Vulnerability fixing method and device for Internet of Things

Abstract

The invention provides a vulnerability repairing method and device for the Internet of Things. The method comprises the steps of obtaining software configuration of first equipment of the Internet of Things; determining first vulnerability information of the first equipment based on software configuration of the first equipment, a vulnerability library and a vulnerability maintenance list; performing vulnerability detection on the first equipment to obtain a vulnerability detection result, and correcting the first vulnerability information by using the vulnerability detection result to obtain second vulnerability information; based on second vulnerability information of the first device, determining a repair value of each vulnerability; and based on the repair value of each vulnerability of the first equipment, determining the vulnerability, needing to be repaired, of the first equipment, and repairing the vulnerability, needing to be repaired, of the first equipment. According to the method, the influence of the vulnerability can be effectively evaluated by calculating the repair value of the vulnerability, so that the repair efficiency of the vulnerability is improved, and the repair effect of the vulnerability is ensured.

Description

Technical Field

[0001] This application relates to the field of Internet of Things (IoT) security technology, and in particular to a method and apparatus for patching IoT vulnerabilities. Background Technology

[0002] With the rapid development of IoT technology, the number of IoT terminal devices has exploded, and the IoT is becoming increasingly networked, integrated, and intelligent. However, at the same time, security incidents involving IoT terminal devices are frequent, highlighting security vulnerabilities and creating a serious security situation. Therefore, it is necessary to uniformly maintain IoT security vulnerabilities in order to promptly identify and address them.

[0003] The existing approach to handling IoT vulnerabilities involves collecting information on vulnerabilities in IoT devices, having relevant personnel develop a maintenance plan for the vulnerability, and then performing maintenance based on the plan.

[0004] With the explosive growth in the number of IoT devices and the accelerated pace of their updates, relying solely on manual maintenance of vulnerabilities in these devices is inefficient and can lead to untimely fixes, thus exacerbating security risks. Summary of the Invention

[0005] In view of this, this application provides a method and apparatus for patching vulnerabilities in the Internet of Things to solve the above-mentioned technical problems.

[0006] In a first aspect, embodiments of this application provide a method for patching vulnerabilities in the Internet of Things (IoT), comprising: Obtain the software configuration of the first device in the Internet of Things; Based on the software configuration, vulnerability database, and vulnerability maintenance list of the first device, determine the first vulnerability information of the first device; Vulnerability detection is performed on the first device to obtain vulnerability detection results. The first vulnerability information is corrected using the vulnerability detection results to obtain the second vulnerability information. Based on the second vulnerability information of the first device, determine the repair value for each vulnerability; Based on the repair values ​​of each vulnerability in the first device, the vulnerabilities that need to be repaired in the first device are determined, and the vulnerabilities that need to be repaired are repaired.

[0007] Secondly, embodiments of this application provide an Internet of Things (IoT) vulnerability remediation device, comprising: The acquisition unit is used to acquire the software configuration of the first device in the Internet of Things. The first determining unit is used to determine the first vulnerability information of the first device based on the software configuration, vulnerability database and vulnerability maintenance list of the first device; The correction unit is used to perform vulnerability detection on the first device to obtain vulnerability detection results, and use the vulnerability detection results to correct the first vulnerability information to obtain the second vulnerability information; The second determining unit is used to determine the repair value of each vulnerability based on the second vulnerability information of the first device; The repair unit is used to determine the vulnerabilities that need to be repaired in the first device based on the repair values ​​of each vulnerability in the first device, and to repair the vulnerabilities that need to be repaired.

[0008] Thirdly, embodiments of this application provide an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method of embodiments of this application.

[0009] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer instructions that, when executed by a processor, implement the methods of embodiments of this application.

[0010] Fifthly, embodiments of this application provide a computer program product, including a computer program / instructions, which, when executed by a processor, implement the method of embodiments of this application.

