Integrated processing method for linkage of real-time collection and reproduction verification of vulnerability information

Abstract

The invention relates to the technical field of vulnerability processing, in particular to an integrated processing method for linkage of real-time collection and reproduction verification of vulnerability information, which comprises the following steps: converting vulnerability information data into standardized vulnerability knowledge entries based on a semantic analysis and structured extraction technology, and generating a vulnerability reproduction script adaptive to a target controlled environment; running the vulnerability reproduction script in the target controlled environment, and collecting a system index and a behavior log during running; and based on a preset vulnerability triggering feature, obtaining a reproduction result, generating a defense strategy and pushing the defense strategy to the security device. According to the method, the intelligence utilization efficiency is improved through structured extraction and semantic analysis, the reproduction script is generated based on standardized vulnerability knowledge entries, and automatic and portable vulnerability verification is achieved. The script is operated in the isolation environment, the reproduction result is safely and efficiently obtained, the defense strategy is automatically generated according to the result and pushed to the security equipment in time, the vulnerability handling period is remarkably shortened, and the network security protection capability is improved.

Description

Technical Field

[0001] This invention relates to the field of vulnerability processing technology, specifically to an integrated processing method that links real-time vulnerability intelligence collection with reproduction and verification. Background Technology

[0002] With the continuous evolution of cyberattack techniques, vulnerabilities have become a core threat to network and information system security. Attackers often exploit unpatched or insufficiently understood vulnerabilities to launch attacks such as remote intrusion, malicious code execution, or denial-of-service attacks, causing serious information leaks and system paralysis. Vulnerability handling typically includes intelligence gathering, analysis and assessment, verification and reproduction, and defense deployment. However, existing technologies still have significant shortcomings in these aspects.

[0003] First, vulnerability intelligence sources are broad and heterogeneous, including security communities, intelligence platforms, open-source forums, as well as vendor announcements and research reports. These different channels vary significantly in description methods, formatting standards, and granularity, directly hindering the rapid integration and utilization of intelligence. Manual analysis is costly and impacts response timeliness. Second, existing vulnerability reproduction and verification processes rely on human experience, typically requiring security personnel to manually write test scripts and verify them in experimental environments. This is not only inefficient but also time-consuming, failing to meet the emergency response needs of zero-day vulnerabilities or rapidly spreading vulnerabilities.

[0004] Furthermore, the generation and distribution of vulnerability defense strategies are also fragmented. Most existing solutions involve security personnel developing rules or policies based on experience after a vulnerability is identified, and then manually configuring them into security devices such as firewalls and intrusion detection systems. This approach lacks automation and real-time capability, causing defense measures to often lag behind attack behavior and making it difficult to form effective protection in a timely manner. Especially when facing large-scale, automated attack scenarios, traditional methods prove inadequate. Summary of the Invention

[0005] (I) Purpose of the Invention

[0006] The purpose of this invention is to provide an integrated processing method for real-time vulnerability intelligence collection and reproduction verification. It improves intelligence utilization efficiency through structured extraction and semantic analysis, generates reproduction scripts based on standardized vulnerability knowledge entries, and achieves automated and portable vulnerability verification. Running the scripts in an isolated environment securely and efficiently obtains reproduction results, automatically generates defense strategies based on the results, and promptly pushes them to security devices, significantly shortening the vulnerability handling cycle and improving network security protection capabilities.

[0007] (II) Technical Solution

[0008] To address the above problems, this invention provides an integrated processing method for real-time vulnerability intelligence collection and reproduction verification, comprising:

[0009] Vulnerability intelligence data is collected in real time from multiple heterogeneous intelligence sources;

[0010] Based on semantic parsing and structured extraction techniques, the vulnerability intelligence data is transformed into standardized vulnerability knowledge entries.

[0011] Based on the vulnerability knowledge entries, generate a vulnerability reproduction script adapted to the target controlled environment;

[0012] Run the vulnerability reproduction script in the target controlled environment and collect runtime system metrics and behavior logs;

[0013] Based on the system metrics and behavior logs, and using preset vulnerability triggering characteristics, the reproduction results are obtained.

[0014] Based on the reproduction results, a defense strategy is generated and pushed to the security device.

