability using web crawler technology, and to perform noise reduction, deduplication, and format unification on the multi-source data.
[0086] The information determination unit is used to evaluate the credibility of preprocessed multi-source data based on a preset large model. If the credibility evaluation result reaches the preset credibility threshold, the preprocessed multi-source data will be used as supplementary information.
[0087] In some specific embodiments, the data standardization module 13 includes:
[0088] The data merging unit is used to merge asset data with the same product name and version number in the customer asset database;
[0089] The name mapping unit is used to identify and normalize the merged asset data through the semantic understanding and entity recognition capabilities of the preset large model, so as to map the non-standard product names in the merged asset data to the preset standard product names.
[0090] The mapping establishment unit is used to unify the version numbers of different expressions in the merged asset data into a preset normalized version number, and to establish a mapping relationship table between the product standard name, product alias and normalized version number based on the product standard name and normalized version number.
[0091] In some specific embodiments, the asset restoration module 14 includes:
[0092] The probability calculation unit is used to perform two association probability calculations on the association relationship between vulnerabilities and assets in any vulnerability-asset combination, and obtain two association probability values; the association probability calculation is a comprehensive evaluation based on version matching dimension, type matching dimension and case gain dimension.
[0093] The version matching dimension is used to assess whether the specific version number of the asset falls within the affected version range of the vulnerability; the type matching dimension is used to assess whether the product type of the asset is consistent with the product type targeted by the vulnerability; and the case gain dimension is used to assess whether there is supplementary information from public network resources that can confirm that the vulnerability has been exploited or attacked in a specific product or environment.
[0094] The first probability determination unit is used to perform consistency verification on the two associated probability values. If the difference between the two associated probability values does not exceed a preset difference threshold, the average of the two associated probability values is used as the final associated probability of any vulnerability-asset combination.
[0095] The second probability determination unit is used to perform a third association probability calculation if the difference between the two association probability values exceeds a preset difference threshold. If there are two identical association probability values among the three association probability values corresponding to the three association probability calculations, the identical association probability values are taken as the final association probability of any vulnerability-asset combination. If the three association probability values are not the same, the calculation weight of at least one of the version matching dimension, the type matching dimension, and the case gain dimension is adjusted based on a preset weight correction rule, and the association probability is recalculated using the adjusted dimension weights to obtain the final association probability between the vulnerability and the asset.
[0096] In some specific embodiments, the asset vulnerability remediation device based on a large model further includes:
[0097] The knowledge base construction unit is used to build a vulnerability exploitation condition knowledge base containing the conditions that must be met to trigger a vulnerability; the conditions that must be met to trigger a vulnerability include process name, open port status, command line parameter characteristics, and system configuration parameters.
[0098] The data acquisition unit is used to collect the actual operating status data of the target asset corresponding to the vulnerability in the asset vulnerability notification data; the actual operating status data of the asset includes process data, port status data, and system configuration file data;
[0099] The evaluation unit is used to match and verify the vulnerability exploitation condition knowledge base with the actual operating status data of the asset, and generate a vulnerability exploitability evaluation conclusion based on the matching and verification results; the vulnerability exploitability evaluation conclusion is a conclusion on whether the vulnerability has the characteristics of being successfully exploited by an attacker and causing actual harm.
[0100] The report generation submodule is used to generate a visualized correlation report based on the vulnerability exploitability assessment conclusions and the correlation probability between the vulnerability and the asset.
[0101] In some specific implementations, the report generation submodule includes:
[0102] The scoring determination unit is used to determine the comprehensive risk score of each vulnerability-asset combination based on the vulnerability exploitability assessment conclusion and the correlation probability between the vulnerability and the asset.
[0103] The report generation unit is used to prioritize the vulnerability-asset portfolio based on the comprehensive risk score and generate a visual association report containing the priority ranking.
[0104] Accordingly, the asset restoration module 14 includes:
[0105] The asset repair unit is used to create repair work orders based on the priority order in the visualization association report, so that maintenance personnel can perform targeted repair operations on the affected assets based on the priority order of the repair work orders.
