Code vulnerability response strategy generation method and related device

Abstract

The present disclosure provides a code vulnerability response strategy generation method and related equipment; wherein the method comprises: in response to a log recording instruction, generating a target log query statement according to the type of the log recording instruction; wherein the target log query statement is used to query logs related to log4j vulnerability attack behavior characteristics; executing the target log query statement to obtain a target log query result; determining whether the log recording instruction contains suspected log4j vulnerability attack behavior according to the target log query result; if it contains, identifying the link of the log4j vulnerability attack based on the target log query result to obtain a target attack link; and generating a target response strategy for the log4j vulnerability attack according to the target attack link. The present disclosure can improve the network security defense capability.

Description

Methods for generating code vulnerability mitigation strategies and related equipment Technical Field

[0001] This disclosure relates to the field of code vulnerability handling technology, and in particular to a method for generating a code vulnerability response strategy and related equipment. Background Technology

[0002] The Log4j vulnerability (CVE-2021-44228, also known as Log4Shell) is an extremely serious remote code execution vulnerability in the Java logging framework Apache Log4j 2. An attacker can gain complete control of the target system without needing a password, simply by sending a specially crafted string of text.

[0003] However, current countermeasures against such code vulnerabilities typically rely on localized detection tools. This makes attack detection and analysis extremely complex in large-scale environments, especially in complex network architectures, making it difficult to quickly and accurately locate the attack source and intrusion path, resulting in a technical problem of low network security defense capabilities. Summary of the Invention

[0004] In view of this, the purpose of this disclosure is to provide a method and related equipment for generating strategies to address code vulnerabilities, so as to improve network security defense capabilities.

[0005] In a first aspect, embodiments of this disclosure provide a method for generating a response strategy for a code vulnerability. The method includes: responding to a logging instruction, generating a target log query statement according to the type of the logging instruction; wherein the target log query statement is used to query logs related to log4j vulnerability attack behavior characteristics; executing the target log query statement to obtain a target log query result; determining, based on the target log query result, whether the logging instruction contains the execution of a suspected log4j vulnerability attack behavior; if so, performing link identification on the log4j vulnerability attack based on the target log query result to obtain a target attack link; and generating a target response strategy for the log4j vulnerability attack based on the target attack link.

[0006] Secondly, embodiments of this disclosure provide a code vulnerability response strategy generation apparatus, comprising: a response module, configured to generate a target log query statement in response to a log recording instruction, based on the type of the log recording instruction; wherein the target log query statement is used to query logs related to log4j vulnerability attack behavior characteristics; an execution module, configured to execute the target log query statement to obtain a target log query result; a judgment module, configured to determine, based on the target log query result, whether the log recording instruction contains suspected log4j vulnerability attack behavior; an identification module, configured to, if contained, perform link identification on the log4j vulnerability attack based on the target log query result to obtain a target attack link; and a response module, configured to generate a target response strategy for the log4j vulnerability attack based on the target attack link.

[0007] Thirdly, this disclosure provides an electronic device, including a processor and a memory, wherein the memory stores machine-executable instructions that can be executed by the processor, and the processor executes the machine-executable instructions to implement the above-mentioned method for generating a strategy to address code vulnerabilities.

[0008] Fourthly, embodiments of this disclosure provide a computer-readable storage medium storing computer-executable instructions. When the computer-executable instructions are invoked and executed by a processor, the computer-executable instructions cause the processor to implement the aforementioned method for generating a response strategy to code vulnerabilities.

[0009] Fifthly, this disclosure provides a computer program product comprising a computer program stored in a computer-readable storage medium; the computer program is read from and executed by a processor of a computer device from the computer-readable storage medium, causing the computer device to execute the aforementioned method for generating a code vulnerability mitigation strategy.

[0010] The embodiments disclosed herein bring the following beneficial effects:

[0011] The aforementioned code vulnerability response strategy generation method and related equipment trigger code vulnerability attack identification for all log recording commands. Through automated risk assessment and response strategy generation, it ensures that the security team can take the most effective action in a very short time, greatly improving the speed and accuracy of Log4j vulnerability attack detection and response, reducing the error rate of human decision-making, and improving the overall network security defense capability.

[0012] Other features and advantages of this disclosure will be set forth in the following description and will be apparent in part from the description or may be learned by practicing the disclosure. The objects and other advantages of this disclosure are realized and obtained through the structures particularly pointed out in the description, claims and drawings.

[0013] To make the above-mentioned objects, features and advantages of this disclosure more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0014] To more clearly illustrate the technical solutions in the specific embodiments of this disclosure or the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0015] Figure 1 is a flowchart of an embodiment of the method for generating response strategies for code vulnerabilities in this disclosure;

[0016] Figure 2 is a flowchart of another embodiment of the method for generating response strategies for code vulnerabilities in this disclosure;

[0017] Figure 3 is a schematic diagram of a code vulnerability response strategy generation device provided in an embodiment of this disclosure;

[0018] Figure 4 is a schematic diagram of an electronic device provided in an embodiment of this disclosure. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this disclosure, and not all embodiments. Based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0020] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in this disclosure, claims, and accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a particular order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” or “having,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0021] For ease of understanding, the specific process of the embodiments of this disclosure is described below. Please refer to Figure 1. An embodiment of the method for generating code vulnerability response strategies in this disclosure includes:

[0022] Step S10: In response to the logging instruction, generate a target log query statement according to the type of the logging instruction; wherein, the target log query statement is used to query logs related to the characteristics of log4j vulnerability attack behavior;

[0023] In this embodiment, the logging instruction can be targeted at a target system, such as a game system, financial system, human resources system, shopping system, etc. When the logging instruction for the target system is triggered, the subsequent process can be triggered to identify log4j vulnerability attack behavior and generate response strategies, so as to improve the network security defense capability of the target system.

[0024] It should be noted that a log4j vulnerability attack is a type of network attack that exploits a vulnerability in Log4j. Log4j is a Java-based logging tool. When logging with Log4j, if the logging instructions contain strings with a specific format, Java will actively parse and execute the instructions. An attacker can construct a special string and inject it into any location that might need logging (such as usernames in search boxes, HTTP request headers, form data, etc.), thereby causing the remote code in the attacker's constructed string to be executed, thus resulting in a log4j vulnerability attack.