[0015] In another aspect of the present invention, preferably, the vulnerability intelligence data includes: structured vulnerability information and unstructured vulnerability description text;

[0016] The real-time collection of vulnerability intelligence data from multiple heterogeneous intelligence channels includes:

[0017] Structured vulnerability information is obtained from a publicly available vulnerability database, including vulnerability number, scope of impact, and patch information;

[0018] Obtain unstructured vulnerability description texts from threat intelligence platforms, dark web forums, and security communities;

[0019] The structured vulnerability information and unstructured vulnerability description text are timestamped and their source credibility is rated.

[0020] A vulnerability intelligence cache queue is established based on the timestamp markers and source credibility ratings.

[0021] In another aspect of the present invention, preferably, the step of converting the vulnerability intelligence data into standardized vulnerability knowledge entries based on semantic parsing and structured extraction technology includes:

[0022] The structured vulnerability information is parsed to extract the vulnerability number, vulnerability level, scope of impact, and patch information, thus obtaining structured fields.

[0023] Unstructured vulnerability description text is segmented, entity-recognized, and contextually semantically analyzed to identify affected software, version numbers, vulnerability exploitation methods, and environmental dependencies, thereby obtaining unstructured semantic analysis results.

[0024] Based on a pre-defined vulnerability knowledge representation structure, standardized vulnerability knowledge entries are generated according to the structured fields and unstructured semantic analysis results. These entries include vulnerability identifiers, affected objects, triggering conditions, attack methods, and environmental dependencies.

[0025] In another aspect of the present invention, preferably, the step of generating a vulnerability reproduction script adapted to the target controlled environment based on the vulnerability knowledge entry includes:

[0026] Based on the triggering conditions and attack methods in the aforementioned vulnerability knowledge entries, a vulnerability triggering instruction sequence and attack payload are constructed.

[0027] The vulnerability triggering instruction sequence and attack payload are encapsulated into an executable script to generate a vulnerability reproduction script.

[0028] In another aspect of the present invention, preferably, the step of generating a vulnerability reproduction script adapted to the target controlled environment based on the vulnerability knowledge entry includes:

[0029] Analyze the vulnerability identifiers, affected objects, and environmental dependencies in the vulnerability knowledge entries to determine the system configuration and software version of the target controlled environment;

[0030] Based on a pre-set vulnerability script template library, the corresponding script template is determined according to the triggering conditions and attack methods in the vulnerability knowledge entries;

[0031] Based on the script template, and considering the system configuration and software version of the target controlled environment, determine the execution parameters required for the vulnerability reproduction script;

[0032] The script template is populated and assembled according to the execution parameters.

[0033] In another aspect of the present invention, preferably, the step of generating a vulnerability reproduction script adapted to the target controlled environment based on the vulnerability knowledge entries further includes:

[0034] Based on the triggering conditions and attack methods in the aforementioned vulnerability knowledge entries, a vulnerability triggering instruction sequence and attack payload are constructed.

[0035] The script template is populated and assembled based on the vulnerability triggering instruction sequence and attack payload to generate a vulnerability reproduction script.

[0036] In another aspect of the present invention, preferably, the target controlled environment is isolated from the production environment, and the target controlled environment includes an isolated virtualized environment or a container sandbox;

[0037] The process of running the vulnerability reproduction script in the target controlled environment and collecting runtime system metrics and behavior logs includes:

[0038] Load the vulnerability reproduction script in an isolated virtualized environment or container sandbox;

[0039] The initial state of the target controlled environment is saved before execution;

[0040] Collect runtime system metrics and behavior logs.

[0041] In another aspect of the present invention, preferably,

[0042] The system metrics include CPU utilization, memory usage, disk I / O, and network bandwidth.

[0043] The behavior log includes kernel logs, application logs, and system event logs, and information on abnormal events generated during the exploitation of vulnerabilities is obtained through the behavior log.

[0044] The system metrics and behavior logs are associated and stored.

[0045] In another aspect of the present invention, preferably, based on the system indicators and behavior logs, and based on preset vulnerability triggering characteristics, the reproduction result is obtained, including:

[0046] The system metrics and behavior logs are compared with preset vulnerability triggering features to obtain a vulnerability triggering feature template, which includes system call sequence, memory out-of-bounds behavior, abnormal process creation mode and abnormal network communication mode.