[0106] Furthermore, embodiments of this application also disclose an electronic device, Figure 4 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.
[0107] Figure 4 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the asset vulnerability remediation method based on a large model disclosed in any of the foregoing embodiments. Alternatively, the electronic device 20 in this embodiment may specifically be an electronic computer.
[0108] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.
[0109] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.
[0110] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including computer programs capable of performing the large-model-based asset vulnerability remediation method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include computer programs capable of performing other specific tasks.
[0111] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned disclosed method for remediating asset vulnerabilities based on a large model. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.
[0112] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.
[0113] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.
[0114] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.
[0115] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.
[0116] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.
Claims
1. A method for remediating asset vulnerabilities based on a large model, characterized in that, include: The system receives asset vulnerability notification data, performs semantic analysis on the data using a pre-set large model, and extracts vulnerability feature information and asset association clues. The vulnerability feature information includes vulnerability number, hazard type, and affected version. The asset association clues are relevant information about potentially affected assets identified from the asset vulnerability notification data. If there are ambiguous or missing information about a target vulnerability in the vulnerability feature information and the asset association clues, supplementary information about the target vulnerability is extracted from publicly available online resources; the supplementary information includes the actual impact of the target vulnerability on different assets; Based on the preset product standard name, the different product names of the same product in the asset data of the customer asset library are unified, and the mapping relationship between the product standard name, product alias and corresponding version is established to obtain standardized asset data. By using a pre-defined large model, the vulnerability feature information, asset association clues, standardized asset data, and supplementary information, the association probability between the vulnerability and the asset is determined. The association probability is then used to generate a visualized association report, which is used to repair the assets affected by the vulnerability.
2. The asset vulnerability remediation method based on a large model according to claim 1, characterized in that, The received asset vulnerability notification data is subjected to semantic analysis using a pre-defined large model to extract vulnerability feature information and asset association clues, including: Receive asset vulnerability notification data, identify the asset vulnerability notification data, and determine whether there is a data segment in the asset vulnerability notification data that conforms to a preset common vulnerability data format; If the asset vulnerability notification data contains a data segment that conforms to a preset common vulnerability data format, then the preset matching method is used to directly match the data segment to obtain a matching result; Determine whether the confidence level of the matching result reaches a preset confidence threshold. If the confidence level of the matching result reaches the preset confidence threshold, then determine the vulnerability feature information and asset association clues corresponding to the asset vulnerability notification data based on the matching result. If the confidence level of the matching result does not reach the preset confidence threshold, then perform semantic analysis on the asset vulnerability notification data through a preset large model, and extract vulnerability feature information and asset association clues.
3. The asset vulnerability remediation method based on a large model according to claim 1, characterized in that, The extraction of supplementary information about the target vulnerability from publicly available online resources includes: The web crawler technology is used to capture multi-source data related to the target vulnerability, and the multi-source data is then denoised, deduplicated, and formatted. The credibility of the preprocessed multi-source data is evaluated based on a pre-defined large model. If the credibility evaluation result reaches the pre-defined credibility threshold, the preprocessed multi-source data will be used as supplementary information.
4. The asset vulnerability remediation method based on a large model according to claim 1, characterized in that, The process of unifying different product names for the same product in the customer's asset database based on preset product standard names, and establishing a mapping relationship between product standard names, product aliases, and corresponding versions, includes: Merge asset data with the same product name and version number in the customer asset database; By leveraging the semantic understanding and entity recognition capabilities of a pre-defined large model, the merged asset data is identified and normalized to map non-standard product names in the merged asset data to pre-defined standard product names. The version numbers of different expressions in the merged asset data are unified into preset standardized version numbers. A mapping table between product standard names, product aliases and standardized version numbers is established based on product standard names and standardized version numbers.