[0025] The content recorded by the logging command is not limited to the content recorded in a specific log file. It can also include any form of raw event data that reflects the system status or network interaction, such as network traffic metadata, API call records, or terminal process activity records. The specifics are not limited here.

[0026] In this embodiment, the type of log recording instruction can be divided according to the different query objects targeted by different log query statements. Specifically, the types of log recording instructions can include system-level log types (such as host operating system or middleware logs), application-level log types (such as Java application runtime logs), and network-level log types (such as traffic session or Web request logs). These types are divided according to the level of the query object. Other classification methods will not be elaborated here.

[0027] Based on different logging instruction types, template log query statements for the corresponding logging instruction type can be generated using a large language model. It should be noted that the logging instruction type can include more than one type. Specifically, log query statements for the corresponding query object can be generated based on the query object indicated by the logging instruction type. For example, a log query instruction for a query object of the system-level log type.

[0028] In one implementation, when generating the target log query statement, the characteristics related to log4j vulnerability attack behavior in the logging instructions can also be combined to generate the target log query statement. The characteristics related to log4j vulnerability attack behavior may include specific markers left in the data stream or log by remote code execution vulnerabilities (such as JNDI injection), such as specific protocol calls for remote resource loading (such as ldop, rmi:, dns:) or Base64 encoded attack payload characteristics, which are not limited here.

[0029] Among them, the aforementioned JNDI (Java Naming and Directory Interface) injection is an attack behavior that remotely loads malicious payloads by passing parameters through Java's naming and directory interface, and belongs to one type of log4j vulnerability attack behavior.

[0030] Performing this step may include: forwarding the HTTP request header (logging instruction) for the target system to a pre-trained large language model. After receiving the logging instruction, the model parses the strings in the request header that are related to the characteristics of log4j vulnerability attack behavior and adaptively generates query expressions (i.e., target log query statements) across multiple database types. For example, it generates SQL for relational databases and JSON format queries for NoSQL databases.

[0031] When generating the target log query statement, you can first extract the known attack payload template of the Log4j vulnerability from the preset threat intelligence database, and then combine the template with the timestamp, source IP and other variables obtained from the log recording instructions by the large language model, and instantiate it into a specific SQL query statement for querying the application log database, thereby obtaining the target log query statement.

[0032] Step S20: Execute the target log query statement to obtain the target log query results;

[0033] After generating the target log query statement, it can be sent to and executed by the log storage system to obtain the target log query results. The log storage system can be distributed or centralized, and the target log query statement can be executed through the target system or the log retrieval interface provided by the Java language.

[0034] The target log query results can include a set of log entries related to the characteristics of log4j vulnerability attack behavior. Specifically, it can include a set of log entries recorded within a specific time window that match the characteristics of log4j vulnerability attack behavior. These entries can be obtained from different query objects, such as log files or log databases, and are not limited here.

[0035] To improve query efficiency, the generated query expression (i.e., the target log query statement) can be distributed to a log data lake or multiple independent log clusters (such as ELK clusters or Splunk instances) for parallel retrieval. This leverages cluster computing power to achieve millisecond-level responses to massive amounts of log data, ensuring real-time response to code vulnerabilities.

[0036] In one implementation, after receiving the raw query results of the target log query statement, the raw query results can be standardized, such as through data cleaning, format conversion, and key field extraction, to obtain query results with a standardized data structure, which can then be used as the target log query results. Specifically, the standardization process may include unifying fields such as time, IP, and process ID in different types of logs, etc., without limitation here.

[0037] Step S30: Based on the target log query results, determine whether the log recording instructions contain suspected log4j vulnerability attack behaviors;

[0038] In this implementation, the target log query results can be used to preliminarily determine whether the log recording commands are malicious and whether there is an attack intent to exploit the log4j vulnerability. This is a preliminary screening process. Specifically, a pre-trained large language model can be used to identify suspected log4j vulnerability attack behaviors in the target log query results. The large model's natural language processing (NLP) and reasoning capabilities are utilized, combined with threat intelligence data, log4j vulnerability attack behavior analysis data, and vulnerability knowledge bases for training, thereby identifying the malice and attack intent of the target log query results.

[0039] In one implementation, a pre-trained large language model can be used to perform semantic analysis on the target log query results, extract key fields such as the IP address of the suspected attacker, the target hostname, and the executed commands. By cross-comparing the frequency and time relationship of these fields in different types of logs, the authenticity of the attack behavior can be evaluated. If the authenticity exceeds a certain threshold, it can be determined that the log recording instruction contains the execution of a suspected log4j vulnerability attack behavior.

[0040] In one implementation, in addition to the target log query results, other multimodal data can be integrated to identify suspected log4j vulnerability attack behaviors. Specifically, the target log query results (such as application log messages), structured data corresponding to the log recording instructions (such as traffic metadata, domain name Whois information), and binary features (such as static analysis results of payload files) can be integrated and input into a large language model. The large language model, based on a cross-verification algorithm, comprehensively correlates the domain name malice, payload class features, and abnormal server-side behavior to obtain the confidence level of the log4j vulnerability attack behavior. If the confidence level is higher than a certain threshold, it can be determined that the log recording instructions contain suspected log4j vulnerability attack behaviors.

[0041] Step S40: If included, then based on the target log query results, perform link identification on the log4j vulnerability attack to obtain the target attack link;

[0042] If the log recording instructions contain suspected log4j vulnerability attack behaviors, then continue with vulnerability attack behavior tracking and response strategy generation, including this step. In this step, based on the target log query results, an event flow of log4j vulnerability attack behavior can be constructed as the target attack chain, which is used to indicate the event nodes and causal relationships of log4j vulnerability attack behavior in time series.

[0043] For example, a typical attack chain can be represented as: "Vulnerability Trigger -> Remote Code Execution -> Backdoor Implantation -> Lateral Movement". Here, "backdoor implantation" refers to a covert entry point that the attacker implants into the target system to gain control. This entry point can be a website address or a program. Once the target system is implanted with a "backdoor", even if the initial vulnerability in the code is patched, the attacker can still continuously gain control of the target system through the "backdoor". "Lateral movement" refers to the behavior of spreading the attack scope from a single point to the entire network, which may cause catastrophic data breaches or system paralysis.