[0047] When the system metrics and behavior logs show an event sequence that is consistent with or has a similarity exceeding the corresponding preset threshold to the vulnerability trigger feature template, it is determined that the vulnerability has been successfully reproduced.

[0048] When the system metrics and behavior logs do not show an event sequence that is consistent with or has a similarity exceeding the corresponding preset threshold to the vulnerability trigger feature template, the vulnerability reproduction is determined to have failed and is marked as pending review.

[0049] In another aspect of the present invention, preferably, generating a defense strategy and pushing it to a security device based on the reproduction results includes:

[0050] Based on the successful vulnerability reproduction of the attack methods and triggering conditions, corresponding detection rules and interception strategies are generated. The detection rules include a system call whitelist, a process behavior blacklist, and network access restrictions.

[0051] Based on the failure to reproduce the vulnerability, a monitoring strategy is generated, which includes enhanced log collection and alerts for suspicious behavior.

[0052] The detection rules, interception strategies, and monitoring strategies are uniformly encapsulated into a deployable defense strategy.

[0053] In another aspect of the present invention, preferably, generating a defense strategy and pushing it to a security device based on the reproduction results further includes:

[0054] The defense strategy is converted into a rule format compatible with different security devices, including firewalls, intrusion detection systems, and host security agents.

[0055] The defense policy is distributed to the corresponding security device through the security policy distribution interface, and an effectiveness verification is performed after the defense policy is distributed.

[0056] When the defense strategy fails to be deployed, a rollback mechanism is triggered and an alarm log is generated.

[0057] (III) Beneficial Effects

[0058] The above-described technical solution of the present invention has the following beneficial technical effects:

[0059] This invention collects vulnerability intelligence data from multiple heterogeneous sources in real time and, combined with semantic parsing and structured extraction techniques, transforms fragmented and heterogeneous intelligence information into standardized vulnerability knowledge entries, thereby achieving the standardization and efficient utilization of intelligence. Based on these knowledge entries, vulnerability reproduction scripts adapted to the target controlled environment are generated, enabling automated vulnerability verification, significantly reducing manual intervention and improving the accuracy and timeliness of vulnerability verification. Running the reproduction scripts in an isolated virtualized environment or container sandbox ensures the verification process is secure and controllable, and collects runtime system indicators and behavior logs, providing a reliable basis for judging vulnerability trigger characteristics. Through automatic analysis of the reproduction results, corresponding defense strategies can be quickly generated and pushed to security devices, achieving a closed-loop linkage of vulnerability intelligence, reproduction verification, and defense response throughout the entire process. Compared with existing technologies, this invention significantly shortens the time from vulnerability discovery to handling, improves the automation and intelligence level of vulnerability management, and enhances the initiative and reliability of network security protection. Attached Figure Description

[0060] Figure 1 This is an overall flowchart of one embodiment of the present invention. Detailed Implementation

[0061] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to specific embodiments and the accompanying drawings. It should be understood that these descriptions are merely exemplary and not intended to limit the scope of the invention. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concept of the invention.

[0062] Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0063] Furthermore, the technical features involved in the different embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0064] The invention will now be described in more detail with reference to the accompanying drawings. In the various drawings, the same elements are indicated by similar reference numerals. For clarity, the various parts in the drawings are not drawn to scale.

[0065] Example 1

[0066] An integrated processing method that links real-time vulnerability intelligence collection with reproduction and verification. Figure 1 An overall flowchart of one embodiment of the present invention is shown, as follows: Figure 1 As shown, it includes:

[0067] Vulnerability intelligence data is collected in real time from multiple heterogeneous intelligence channels. These channels may include national vulnerability databases, vendor security bulletins, threat intelligence sharing platforms, security community forums, open-source code repositories, and network security monitoring systems. In this embodiment, the vulnerability intelligence data includes structured vulnerability information and unstructured vulnerability description text to meet different needs for vulnerability analysis and reproduction verification.

[0068] The real-time collection of vulnerability intelligence data from multiple heterogeneous intelligence channels includes:

[0069] Structured vulnerability information is obtained from publicly available vulnerability databases, including vulnerability IDs, scope of impact, and patch information; such as the National Vulnerability Database (NVD), vendor security bulletins, or vulnerability information centers.