5. The asset vulnerability remediation method based on a large model according to claim 1, characterized in that, The determination of the correlation probability between vulnerabilities and assets includes: For any vulnerability-asset combination, the association probability between the vulnerability and the asset in the vulnerability-asset combination is calculated twice to obtain two association probability values; the association probability calculation is a comprehensive evaluation based on version matching dimension, type matching dimension and case gain dimension. The version matching dimension is used to assess whether the specific version number of the asset falls within the affected version range of the vulnerability; the type matching dimension is used to assess whether the product type of the asset is consistent with the product type targeted by the vulnerability; and the case gain dimension is used to assess whether there is supplementary information from public network resources that can confirm that the vulnerability has been exploited or attacked in a specific product or environment. A consistency check is performed on the two associated probability values. If the difference between the two associated probability values does not exceed a preset difference threshold, the average of the two associated probability values is taken as the final associated probability of any vulnerability-asset combination. If the difference between the two associated probability values exceeds a preset difference threshold, a third associated probability calculation is performed. If two of the three associated probability values corresponding to the three associated probability calculations are the same, then the same associated probability value is taken as the final associated probability of any vulnerability-asset combination. If the three associated probability values are not the same, then the calculation weight of at least one of the version matching dimension, the type matching dimension, and the case gain dimension is adjusted based on the preset weight correction rule, and the associated probability is recalculated using the adjusted dimension weights to obtain the final associated probability between the vulnerability and the asset.
6. The asset vulnerability remediation method based on a large model according to claim 1, characterized in that, Also includes: Construct a vulnerability exploitation condition knowledge base that includes the conditions that must be met to trigger a vulnerability; The conditions required for the vulnerability to be triggered include process name, open port status, command line parameter characteristics, and system configuration parameters; Collect the actual operational status data of the target asset corresponding to the vulnerability in the asset vulnerability notification data; the actual operational status data of the asset includes process data, port status data, and system configuration file data; The vulnerability exploitation condition knowledge base is matched and verified with the actual operating status data of the asset, and a vulnerability exploitability assessment conclusion is generated based on the matching and verification results; the vulnerability exploitability assessment conclusion is a conclusion on whether the vulnerability has the characteristics of being successfully exploited by an attacker and causing actual harm. Based on the vulnerability exploitability assessment results and the probability of association between the vulnerability and the asset, a visualized association report is generated.
7. The asset vulnerability remediation method based on a large model according to claim 6, characterized in that, The generation of a visualized correlation report based on the vulnerability exploitability assessment conclusions and the correlation probability between the vulnerability and the asset includes: Based on the vulnerability exploitability assessment results and the correlation probability between vulnerabilities and assets, a comprehensive risk score is determined for each vulnerability-asset combination. Based on the comprehensive risk score, the vulnerability-asset portfolio is prioritized and a visual correlation report containing the priority ranking is generated. Accordingly, the remediation of assets affected by the vulnerability based on the associated report includes: Repair work orders are created based on the priority order in the visualization report, so that maintenance personnel can perform targeted repair operations on affected assets according to the priority order of the repair work orders.
8. An asset vulnerability remediation device based on a large model, characterized in that, include: The data extraction module is used to receive asset vulnerability notification data, perform semantic analysis on the asset vulnerability notification data through a preset large model, and extract vulnerability feature information and asset association clues. The vulnerability feature information includes vulnerability number, hazard type, and affected version. The asset association clues are relevant information of potentially affected assets identified from the asset vulnerability notification data. The information acquisition module is used to extract supplementary information about the target vulnerability from publicly available network resources if there is ambiguous or missing information in the vulnerability feature information and the asset association clues; the supplementary information includes the actual impact of the target vulnerability on different assets; The data standardization module is used to unify different product names of the same product in the asset data of the customer's asset library based on the preset product standard name, and to establish a mapping relationship between the product standard name, product alias and corresponding version to obtain standardized asset data. The asset remediation module is used to determine the correlation probability between vulnerabilities and assets by using the vulnerability feature information, asset association clues, standardized asset data and supplementary information through a preset large model, and to generate a visualized correlation report using the correlation probability, so as to remediate the assets affected by the vulnerability based on the correlation report.
9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the asset vulnerability remediation method based on a large model as described in any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that, Used to store a computer program, which, when executed by a processor, implements the asset vulnerability remediation method based on a large model as described in any one of claims 1 to 7.