[0044] In one implementation, during link identification, based on the time range or time node indicated by the target log query results, a causal relationship can be constructed for all system operation events within the corresponding time range or time node using a preset tracing algorithm or a pre-trained large language model. This generates an event stream / chain with causal relationships and temporal order, thus obtaining the target attack link. For example, if there is a JNDI request in the application log followed by the execution of a malicious script in the host log, these two actions constitute a log4j vulnerability attack with a strong causal relationship.

[0045] Step S50: Generate a target response strategy for the log4j vulnerability attack based on the target attack chain.

[0046] After obtaining the target attack chain, a response strategy can be generated based on the target attack chain to address the log4j vulnerability attack currently being attacked on the target system. This results in a target response strategy, which may include a series of executable instructions. These executable instructions can be used to terminate the attack and patch the vulnerability on the target system, as well as to strengthen the defense. The specifics are not limited here.

[0047] In one implementation, key information such as attacker IP, malicious domain name, and infected hostname can be extracted from the target attack chain through a pre-trained large language model. This key information is then written into a preset emergency response process template to generate directly executable firewall blocking rules or system isolation instructions as a target response strategy.

[0048] In one implementation, the target response strategy may include action guidelines. When generating a target response strategy for a log4j vulnerability attack, a risk assessment of the log4j vulnerability attack may be performed first based on the attack impact range indicated by the target attack chain. Then, action guidelines for technical measures (such as patching, isolation, and traffic blocking) and management measures (such as policy updates and asset inventory) corresponding to the risk assessment results may be matched from a preset response strategy library and used as the target response strategy.

[0049] For example, assuming the risk assessment results indicate that the system's core data has been leaked, the corresponding response strategy can be obtained from the pre-set response strategy library as the target response strategy. This target response strategy can include tiered handling suggestions such as isolating the affected system, deploying virtual patches (WAF rules), and updating Log4j components.

[0050] The code vulnerability response strategy generation method provided by the above implementation method triggers the identification of code vulnerability attacks for all log recording commands, and then generates automated risk assessment and disposal strategies. This ensures that the security team can take the most effective action in a very short time, greatly improving the speed and accuracy of Log4j vulnerability attack detection and response, reducing the error rate of human decision-making, and improving the overall network security defense capability.

[0051] Please refer to Figure 2. Another embodiment of the code vulnerability mitigation strategy generation method in this disclosure includes:

[0052] Step S201: In response to the logging instruction, generate a target log query statement according to the type of the logging instruction; wherein, the target log query statement is used to query logs related to the characteristics of log4j vulnerability attack behavior;

[0053] In one implementation, the step of generating a target log query statement in response to a logging instruction, based on the type of the logging instruction, includes: constructing context information for the logging instruction in response to the logging instruction; wherein the context information includes at least asset database information associated with the logging instruction and matching results with a preset vulnerability database; inputting the content of the logging instruction and the context information into a pre-trained large language model, and generating a log query statement for at least one log database that matches the log4j vulnerability attack behavior characteristics of the logging instruction, thereby obtaining the target log query statement.

[0054] In this embodiment, context information is constructed for each log recording command to improve the comprehensiveness of subsequent identification of log4j vulnerability attack behavior. The context information may include the environment and background information in which the log recording command occurs. Specifically, the context information includes at least the asset database information associated with the log recording command and the matching results with the preset vulnerability database.

[0055] The asset database information associated with the logging command can include detailed configuration, topology, and security status information of network assets (such as hosts, applications, and middleware) that are directly or indirectly associated with the logging command. For example, the type of network asset can be used to indicate whether the corresponding network asset belongs to a Java application server using the Log4j component; the location information of the topology can be used to indicate the area and isolation status of the network asset in the network; and the configuration information of the network asset can include the currently running operating system, software version, security protection (such as WAF / IDS) configuration, etc., without being limited here.

[0056] The matching results of logging instructions and preset vulnerability databases in the context information are the results of comparing the content of the logging instructions (such as JNDI search strings) with known Log4j vulnerability signature databases or threat intelligence databases. It can be used to indicate the Log4j vulnerability with the highest matching degree and the corresponding matching degree, and it can also be used to indicate matching results such as Log4j vulnerabilities with a matching degree higher than a certain threshold, or Log4j vulnerabilities with a matching degree ranking in the top N. The specifics are not limited here.

[0057] Specifically, when a network request (logging instruction) containing "${jndi:ldap: / / ...}" is captured, the asset database can be queried to confirm whether the IP corresponds to a Java application server. The threat intelligence platform (a pre-set vulnerability database) can also be queried to confirm whether the remote LDAP server IP carried in the request is a known malicious C2 (Command and Control) address. All of this related information can be structured into the context information of the logging instruction.

[0058] In this embodiment, the pre-trained large language model can be a Transformer architecture model trained or fine-tuned with security domain knowledge and log query language. Based on the characteristics of log4j vulnerability attack behavior learned by the large language model, it generates log query statements for at least one log database. The types of log databases can include host logs (recording system behavior), application logs (recording Java component behavior), and network traffic logs (recording abnormal requests).

[0059] Step S202: Execute the target log query statement to obtain the target log query results;

[0060] The execution process of step S202 is similar to that of step S20, and will not be described in detail here.

[0061] Step S203: Based on the target log query results, determine whether the log recording instructions contain suspected log4j vulnerability attack behaviors;

[0062] In one implementation, the step of determining whether a log recording instruction contains a suspected log4j vulnerability attack based on the target log query result includes: performing log semantic recognition on the target log query result using a pre-trained log semantic recognition model to obtain a log semantic recognition result; wherein the log semantic recognition result is used to indicate the confidence level corresponding to at least one preset log4j vulnerability attack behavior in the target log query result; and determining whether the log recording instruction contains a suspected log4j vulnerability attack based on the log semantic recognition result.