[0011] This application determines the repair value for each vulnerability based on its severity, impact on the Internet of Things (IoT), and loss to IoT services. The repair value identifies the vulnerabilities to be repaired, and the application repairs these vulnerabilities on all IoT devices containing them, achieving automatic vulnerability repair. Furthermore, the repair value effectively assesses the impact of vulnerabilities, allowing minor vulnerabilities to be omitted from the repair process, thus ensuring both the efficiency and effectiveness of the repair. Attached Figure Description

[0012] To more clearly illustrate the technical solutions in the specific embodiments of this application or the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0013] Figure 1 A flowchart illustrating the IoT vulnerability remediation method provided in this application embodiment; Figure 2 This application provides a network topology diagram for its embodiments. Figure 3 A functional structure diagram of the IoT vulnerability repair device provided in the embodiments of this application; Figure 4 This is a structural diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0014] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0015] Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0016] The technical solutions provided in the embodiments of this application will be described below.

[0017] like Figure 1 As shown in the figure, this application embodiment provides a vulnerability remediation method for the Internet of Things, including the following steps: Step 101: Obtain the software configuration of the first IoT device; Step 102: Based on the software configuration, vulnerability database, and vulnerability maintenance list of the first device, determine the first vulnerability information of the first device; Step 103: Perform vulnerability detection on the first device to obtain vulnerability detection results, and use the vulnerability detection results to correct the first vulnerability information to obtain the second vulnerability information; Step 104: Based on the second vulnerability information of the first device, determine the repair value for each vulnerability; The fix value indicates the urgency of fixing the vulnerability; the larger the value, the more dangerous the vulnerability is and the more urgent it needs to be fixed.

[0018] Step 105: Based on the repair values ​​of each vulnerability in the first device, determine the vulnerabilities that need to be repaired in the first device, and repair the vulnerabilities that need to be repaired.

[0019] Specifically, based on the second vulnerability information of each device, the processing device for fixing the vulnerability is determined, the vulnerability is fixed using the processing device, and after the fix is ​​completed, the carrier identifier, the fixed vulnerability identifier, and the device identifier are stored in the vulnerability maintenance list.

[0020] This embodiment determines the repair value for each vulnerability based on the severity of the vulnerability itself, the impact of the vulnerability on the Internet of Things (IoT), and the degree of loss caused to IoT services. The repair value is used to identify the vulnerabilities to be repaired, and the vulnerability is repaired for all IoT devices containing the vulnerability, thus achieving automatic vulnerability repair. At the same time, the repair value can effectively assess the impact of the vulnerability, and vulnerabilities with minor impact are not repaired at this time, which ensures both the efficiency and effectiveness of vulnerability repair.

[0021] In some embodiments, IoT devices include terminal nodes (such as terminal acquisition devices like cameras in the Internet of Things) and intermediate nodes (such as servers in the Internet of Things).

[0022] Specifically, an IoT device attribute database can be established, including device identifiers, hardware configurations, and software configurations. Whenever a new device joins the IoT, an IoT device updates its configuration, or an IoT device leaves the IoT, the attribute database will be updated. The device attribute database stores the latest device attribute information in the IoT, and the device's software configuration can be obtained by reading the device attribute database.

[0023] In some embodiments, the vulnerability database includes: a carrier identifier and multiple vulnerability identifiers; the vulnerability maintenance list includes multiple records, each record including: a carrier identifier, a patched vulnerability identifier, and a patched device identifier; Based on the software configuration, vulnerability database, and vulnerability maintenance list of the first device, the first vulnerability information of the first device is determined, including: The software configuration of the first device is matched with the carrier identifier in the vulnerability database, and the multiple vulnerabilities corresponding to the matched carrier identifiers are used as the initial vulnerabilities of the first device. The vulnerability is matched against the vulnerability maintenance list using the carrier identifier, the initial vulnerability identifier, and the first device identifier. If a match is found, the matched record is obtained. If the first device identifier is included in the patched devices of the record, the vulnerability in the record is removed from the initial vulnerabilities of the first device (the vulnerability has been patched). The remaining initial vulnerabilities were identified as the first vulnerability information for the first device.

[0024] This embodiment maintains IoT vulnerabilities based on a vulnerability database and a vulnerability maintenance list. The vulnerability database stores all vulnerability information related to the Internet of Things.

[0025] When configuring IoT devices, information about the device is collected, such as the device model, operating system version, and all software versions. Whenever a device is updated, the updated data is also synchronized, ensuring that the device information is up-to-date across all IoT devices.

