Cloud environment vulnerability detection and verification method, system, device and medium

Abstract

The invention discloses a cloud environment vulnerability detection and verification method, system and device and a medium. The method comprises the following steps: encoding running multi-source features and generating an asset portrait vector through an attention fusion mechanism; performing similarity matching on the asset portrait vector and a vulnerability knowledge base semantic vector, and screening a potential vulnerability candidate set; executing automatic vulnerability verification on the potential vulnerability candidate set, calculating a vulnerability triggering probability and judging whether the vulnerability really exists or not to obtain a verification result; constructing a comprehensive risk scoring model to calculate vulnerability priority scores, and generating a vulnerability risk priority list; and executing vulnerability repair operation according to the vulnerability risk priority list, calculating repair income based on state change after repair and repair cost, and updating parameters of the comprehensive risk assessment model to realize optimized closed-loop feedback. According to the method, a closed-loop optimization mechanism is constructed, so that the system can continuously perform self-optimization according to the repair feedback, and finally an intelligent cloud environment vulnerability precise governance system is formed.

Description

Technical Field

[0001] This invention relates to the field of cloud environment vulnerability detection and security management technology, and in particular to a cloud environment vulnerability detection and verification method, system, device and medium. Background Technology

[0002] Currently, in the field of cloud environment vulnerability detection and security management, numerous technical solutions involve vulnerability scanning, asset identification, and risk assessment. For example, mainstream cloud security platforms typically discover vulnerabilities in resources such as cloud hosts, containers, and function services through periodic scanning and vulnerability signature matching. Some research has introduced deep learning or knowledge graph technologies to improve the accuracy of vulnerability identification or to perform asset vulnerability correlation analysis. Furthermore, some platforms combine CVE scoring systems (CVSS) with initial risk ratings after detection and trigger security personnel responses through alert systems, thus forming a basic vulnerability discovery and handling process. Other academic research has explored the automation of vulnerability detection and patch verification, such as using sandbox reproduction or simulation environments to assess vulnerability exploitability, thereby improving the reliability of vulnerability verification.

[0003] However, these existing technologies still have significant limitations in large-scale, multi-tenant, and dynamically evolving cloud environments. First, traditional detection tools primarily target fixed asset lists or baseline images, lacking real-time tracking capabilities for elastic resources such as containers, microservices, and serverless computing. In cloud environments, assets are frequently created, destroyed, and migrated, and their operational status and exposure surfaces constantly change over time. Static detection methods cannot capture this dynamic evolution, leading to delayed scan results, incomplete asset identification, or the risk of misjudgment. Especially in multi-cloud and hybrid deployment scenarios, cross-platform configuration differences and isolation strategies further reduce scan coverage and consistency. Second, existing systems often rely on vulnerability signatures or fingerprints for matching and judgment, without verifying whether vulnerabilities are actually exploitable in the current operating environment. While some research introduces vulnerability reproduction techniques, it is mostly limited to single-point sandbox testing, lacking a unified verification strategy and a reliable result feedback mechanism, resulting in a disconnect between detection and verification, making it difficult to form a closed loop. Furthermore, current mainstream platforms generally use CVSS scoring or vulnerability type classification as the basis for risk assessment, without comprehensively considering asset importance, exposure paths, dependencies, and operational status. Furthermore, the interactions between different vulnerabilities were not modeled, making it impossible to formulate a globally optimized remediation priority strategy.

[0004] Therefore, there is an urgent need for a precise detection and verification method for cloud environment vulnerabilities based on dynamic asset profiling and risk priority assessment, so as to achieve high accuracy, strong verifiability and closed-loop intelligence in cloud environment vulnerability detection. Summary of the Invention

[0005] In view of the aforementioned existing problems, the present invention is proposed.

[0006] Therefore, this invention provides a cloud environment vulnerability detection and verification method, system, device and medium to solve the problems that current cloud environment vulnerability detection methods are unable to accurately reflect dynamic changes in assets and lack automated verification and context-based risk priority assessment, resulting in delayed vulnerability discovery, high false alarm rate and unreasonable remediation priorities.

[0007] To solve the above-mentioned technical problems, the present invention provides the following technical solution: In a first aspect, the present invention provides a cloud environment vulnerability detection and verification method, comprising: Collect multi-source features of cloud environment operation, encode the multi-source features and generate asset profile vector through attention fusion mechanism; The asset profile vector is matched with the semantic vector of the vulnerability knowledge base to filter potential vulnerability candidates. Automated vulnerability verification is performed on the potential vulnerability candidate set to calculate the vulnerability trigger probability and determine whether the vulnerability actually exists, thereby obtaining the verification result. Construct a comprehensive risk scoring model to calculate vulnerability priority scores and generate a vulnerability risk priority list; Vulnerability remediation operations are performed based on the vulnerability risk priority list. The remediation benefits are calculated based on the post-remediation status changes and remediation costs, and the parameters of the comprehensive risk assessment model are updated to achieve optimized closed-loop feedback.