[0070] Unstructured vulnerability description texts are obtained from threat intelligence platforms, dark web forums, and security communities. These unstructured vulnerability description texts describe the exploitation methods, attack conditions, affected targets, and environmental dependencies of the vulnerabilities in natural language. The process of collecting vulnerability intelligence data in real time from multiple heterogeneous intelligence channels includes: obtaining structured vulnerability information from public vulnerability databases through interfaces or web crawling techniques, parsing and extracting key fields to form standardized data entries; simultaneously, obtaining unstructured vulnerability description texts from threat intelligence platforms, dark web forums, and security communities through API interfaces, targeted crawling, or subscription mechanisms, and performing text cleaning and format standardization for subsequent analysis.

[0071] The structured vulnerability information and unstructured vulnerability description text are timestamped and rated for source credibility. To ensure the timeliness and reliability of vulnerability intelligence, this embodiment timestamps the collected structured information and unstructured text and rates them based on source credibility. For example, data from official vendor announcements are given a high credibility rating, while community or forum data is weighted and scored based on user reputation, historical accuracy, and posting frequency.

[0072] A vulnerability intelligence cache queue is established based on the timestamp markers and source credibility ratings. Newly collected vulnerability data is sorted and prioritized. High-credibility and up-to-date data is given priority in subsequent processing, used for vulnerability knowledge entry generation and reproduction script construction. The cache queue can be dynamically updated, supporting real-time addition and expiration deletion mechanisms, thereby ensuring the timeliness, integrity, and reliability of vulnerability intelligence data, providing a solid data foundation for subsequent vulnerability reproduction verification and defense strategy generation.

[0073] Based on semantic parsing and structured extraction technology, the vulnerability intelligence data is transformed into standardized vulnerability knowledge entries. In this embodiment, the structured vulnerability information is parsed to extract the vulnerability number, vulnerability level, scope of impact, and patch information to obtain structured fields, which are used to accurately describe the basic attributes and scope of impact of the vulnerability.

[0074] Unstructured vulnerability description text is segmented, entity-based, and analyzed using contextual semantics to identify affected software, version numbers, exploit methods, and environmental dependencies, yielding unstructured semantic analysis results. Segmentation breaks the text into words or phrases. Entity recognition uses a named entity recognition model to identify the affected software name, version number, attack components, exploit methods, and related environmental dependencies. Contextual semantic analysis uses a semantic parsing model to identify logical relationships between sentences and exploit conditions, obtaining unstructured semantic analysis results.

[0075] Based on a pre-defined vulnerability knowledge representation structure, standardized vulnerability knowledge entries are generated according to the structured fields and unstructured semantic analysis results. These entries include vulnerability identifiers, affected objects, triggering conditions, attack methods, and environmental dependencies. The vulnerability knowledge representation structure defines the core information fields that a vulnerability entry should include, such as vulnerability identifiers, affected objects, triggering conditions, attack methods, and environmental dependencies. Through rule matching, field mapping, and semantic association techniques, structured fields and unstructured semantic analysis results are mapped to standardized fields, generating complete and unified standardized vulnerability knowledge entries. These standardized vulnerability knowledge entries not only include the basic attributes and scope of impact of the vulnerability but also explicitly describe the vulnerability triggering conditions, attack methods, and execution environment requirements, providing a data foundation for the subsequent automatic generation of vulnerability reproduction scripts adapted to the target controlled environment.

[0076] Based on the vulnerability knowledge entries, a vulnerability reproduction script adapted to the target controlled environment is generated to automate and enable vulnerability verification. In this embodiment, generating a vulnerability reproduction script adapted to the target controlled environment based on the vulnerability knowledge entries includes:

[0077] The vulnerability identifier, affected objects, and environmental dependencies in the vulnerability knowledge entries are analyzed to determine the system configuration and software version of the target controlled environment, including the operating system type and version, installed software and patches, network configuration, permission settings, and security policies, so as to ensure that the generated reproduction script can be executed correctly in the target environment.

