Double-task vulnerability intelligent evaluation method and system

Abstract

The invention relates to a double-task vulnerability intelligent evaluation method and system, belongs to the technical field of vulnerability analysis, and solves the problem that in the prior art, vulnerability evaluation only supports single-label and multi-task mutual isolation. The method comprises the following steps: acquiring a vulnerability description text and a vulnerability source code fragment of a to-be-evaluated vulnerability, and encoding the vulnerability description text and the vulnerability source code fragment according to a preset encoding rule to obtain a corresponding vulnerability encoding sequence; extracting a feature vector of the vulnerability coding sequence by using a target vector acquisition module to obtain a vulnerability feature vector; according to the vulnerability characteristic vector, determining the vulnerability type of the to-be-evaluated vulnerability by using the target linear classification head; and according to the vulnerability characteristic vector, using the target ordinal regression classification head to determine the vulnerability threat level of the to-be-evaluated vulnerability. Automatic multi-label classification and synchronous evaluation of classification tasks and hierarchical tasks in vulnerability evaluation are realized, the robustness and accuracy of vulnerability evaluation are improved, and the processing time delay and calculation overhead are reduced.

Description

Technical Field

[0001] This invention relates to the field of vulnerability analysis technology, and in particular to a dual-task intelligent vulnerability assessment method and system. Background Technology

[0002] In recent years, with the development of new technologies such as artificial intelligence, cloud computing, and the Internet of Things, the number of vulnerabilities has continued to grow, and the types of vulnerabilities have become increasingly diversified. Given limited time and resources, it is impossible to patch all vulnerabilities equally. Prioritizing the patching of high-risk vulnerabilities to minimize security threats and losses has become the industry's recognized optimal strategy. To achieve effective prioritization, it is first necessary to determine the classification of vulnerability types and their threat levels.

[0003] In existing technologies, vulnerability classification and threat level grading mainly employ two methods: manual annotation and automated annotation. Manual annotation is inefficient and suffers from data lag, while existing automated classification technologies have limitations due to single-label limitations, leading to inaccurate classification. Furthermore, the classification of types and the grading of levels are disconnected, resulting in resource and time consumption due to the deployment of multiple models, and the correlation between classification and grading is ignored.

[0004] Therefore, there is an urgent need for a new vulnerability assessment method to overcome the lag of manual annotation, the limitations of single-label classification, and the defects of multi-task isolation, so as to achieve efficient, accurate, and multi-label classification of massive vulnerabilities and simultaneously output the level classification. Summary of the Invention

[0005] Based on the above analysis, the embodiments of the present invention aim to provide a dual-task intelligent vulnerability assessment method and system to solve the problem that vulnerability assessment in the prior art only supports single labels and multiple tasks are isolated from each other.

[0006] On one hand, embodiments of the present invention provide a dual-task intelligent vulnerability assessment method, including: Obtain the vulnerability description text and vulnerability source code fragment of the vulnerability to be evaluated, and encode the vulnerability description text and the vulnerability source code fragment according to the preset encoding rules to obtain the corresponding vulnerability encoding sequence; Using the target vector acquisition module, the feature vector of the vulnerability encoding sequence is extracted to obtain the vulnerability feature vector; Based on the vulnerability characteristic vector, the target linear classification head is used to determine the vulnerability type to be evaluated. Based on the vulnerability characteristic vector, the target ordinal regression classification head is used to determine the vulnerability threat level of the vulnerability to be evaluated.

[0007] Furthermore, the preset encoding rules include preset concatenation rules; according to the preset encoding rules, the vulnerability description text and the vulnerability source code fragment are encoded to obtain the corresponding vulnerability encoding sequence, including: According to the preset splicing rules, a first modal identifier is added to the front of the vulnerability description text, and a second modal identifier is added to the front of the vulnerability source code fragment. Following the structure of task instruction-vulnerability description text-vulnerability source code fragment, the vulnerability description text and the vulnerability source code fragment are concatenated to obtain the vulnerability encoding sequence.