[0008] As a preferred embodiment of the cloud environment vulnerability detection and verification method described in this invention, the screening of the potential vulnerability candidate set includes: Obtain vulnerability description text from publicly available vulnerability databases and standardize it; The standardized vulnerability description text is input into a text encoding model for semantic encoding to generate an initial semantic vector. The initial semantic vector is processed by a first processing operation to obtain the vulnerability knowledge base semantic vector; The first matching algorithm is used to calculate the semantic similarity between the asset profile vector and the vulnerability knowledge base semantic vector. Vulnerabilities whose semantic similarity exceeds the first detection threshold are included in the potential vulnerability candidate set, and a detection confidence matrix is ​​generated for subsequent verification.

[0009] The advantages of this preferred technical solution are: it can identify complex combination vulnerabilities and unknown variant vulnerabilities, reducing false positive and false negative rates. Especially in containerized and microservice environments, it can perform pre-detection before vulnerabilities form an explicit exploitation path, exhibiting higher robustness and foresight.

[0010] As a preferred embodiment of the cloud environment vulnerability detection and verification method described in this invention, the verification results include: Based on the potential vulnerability candidate set, an isolated test environment is constructed based on the configuration information of the target asset. In the isolated test environment, a corresponding verification task is generated and executed for each candidate vulnerability. Record the execution results of each verification task, and count the number of times the vulnerability was successfully triggered and the total number of verifications; The trigger probability of each vulnerability is calculated based on the number of successful triggers and the total number of verifications. The trigger probability is compared with a first verification threshold to determine whether the vulnerability actually exists. The output includes the vulnerability identifier and the corresponding trigger probability, and generates a verification log report.

[0011] The beneficial effects of this preferred technical solution are: it overcomes the problem of the lack of reproducibility and credibility of existing detection results, effectively filters false high-risk alarms by verifying the probability quantification of vulnerability authenticity, greatly reduces the workload of manual review, and improves the efficiency and reliability of vulnerability handling process.

[0012] As a preferred embodiment of the cloud environment vulnerability detection and verification method described in this invention, the step of constructing a comprehensive risk scoring model to calculate vulnerability priority scores and generating a vulnerability risk priority list includes: Extract asset importance information from the cloud management platform, calculate asset exposure factors based on security monitoring data, and obtain general basic scores for vulnerabilities from public vulnerability databases; The trigger probability of the vulnerability, asset importance information, asset exposure factor and general basic score are input into the comprehensive risk scoring model, and the vulnerability priority score of each vulnerability is calculated by weighted combination. All vulnerabilities are sorted in descending order based on their vulnerability priority scores to generate a vulnerability risk priority list.

[0013] As a preferred embodiment of the cloud environment vulnerability detection and verification method described in this invention, the step of performing vulnerability remediation operations according to the vulnerability risk priority list includes: According to the priority list of vulnerability risks, the corresponding repair commands or patch scripts are executed sequentially in the isolated test environment. After the sandbox verification shows no negative impact, the repair actions are pushed to the target assets in the production environment in the form of automated scripts. Re-execute the vulnerability verification process to confirm whether the vulnerability has been successfully patched. If the vulnerability fails to trigger, it is considered to have been patched successfully; if it can still be triggered, return to the next round of policy updates.

[0014] As a preferred embodiment of the cloud environment vulnerability detection and verification method described in this invention, the step of calculating the repair benefit based on the post-repair state change and repair cost, and updating the parameters of the comprehensive risk assessment model, includes: Collect system status data after repair, including port status, service version, and configuration item changes; The system status data after repair is compared with the system status before repair to obtain the change in system status. Combined with the cost data of the repair operation and the probability of vulnerability triggering, the repair benefit value is calculated. The weight parameters of the comprehensive risk assessment model are updated in a gradient based on the repair benefit value; The updated model parameters are fed back to the asset profiling and vulnerability detection steps, forming a closed-loop optimization process.

[0015] As a preferred embodiment of the cloud environment vulnerability detection and verification method described in this invention, the generated asset profile vector includes: Collect multi-source features of the cloud environment, including system configuration, network traffic, process logs, and service metadata; encode the multi-source features to obtain corresponding feature vectors; The feature vectors are weighted and combined using an attention weight fusion mechanism to generate a unified asset profile vector.

[0016] Secondly, the present invention provides a cloud environment vulnerability detection and verification system, comprising: The asset profile construction module is used to collect multi-source features of cloud environment operation, encode the multi-source features of operation and generate asset profile vectors through attention fusion mechanism; The vulnerability precision detection module is used to perform similarity matching between the asset profile vector and the semantic vector of the vulnerability knowledge base to filter potential vulnerability candidate sets; An automated vulnerability verification module is used to perform automated vulnerability verification on the potential vulnerability candidate set, calculate the vulnerability trigger probability and determine whether the vulnerability actually exists, and obtain the verification result. The adaptive risk ranking module is used to build a comprehensive risk scoring model to calculate vulnerability priority scores and generate a vulnerability risk priority list. The closed-loop optimization module is used to perform vulnerability remediation operations according to the vulnerability risk priority list, calculate the remediation benefits based on the post-remediation status changes and remediation costs, and update the parameters of the comprehensive risk assessment model to achieve closed-loop optimization feedback.