[0078] Based on a pre-defined vulnerability script template library, the corresponding script template is determined according to the triggering conditions and attack methods in the vulnerability knowledge entries; the applicable script template is determined by matching the triggering conditions and attack methods in the vulnerability knowledge entries. The template library includes execution templates for different types of vulnerabilities, such as buffer overflow, SQL injection, remote code execution, privilege escalation, etc. Each template predefines execution logic, flow control, and parameter placeholders, providing a general framework for vulnerability reproduction.

[0079] Based on the script template, and considering the system configuration and software version of the target controlled environment, determine the execution parameters required for the vulnerability reproduction script;

[0080] The script template is populated and assembled according to the execution parameters. Based on the selected template and the system configuration and software version information of the target controlled environment, the execution parameters required for the vulnerability reproduction script are determined, such as file path, port number, memory offset, environment variables, and execution order. By populating these execution parameters into the template placeholders and performing assembly and encoding, a basic reproduction script framework is formed.

[0081] Based on the triggering conditions and attack methods in the aforementioned vulnerability knowledge entries, a vulnerability triggering instruction sequence and attack payload are constructed.

[0082] The script template is populated and assembled based on the vulnerability triggering instruction sequence and attack payload to generate a vulnerability reproduction script. The vulnerability triggering instruction sequence and attack payload are constructed according to the triggering conditions and attack methods in the vulnerability knowledge entries. The vulnerability triggering instruction sequence includes system calls, command operations, or API calls required to exploit the vulnerability; the attack payload includes malicious code or test data that actually triggers the vulnerability. The triggering instruction sequence and attack payload are mapped to the corresponding modules in the reproduction script template, and populated and assembled to finally generate an executable vulnerability reproduction script compatible with the target controlled environment. Through this method, the generated reproduction script can not only automate the vulnerability triggering and verification process but also flexibly adjust execution parameters according to different environment configurations, achieving portability and high reliability. Simultaneously, it provides a data foundation for subsequent system indicator collection, behavior log analysis, and defense strategy generation, constructing a closed-loop processing system from vulnerability intelligence to protection.

[0083] The vulnerability reproduction script is run in the target controlled environment, and runtime system metrics and behavior logs are collected. The target controlled environment is isolated from the production environment, including an isolated virtualized environment or container sandbox. The test environment is physically and logically isolated from the actual production system through virtualization or container technology, thereby ensuring that vulnerability triggering and attack payloads will not affect the production environment, while also being able to collect complete runtime data during the vulnerability reproduction process.

[0084] In this embodiment, running the vulnerability reproduction script in the target controlled environment and collecting runtime system metrics and behavior logs includes:

[0085] Load the vulnerability reproduction script in an isolated virtualized environment or container sandbox;

[0086] Before execution, the initial state of the target controlled environment is saved; the generated vulnerability reproduction script is loaded into the isolated environment, and a snapshot of the initial state of the target controlled environment is saved before execution, including the operating system state, system configuration, installed software and patch status, network configuration, and running processes, so that the environment can be rolled back after the script is executed, ensuring the consistency and security of the environment.

[0087] Collect runtime system metrics and behavior logs, including CPU utilization, memory usage, disk I / O, and network bandwidth;

[0088] The behavior logs include kernel logs, application logs, and system event logs. These logs are used to obtain information on abnormal events generated during vulnerability exploitation. During the execution of the vulnerability reproduction script, system metrics and behavior logs of the target environment are collected in real time. System metrics include CPU utilization, memory usage, disk I / O operations, network bandwidth usage, and other critical resource statuses, used to analyze the impact of vulnerability exploitation on system performance and resources. The behavior logs, including kernel logs, application logs, and system event logs, can be parsed to obtain information on abnormal events generated during vulnerability triggering, such as unauthorized system calls, privilege escalation attempts, abnormal file operations, and network connection anomalies.

[0089] The system metrics and behavior logs are stored in association. By associating information such as timestamps, process IDs, and event types, the entire vulnerability exploitation process can be completely recorded, providing a reliable basis for judging vulnerability reproduction results, generating defense strategies, and analyzing vulnerability exploitation behavior.