[0008] Furthermore, the target vector acquisition module includes an encoder and an aggregator; using the target vector acquisition module, the feature vector of the vulnerability encoding sequence is extracted to obtain the vulnerability feature vector, including: The vulnerability encoding sequence is divided into multiple encoding sub-blocks according to the length threshold; Using the encoder, each coded sub-block is converted into a corresponding local feature vector; The aggregator is used to aggregate all the local feature vectors to obtain the vulnerability feature vector.

[0009] Further, the target linear classification head includes a target label embedding matrix; based on the vulnerability characteristic vector, the target linear classification head is used to determine the vulnerability type of the vulnerability to be evaluated, including: Based on the vulnerability feature vector and the target label embedding matrix, the similarity between the vulnerability feature vector and each vulnerability type is determined; wherein, the target label embedding matrix includes a vector representation of each vulnerability type; The types of vulnerabilities to be assessed are determined based on the similarity of all the aforementioned types.

[0010] Furthermore, the target ordinal regression classification head includes multiple classifiers; based on the vulnerability feature vector, the target ordinal regression classification head is used to determine the vulnerability threat level of the vulnerability to be evaluated, including: The vulnerability feature vector is input into each classifier to obtain the corresponding threat score; The threat level of the assessed vulnerability is determined based on all the threat scores.

[0011] Furthermore, before extracting the feature vector of the vulnerability encoding sequence using the target vector acquisition module, the process further includes: Construct a vulnerability sample set; wherein, the vulnerability sample set includes multiple sample vulnerability tagging sequences, vulnerability type tags, and vulnerability threat level tags; The initial vulnerability assessment model is trained based on the vulnerability sample set to obtain the target vulnerability assessment model; wherein, the target vulnerability assessment model includes the target vector acquisition module, the target linear classification head, and the target ordinal regression classification head.

[0012] Further, the initial vulnerability assessment model is trained based on the vulnerability sample set to obtain the target vulnerability assessment model, including: Based on the vulnerability sample set, hierarchical sampling is performed according to the vulnerability type labels to determine the first-stage sample set; Input the first-stage sample set into the initial vulnerability assessment model to obtain the first-stage output results; Calculate the total loss of the first stage based on the output of the first stage; Based on the total loss in the first stage, the model parameters of the initial vulnerability assessment model are updated, and after the first training objective is achieved, the target vulnerability assessment model is output.

[0013] Furthermore, the total loss in the first phase was achieved through... Calculate, where, This represents the total loss in the first phase. For category classification loss, For level loss, This is the regularization loss; The category classification loss is through Calculate, where, Let be the balancing parameter for the i-th type corresponding to the sample vulnerability. The correction probability for the i-th vulnerability type corresponding to the sample vulnerability. To focus on the parameter, I represents the total number of vulnerability types; The level of loss is through Calculate, where, Let j be the true label value of the j-th binary category corresponding to the sample vulnerability. Let J be the probability of the j-th level corresponding to the sample vulnerability, and J be the total number of classifiers. The regularization loss is obtained through Calculate, where c is the regularization coefficient. In order to carry out the mission The overall importance of the first k-th parameter, The value of the k-th parameter after completing the current task. In order to carry out the mission The value of the kth parameter, where K is the total number of parameters.

[0014] Furthermore, the initial vulnerability assessment model includes an initial vector acquisition module, an initial linear classification head, and an initial ordinal regression classification head; after achieving the first training objective, the target vulnerability assessment model is output, including: Based on the vulnerability sample set, balanced sampling is performed based on the vulnerability type labels to determine the second-stage sample set; After achieving the first training objective, the model parameters of the initial vector acquisition module are frozen. Input the second-stage sample set into the initial vulnerability assessment model to obtain the second-stage output results; Calculate the total loss of the second stage based on the output of the second stage; Based on the total loss of the second stage, update the model parameters of the initial linear classifier head and the model parameters of the initial ordinal regression classifier head; After achieving the second training objective, the target vulnerability assessment model is output.