[0017] Thirdly, the present invention provides an electronic device, including a memory and a processor; the memory is used to store computer-executable instructions, and the processor, when executing the computer-executable instructions, implements the steps of a cloud environment vulnerability detection and verification method.

[0018] Fourthly, the present invention provides a computer-readable storage medium storing computer-executable instructions that, when executed by a processor, implement the steps of a cloud environment vulnerability detection and verification method.

[0019] Compared with existing technologies, the beneficial effects of this invention are as follows: This invention captures the dynamic changes and dependencies of assets in the cloud environment in real time through a dynamic asset profiling modeling mechanism, providing accurate contextual support for vulnerability detection; it adopts a semantically driven vulnerability precision detection model, integrating asset profiling and vulnerability semantic information to effectively identify complex vulnerabilities and reduce false positives and false negatives. This invention reproduces vulnerabilities in an isolated environment through an automated vulnerability verification mechanism, improving the credibility of detection results and the efficiency of handling; it introduces an adaptive risk priority assessment model, combining multi-dimensional risk factors to dynamically calculate the remediation order, achieving scientific risk governance. Furthermore, this invention constructs a closed-loop optimization mechanism of detection-verification-remediation, enabling the system to continuously self-optimize based on remediation feedback, ultimately forming an intelligent, adaptive, and scalable cloud environment vulnerability precision governance system. Attached Figure Description

[0020] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a schematic diagram of the overall process logic of a cloud environment vulnerability detection and verification method provided in one embodiment of the present invention. Detailed Implementation

[0022] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0023] Example 1, referring to Figure 1 As one embodiment of the present invention, a cloud environment vulnerability detection and verification method is provided, such as... Figure 1 The specific steps shown are as follows: S100: Collect multi-source features of cloud environment operation, encode the multi-source features of operation and generate asset profile vector through attention fusion mechanism; S200: Match the asset profile vector with the semantic vector of the vulnerability knowledge base to screen potential vulnerability candidates; S300: Performs automated vulnerability verification on the potential vulnerability candidate set, calculates the vulnerability trigger probability and determines whether the vulnerability actually exists, and obtains the verification result; S400: Build a comprehensive risk scoring model to calculate vulnerability priority scores and generate a vulnerability risk priority list; S500: Performs vulnerability remediation operations based on the vulnerability risk priority list, calculates remediation benefits based on the post-remediation status changes and remediation costs, and updates the parameters of the comprehensive risk assessment model to achieve optimized closed-loop feedback.

[0024] It should be noted that, to address the shortcomings of current cloud environment vulnerability detection methods in accurately reflecting dynamic asset changes and lacking automated verification and context-based risk prioritization, leading to delayed vulnerability discovery, high false positive rates, and unreasonable remediation priorities, steps S100-S500 above utilize a dynamic asset profiling modeling mechanism to capture the dynamic changes and dependencies of assets in the cloud environment in real time, providing accurate contextual support for vulnerability detection. A semantically driven vulnerability precision detection model is employed, integrating asset profiling and vulnerability semantic information to effectively identify complex vulnerabilities and reduce false positives and false negatives. This invention uses an automated vulnerability verification mechanism to realistically reproduce vulnerabilities in an isolated environment, improving the credibility of detection results and the efficiency of handling. An adaptive risk prioritization assessment model is introduced, combining multi-dimensional risk factors to dynamically calculate the remediation order, achieving scientific risk governance. Furthermore, this invention constructs a closed-loop optimization mechanism for detection-verification-remediation, enabling the system to continuously self-optimize based on remediation feedback, ultimately forming an intelligent, adaptive, and scalable cloud environment vulnerability precision governance system.

[0025] In this embodiment of the invention, step S100, which involves collecting multi-source operational features of the cloud environment, encoding these features, and generating an asset profile vector through an attention fusion mechanism, includes: Specifically, the multi-source characteristics of the cloud environment are collected. Including system configuration Network traffic Process logs and service metadata The formula is expressed as: Specifically, the multi-source features are encoded separately to obtain corresponding feature vectors. These feature vectors are then weighted and combined using an attention-weight fusion mechanism to generate a unified asset profile vector. in, This represents the high-dimensional characteristics of assets. For attention weight-based feature fusion functions, This represents the configuration feature vector of the asset (such as instance type, CPU / memory specifications, image version, etc.). A vector representing the network behavior characteristics of an asset (such as bandwidth usage, number of connections, traffic patterns, etc.). Represents the process and runtime characteristic vectors of an asset (such as the number of processes, the number of threads, system call patterns, etc.). This represents the service interaction feature vector of an asset (such as API call frequency, dependent service chain, request and response statistics, etc.).