[0026] Whenever device information is updated, the system retrieves corresponding vulnerability information through methods such as web scraping or scanning with existing vulnerability scanning programs. All vulnerability information is maintained in a vulnerability database. In addition, the system periodically checks for updates to vulnerability information; if updates are found, the corresponding vulnerability information in the database is updated accordingly.

[0027] The storage format is identified by the carrier, which represents the object with the vulnerability. For example, if operating system A includes the vulnerability, then the carrier identifier is the identifier of operating system A. The vulnerability information includes the vulnerability identifier (such as the CVE number, i.e., the Common Vulnerability Disclosure Number), vulnerability description information, and CVSS score for each vulnerability.

[0028] CVSS (Common Vulnerability Scoring System) is an industry-standard, publicly available standard used to assess the severity of vulnerabilities and help determine the urgency and importance of the required responses. Its primary purpose is to establish a standard for measuring vulnerability severity, thereby determining the priority of addressing them. A CVSS score is a measurement across a series of dimensions called metrics. The maximum CVSS score for a vulnerability is 10, and the minimum is 0. Vulnerabilities with scores of 7-10 are generally considered severe, those with scores between 4-6.9 are considered medium-severity, and those between 0-3.9 are considered low-severity.

[0029] The vulnerability database is maintained independently and can be continuously updated periodically. It is also updated based on the new and updated content when new IoT devices are added or updated.

[0030] The vulnerability maintenance list is also identified by carrier, with each record including: carrier identifier, patched vulnerability identifier (CVE number), and patched device identifier. The vulnerability maintenance column is updated after vulnerability maintenance is performed. Whenever a vulnerability corresponding to a carrier is patched, the patching information is recorded. In this way, the vulnerability database can identify the vulnerabilities corresponding to each carrier in the IoT. However, the vulnerability database does not record device identifiers; therefore, vulnerabilities recorded in the database may appear in all devices using the same carrier, achieving information reuse within the vulnerability database. Nevertheless, the vulnerability maintenance list maintains a correspondence between carriers, vulnerabilities, and devices, allowing information about the devices on which vulnerabilities have been patched.

[0031] In some embodiments, vulnerability detection is performed on the first device to obtain vulnerability detection results, and the first vulnerability information is corrected using the vulnerability detection results to obtain second vulnerability information; The first device is tested using a vulnerability detector to obtain vulnerability detection results; Based on the vulnerability identifiers from all vulnerability detection results, construct a second vulnerability information; Obtain vulnerability identifiers that exist in the first vulnerability information but not in the second vulnerability information; Determine whether the CVSS score of the vulnerability identifier is greater than a preset first threshold. If so, add the vulnerability identifier to the second vulnerability information.

[0032] For example, vulnerability detection is performed using the OVAL vulnerability detector. OVAL (Open Vulnerability Assessment Language) is an international information security community standard, a new standard for computer vulnerability assessment released by the Mitre organization, used to assess and report the machine status of computer systems.

[0033] For example, comparing vulnerability identifiers will result in three possible outcomes for any given vulnerability identifier: The first scenario is that both the vulnerability detection result and the first vulnerability information contain the vulnerability identifier, which means that the first vulnerability information is correct, and no action is taken in this case.

[0034] The second scenario is that the vulnerability identifier is present in the vulnerability detection results, but not in the first vulnerability information. This indicates that the first vulnerability information may be incorrect, and in this case, the vulnerability identifier is added to the final vulnerability information.

[0035] The third scenario involves a vulnerability that is not identified in the vulnerability detection results but is present in the first vulnerability information. This indicates that the first vulnerability information may be incorrect, and a vulnerability that should exist has not been detected. Simply deleting it in this case might result in missed vulnerabilities. In this case, the CVSS score of the vulnerability can be determined. If the CVSS score is less than 4, it indicates a low-risk vulnerability, and therefore it is not addressed. Otherwise, it is included in the final vulnerability information but marked to indicate that the vulnerability may exist. Thus, for each device, the final vulnerability information includes both existing and potential vulnerabilities.