[0015] On the other hand, embodiments of the present invention provide a dual-task intelligent vulnerability assessment system, including: The data encoding module is used to acquire the vulnerability description text and vulnerability source code fragment of the vulnerability to be evaluated, and encode the vulnerability description text and the vulnerability source code fragment according to the preset encoding rules to obtain the corresponding vulnerability encoding sequence. The target vector acquisition module is used to extract the feature vector of the vulnerability encoding sequence to obtain the vulnerability feature vector. A target linear classification head is used to determine the vulnerability type of the vulnerability to be evaluated based on the vulnerability characteristic vector. The target ordinal regression classification header is used to determine the vulnerability threat level of the vulnerability to be evaluated based on the vulnerability feature vector.

[0016] Compared with the prior art, the present invention can achieve at least one of the following beneficial effects: 1. By using a vulnerability encoding sequence composed of vulnerability description text and vulnerability source code fragments as bimodal input, a vulnerability feature vector is obtained. This vector is synchronously transmitted to the target linear classification head and the target ordinal regression classification head. This ensures that the classification task (determining the type of vulnerability to be assessed) and the classification task (determining the threat level of the vulnerability to be assessed) are based on the same vulnerability feature vector. This enables efficient, accurate, and multi-label vulnerability type assessment of massive vulnerabilities, and simultaneously outputs an integrated and high-precision assessment of the vulnerability threat level. This improves the robustness and accuracy of vulnerability assessment, as well as the logical consistency between assessing vulnerability type and assessing vulnerability threat level. At the same time, by sharing the model backbone network, processing latency and computational overhead are reduced.

[0017] 2. Based on vulnerability feature vectors and target label embedding matrices, the vulnerability types are determined and evaluated in a more refined manner through multi-label learning. The vulnerability types are mapped to a high-dimensional vector space, and a target label embedding matrix is ​​constructed to accurately capture the inherent correlation between different vulnerability types and improve the accuracy of vulnerability type evaluation.

[0018] 3. During training, the category classification loss, rank loss, and regularization loss are used as the total loss in the first stage. Attention is paid to the correlation and strong coupling between the initial linear classification head and the initial ordinal regression classification head. The parameters of the initial vector acquisition module and the two initial classification heads are adjusted synchronously through the total loss in the first stage to ensure the consistency and rationality of the output vulnerability types and vulnerability threat levels, and to reduce processing latency.

[0019] In this invention, the above-described technical solutions can be combined with each other to achieve more preferred combinations. Other features and advantages of this invention will be set forth in the following description, and some advantages may become apparent from the description or be learned by practicing the invention. The objects and other advantages of this invention can be realized and obtained from what is particularly pointed out in the description and drawings. Attached Figure Description

[0020] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts. Figure 1 This is a flowchart illustrating a dual-task vulnerability intelligent assessment method according to an embodiment of the present invention. Figure 2 This is a flowchart illustrating another dual-task vulnerability intelligent assessment method in an embodiment of the present invention; Figure 3 This is a schematic diagram illustrating the process of training the initial vulnerability assessment model in an embodiment of the present invention; Figure 4 This is a schematic diagram of the main modules of a dual-task vulnerability intelligent assessment system according to an embodiment of the present invention. Detailed Implementation

[0021] Preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings, which form part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not intended to limit the scope of the present invention.

[0022] A specific embodiment of the present invention discloses a dual-task intelligent vulnerability assessment method, such as... Figure 1 As shown, it includes: Step S1: Obtain the vulnerability description text and vulnerability source code fragment of the vulnerability to be evaluated, and encode the vulnerability description text and the vulnerability source code fragment according to the preset encoding rules to obtain the corresponding vulnerability encoding sequence.