[0063] Log semantic recognition models can be deep learning models trained using Log4j attack samples and normal system logs. The basic architecture of this model can be Transformer or RNN (Recurrent Neural Network). This model has the ability to perform natural language understanding (NLU) on log text, understand log entries, and identify attack intentions and code execution traces in the logs, rather than simply performing keyword matching.

[0064] When performing log semantic recognition on target log query results, the log semantic recognition model can first extract key information such as attacker's IP address, target host, executed command, or payload characteristics from the log query results. Then, the extracted key information is compared with preset Log4j vulnerability attack behavior patterns, and a quantitative score is given for the probability of containing specific Log4j vulnerability attack behavior to obtain the target semantic recognition result.

[0065] As an example, and not a limitation, the types of preset log4j vulnerability attack behaviors or patterns can include: malicious domain requests, malicious payload class execution, remotely executed Bash scripts, abnormal call stacks, etc. By matching the behavior patterns through the log semantic recognition model, the confidence level corresponding to the log recording instruction containing the execution of at least one preset log4j vulnerability attack behavior can be obtained.

[0066] In one implementation, the preset types of log4j vulnerability attack behaviors include at least: exception class loading behavior, remote code execution intent behavior, and covert channel communication behavior; the step of determining whether the log recording instruction contains the execution of suspected log4j vulnerability attack behavior based on the log semantic recognition result includes: weighting and fusing the confidence level corresponding to each preset log4j vulnerability attack behavior according to the preset weight value corresponding to each preset log4j vulnerability attack behavior to obtain a weighted fusion score; if the weighted fusion score is greater than the preset score threshold, it is determined that the log recording instruction contains the execution of suspected log4j vulnerability attack behavior.

[0067] Abnormal class loading behavior is an action performed during the exploitation phase of an attack. It manifests as the Log4j JNDI Lookup mechanism being triggered in the target log query results, causing a connection request to an external malicious LDAP / RMI server or an attempt to load an unexpected remote malicious class file (payload class).

[0068] Remote code execution intent is a behavior that occurs during the payload execution phase of an attack. It manifests as records in the target log query results showing that the system process is executing malicious or unexpected commands, such as the "curl" or "wget" commands used to download secondary payloads, or commands that start a reverse shell.

[0069] Covert channel communication behavior belongs to the control and communication phase (C2) of the attack. It is manifested by abnormal, high-frequency, or DNS / HTTP-based outbound connections shown in logs or network metadata. For example, connecting to a C2 server with dynamic domain name generation (DGA) or communicating with non-standard ports of known malicious IPs. This usually means that a backdoor has been established and is attempting to send data back.

[0070] In one implementation, the preset weight value corresponding to each preset log4j vulnerability attack behavior can be dynamically adjusted according to the sensitivity of the asset. For example, for the core database server, the weight of all attack behaviors is increased.

[0071] When performing weighted fusion, the final comprehensive risk score can be obtained by linearly or non-linearly combining the confidence levels of various preset log4j vulnerability attack behaviors with their corresponding preset weight values. Specifically, logistic regression or decision tree models can be used for weighted fusion. If the confidence level of the remote code execution intent behavior exceeds a certain threshold (e.g., 0.95), even if the confidence levels of other behaviors are below a certain threshold, the final weighted fusion score will be directly raised to the high-risk zone, thereby prioritizing the identification of key evidence.

[0072] Step S204: If included, construct the time chain of the log4j vulnerability attack event for the target log query result to obtain the attack event time chain, where the log4j vulnerability attack event is an attack event targeting any asset database.

[0073] In this embodiment, for each attack event in the asset database, the log records across assets and systems are time-calibrated and associated with key identifiers (such as process ID, session ID, and source IP) according to the chronological order of the attack events, thereby obtaining the attack event time chain. The time chain is the basic framework for attack chain identification.

[0074] Specifically, one can first standardize all log entries in the target log query results using UTC time to eliminate time discrepancies between different systems. Then, using graph database technology, events with the same source IP, target asset, and timestamps with differences less than a certain threshold are associated as nodes to construct an event graph, thereby obtaining the attack event time chain.

[0075] Step S205: Based on the attack event time chain, perform multi-dimensional causal behavior analysis on each log4j vulnerability attack event to obtain the analysis results;

[0076] In this step, if an attack event is a prerequisite or direct result of another attack event, then the two have a causal relationship. Based on the attack event time chain, this step performs multi-dimensional causal behavior analysis on each log4j vulnerability attack event in the attack event time chain to obtain analysis results.

[0077] For example, the descriptions of two adjacent events in the attack event timeline are as follows: Event A: Application log records JNDI lookup; Event B: Host log records wget command execution. After multi-dimensional causal behavior analysis using a large language model, it is determined that Event A is the causal relationship that led to the occurrence of Event B.

[0078] In one implementation, multi-dimensional causal behavior analysis may include: initial intrusion point identification (network and domain dimension), malicious payload acquisition and delivery analysis (payload dimension), local code execution verification (application and execution dimension), persistence and lateral movement reconnaissance (host and lateral movement dimension), and data exfiltration behavior identification (exfiltration dimension).

[0079] In one implementation, the steps of performing multi-dimensional causal behavior analysis on each log4j vulnerability attack event based on the attack event time chain to obtain the analysis results include: identifying the domain name information that initiated the attack event from the attack event time chain to obtain the initial attack domain name; performing behavior identification on the initial attack domain name and determining the identified behavior as the causal behavior of the log4j vulnerability attack event; if the causal behavior includes file download behavior, then including the process triggering behavior, persistent setting behavior, and internal network scanning behavior after the file download behavior in the causal behavior of the log4j vulnerability attack event; performing recursive attack propagation identification based on the causal behavior to determine the infected host and including the behavior of the infected host in the causal behavior of the log4j vulnerability attack event; and taking the causal behavior of all log4j vulnerability attack events as the analysis results.

[0080] The initial attack domain refers to the remote server domain name or IP address used by the attacker to host the malicious payload class or as a JNDI lookup target during the Log4j vulnerability exploitation process; it is the external starting point of the attack chain. The domain name information can be extracted from the earliest abnormal class loading event (such as a JNDI lookup) in the attack event timeline, pointing to the URI or URL it points to, as the initial attack domain.