[0090] Based on the system metrics and behavior logs, and using preset vulnerability triggering characteristics, the reproduction results are obtained, including:

[0091] The system metrics and behavior logs are compared with preset vulnerability triggering features to obtain vulnerability triggering feature templates. These templates include system call sequences, memory access violations, abnormal process creation patterns, and abnormal network communication patterns. The preset vulnerability triggering features are pre-defined behavior pattern templates for different types of vulnerabilities, including but not limited to system call sequences, memory access violations, abnormal process creation patterns, abnormal file operations, and abnormal network communication patterns. These templates accurately characterize the abnormal behavior of the system when a vulnerability is triggered, providing a basis for reproducing the results. The collected system metrics and behavior logs are then compared and analyzed with the preset vulnerability triggering features. The comparison process can employ rule matching, pattern recognition, or similarity calculation methods. For example, sequence alignment analysis can be performed on system call sequences, pattern matching can be performed on memory access anomalies, and statistical patterns or machine learning models can be used to judge abnormal processes or network behaviors. Through this comparison, event sequences can be extracted, and a correspondence between the vulnerability triggering feature templates and the actual execution can be formed.

[0092] When the system metrics and behavior logs show an event sequence that is consistent with or has a similarity exceeding the corresponding preset threshold to the vulnerability trigger feature template, it is determined that the vulnerability has been successfully reproduced.

[0093] When the system metrics and behavior logs do not show an event sequence that is identical to the vulnerability trigger feature template or has a similarity exceeding a preset threshold, the vulnerability reproduction is deemed to have failed and is marked as pending review. When the system metrics and behavior logs show an event sequence that is completely identical to the vulnerability trigger feature template or has a similarity exceeding a preset threshold, this embodiment determines that the vulnerability has been successfully reproduced, and the reproduction result is marked as "successful". Correspondingly, when the system metrics and behavior logs do not show an event sequence that is identical to the trigger feature template or has a similarity below the threshold, the vulnerability reproduction is deemed to have failed, and the vulnerability is marked as pending review so that security personnel or subsequent automated processes can conduct further verification or supplementary testing.

[0094] This embodiment can securely and accurately determine vulnerability reproduction results in an isolated environment, avoiding both false positives and false negatives, and providing a reliable basis for generating subsequent defense strategies. Furthermore, this method can dynamically update trigger feature templates based on different vulnerability types, improving the automation and intelligence of vulnerability reproduction and assessment, and achieving effective integration of vulnerability verification data and defense responses.

[0095] Based on the reproduction results, a defense strategy is generated and pushed to the security device, achieving a closed-loop linkage between vulnerability verification and defense. This embodiment includes:

[0096] Based on the successfully reproduced attack methods and triggering conditions, corresponding detection rules and interception strategies are generated. The detection rules include a system call whitelist, a process behavior blacklist, and network access restrictions. The system call whitelist restricts the system to only allow legitimate calls; the process behavior blacklist blocks the startup of abnormal processes or illegal operations; and the network access restriction rules block malicious network connections or abnormal data streams. The interception strategies can block specific attack payloads in real time to reduce the risk of the vulnerability being actually exploited.

[0097] Based on the failure to reproduce the vulnerability, a monitoring strategy is generated. This strategy includes enhanced log collection and suspicious behavior alerts to improve vulnerability-related log collection and behavior monitoring. For example, the frequency of log collection for suspicious process behavior, system calls, network access, and file operations is dynamically increased, and abnormal behavior alert rules are configured so that security personnel or subsequent automated analysis can promptly identify potential threats.

[0098] The detection rules, interception strategies, and monitoring strategies are uniformly encapsulated into a deployable defense strategy.

[0099] The defense strategy is converted into a rule format compatible with different security devices, including firewalls, intrusion detection systems, and host security agents, to ensure that the defense strategy can be correctly parsed and executed on different devices.

[0100] The defense policy is distributed to the corresponding security device through the security policy distribution interface, and an effectiveness verification is performed after the defense policy is distributed.

[0101] When the defense policy deployment fails, a rollback mechanism is triggered and an alarm log is generated. After deployment, the system performs an effectiveness verification, including policy loading status, device response, and policy execution result confirmation, to ensure that the policy has taken effect correctly. If the defense policy deployment fails or the effectiveness verification fails, this embodiment triggers a rollback mechanism to restore the security device to its state before the policy was deployed, and an alarm log is generated to notify security operations personnel for further processing.