[0023] Obtain the vulnerability description text and vulnerability source code fragment of the vulnerability to be evaluated, construct a dual-modal prompt module, encode the vulnerability description text and vulnerability source code fragment according to the preset encoding rules, and construct a dual-modal input sequence, namely the vulnerability encoding sequence, for the convenience of subsequent processing.

[0024] Specifically, in this embodiment, the preset encoding rules include preset concatenation rules. According to these preset encoding rules, the vulnerability description text and the vulnerability source code fragment are encoded to obtain a corresponding vulnerability encoding sequence, including: Step S11: According to the preset splicing rules, add a first modal identifier to the front of the vulnerability description text and add a second modal identifier to the front of the vulnerability source code fragment.

[0025] Specifically, a first modal identifier is added to the beginning of the vulnerability description text, and a second modal identifier is added to the beginning of the vulnerability source code fragment. For example, the first modal identifier "vuln-desc:" is added before the vulnerability description text, and the second modal identifier "vuln-code:" is added before the vulnerability source code fragment.

[0026] Step S12: Following the structure of task instruction - vulnerability description text - vulnerability source code fragment, concatenate the vulnerability description text and the vulnerability source code fragment to obtain the vulnerability encoding sequence.

[0027] Specifically, following the structure of task instruction - vulnerability description text - vulnerability source code fragment, the vulnerability description text and the vulnerability source code fragment are concatenated to obtain a concatenated text sequence, i.e., the vulnerability encoding sequence, which serves as the input for the subsequent target vector acquisition module. For example, the vulnerability encoding sequence is "classify vulnerability: {vulnerability description text}{vulnerability source code fragment}", where {vulnerability description text} is the vulnerability description text containing the first modality identifier, and {vulnerability source code fragment} is the vulnerability source code fragment containing the second modality identifier.

[0028] Step S2: Using the target vector acquisition module, extract the feature vector of the vulnerability encoding sequence to obtain the vulnerability feature vector.

[0029] The target vector acquisition module is used to extract the feature vector of the vulnerability encoding sequence to obtain the vulnerability feature vector, which is used as the input for the subsequent target linear classification head and target ordinal regression classification head.

[0030] Considering that the target vector acquisition module has an input sequence length threshold, when the length of the constructed vulnerability encoding sequence exceeds this threshold, in order to avoid the word segmenter truncating the text sequence exceeding the threshold and causing the loss of key semantic information, this implementation adopts a hierarchical encoding and feature aggregation method to obtain the vulnerability feature vector. Specifically, the target vector acquisition module includes an encoder and an aggregator; using the target vector acquisition module, the feature vector of the vulnerability encoding sequence is extracted to obtain the vulnerability feature vector, including steps S21-S23.

[0031] Step S21: Divide the vulnerability encoding sequence into multiple encoding sub-blocks according to the length threshold.

[0032] Specifically, when the length of the vulnerability encoding sequence is no greater than the length threshold, no division is required, and it can be directly used as the input of the subsequent encoder. The resulting vector is the vulnerability feature vector.

[0033] When the length of the vulnerability encoding sequence exceeds a length threshold, the vulnerability encoding sequence is divided into multiple encoding sub-blocks according to the length threshold, with each encoding sub-block having a length equal to the length threshold. It is understandable that the length of the last encoding sub-block may be less than the length threshold.

[0034] Furthermore, when the length of the vulnerability coding sequence or the length of the coding sub-block is less than the length threshold, invalid data is filled in to make the length of the vulnerability coding sequence or the coding sub-block reach the length threshold, thus ensuring the consistency of the text length.

[0035] Step S22: Using the encoder, each encoded sub-block is converted into a corresponding local feature vector.

[0036] Specifically, each encoded sub-block is processed independently using an encoder, converting it into a fixed-dimensional local feature vector to capture the contextual semantic information within each sub-block. In this embodiment, the encoder can be a pre-trained code language model encoder. For example, the codet5p-220m encoder using the CodeT5+ model is used, with the local feature vector dimension set to 1×768 when the encoder parameter count is configured to 110M.