[0081] When identifying the behavior of the initial attack domain, threat intelligence can be linked and security tools can be invoked for the initial attack domain / IP. By performing static and dynamic sandbox analysis on the remote payload class file associated with the domain / IP, its malicious code characteristics (such as backdoors) can be extracted, and these identified behaviors can be listed as the causal behaviors of the log4j vulnerability attack event.

[0082] Next, if the causal behavior includes file download behavior, then the process triggering behavior, persistence setting behavior, and internal network scanning behavior after the file download are also listed as causal behaviors of the log4j vulnerability attack event. Based on the determined causal behavior clues, the attack events involving network assets in the time chain are iteratively searched to identify the infected host, and all abnormal process startups, file reading and writing, and network communication behaviors that occur on it are listed as causal behaviors of the log4j vulnerability attack event.

[0083] Among them, process triggering behavior refers to the unexpected start of a process on the host; persistent setting behavior refers to the actions taken by the attacker to ensure persistent access, such as modifying startup items, adding scheduled tasks (Cron Job / WindowsTask), or creating malicious service records; internal network scanning behavior refers to network traffic records initiated from the infected host to perform port scans or service probes on other assets on the internal network.

[0084] Step S206: Based on the analysis results, causal behavior marking is performed on the attack event time chain to obtain the target attack chain;

[0085] After obtaining the analysis results, the causal relationships and attack stages (such as reconnaissance, exploitation, control, and residence) determined in the analysis results can be marked on each node or edge of the attack event time chain to obtain the target attack chain. The target attack chain can be a graph model of the topology, which can include: attacker IP, initial victim host, successfully executed malicious command, and the time sequence of command execution.

[0086] Step S207: Generate a target response strategy for the log4j vulnerability attack based on the target attack chain.

[0087] In one implementation, the step of generating a target response strategy for a log4j vulnerability attack based on the target attack chain includes: identifying the severity and urgency of the log4j vulnerability attack based on the target attack chain; and matching a target vulnerability remediation strategy and a target attack defense strategy using a pre-trained strategy generation model based on the severity and urgency, as the target response strategy for the log4j vulnerability attack.

[0088] Severity refers to the potential or actual damage caused by a log4j vulnerability attack to system assets, data confidentiality, integrity, and availability. It can be identified based on the depth of the target attack chain and the sensitivity of the affected assets.

[0089] Urgency level refers to the time urgency required to take immediate action to stop the spread or damage of a log4j vulnerability attack. It can be identified based on the duration of the log4j vulnerability attack and whether the attack chain includes active reverse shell or C2 communication.

[0090] The pre-trained strategy generation model can be a large language model or expert system trained with security handling procedures, vulnerability remediation knowledge, and defense rules. It is used to automatically match, combine, or dynamically generate an operable / executable handling plan based on the severity and urgency of the input log4j vulnerability attack, including vulnerability remediation strategies and attack defense strategies.

[0091] For example, assuming both severity and urgency are at the highest level, the target vulnerability remediation strategy could include "immediately upgrade the target asset's Log4j version to the latest version", the target attack access strategy could include "force isolation of the infected host and perform memory forensics", "block the IP of the originating attack source on the perimeter firewall", and "remove the implanted malicious files".

[0092] The code vulnerability response strategy generation method provided by the above implementation method identifies code vulnerability attacks triggered by all log recording commands, integrates scattered log evidence into a clear and orderly attack chain, and enables security personnel to quickly grasp the attacker's intrusion starting point and spread path. Then, through automated risk assessment and response strategy generation, it can ensure that the security team can take the most effective action in a very short time, greatly improve the speed and accuracy of Log4j vulnerability attack detection and response, reduce the error rate of human decision-making, and improve the overall network security defense capability.

[0093] Corresponding to the above method embodiments, see Figure 3, which shows a schematic diagram of a code vulnerability response strategy generation device. This device includes: a response module 30, used to generate a target log query statement in response to a log recording instruction, based on the type of the log recording instruction; wherein the target log query statement is used to query logs related to log4j vulnerability attack behavior characteristics; an execution module 32, used to execute the target log query statement to obtain a target log query result; a judgment module 34, used to determine, based on the target log query result, whether the log recording instruction contains suspected log4j vulnerability attack behavior; an identification module 36, used to, if it contains such behavior, perform link identification on the log4j vulnerability attack based on the target log query result to obtain a target attack link; and a response module 38, used to generate a target response strategy for the log4j vulnerability attack based on the target attack link.

[0094] The aforementioned code vulnerability response strategy generation device triggers the identification of code vulnerability attacks for all log recording commands. Then, through automated risk assessment and response strategy generation, it can ensure that the security team can take the most effective action in a very short time. This greatly improves the speed and accuracy of Log4j vulnerability attack detection and response, reduces the error rate of human decision-making, and improves the overall network security defense capability.

[0095] Optionally, the response module 30 is specifically used to: in response to a logging instruction, construct context information of the logging instruction; wherein the context information includes at least asset database information associated with the logging instruction and matching results with a preset vulnerability database; input the content of the logging instruction and the context information into a pre-trained large language model, and generate a log query statement for at least one log database that matches the log4j vulnerability attack behavior characteristics of the logging instruction, thereby obtaining a target log query statement.

[0096] Optionally, the judgment module 34 includes: an identification unit, used to perform log semantic recognition on the target log query result through a pre-trained log semantic recognition model to obtain a log semantic recognition result; wherein the log semantic recognition result is used to indicate the confidence level corresponding to at least one preset log4j vulnerability attack behavior in the target log query result; and a judgment unit, used to determine whether the log recording instruction contains the execution of a suspected log4j vulnerability attack behavior based on the log semantic recognition result.

[0097] Optionally, the types of preset log4j vulnerability attack behaviors include at least: abnormal class loading behavior, remote code execution intent behavior, and covert channel communication behavior; the aforementioned judgment unit is specifically used to: perform weighted fusion on the confidence level corresponding to each preset log4j vulnerability attack behavior according to the preset weight value corresponding to each preset log4j vulnerability attack behavior, and obtain a weighted fusion score; if the weighted fusion score is greater than the preset score threshold, then it is determined that the log recording instruction contains the execution of a suspected log4j vulnerability attack behavior.