[0026] It should be noted that step S100 above, by introducing a dynamic asset profiling modeling mechanism, achieves a multi-dimensional characterization of asset configuration, service interaction, and operational behavior in the cloud environment. Compared to traditional methods relying on static asset lists or periodic scanning, this embodiment can perceive changes in asset status and the evolution of dependencies in real time, significantly improving the coverage and accuracy of vulnerability detection, and solving the problems of delayed asset identification, missing operational information, and inability to capture dynamic exposure paths in a timely manner in existing technologies. The system can maintain the integrity and consistency of the asset view in complex multi-cloud and multi-tenant scenarios, providing high-precision contextual support for subsequent vulnerability detection and risk assessment.

[0027] In this embodiment of the invention, step S200, which involves similarity matching between the asset profile vector and the semantic vector of the vulnerability knowledge base to screen potential vulnerability candidates, includes the following sub-steps B1 to B5: In B1: The vulnerability description text is obtained from the publicly available vulnerability database and then standardized. Specifically, basic descriptions of vulnerabilities are obtained from publicly available vulnerability databases (such as CVE / CNVD / CNNVD), including structured or semi-structured text such as vulnerability name, affected components, attack methods, exploitation conditions, and vulnerability impact. The obtained vulnerability text is then standardized, including: removing special characters and HTML tags; word segmentation; stop word filtering; and standardizing the format.

[0028] In B2: The standardized vulnerability description text is input into the text encoding model for semantic encoding to generate an initial semantic vector; Specifically, the processed vulnerability text is input into a text encoding model (such as BERT) to obtain the initial semantic vector of the vulnerability, using the following formula: in, For pre-trained language models.

[0029] In B3: The initial semantic vector is processed to obtain the vulnerability knowledge base semantic vector; Specifically, the generated initial embedding vector is subjected to dimension normalization and scalarization to make it similar to the asset vector. In a consistent space, the final result is The high-dimensional semantic features of vulnerability j are used for subsequent matching calculations.

[0030] In an optional embodiment, the first processing operation may also be to perform dimensionality reduction and feature alignment on the initial semantic vector, for example, by using principal component analysis or autoencoder technology to extract key feature dimensions, and then using vector space mapping method to achieve spatial alignment with the asset profile vector.

[0031] In an optional embodiment, the first processing operation may further involve reconstructing the initial semantic vector through a cross-modal attention mechanism and adapting the vulnerability semantic representation in conjunction with the asset feature distribution to enhance the semantic consistency of subsequent matching.

[0032] In B4: The first matching algorithm (bidirectional Transformer semantic matching network) is used to calculate the semantic similarity between the asset profile vector and the vulnerability knowledge base semantic vector, expressed by the formula: In an optional embodiment, the first matching algorithm can also be a deep semantic matching model based on a Siamese neural network structure, which processes the asset profile vector and the vulnerability semantic vector through two shared weight encoding networks, and then calculates their matching degree through a multilayer perceptron.

[0033] In an optional embodiment, the first matching algorithm may also employ an interactive attention-based matching network, which first performs cross-attention calculation on the vectors of assets and vulnerabilities to capture fine-grained feature associations, and then outputs a comprehensive similarity score through an aggregation layer.

[0034] In B5: Vulnerabilities with semantic similarity exceeding the first detection threshold are included in the potential vulnerability candidate set, and a detection confidence matrix is ​​generated for subsequent verification. Specifically, in this embodiment, the first detection threshold is 0.5. This threshold was determined through statistical analysis of historical vulnerability detection data, ROC curve evaluation during the model validation phase, and expert experience. It aims to effectively control the false positive rate while ensuring recall, thus avoiding a large number of low-relevance vulnerabilities entering the verification stage and wasting resources. This threshold indicates that within the semantic similarity score standardized to the range of 0 to 1, only when the matching degree between the asset and the vulnerability reaches a moderate or higher level is the vulnerability considered likely to exist in the current asset environment. This achieves a balance between detection sensitivity and result reliability, and provides high-quality candidate input for subsequent automated verification modules.

[0035] It should be noted that step S200 above integrates asset profile features with vulnerability semantic embedding information to construct a multi-layer semantic matching network, thereby achieving contextual correlation analysis between vulnerabilities and asset features. Compared with traditional detection methods based on signature codes or CVE rule matching, this invention can identify complex combination vulnerabilities and unknown variant vulnerabilities, reducing false positive and false negative rates. Especially in containerized and microservice environments, it can complete pre-detection before vulnerabilities form explicit exploitation paths, exhibiting higher robustness and foresight.