[0037] Step S23: Using the aggregator, aggregate all the local feature vectors to obtain the vulnerability feature vector.

[0038] Specifically, all local feature vectors are input into an aggregator for global interaction and fusion, resulting in a single global feature vector containing complete contextual information. For example, a vulnerability coding sequence is divided into three coding sub-blocks, each corresponding to a 1×768 local feature vector, which is then aggregated by the aggregator to generate a 1×768 vulnerability feature vector.

[0039] Step S3: Based on the vulnerability characteristic vector, use the target linear classification head to determine the vulnerability type to be evaluated.

[0040] The target linear classification head includes a target label embedding matrix; based on the vulnerability characteristic vector, the target linear classification head is used to determine the vulnerability type to be evaluated, including: Step S31: Determine the similarity between the vulnerability feature vector and each vulnerability type based on the vulnerability feature vector and the target label embedding matrix; the target label embedding matrix includes a vector representation of each vulnerability type.

[0041] Specifically, each row of the target label embedding matrix represents a vector representation of a vulnerability type. All vector representations of vulnerability types constitute the target label embedding matrix. The geometric proximity of the vector representations in the matrix reflects the correlation between different vulnerability types. Based on the dot product of the vulnerability feature vector and the target label embedding matrix, the similarity between the vulnerability feature vector and each vulnerability type is determined.

[0042] , In the formula, This is the vulnerability feature vector of the vulnerability to be evaluated. Embed a matrix for the target label. Let be the type similarity vector of the vulnerability to be evaluated. Each element in the vector represents the type similarity between the vulnerability feature vector and the corresponding vulnerability type.

[0043] Step S32: Determine the types of vulnerabilities to be assessed based on the similarity of all the types.

[0044] Specifically, the sigmoid activation function is used to convert the similarity of categories into the corresponding vulnerability category probabilities. For vulnerability category probabilities that are greater than the category probability threshold, the corresponding vulnerability category is determined as the evaluation vulnerability category of the vulnerability to be evaluated. The determined evaluation vulnerability category may be one or more.

[0045] , In the formula, Let be the probability of the i-th vulnerability type corresponding to the vulnerability to be evaluated. Let be the similarity score of the i-th type of vulnerability to be evaluated.

[0046] For example, the dimension of the vulnerability feature vector of the vulnerability to be evaluated is 1×768. For subsequent matrix calculations, the matrix is ​​transposed to 768×1, that is, the row vector is transformed into a column vector. The dimension of the vector representation of each vulnerability type is 1×768. The target label embedding matrix includes 5 vulnerability types, so the dimension of the target label embedding matrix is ​​5×768. The probability threshold is set to 0.85. When the probabilities of the 5 vulnerability types corresponding to the vulnerability to be evaluated are 0.30, 0.50, 0.90, 0.88, and 0.7 respectively, it is determined that the vulnerability to be evaluated belongs to the 3rd and 4th vulnerability types. That is, the 3rd and 4th vulnerability types are output as the evaluated vulnerability types.

[0047] The vulnerability types are determined based on vulnerability feature vectors and target label embedding matrices, and a refined evaluation of vulnerability types is achieved through multi-label learning. By mapping vulnerability types to a high-dimensional vector space and constructing a target label embedding matrix, the inherent relationships between different vulnerability types can be accurately captured, improving the accuracy and comprehensiveness of vulnerability type evaluation.

[0048] Step S4: Based on the vulnerability characteristic vector, use the target ordinal regression classification head to determine the vulnerability threat level of the vulnerability to be evaluated.

[0049] In the vulnerability threat level classification task, the vulnerability threat levels are ordered, and there is a progressive relationship between different levels. For example, the severity of the vulnerability threat levels follows the relationship of "Low < Medium < High < Critical". A target ordinal regression classification head is used to transform a single multi-classification problem into a series of binary classification sub-problems.