[0098] Optionally, the identification module 36 includes: a construction unit, configured to, if applicable, construct a time chain of log4j vulnerability attack events from the target log query results to obtain an attack event time chain, wherein the log4j vulnerability attack event is an attack event targeting any asset database; an analysis unit, configured to perform multi-dimensional causal behavior analysis on each log4j vulnerability attack event based on the attack event time chain to obtain analysis results; and a marking unit, configured to mark the attack event time chain with causal behavior based on the analysis results to obtain a target attack chain.

[0099] Optionally, the analysis unit is specifically used for: identifying the domain name information of the starting point of the attack event from the attack event time chain to obtain the starting attack domain name; performing behavior identification on the starting attack domain name and determining the identified behavior as the causal behavior of the log4j vulnerability attack event; if the causal behavior includes file download behavior, then including the process triggering behavior, persistent setting behavior, and intranet scanning behavior after the file download behavior in the causal behavior of the log4j vulnerability attack event; performing recursive attack propagation identification based on the causal behavior to determine the infected host, and including the behavior of the infected host in the causal behavior of the log4j vulnerability attack event; and taking the causal behavior of all the log4j vulnerability attack events as the analysis result.

[0100] Optionally, the aforementioned response module 38 is specifically used to: identify the severity and urgency of the log4j vulnerability attack based on the target attack chain; and, based on the severity and urgency, match the target vulnerability remediation strategy and the target attack defense strategy using a pre-trained strategy generation model as the target response strategy for the log4j vulnerability attack.

[0101] This embodiment also provides an electronic device, including a processor and a memory. The memory stores machine-executable instructions that can be executed by the processor. The processor executes the machine-executable instructions to implement the aforementioned method for generating a strategy to address code vulnerabilities. This electronic device can be a server or a terminal device.

[0102] Referring to Figure 4, the electronic device includes a processor 100 and a memory 101. The memory 101 stores machine-executable instructions that can be executed by the processor 100. The processor 100 executes the machine-executable instructions to implement the above-mentioned code vulnerability response strategy generation method.

[0103] Furthermore, the electronic device shown in Figure 4 also includes a bus 102 and a communication interface 103, with the processor 100, the communication interface 103, and the memory 101 connected via the bus 102.

[0104] The memory 101 may include high-speed random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Communication between this system network element and at least one other network element is achieved through at least one communication interface 103 (which can be wired or wireless), such as the Internet, wide area network, local area network, or metropolitan area network. The bus 102 may be an ISA bus, PCI bus, or EISA bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only a single bidirectional arrow is used in Figure 4, but this does not indicate that there is only one bus or one type of bus.

[0105] The processor 100 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of the processor 100 or by instructions in software form. The processor 100 may be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it may also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this disclosure. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this disclosure can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software module can reside in a readily available storage medium in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory 101. The processor 100 reads information from memory 101 and, in conjunction with its hardware, completes the steps of the method described in the foregoing embodiments, for example:

[0106] In response to a logging instruction, a target log query statement is generated based on the type of the logging instruction. This target log query statement is used to query logs related to the characteristics of a log4j vulnerability attack. The target log query statement is executed to obtain the target log query results. Based on the target log query results, it is determined whether the logging instruction contains suspected log4j vulnerability attack behavior. If so, based on the target log query results, the log4j vulnerability attack chain is identified to obtain the target attack chain. Based on the target attack chain, a target response strategy for the log4j vulnerability attack is generated.

[0107] In this approach, all logging commands trigger the identification of code vulnerability attacks. Then, through automated risk assessment and response strategy generation, it can ensure that the security team can take the most effective action in a very short time. This greatly improves the speed and accuracy of Log4j vulnerability attack detection and response, reduces the error rate of human decision-making, and improves the overall network security defense capability.

[0108] Optionally, the step of generating a target log query statement in response to a logging instruction, based on the type of the logging instruction, includes: constructing context information for the logging instruction in response to the logging instruction; wherein the context information includes at least the asset database information associated with the logging instruction and the matching results with a preset vulnerability database; inputting the content of the logging instruction and the context information into a pre-trained large language model, and generating a log query statement for at least one log database that matches the log4j vulnerability attack behavior characteristics of the logging instruction, thereby obtaining the target log query statement.

[0109] Optionally, the step of determining whether the log recording instruction contains the execution of a suspected log4j vulnerability attack behavior based on the target log query result includes: performing log semantic recognition on the target log query result using a pre-trained log semantic recognition model to obtain a log semantic recognition result; wherein, the log semantic recognition result is used to indicate the confidence level corresponding to at least one preset log4j vulnerability attack behavior in the target log query result; and determining whether the log recording instruction contains the execution of a suspected log4j vulnerability attack behavior based on the log semantic recognition result.

[0110] Optionally, the preset types of log4j vulnerability attack behaviors include at least: exception class loading behavior, remote code execution intent behavior, and covert channel communication behavior; the step of determining whether the log recording instruction contains the execution of suspected log4j vulnerability attack behavior based on the log semantic recognition result includes: weighting and fusing the confidence level corresponding to each preset log4j vulnerability attack behavior according to the preset weight value corresponding to each preset log4j vulnerability attack behavior to obtain a weighted fusion score; if the weighted fusion score is greater than the preset score threshold, it is determined that the log recording instruction contains the execution of suspected log4j vulnerability attack behavior.

[0111] Optionally, the steps of identifying the target attack chain based on the target log query results and obtaining the target attack chain include: constructing a time chain of log4j vulnerability attack events from the target log query results to obtain the attack event time chain, wherein the log4j vulnerability attack event is an attack event targeting any asset database; performing multi-dimensional causal behavior analysis on each log4j vulnerability attack event based on the attack event time chain to obtain the analysis results; and marking the attack event time chain with causal behavior based on the analysis results to obtain the target attack chain.