[0036] In some embodiments, based on the second vulnerability information of the first device, a remediation value for each vulnerability is determined; including: Based on the second vulnerability information of all first devices, the vulnerability was identified. All second devices; Based on vulnerabilities All secondary devices, identify vulnerabilities Maintenance weight, hazard value, impact value, and business loss value; Computational vulnerabilities Repair value :

[0037] in, The percentage of vulnerabilities. For vulnerabilities Maintenance weights; For vulnerabilities The severity value is taken as the vulnerability. CVSS score Weights for hazard values; For vulnerabilities The impact value, The weights that affect the values; For vulnerabilities The value of IoT business losses, Weights for business loss values; .

[0038] If the vulnerability is not marked in the second vulnerability information, it means that the vulnerability does exist. If the vulnerability is marked, it means that the vulnerability may exist. This way, if a vulnerability is important, it will be addressed; if it is not important, it will not be addressed. This allows for flexible handling of vulnerabilities that raise concerns, ensuring security while reducing the resource consumption of processing. , , The preferred values ​​are 0.3, 0.3, and 0.4.

[0039] In some embodiments, based on vulnerabilities All secondary devices, identify vulnerabilities The maintenance weights include: Obtain the security requirements value of the second device; Based on the amount of data marked as sensitive data by the second device, the total amount of all data processed, the maximum value of the security requirement for all processed data, and the maximum value of the security requirement in the pre-set correspondence, the data requirement value of the second device is determined as follows: Data requirement value = (Amount of data marked as sensitive data by the second device / Total amount of data processed by the second device) × (Maximum value of security requirements for all data processed by the second device) / Maximum value of security requirements in the pre-set correspondence).

[0040] Vulnerabilities are identified based on the maximum security requirement value of all second devices, the number of second devices with the maximum security requirement value, the total number of second devices, and the average data requirement value of the second devices. Maintenance weight : =[Maximum value of security requirements for all second devices × (Number of second devices with the maximum security requirement value among all devices / Number of second devices) + Average value of data requirements for second devices] / 2.

[0041] The data requirement value of the second device is based on the security requirements of the data it processes, which is determined by the sensitivity of the data it processes.

[0042] During data production, relevant personnel will label whether the data contains sensitive information and also indicate the security requirements for those reading the data (e.g., only administrators can access it). For example, the security requirement of "only administrators can access it" corresponds to a security requirement value of 1. The security requirement of "administrators and standard users can access it" corresponds to a security requirement value of 0.5. The security requirement of "any user can access it" corresponds to a security requirement value of 0.1.

[0043] Maintaining weights is from vulnerabilities From the perspective of all devices, this assesses the urgency of the device needing the vulnerability patched; a higher value indicates that the device urgently needs the vulnerability patched. .

[0044] In some embodiments, based on vulnerabilities All secondary devices, identify vulnerabilities The impact values ​​include: Based on the CVSS score of the vulnerability in the second device, determine the type of vulnerability in the second device; For example, vulnerabilities with CVSS scores of 7-10 are grouped into one category, those with CVSS scores of 4-6.9 into another, and those with CVSS scores of 0-3.9 into yet another, thus identifying the corresponding vulnerabilities. The number of vulnerabilities in each category for all devices.

[0045] Calculate the second device Vulnerability Number of vulnerabilities of a certain type With the second device Number of vulnerabilities ratio ; Computational vulnerabilities Influence weight :

[0046] Computational vulnerabilities Safety impact value :

[0047] in, The mean of the ratios of all second devices. The standard deviation of the ratios of all second devices; On the one hand, it will expose vulnerabilities The influence of the quantity is transformed into a value of a normal distribution with a mean of 0 and a variance of 1, thereby eliminating the influence of the dimension. On the other hand, it can highlight the magnitude of the dispersion of the class to which the vulnerability belongs relative to its average level. The larger the value, the greater the dispersion, indicating that the proportion of vulnerabilities of the same type varies greatly across devices and shows no strong regularity. Its impact is only on individual devices and will not affect the entire network.

[0048] Acquiring a second device Number of connected devices And the number of non-secondary devices in the devices directly connected to it. ; For example, an IoT topology is as follows Figure 2 As shown, if the second device is device 4, and the points directly connected to it are device 3 and device 5, then its Device 3 is also a second device, but device 5 is not a second device, so... .