[0050] Specifically, the target ordinal regression classification head includes multiple classifiers; based on the vulnerability feature vector, the target ordinal regression classification head is used to determine the vulnerability threat level of the vulnerability to be evaluated, including: Step S41: Input the vulnerability feature vector into each classifier to obtain the corresponding threat score.

[0051] The vulnerability feature vector is input into each classifier to obtain the corresponding threat score. In this embodiment, a binary classifier is used. The number of classifiers can be determined according to the number of vulnerability threat levels. For example, if there are four vulnerability threat levels, then three classifiers are set.

[0052] For example, threat score In the formula, The threat score for the vulnerability to be evaluated. Represents the weight of the j-th classifier The transpose of the matrix, This is the vulnerability feature vector of the vulnerability to be evaluated. The bias of the j-th classifier can be set empirically or determined through training in steps S01-S02 below.

[0053] Step S42: Determine the threat level of the assessed vulnerability based on all the threat scores.

[0054] First, the threat score is converted into a corresponding level probability using the Sigmoid activation function. For example, the level probability... In the formula, Let be the probability of the j-th level of the vulnerability to be evaluated, that is, the probability that the j-th classifier predicts it to be true (i.e., meets the specific level threshold condition). This represents the probability that the assessed vulnerability threat level is greater than the level corresponding to the j-th classifier. For example, the probability that the first classifier predicts a vulnerability threat level > low. When the output probability is greater than 50%, it means that the assessed vulnerability threat level is greater than the low level.

[0055] Then, based on the probability levels and the progressive relationship between different vulnerability threat levels, the assessed vulnerability threat level is determined. For example, there are four vulnerability threat levels: Classifier 1 predicts the probability of a vulnerability threat level > low; Classifier 2 predicts the probability of a vulnerability threat level > medium; and Classifier 3 predicts the probability of a vulnerability threat level > high. Assuming that the probability output by Classifier 1 is greater than 50%, it means the assessed vulnerability threat level is greater than low. Then, we check the probability output by Classifier 2. If the vulnerability probability output by Classifier 2 is less than 50%, it means the assessed vulnerability threat level is not greater than medium. Therefore, the assessed vulnerability threat level is medium.

[0056] Within a unified model architecture, both vulnerability types and vulnerability threat levels are determined simultaneously. Considering the inherent hierarchical nature of vulnerability threat levels, an ordinal regression classification head is employed. Compared to traditional classification or regression methods, this approach can more accurately fit the distribution of vulnerability threat levels and precisely confirm the scope of vulnerability impact.

[0057] like Figure 2 The diagram shown is a flowchart of another dual-task vulnerability intelligent assessment method in an embodiment of the present invention. It illustrates the process of determining the type and threat level of the vulnerability from the vulnerability description file and vulnerability source code fragment of the vulnerability to be assessed, through preset encoding rules, target vector acquisition module, target linear classification head and target ordinal regression classification head.

[0058] Furthermore, to ensure the accuracy of assessing vulnerability types and vulnerability threat levels, before extracting the feature vector of the vulnerability encoding sequence using the target vector acquisition module, steps S01-S02 are also included.

[0059] Step S01: Construct a vulnerability sample set; wherein the vulnerability sample set includes multiple sample vulnerability coding sequences, vulnerability type tags, and vulnerability threat level tags.

[0060] In this embodiment, raw vulnerability data is obtained through public vulnerability databases and other channels, and then a vulnerability sample set is constructed, specifically including steps S011-S013.

[0061] Step S011: Obtain the original vulnerability dataset. Specifically, original vulnerability data is obtained from various channels such as public vulnerability databases, open-source code hosting websites, and cybersecurity communities. The obtained data is cleaned and screened for completeness, removing data with missing annotations and retaining valid vulnerability data entries that simultaneously contain vulnerability description text, vulnerability source code fragments, labeled vulnerability types, and vulnerability threat levels as sample vulnerabilities. In this embodiment, vulnerability data (Common Vulnerabilities and Exposures, or CVEs) from the official website of the National Vulnerability Database (NVD) is used as an example for illustration.