[0112] Optionally, based on the attack event timeline, the steps for performing multi-dimensional causal behavior analysis on each log4j vulnerability attack event to obtain the analysis results include: identifying the domain name information that initiated the attack event from the attack event timeline to obtain the initial attack domain name; performing behavior identification on the initial attack domain name and determining the identified behavior as the causal behavior of the log4j vulnerability attack event; if the causal behavior includes file download behavior, then including the process triggering behavior, persistent setting behavior, and internal network scanning behavior after the file download behavior in the causal behavior of the log4j vulnerability attack event; performing recursive attack propagation identification based on the causal behavior to determine the infected host and including the behavior of the infected host in the causal behavior of the log4j vulnerability attack event; and using the causal behavior of all log4j vulnerability attack events as the analysis results.

[0113] Optionally, the step of generating a target response strategy for the log4j vulnerability attack based on the target attack chain includes: identifying the severity and urgency of the log4j vulnerability attack based on the target attack chain; and matching the target vulnerability remediation strategy and the target attack defense strategy with a pre-trained strategy generation model based on the severity and urgency, as the target response strategy for the log4j vulnerability attack.

[0114] This embodiment also provides a computer-readable storage medium storing computer-executable instructions. When these computer-executable instructions are invoked and executed by a processor, they cause the processor to implement the aforementioned method for generating a response strategy to code vulnerabilities, for example:

[0115] In response to a logging instruction, a target log query statement is generated based on the type of the logging instruction. This target log query statement is used to query logs related to the characteristics of a log4j vulnerability attack. The target log query statement is executed to obtain the target log query results. Based on the target log query results, it is determined whether the logging instruction contains suspected log4j vulnerability attack behavior. If so, based on the target log query results, the log4j vulnerability attack chain is identified to obtain the target attack chain. Based on the target attack chain, a target response strategy for the log4j vulnerability attack is generated.

[0116] In this approach, all logging commands trigger the identification of code vulnerability attacks. Then, through automated risk assessment and response strategy generation, it can ensure that the security team can take the most effective action in a very short time. This greatly improves the speed and accuracy of Log4j vulnerability attack detection and response, reduces the error rate of human decision-making, and improves the overall network security defense capability.

[0117] Optionally, the step of generating a target log query statement in response to a logging instruction, based on the type of the logging instruction, includes: constructing context information for the logging instruction in response to the logging instruction; wherein the context information includes at least the asset database information associated with the logging instruction and the matching results with a preset vulnerability database; inputting the content of the logging instruction and the context information into a pre-trained large language model, and generating a log query statement for at least one log database that matches the log4j vulnerability attack behavior characteristics of the logging instruction, thereby obtaining the target log query statement.

[0118] Optionally, the step of determining whether the log recording instruction contains the execution of a suspected log4j vulnerability attack behavior based on the target log query result includes: performing log semantic recognition on the target log query result using a pre-trained log semantic recognition model to obtain a log semantic recognition result; wherein, the log semantic recognition result is used to indicate the confidence level corresponding to at least one preset log4j vulnerability attack behavior in the target log query result; and determining whether the log recording instruction contains the execution of a suspected log4j vulnerability attack behavior based on the log semantic recognition result.

[0119] Optionally, the preset types of log4j vulnerability attack behaviors include at least: exception class loading behavior, remote code execution intent behavior, and covert channel communication behavior; the step of determining whether the log recording instruction contains the execution of suspected log4j vulnerability attack behavior based on the log semantic recognition result includes: weighting and fusing the confidence level corresponding to each preset log4j vulnerability attack behavior according to the preset weight value corresponding to each preset log4j vulnerability attack behavior to obtain a weighted fusion score; if the weighted fusion score is greater than the preset score threshold, it is determined that the log recording instruction contains the execution of suspected log4j vulnerability attack behavior.

[0120] Optionally, the steps of identifying the target attack chain based on the target log query results and obtaining the target attack chain include: constructing a time chain of log4j vulnerability attack events from the target log query results to obtain the attack event time chain, wherein the log4j vulnerability attack event is an attack event targeting any asset database; performing multi-dimensional causal behavior analysis on each log4j vulnerability attack event based on the attack event time chain to obtain the analysis results; and marking the attack event time chain with causal behavior based on the analysis results to obtain the target attack chain.

[0121] Optionally, based on the attack event timeline, the steps for performing multi-dimensional causal behavior analysis on each log4j vulnerability attack event to obtain the analysis results include: identifying the domain name information that initiated the attack event from the attack event timeline to obtain the initial attack domain name; performing behavior identification on the initial attack domain name and determining the identified behavior as the causal behavior of the log4j vulnerability attack event; if the causal behavior includes file download behavior, then including the process triggering behavior, persistent setting behavior, and internal network scanning behavior after the file download behavior in the causal behavior of the log4j vulnerability attack event; performing recursive attack propagation identification based on the causal behavior to determine the infected host and including the behavior of the infected host in the causal behavior of the log4j vulnerability attack event; and using the causal behavior of all log4j vulnerability attack events as the analysis results.

[0122] Optionally, the step of generating a target response strategy for the log4j vulnerability attack based on the target attack chain includes: identifying the severity and urgency of the log4j vulnerability attack based on the target attack chain; and matching the target vulnerability remediation strategy and the target attack defense strategy with a pre-trained strategy generation model based on the severity and urgency, as the target response strategy for the log4j vulnerability attack.

[0123] This embodiment also provides a computer program product, which includes a computer program stored in a computer-readable storage medium; the computer program is read from the computer-readable storage medium and executed by the processor of a computer device, causing the computer device to execute the above-described method for generating a code vulnerability response strategy.

[0124] The computer program product for generating code vulnerability response strategies, apparatus, electronic device, and storage medium provided in this disclosure includes a computer-readable storage medium storing program code. The instructions included in the program code can be used to execute the methods described in the preceding method embodiments. For specific implementation details, please refer to the method embodiments, which will not be repeated here.

[0125] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the system and apparatus described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0126] Furthermore, in the description of the embodiments of this disclosure, unless otherwise expressly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this disclosure based on the specific circumstances.

[0127] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this disclosure, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this disclosure. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0128] In the description of this disclosure, it should be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings, and are only for the convenience of describing this disclosure and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of this disclosure. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0129] Finally, it should be noted that the above embodiments are merely specific implementations of this disclosure, used to illustrate the technical solutions of this disclosure, and not to limit it. The protection scope of this disclosure is not limited thereto. Although this disclosure has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this disclosure. Such modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this disclosure, and should all be covered within the protection scope of this disclosure. Therefore, the protection scope of this disclosure should be determined by the protection scope of the claims.