[0036] In this embodiment of the invention, step S300 performs automated vulnerability verification on the potential vulnerability candidate set, calculates the vulnerability trigger probability, and determines whether the vulnerability actually exists. The verification result includes the following sub-steps C1 to C3: In C1: Based on the potential vulnerability candidate set, an isolated test environment is built based on the configuration information of the target asset. In the isolated test environment, a corresponding verification task is generated and executed for each candidate vulnerability. Specifically, obtaining a candidate set of vulnerabilities. and asset environment mirrors or sandbox instances Among them, asset environment mirroring The system automatically builds sandbox instances based on the configuration snapshots of production assets (image ID, software dependencies, runtime environment, etc.) and generates isolated sandbox instances for vulnerability verification during test execution.

[0037] Specifically, an automated verification task set is generated for each candidate vulnerability. : In C2: Record the execution result of each verification task, count the number of successful vulnerability triggers and the total number of verifications, and calculate the trigger probability of each vulnerability based on the number of successful triggers and the total number of verifications. The formula is: in, This represents the probability of successful triggering of vulnerability j, reflecting the actual exploitability of the vulnerability in the current asset environment. This indicates the number of times the vulnerability was successfully triggered during the vulnerability verification process. This indicates the total number of verification attempts made for this vulnerability.

[0038] In C3: The trigger probability is compared with the first verification threshold to determine whether the vulnerability actually exists. The verification result, which includes the vulnerability identifier and the corresponding trigger probability, is output, and a verification log report is generated. Specifically, in this embodiment, the first verification threshold Typically, a value of 0.4 is used (adjustable within the range of 0.3–0.5). When At that time, it was determined that the vulnerability truly existed.

[0039] It should be noted that the first verification threshold was determined by statistically analyzing the trigger probability of a large number of verified vulnerabilities in various typical cloud environment scenarios, combined with the acceptable false positive tolerance and remediation resource constraints in security operations and maintenance. This threshold means that when the verification success rate of a vulnerability in an isolated environment reaches 40% or more, the system considers it to be actually exploitable. This setting aims to balance the rigor and efficiency of verification, avoiding both underestimating actual risks due to an excessively high threshold and misjudging accidental or demanding triggers as real vulnerabilities due to an excessively low threshold, thereby ensuring that subsequent risk assessments and remediation decisions are based on high-confidence verification results.

[0040] In an alternative embodiment, the automated vulnerability verification step may also employ a symbolic execution-based pathfinding method to systematically generate and test combinations of input conditions that trigger vulnerabilities in an isolated environment, in order to quantify the reachability and exploitability of vulnerabilities.

[0041] In an optional embodiment, the automated vulnerability verification step may also involve implementing a verification strategy based on dynamic taint tracking and data flow analysis, which monitors the propagation path of sensitive data in the sandbox environment to determine whether the vulnerability poses an actual risk of data leakage or system control failure.

[0042] It should be noted that step S300 overcomes the problem of existing detection results lacking reproducibility and reliability, and can automatically determine whether a vulnerability can actually be triggered and whether runtime protection coverage exists. By verifying the probability quantification of vulnerability authenticity, it effectively filters false high-risk alerts, greatly reduces the workload of manual review, and improves the efficiency and reliability of the vulnerability handling process.

[0043] In this embodiment of the invention, the above step S400, which constructs a comprehensive risk scoring model to calculate vulnerability priority scores and generates a vulnerability risk priority list, includes the following sub-steps D1~D3: In D1: Extract asset importance information from the cloud management platform, calculate asset exposure factors based on security monitoring data, and obtain general basic scores for vulnerabilities from the public vulnerability database; Specifically, asset importance The asset attributes are automatically obtained by the system from the cloud platform or CMDB and are calculated, including but not limited to: the business level of the asset (e.g., core business, important business, general business); the criticality of the asset in the business chain (e.g., whether it is a critical node, whether there is redundancy); the business importance level of the asset's value tag and the configuration of the operation and maintenance personnel; and the environment in which the asset is located (production environment > disaster recovery environment > testing environment > development environment). The system converts this structured information into numerical levels to form... .

[0044] Specifically, exposure factors This data is generated in real-time from attack surface data collected by the security monitoring platform, including: the number of open ports and services on assets; the status of exposed public / cross-domain access interfaces; access traffic characteristics (external access ratio, exposure duration); and attack surface indicators such as discovered weak passwords, expired certificates, and unauthorized interfaces. The system normalizes and quantifies the exposure level based on these indicators, generating... Numerical value.

[0045] In D2: The vulnerability trigger probability, asset importance information, asset exposure factor and general basic score are input into the comprehensive risk scoring model, and the vulnerability priority score of each vulnerability is calculated by weighted combination; Specifically, a comprehensive risk scoring model is constructed to calculate a priority score for each vulnerability: in, The weight parameters are dynamically adjusted by the reinforcement learning mechanism, enabling the risk assessment to be optimized in real time according to the environmental conditions. The CVSS (Common Vulnerability Scoring System) baseline score for vulnerability j is provided by national or international vulnerability databases (such as CVE, CNVD, CNNVD) and is used to characterize the severity and scope of the vulnerability.