[0062] Step S012: Correct the vulnerability types and threat levels of the sample vulnerabilities labeled in the original vulnerability dataset to form a vulnerability dataset. Specifically, change the outdated CWE (Common WeaknessEnumeration) type numbers labeled in the NVD data to the CWE numbers currently used in the latest version CWE 4.18, and convert the vulnerability threat levels of different versions of CVSS (Common Vulnerability Scoring system) into the corresponding vulnerability threat levels of CVSS 4.0 through vulnerability vector strings, resulting in a vulnerability dataset containing CVE numbers, vulnerability description text, labeled vulnerability types, vulnerability source code fragments, and labeled vulnerability threat levels.

[0063] Step S013: Preprocess the vulnerability dataset to construct a vulnerability sample set.

[0064] First, multi-hot encoding is performed on the vulnerability types to obtain vulnerability type labels, enabling a sample vulnerability to belong to multiple vulnerability types simultaneously. For example, in CWE version 4.18, there are 944 vulnerability types. Therefore, in this embodiment, the vulnerability type label is set as a 944×1 dimension vector, where the i-th element is 1, indicating that the sample vulnerability belongs to the i-th vulnerability type.

[0065] Secondly, the vulnerability threat level is tagged and encoded by converting the vulnerability threat level into an integer label. For example, the vulnerability threat levels corresponding to CVSS 4.0 include four categories: [low, medium, high, critical], which are 0, 1, 2, and 3 respectively after conversion to integer labels. For instance, if the vulnerability threat level of sample vulnerability A is medium, then the corresponding vulnerability threat level label is 1.

[0066] Next, the vulnerable source code fragments are preprocessed by removing comments, blank lines, and other irrelevant information, retaining only the core code logic to ensure that the vulnerable source code fragments have a clear structure and can reflect the characteristics of the vulnerability.

[0067] Then, according to the preset encoding rules, the vulnerability description text and vulnerability source code fragments of the sample vulnerability are encoded to obtain the corresponding marked vulnerability encoding sequence. You can refer to the aforementioned step S1, which will not be repeated here.

[0068] Finally, a vulnerability sample set is constructed based on the vulnerability coding sequence, vulnerability type label, and vulnerability threat level label of each sample vulnerability.

[0069] Step S02: Train the initial vulnerability assessment model based on the vulnerability sample set to obtain the target vulnerability assessment model; wherein, the target vulnerability assessment model includes the target vector acquisition module, the target linear classification head, and the target ordinal regression classification head.

[0070] The initial vulnerability assessment model is trained based on the vulnerability sample set to obtain the target vulnerability assessment model, specifically including steps S021-S024.

[0071] Step S021: Based on the vulnerability sample set, perform stratified sampling based on the vulnerability type labels to determine the first-stage sample set.

[0072] Based on the vulnerability type label of each vulnerability in the vulnerability sample set, stratified sampling is performed to determine the first-stage sample set. This ensures that the distribution characteristics of the vulnerability type labels in the first-stage sample set are consistent with those in the vulnerability sample set. The first-stage sample set is then used to train the initial vulnerability assessment model in the first stage.

[0073] Step S022: Input the first-stage sample set into the initial vulnerability assessment model to obtain the first-stage output results.

[0074] The vulnerability encoding sequence of the sample vulnerabilities in the first-stage sample set is input into the initial vulnerability assessment model to obtain the first-stage output results.