[0102] This embodiment collects vulnerability intelligence data from multiple heterogeneous sources in real time and combines semantic parsing and structured extraction techniques to transform scattered and heterogeneous intelligence information into standardized vulnerability knowledge entries, thereby achieving the standardization and efficient utilization of intelligence. Based on these knowledge entries, vulnerability reproduction scripts adapted to the target controlled environment are generated, enabling automated vulnerability verification, significantly reducing manual intervention, and improving the accuracy and timeliness of vulnerability verification. Running the reproduction scripts in an isolated virtualized environment or container sandbox ensures the verification process is secure and controllable, and collects runtime system indicators and behavior logs, providing a reliable basis for judging vulnerability trigger characteristics. Through automatic analysis of the reproduction results, corresponding defense strategies can be quickly generated and pushed to security devices, achieving a closed-loop linkage of vulnerability intelligence, reproduction verification, and defense response throughout the entire process. Compared with existing technologies, this invention significantly shortens the time from vulnerability discovery to handling, improves the automation and intelligence level of vulnerability management, and enhances the initiative and reliability of network security protection.

[0103] It should be understood that the specific embodiments described above are merely illustrative or explanatory of the principles of the invention and do not constitute a limitation thereof. Therefore, any modifications, equivalent substitutions, improvements, etc., made without departing from the spirit and scope of the invention should be included within the protection scope of the invention. Furthermore, the appended claims are intended to cover all variations and modifications falling within the scope and boundaries of the appended claims, or equivalent forms of such scope and boundaries.

[0104] The present invention has been described above with reference to embodiments thereof. However, these embodiments are merely illustrative and not intended to limit the scope of the invention. The scope of the invention is defined by the appended claims and their equivalents. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of the invention, and all such substitutions and modifications should fall within the scope of the invention.

[0105] Although embodiments of the present invention have been described in detail, it should be understood that various changes, substitutions, and modifications can be made to the embodiments of the present invention without departing from the spirit and scope of the invention.

[0106] Obviously, the above embodiments are merely illustrative examples for clear explanation and are not intended to limit the implementation. Those skilled in the art will recognize that other variations or modifications can be made based on the above description. It is neither necessary nor possible to exhaustively list all possible implementations here. However, obvious variations or modifications derived therefrom are still within the scope of protection of this invention.

Claims

1. A vulnerability intelligence real-time collection and reproduction verification integrated processing method, characterized in that, The application comprises the following steps: Real-time collection of vulnerability information data from multiple heterogeneous information channels; Based on semantic analysis and structured extraction technology, the vulnerability information data is converted into standardized vulnerability knowledge entries; According to the vulnerability knowledge entries, a vulnerability reproduction script is generated for the target controlled environment; Running the vulnerability reproduction script in the target controlled environment, collecting runtime system indicators and behavior logs; According to the system indicators and behavior logs, based on the preset vulnerability trigger characteristics, the reproduction result is obtained; According to the reproduction result, a defense strategy is generated and pushed to the security device.

2. The vulnerability intelligence real-time collection and reproduction verification integrated processing method according to claim 1, characterized in that, The vulnerability information data includes structured vulnerability information and unstructured vulnerability description text; The real-time collection of vulnerability information data from multiple heterogeneous information channels comprises the following steps: Obtaining structured vulnerability information from public vulnerability databases, including vulnerability number, impact range and patch information; Obtaining unstructured vulnerability description text from threat intelligence platforms, dark web forums and security communities; Timestamp marking and source credibility rating of the structured vulnerability information and unstructured vulnerability description text; According to the timestamp marking and source credibility rating, a vulnerability information cache queue is established.

3. The method of claim 2, wherein the method further comprises: The conversion of the vulnerability information data into standardized vulnerability knowledge entries based on semantic analysis and structured extraction technology comprises the following steps: Parsing the structured vulnerability information to extract vulnerability number, vulnerability level, impact range and patch information, and obtaining structured fields; Segmenting, entity recognition and context semantic analysis of unstructured vulnerability description text to identify affected software, version number, vulnerability exploitation method and environmental dependency conditions, and obtaining unstructured semantic analysis results; Based on the preset vulnerability knowledge representation structure, according to the structured fields and unstructured semantic analysis results, a standardized vulnerability knowledge entry containing vulnerability identification, affected object, trigger condition, attack method and environmental dependency condition is generated.