[0046] In an optional embodiment, the vulnerability priority score can also be calculated using a combined weighting model based on the analytic hierarchy process and the entropy weighting method. The weights of each risk factor are determined by subjective experience and objective data distribution, and then the standardized indicators are weighted and aggregated.

[0047] In an optional embodiment, the vulnerability priority score can also be calculated using a nonlinear scoring model based on a deep neural network. This model inputs multidimensional risk features into the network for high-order interaction and nonlinear transformation, directly outputting a comprehensive risk score to more flexibly capture complex risk correlations.

[0048] In D3: All vulnerabilities are sorted in descending order based on their vulnerability priority scores to generate a vulnerability risk priority list; Specifically, all vulnerabilities are sorted in descending order based on their vulnerability priority scores, i.e., from... Determine the vulnerability handling order and generate a vulnerability risk priority list. .

[0049] It should be noted that step S400 above dynamically generates a vulnerability risk score by comprehensively considering asset importance, exposure factor, CVSS score, and time sensitivity based on the vulnerability verification results. Unlike traditional static risk classification mechanisms, this model adaptively adjusts weight parameters through reinforcement learning algorithms, achieving real-time optimization of risk ranking and self-evolution of strategies, thereby automatically determining the optimal remediation order in multi-vulnerability scenarios. This significantly improves the scientific nature of vulnerability governance and the rationality of resource allocation, making security operation decisions more aligned with business priorities and actual security risks.

[0050] In this embodiment of the invention, step S500, which involves performing vulnerability remediation operations based on the vulnerability risk priority list, calculating remediation benefits based on the post-remediation state changes and remediation costs, and updating the parameters of the comprehensive risk assessment model to achieve optimized closed-loop feedback, includes the following sub-steps E1 and E2: In E1: Perform vulnerability remediation operations based on the vulnerability risk priority list; detailed steps include: According to the priority list of vulnerability risks, the corresponding repair commands or patch scripts are executed sequentially in the isolated test environment. After the sandbox verification shows no negative impact, the repair actions are pushed to the target assets in the production environment in the form of automated scripts. Re-execute the vulnerability verification process to confirm whether the vulnerability has been successfully patched. If the vulnerability fails to trigger, it is considered to have been patched successfully; if it can still be triggered, return to the next round of policy updates.

[0051] In E2: the repair benefits are calculated based on the post-repair state changes and repair costs, and the parameters of the comprehensive risk assessment model are updated to achieve optimized closed-loop feedback; Specifically, the system status data after repair is collected, including port status, service version, and configuration item changes. The repaired system status data is then compared with the system status before repair to obtain the amount of system status change. : in, Indicates the system status after repair. This indicates the system state before the repair.

[0052] Specifically, by combining the cost data of the remediation operation with the probability of vulnerability triggering, the remediation benefit value is calculated: in, To cover repair costs, To verify the probability, These are the weight parameters.

[0053] Specifically, the weight parameters of the comprehensive risk assessment model are updated using a gradient based on the repair benefit value, as shown in the formula: Specifically, the updated model parameters Feedback is fed back to the asset profiling and vulnerability detection steps, forming a closed-loop optimization process.

[0054] It should be noted that step S500 above constructs a closed-loop optimization mechanism of detection-verification-remediation. After vulnerability handling is completed, it automatically transmits back the remediation results, performance changes, and risk convergence data. Through causal correlation modeling, it achieves adaptive optimization of the detection model and ranking algorithm. Compared with existing static detection systems, this invention achieves closed-loop linkage, enabling the system to continuously improve vulnerability detection accuracy and risk assessment stability during long-term operation, forming an adaptive security knowledge system with continuous evolution capabilities.

[0055] Example 2, based on the previous example, provides an application example of a cloud environment vulnerability detection and verification method to verify and illustrate the technical effects used in this method.

[0056] This embodiment deploys the system of the present invention in an enterprise cloud environment (100 hosts, 12 container clusters, and 28 business systems) to verify the method flow of the present invention. The system continuously collects the asset operating status and automatically generates profile data as shown in Table 1.

[0057] Table 1: Asset profile data.

[0058] The profile data for the example asset (ID=H23) includes: ① Accessible ports: 22, 80, 6379; ② Exposed components: Nginx 1.16, Redis 5.0; ③ External reachability: Accessible via the external network; ④ Importance metrics ( ): 0.82 after normalization based on business scores; ⑤ Exposure factor ( The value is calculated as 0.67 based on the number of exposed ports and the external network exposure weight. Three potential vulnerabilities were identified on the example asset H23, as shown in Table 2.

[0059] Furthermore, according to the formula The system performs automatic PoC verification for each vulnerability, with a total of 10 rounds of attempts. The results are shown in Table 3. The verification threshold is 0.6. Therefore, the system determines that V1 and V3 are real vulnerabilities, and V2 is a false alarm (filtered).

[0060] Table 2: Potential vulnerabilities.

[0061] Table 3: Verification results.