[0049] According to the Internet of Things and the second device Calculate the number of devices with similar operational safety levels, and then calculate the second device. Network Influence Weight :

[0050] Where N is the total number of nodes in the network. For device identification, and , For the pre-set similarity threshold, Characterization equipment and equipment The similarity in operational security level A value greater than or equal to 1 indicates that the device and equipment Their levels of security are similar; therefore, for The floor function, when , indicating the second device The number of devices with similar operational safety levels is 1. It is equipment and equipment An identifier indicating whether devices are connected in an IoT topology. and equipment If they can be connected by one or more edges, then ,otherwise ,when This indicates the equipment and equipment There is no pathway between them; even if they are similar, they will not affect each other. Therefore, through... It can be made by Removing nodes from the obtained number of nodes will not affect the device. The number of devices makes For the network to truly connect with devices The higher the percentage of similar nodes that may have an impact, the better the device... The greater the potential for influence within the network.

[0051] Computational vulnerabilities Network influence value :

[0052] in, The larger the value, the more likely it is to be a second device. The impact may be significant as it affects a large number of non-secondary devices. The larger the size, the more likely it is to be related to the second device. The more devices connected, the more devices are considered to be a second device. The more devices are affected, the more equipment is affected.

[0053] Computational vulnerabilities Impact value : .

[0054] In some embodiments, based on vulnerabilities All secondary devices, identify vulnerabilities The business loss value includes: Acquiring a second device Type, average runtime per session Total runtime Vulnerability involved The average runtime of the carrier Total number of updates and average data transmission volume ; The types can be acquisition devices, analysis devices, forwarding devices, etc., or they can be further subdivided into image acquisition devices, temperature acquisition devices, etc. The specific type can be preset according to the actual application.

[0055] Calculate the second device IoT business loss value :

[0056] in, The pre-set standard update duration; where, This represents the percentage of runtime of the platform involved in the vulnerability. The larger this percentage is, the longer the platform runs, the greater the impact of the vulnerability, and the greater the loss. For the second device The update frequency is such that the larger the value, the more frequent the updates and the smaller the loss. To be compatible with the second device The average data transmission volume of other IoT devices of the same type The larger the value, the more important the analysis device j is in this type of equipment, and the greater the degree of loss.

[0057] The average of the service loss values ​​of all second devices was identified as the vulnerability. The business loss value.

[0058] In some embodiments, based on the repair values ​​of each vulnerability in the first device, the vulnerabilities that need to be repaired in the first device are determined; including: Determine if the vulnerability repair value of the first device is greater than a preset second threshold. If so, identify the vulnerability as one that needs to be repaired; or All vulnerabilities are sorted in descending order of their repair values ​​to obtain a repair value sequence. The first preset number of vulnerabilities in the repair value sequence are selected as the vulnerabilities that need to be repaired.

[0059] For example, the preset number of vulnerabilities is 30% of the total number of vulnerabilities.

[0060] In addition, if a vulnerability manually indicated by a user is not among the vulnerabilities that need to be fixed, then the vulnerability manually indicated by the user will also be considered as a vulnerability that needs to be fixed.

[0061] Based on the same inventive concept, embodiments of this application provide an Internet of Things (IoT) vulnerability repair device, see below. Figure 3 As shown, the IoT vulnerability repair device 200 provided in this application embodiment includes at least: Acquisition unit 201 is used to acquire the software configuration of the first device in the Internet of Things; The first determining unit 202 is used to determine the first vulnerability information of the first device based on the software configuration, vulnerability database and vulnerability maintenance list of the first device; The correction unit 203 is used to perform vulnerability detection on the first device to obtain vulnerability detection results, and use the vulnerability detection results to correct the first vulnerability information to obtain the second vulnerability information; The second determining unit 204 is used to determine the repair value of each vulnerability based on the second vulnerability information of the first device; Repair unit 205 is used to determine the vulnerabilities that need to be repaired in the first device based on the repair values ​​of each vulnerability in the first device, and to repair the vulnerabilities that need to be repaired.