Claims

1. A method for generating response strategies for code vulnerabilities, characterized in that, The method includes: responding to a log recording instruction, generating a target log query statement according to the type of the log recording instruction; wherein the target log query statement is used to query logs related to log4j vulnerability attack behavior characteristics; executing the target log query statement to obtain a target log query result; determining, based on the target log query result, whether the log recording instruction contains the execution of suspected log4j vulnerability attack behavior; if so, performing link identification on the log4j vulnerability attack based on the target log query result to obtain a target attack link; generating a target response strategy for the log4j vulnerability attack based on the target attack link; the step of generating a target log query statement in response to a log recording instruction according to the type of the log recording instruction includes: responding to a log recording instruction... The instructions construct the context information of the logging instruction; wherein, the context information includes at least the asset database information associated with the logging instruction and the matching result with a preset vulnerability database. The asset database information associated with the logging instruction includes: the configuration, topology, and security status information of network assets directly or indirectly associated with the logging instruction. The matching result of the logging instruction with the preset vulnerability database is the result of comparing the content of the logging instruction with a known Log4j vulnerability feature database or threat intelligence database. The content of the logging instruction and the context information are input into a pre-trained large language model, and the large language model generates a log query statement for at least one log database that matches the log4j vulnerability attack behavior characteristics of the logging instruction, thereby obtaining the target log query statement.

2. The method according to claim 1, characterized in that, The step of determining whether the log recording instruction contains a suspected log4j vulnerability attack based on the target log query result includes: performing log semantic recognition on the target log query result using a pre-trained log semantic recognition model to obtain a log semantic recognition result; wherein the log semantic recognition result is used to indicate the confidence level corresponding to at least one preset log4j vulnerability attack behavior in the target log query result; and determining whether the log recording instruction contains a suspected log4j vulnerability attack based on the log semantic recognition result.

3. The method according to claim 2, characterized in that, The types of preset log4j vulnerability attack behaviors include at least: abnormal class loading behavior, remote code execution intent behavior, and covert channel communication behavior. The step of determining whether the log recording instruction contains suspected log4j vulnerability attack behavior based on the log semantic recognition result includes: weighting and fusing the confidence levels corresponding to each preset log4j vulnerability attack behavior according to preset weight values ​​to obtain a weighted fusion score; if the weighted fusion score is greater than a preset score threshold, then it is determined that the log recording instruction contains suspected log4j vulnerability attack behavior.

4. The method according to claim 1, characterized in that, The steps for identifying the target attack chain based on the target log query results include: constructing a time chain of log4j vulnerability attack events from the target log query results to obtain the attack event time chain, wherein the log4j vulnerability attack event is an attack event targeting any asset database; performing multi-dimensional causal behavior analysis on each log4j vulnerability attack event based on the attack event time chain to obtain the analysis results; and marking the attack event time chain with causal behavior based on the analysis results to obtain the target attack chain.

5. The method according to claim 4, characterized in that, The steps for performing multi-dimensional causal behavior analysis on each of the log4j vulnerability attack events based on the attack event time chain to obtain the analysis results include: identifying the domain name information that initiated the attack event from the attack event time chain to obtain the initial attack domain name; performing behavior identification on the initial attack domain name and determining the identified behavior as the causal behavior of the log4j vulnerability attack event; if the causal behavior includes file download behavior, then including the process triggering behavior, persistent setting behavior, and intranet scanning behavior after the file download behavior in the causal behavior of the log4j vulnerability attack event; performing recursive attack propagation identification based on the causal behavior to determine the infected host, and including the behavior of the infected host in the causal behavior of the log4j vulnerability attack event; and taking the causal behavior of all the log4j vulnerability attack events as the analysis results.

6. The method according to claim 1, characterized in that, The step of generating a target response strategy for the log4j vulnerability attack based on the target attack chain includes: identifying the severity and urgency of the log4j vulnerability attack based on the target attack chain; and matching a target vulnerability remediation strategy and a target attack defense strategy with a pre-trained strategy generation model based on the severity and urgency, as the target response strategy for the log4j vulnerability attack.

7. A device for generating a code vulnerability mitigation strategy, characterized in that, The device includes: a response module, configured to generate a target log query statement in response to a log recording instruction, based on the type of the log recording instruction; wherein the target log query statement is used to query logs related to log4j vulnerability attack behavior characteristics; an execution module, configured to execute the target log query statement to obtain a target log query result; a judgment module, configured to determine, based on the target log query result, whether the log recording instruction contains suspected log4j vulnerability attack behavior; an identification module, configured to, if contained, perform link identification on the log4j vulnerability attack based on the target log query result to obtain a target attack link; and a response module, configured to generate a target response strategy for the log4j vulnerability attack based on the target attack link; the response module is specifically configured to: respond to a log recording instruction... The process involves recording instructions and constructing context information for those instructions. This context information includes at least the asset database information associated with the log recording instruction and a matching result with a preset vulnerability database. The asset database information associated with the log recording instruction includes the configuration, topology, and security status information of network assets directly or indirectly associated with the log recording instruction. The matching result with the preset vulnerability database is the result of comparing the content of the log recording instruction with a known Log4j vulnerability signature database or threat intelligence database. The content and context information of the log recording instruction are input into a pre-trained large language model. The large language model generates a log query statement for at least one log database that matches the log4j vulnerability attack behavior characteristics of the log recording instruction, thus obtaining the target log query statement.

8. An electronic device, characterized in that, The method includes a processor and a memory, the memory storing machine-executable instructions that can be executed by the processor, the processor executing the machine-executable instructions to implement the code vulnerability response strategy generation method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when invoked and executed by a processor, cause the processor to implement the code vulnerability response strategy generation method according to any one of claims 1-6.

10. A computer program product, characterized in that, The computer program product includes a computer program stored in a computer-readable storage medium; the computer program is read from and executed by a processor of a computer device from the computer-readable storage medium, causing the computer device to perform a method for generating a code vulnerability response strategy as described in any one of claims 1-6.

Images