[0062] Calculate asset exposure factors For host H23: there are 3 open ports → the normalized value is 0.42, the external network exposure weight is 0.25, the composite value is 0.67, so the asset exposure factor is 0.67.

[0063] Furthermore, the weights are set as follows: Based on the comprehensive risk scoring model, a priority score is calculated for each vulnerability: vulnerability V1 has a priority score of 0.8425, while vulnerability V3 has a priority score of 0.7230. Therefore, vulnerability V1 has a higher processing priority. Enterprise security personnel will then patch V1 first, followed by V3.

[0064] As demonstrated by the above embodiments, this invention captures the dynamic changes and dependencies of assets in the cloud environment in real time through a dynamic asset profiling modeling mechanism, providing accurate contextual support for vulnerability detection. It employs a semantically driven vulnerability detection model that integrates asset profiling and vulnerability semantic information to effectively identify complex vulnerabilities and reduce false positives and false negatives. This invention uses an automated vulnerability verification mechanism to realistically reproduce vulnerabilities in an isolated environment, improving the credibility of detection results and the efficiency of handling. It introduces an adaptive risk priority assessment model, combining multi-dimensional risk factors to dynamically calculate the remediation order, achieving scientific risk governance. Furthermore, this invention constructs a closed-loop optimization mechanism of detection-verification-remediation, enabling the system to continuously self-optimize based on remediation feedback, ultimately forming an intelligent, adaptive, and scalable cloud environment vulnerability precision governance system.

[0065] Example 3: This example provides a cloud environment vulnerability detection and verification system, including: The asset profiling module is used to collect multi-source features of the cloud environment, encode the multi-source features, and generate asset profiling vectors through an attention fusion mechanism. The vulnerability precision detection module is used to perform similarity matching between asset profile vectors and semantic vectors in the vulnerability knowledge base to filter potential vulnerability candidate sets; The automated vulnerability verification module is used to perform automated vulnerability verification on a potential vulnerability candidate set, calculate the vulnerability trigger probability and determine whether the vulnerability actually exists, and obtain the verification result. The adaptive risk ranking module is used to build a comprehensive risk scoring model to calculate vulnerability priority scores and generate a vulnerability risk priority list. The closed-loop optimization module is used to perform vulnerability remediation operations based on the vulnerability risk priority list, calculate the remediation benefits based on the post-remediation status changes and remediation costs, and update the parameters of the comprehensive risk assessment model to achieve closed-loop optimization feedback.

[0066] It should be noted that the technical solution of the cloud environment vulnerability detection and verification system and the technical solution of the cloud environment vulnerability detection and verification method mentioned above belong to the same concept. For details not described in detail in the technical solution of the cloud environment vulnerability detection and verification system in this embodiment, please refer to the description of the technical solution of the cloud environment vulnerability detection and verification method mentioned above.

[0067] The above-mentioned unit modules can be embedded in the processor of the electronic device in hardware form or independent of it, or they can be stored in the memory of the electronic device in software form, so that the processor can call and execute the corresponding operations of the above modules.

[0068] This embodiment also provides an electronic device, which includes a processor, a memory, a communication interface, a display screen, and an input device connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. When the computer program is executed by the processor, it implements a cloud environment vulnerability detection and verification method. The display screen can be a liquid crystal display (LCD) or an e-ink display. The input device can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the device's casing, or an external keyboard, touchpad, or mouse.

[0069] This embodiment also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method proposed in the above embodiments.

[0070] The storage medium proposed in this embodiment belongs to the same inventive concept as the method proposed in the above embodiments. Technical details not described in detail in this embodiment can be found in the above embodiments, and this embodiment has the same beneficial effects as the above embodiments.

[0071] Based on the above description of the implementation methods, those skilled in the art can clearly understand that the present invention can be implemented using software and necessary general-purpose hardware, and of course, it can also be implemented using hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory, random access memory, flash memory, hard disk, or optical disk, and includes several instructions to cause an electronic device (which may be a personal computer, server, or network device, etc.) to execute the method of the embodiments of the present invention.

[0072] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for vulnerability detection and verification in a cloud environment, characterized in that, include: Collect multi-source features of cloud environment operation, encode the multi-source features and generate asset profile vector through attention fusion mechanism; The asset profile vector is matched with the semantic vector of the vulnerability knowledge base to filter potential vulnerability candidates. Automated vulnerability verification is performed on the potential vulnerability candidate set to calculate the vulnerability trigger probability and determine whether the vulnerability actually exists, thereby obtaining the verification result. Construct a comprehensive risk scoring model to calculate vulnerability priority scores and generate a vulnerability risk priority list; Vulnerability remediation operations are performed based on the vulnerability risk priority list. The remediation benefits are calculated based on the post-remediation status changes and remediation costs, and the parameters of the comprehensive risk assessment model are updated to achieve optimized closed-loop feedback.