[0062] It should be noted that the principle of the IoT vulnerability repair device 200 provided in this application embodiment to solve the technical problem is similar to the method provided in this application embodiment. Therefore, the implementation of the IoT vulnerability repair device 200 provided in this application embodiment can refer to the implementation of the method provided in this application embodiment, and the repeated parts will not be described again.

[0063] Based on the same inventive concept, embodiments of this application also provide an electronic device, such as... Figure 4 As shown, it includes: a memory and a processor, wherein the memory stores an executable program, and the processor executes the executable program to implement the steps of the IoT vulnerability repair method provided in the above embodiments.

[0064] The aforementioned processor can be a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The aforementioned PLD can be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. The general-purpose processor can be a microprocessor or any conventional processor, etc.

[0065] Since the electronic device described in this application embodiment is an electronic device equipped with a memory that implements the IoT vulnerability repair method disclosed in this application embodiment, those skilled in the art can understand the structure and variations of the electronic device described in this application embodiment based on the IoT vulnerability repair method described in this application embodiment, and therefore will not be described again here.

[0066] This application also provides a computer-readable storage medium storing a computer program thereon, which, when run by a processor, implements the steps of the IoT vulnerability repair method provided in the above embodiments.

[0067] The storage medium in this embodiment may be included in an electronic device; or it may exist independently and not be assembled into an electronic device. The storage medium carries one or more computer programs, which, when executed, implement the steps of the IoT vulnerability remediation method provided in the above embodiment.

[0068] It should be understood that the various solutions in this embodiment have the same technical effects as those in the above method embodiments, and will not be repeated here.

[0069] According to embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. Optionally, specific examples in this embodiment can refer to the examples described in any embodiment of this application, which will not be repeated here. Obviously, those skilled in the art should understand that the various modules or steps of this application described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. Optionally, they can be implemented using computer-executable program code, thereby storing them in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those presented here, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, this application is not limited to any particular hardware and software combination.

[0070] This application also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the IoT vulnerability repair method provided in the above embodiments.

[0071] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions targeted in the blocks may occur in a different order than those targeted in the drawings. For example, two consecutively represented blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0072] Furthermore, while the operations are described in a specific order, this should not be construed as requiring these operations to be performed in the specific order shown or in a sequential order. Multitasking and parallel processing may be advantageous in certain environments. Similarly, while several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of this application. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.

Claims

1. A method for patching vulnerabilities in the Internet of Things (IoT), characterized in that, include: Obtain the software configuration of the first device in the Internet of Things; Based on the software configuration, vulnerability database, and vulnerability maintenance list of the first device, determine the first vulnerability information of the first device; Vulnerability detection is performed on the first device to obtain vulnerability detection results. The first vulnerability information is corrected using the vulnerability detection results to obtain the second vulnerability information. Based on the second vulnerability information of the first device, determine the repair value for each vulnerability; Based on the repair values ​​of each vulnerability in the first device, the vulnerabilities that need to be repaired in the first device are determined, and the vulnerabilities that need to be repaired are repaired.

2. The method according to claim 1, characterized in that, The vulnerability database includes: a carrier identifier and multiple vulnerability identifiers; the vulnerability maintenance list includes multiple records, each record including: a carrier identifier, a patched vulnerability identifier, and a patched device identifier; Based on the software configuration, vulnerability database, and vulnerability maintenance list of the first device, the first vulnerability information of the first device is determined, including: The software configuration of the first device is matched with the carrier identifier in the vulnerability database, and the multiple vulnerabilities corresponding to the matched carrier identifiers are used as the initial vulnerabilities of the first device. The vulnerability is matched against the vulnerability maintenance list using the carrier identifier, the initial vulnerability identifier, and the first device identifier. If a match is successful, the matched record is obtained. If the first device identifier is included in the patched device of the record, the vulnerability in the record is removed from the initial vulnerability of the first device. The remaining initial vulnerabilities were identified as the first vulnerability information for the first device.