4. The vulnerability intelligence real-time collection and reproduction verification integrated processing method according to claim 3, characterized in that, The generation of a vulnerability reproduction script adapted to the target controlled environment according to the vulnerability knowledge entry comprises the following steps: Parsing the vulnerability identification, affected object and environmental dependency condition in the vulnerability knowledge entry to determine the system configuration and software version of the target controlled environment; Based on the preset vulnerability script template library, according to the trigger condition and attack method in the vulnerability knowledge entry, the corresponding script template is determined; According to the script template, based on the system configuration and software version of the target controlled environment, the execution parameters required by the vulnerability reproduction script are determined; According to the execution parameters, the script template is filled and assembled.

5. The method of claim 4, wherein the method further comprises: The generation of a vulnerability reproduction script adapted to the target controlled environment according to the vulnerability knowledge entry further comprises the following steps: Based on the trigger condition and attack method in the vulnerability knowledge entry, a vulnerability trigger instruction sequence and attack payload are constructed; According to the vulnerability trigger instruction sequence and attack payload, the script template is filled and assembled to generate a vulnerability reproduction script.

6. The vulnerability intelligence real-time collection and reproduction verification integrated processing method according to claim 5, characterized in that, The target controlled environment and the production environment are isolated from each other, and the target controlled environment includes an isolated virtualization environment or a container sandbox; The running of the vulnerability reproduction script in the target controlled environment, the collection of runtime system indicators and behavior logs, including: Loading the vulnerability reproduction script in an isolated virtualized environment or container sandbox; Saving the initial state of the target controlled environment before running; Collecting runtime system indicators and behavior logs.

7. The integrated processing method of vulnerability intelligence real-time collection and reproduction verification linkage according to claim 6, characterized in that, The system indicators include CPU utilization, memory occupancy, disk I / O and network bandwidth; The behavior logs include kernel logs, application logs and system event logs, and the abnormal event information generated during the vulnerability exploitation process is obtained through the behavior logs; The system indicators and behavior logs are stored in association.

8. The vulnerability intelligence real-time collection and reproduction verification integrated processing method according to claim 7, characterized in that, According to the system indicators and behavior logs, based on the preset vulnerability trigger characteristics, the reproduction result is obtained, including: Comparing the system indicators and behavior logs with the preset vulnerability trigger characteristics to obtain a vulnerability trigger characteristic template, the vulnerability trigger characteristic template including system call sequence, memory out-of-bound behavior, abnormal process creation mode and abnormal network communication mode; When the event sequence in the system indicators and behavior logs is consistent with the vulnerability trigger characteristic template or the similarity exceeds the corresponding preset threshold, it is determined that the vulnerability is successfully reproduced; When the event sequence in the system indicators and behavior logs is not consistent with the vulnerability trigger characteristic template or the similarity does not exceed the corresponding preset threshold, it is determined that the vulnerability reproduction fails, and is marked as a pending review state.

9. The vulnerability intelligence real-time collection and reproduction verification integrated processing method according to claim 8, characterized in that, According to the reproduction result, a defense strategy is generated and pushed to a security device, including: Based on the attack mode and trigger condition of successful vulnerability reproduction, corresponding detection rules and interception strategies are generated, the detection rules including system call whitelist, process behavior blacklist and network access restriction; According to the case of vulnerability reproduction failure, a monitoring strategy is generated, the monitoring strategy including log collection enhancement and suspicious behavior alarm; The detection rules, interception strategies and monitoring strategies are uniformly encapsulated as a deployable defense strategy.

10. The method of claim 9, wherein the method further comprises: According to the reproduction result, a defense strategy is generated and pushed to a security device, further including: Converting the defense strategy into a rule format compatible with different security devices, the security devices including firewall, intrusion detection system and host security agent; Through a security policy distribution interface, the defense strategy is issued to the corresponding security device, and a validity check is performed after the defense strategy is issued; When the defense strategy fails to be issued, a rollback mechanism is triggered and an alarm log is generated.

Images