2. The cloud environment vulnerability detection and verification method as described in claim 1, characterized in that, The candidate set of potential vulnerabilities includes: Obtain vulnerability description text from publicly available vulnerability databases and standardize it; The standardized vulnerability description text is input into a text encoding model for semantic encoding to generate an initial semantic vector. The initial semantic vector is processed by a first processing operation to obtain the vulnerability knowledge base semantic vector; The first matching algorithm is used to calculate the semantic similarity between the asset profile vector and the vulnerability knowledge base semantic vector. Vulnerabilities whose semantic similarity exceeds the first detection threshold are included in the potential vulnerability candidate set, and a detection confidence matrix is ​​generated for subsequent verification.

3. The cloud environment vulnerability detection and verification method as described in claim 2, characterized in that, The verification results include: Based on the potential vulnerability candidate set, an isolated test environment is constructed based on the configuration information of the target asset. In the isolated test environment, a corresponding verification task is generated and executed for each candidate vulnerability. Record the execution results of each verification task, and count the number of times the vulnerability was successfully triggered and the total number of verifications; The trigger probability of each vulnerability is calculated based on the number of successful triggers and the total number of verifications. The trigger probability is compared with a first verification threshold to determine whether the vulnerability actually exists. The output includes the vulnerability identifier and the corresponding trigger probability, and generates a verification log report.

4. The cloud environment vulnerability detection and verification method as described in claim 3, characterized in that, The process of constructing a comprehensive risk scoring model to calculate vulnerability priority scores and generate a vulnerability risk priority list includes: Extract asset importance information from the cloud management platform, calculate asset exposure factors based on security monitoring data, and obtain general basic scores for vulnerabilities from public vulnerability databases; The trigger probability of the vulnerability, asset importance information, asset exposure factor and general basic score are input into the comprehensive risk scoring model, and the vulnerability priority score of each vulnerability is calculated by weighted combination. All vulnerabilities are sorted in descending order based on their vulnerability priority scores to generate a vulnerability risk priority list.

5. The cloud environment vulnerability detection and verification method as described in claim 4, characterized in that, The step of performing vulnerability remediation operations based on the vulnerability risk priority list includes: According to the priority list of vulnerability risks, the corresponding repair commands or patch scripts are executed sequentially in the isolated test environment. After the sandbox verification shows no negative impact, the repair actions are pushed to the target assets in the production environment in the form of automated scripts. Re-execute the vulnerability verification process to confirm whether the vulnerability has been successfully patched. If the vulnerability fails to trigger, it is considered to have been patched successfully; if it can still be triggered, return to the next round of policy updates.

6. The cloud environment vulnerability detection and verification method as described in claim 5, characterized in that, The process of calculating repair benefits based on post-repair state changes and repair costs, and updating the parameters of the comprehensive risk assessment model, includes: Collect system status data after repair, including port status, service version, and configuration item changes; The system status data after repair is compared with the system status before repair to obtain the change in system status. Combined with the cost data of the repair operation and the probability of vulnerability triggering, the repair benefit value is calculated. The weight parameters of the comprehensive risk assessment model are updated in a gradient based on the repair benefit value; The updated model parameters are fed back to the asset profiling and vulnerability detection steps, forming a closed-loop optimization process.

7. The cloud environment vulnerability detection and verification method as described in claim 1, characterized in that, The generated asset profile vector includes: Collect multi-source features of the cloud environment, including system configuration, network traffic, process logs, and service metadata; encode the multi-source features to obtain corresponding feature vectors; The feature vectors are weighted and combined using an attention weight fusion mechanism to generate a unified asset profile vector.

8. A cloud environment vulnerability detection and verification system, employing the cloud environment vulnerability detection and verification method as described in any one of claims 1 to 7, characterized in that, include: The asset profile construction module is used to collect multi-source features of cloud environment operation, encode the multi-source features of operation and generate asset profile vectors through attention fusion mechanism; The vulnerability precision detection module is used to perform similarity matching between the asset profile vector and the semantic vector of the vulnerability knowledge base to filter potential vulnerability candidate sets; An automated vulnerability verification module is used to perform automated vulnerability verification on the potential vulnerability candidate set, calculate the vulnerability trigger probability and determine whether the vulnerability actually exists, and obtain the verification result. The adaptive risk ranking module is used to build a comprehensive risk scoring model to calculate vulnerability priority scores and generate a vulnerability risk priority list. The closed-loop optimization module is used to perform vulnerability remediation operations according to the vulnerability risk priority list, calculate the remediation benefits based on the post-remediation status changes and remediation costs, and update the parameters of the comprehensive risk assessment model to achieve closed-loop optimization feedback.

9. An electronic device comprising a memory and a processor, characterized in that: The memory is used to store computer-executable instructions, and when the processor executes the computer-executable instructions, it implements the steps of the cloud environment vulnerability detection and verification method according to any one of claims 1 to 7.

10. A computer-readable storage medium having computer-executable instructions stored thereon, characterized in that: When the computer-executable instructions are executed by the processor, they implement the steps of the cloud environment vulnerability detection and verification method according to any one of claims 1 to 7.

Images