3. The method according to claim 1, characterized in that, Vulnerability detection is performed on the first device to obtain vulnerability detection results. The first vulnerability information is corrected using the vulnerability detection results to obtain the second vulnerability information. The first device is tested using a vulnerability detector to obtain vulnerability detection results; Based on the vulnerability identifiers from all vulnerability detection results, construct a second vulnerability information; Obtain vulnerability identifiers that exist in the first vulnerability information but not in the second vulnerability information; Determine whether the CVSS score of the vulnerability identifier is greater than a preset first threshold. If so, add the vulnerability identifier to the second vulnerability information.

4. The method according to claim 1, characterized in that, Based on the second vulnerability information of the first device, determine the remediation value for each vulnerability; including: Based on the second vulnerability information of all first devices, the vulnerability was identified. All second devices; Based on vulnerabilities All secondary devices, identify vulnerabilities Maintenance weight, hazard value, impact value, and business loss value; Computational vulnerabilities Repair value : in, The percentage of vulnerabilities. For vulnerabilities Maintenance weights; For vulnerabilities The severity value is taken as the vulnerability. CVSS score Weights for hazard values; For vulnerabilities The impact value, The weights that affect the values; For vulnerabilities The value of IoT business losses, Weights for business loss values; .

5. The method according to claim 4, characterized in that, Based on vulnerabilities All secondary devices, identify vulnerabilities The maintenance weights include: Obtain the security requirements value of the second device; Based on the amount of data marked as sensitive data by the second device, the total amount of all data processed, the maximum value of the security requirement for all processed data, and the maximum value of the security requirement in the pre-set correspondence, the data requirement value of the second device is determined as follows: Vulnerabilities are identified based on the maximum security requirement value of all second devices, the number of second devices with the maximum security requirement value, the total number of second devices, and the average data requirement value of the second devices. Maintenance weights.

6. The method according to claim 4, characterized in that, Based on vulnerabilities All secondary devices, identify vulnerabilities The impact values ​​include: Based on the CVSS score of the vulnerability in the second device, determine the type of vulnerability in the second device; Calculate the second device Vulnerability Number of vulnerabilities of a certain type With the second device Number of vulnerabilities ratio ; Computational vulnerabilities Influence weight : Computational vulnerabilities Safety impact value : in, The mean of the ratios of all second devices. The standard deviation of the ratios of all second devices; Acquiring a second device Number of connected devices And the number of non-secondary devices in the devices directly connected to it. ; According to the Internet of Things and the second device Calculate the number of devices with similar operational safety levels, and then calculate the second device. Network Influence Weight ; Based on the second device Network Influence Weight Identify vulnerabilities Network influence value : Computational vulnerabilities Impact value : 。 7. The method according to claim 4, characterized in that, Based on vulnerabilities All secondary devices, identify vulnerabilities The business loss value includes: Acquiring a second device Type, average runtime per session Total runtime Vulnerability involved The average runtime of the carrier Total number of updates and average data transmission volume ; Calculate the second device IoT business loss value : in, The pre-set standard update duration; The average of the service loss values ​​of all second devices was identified as the vulnerability. The business loss value.

8. The method according to claim 1, characterized in that, Based on the repair values ​​of each vulnerability in the first device, determine the vulnerabilities in the first device that need to be repaired; including: Determine if the vulnerability repair value of the first device is greater than a preset second threshold. If so, identify the vulnerability as one that needs to be repaired; or All vulnerabilities are sorted in descending order of their repair values ​​to obtain a repair value sequence. The first preset number of vulnerabilities in the repair value sequence are selected as the vulnerabilities that need to be repaired.

9. A vulnerability patching device for the Internet of Things, characterized in that, include: The acquisition unit is used to acquire the software configuration of the first device in the Internet of Things. The first determining unit is used to determine the first vulnerability information of the first device based on the software configuration, vulnerability database and vulnerability maintenance list of the first device; The correction unit is used to perform vulnerability detection on the first device to obtain vulnerability detection results, and use the vulnerability detection results to correct the first vulnerability information to obtain the second vulnerability information; The second determining unit is used to determine the repair value of each vulnerability based on the second vulnerability information of the first device; The repair unit is used to determine the vulnerabilities that need to be repaired in the first device based on the repair values ​​of each vulnerability in the first device, and to repair the vulnerabilities that need to be repaired.

10. An electronic device, characterized in that, include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the method as claimed in any one of claims 1-8.

Images