[0075] Specifically, the initial vulnerability assessment model includes an initial vector acquisition module, an initial linear classification head, and an initial ordinal regression classification head. The initial linear classification head includes an initial label embedding matrix. The initial label embedding matrix includes vector representations for each vulnerability type. For example, the dimension of the vector representation for each vulnerability type is 1×768. In CWE version 4.18, there are 944 vulnerability types, and each row represents the vector representation of one vulnerability type. Therefore, the dimension of the CWE initial label embedding matrix is ​​944×768. It should be noted that the vector representation for each vulnerability type in the initial label embedding matrix can be randomly generated or manually set; there are no restrictions here.

[0076] The vulnerability encoding sequences of the sample vulnerabilities in the first-stage sample set are input into the initial vulnerability assessment model to obtain the first-stage output results, including: obtaining the corresponding first training vulnerability feature vector based on the labeled vulnerability encoding sequence using the initial vector acquisition module; determining the corresponding first predicted vulnerability type based on the first training vulnerability feature vector using the initial linear classification head; and determining the corresponding first predicted vulnerability threat level based on the first training vulnerability feature vector using the initial ordinal regression classification head. The principle is the same as steps S2-S4, and will not be repeated here.

[0077] Step S023: Calculate the total loss of the first stage based on the output results of the first stage.

[0078] Specifically, the total loss in the first stage includes classification loss, ranking loss, and regularization loss. For example, the total loss in the first stage is calculated through... Calculate, where, This represents the total loss in the first phase. For category classification loss, For level loss, This is the loss due to regularization.

[0079] Furthermore, the category classification loss is calculated based on the first predicted vulnerability category and vulnerability category label corresponding to the sample vulnerability.

[0080] For example, In the formula, Let be the balancing parameter for the i-th type corresponding to the sample vulnerability. The correction probability for the i-th vulnerability type corresponding to the sample vulnerability. To focus on parameters, this dynamically scales the loss contribution, reducing the weight of easily categorized vulnerability types and allowing the model to focus more on samples with difficult-to-categorize vulnerabilities. Here, I represents the total number of vulnerability types. , Let be the probability of the i-th vulnerability type corresponding to the sample vulnerability. For the i-th value in the vulnerability type label of the sample vulnerability, when , indicating that the sample vulnerability belongs to the i-th vulnerability type, when , indicating that the sample vulnerability does not belong to the i-th vulnerability type. , The baseline value for the vulnerability type balancing parameter is a preset hyperparameter that can address the vulnerability type imbalance problem in sample vulnerabilities. The value can be set based on experience, for example, It is 0.25.

[0081] The severity loss is calculated based on the first predicted vulnerability threat level and vulnerability threat level label for each sample vulnerability.

[0082] For example, In the formula, Let j be the true label value of the j-th binary category corresponding to the sample vulnerability. Let be the probability of the j-th level corresponding to the sample vulnerability, and represent the probability that the j-th classifier predicts the value as true (i.e., meets the specific level threshold condition). J is the total number of classifiers. Based on the vulnerability threat level label, it is generated through logical judgment rules. For example, for three classifiers: classifier 1 predicts the probability that the vulnerability threat level is >low; classifier 2 predicts the probability that the vulnerability threat level is >medium; classifier 3 predicts the probability that the vulnerability threat level is >high. If the vulnerability threat level label of sample vulnerability A is 1, then the corresponding vulnerability threat level label is generated. =1, =0, It is 0.

[0083] Regularization loss is calculated based on the importance and variability of the model parameters. Synaptic Intelligence (SI) regularization is used to limit the magnitude of changes in important parameters for previous tasks, preventing catastrophic forgetting of old knowledge during training. SI uses path integrals to continuously track the contribution of each parameter update to the overall loss function reduction during model learning. For each parameter, SI accumulates the product of its gradient and parameter change during training, representing the parameter's importance to the current task. Once a task is learned, the importance of each parameter is determined. When learning the next task, a regularization term is added to the loss function, proportional to the parameter's importance and the magnitude of its change.

[0084] For example, for the task SI accumulates the contribution of each parameter update to the overall decrease in the loss function. In the formula, Complete the task for the k-th parameter. Contribution value at that time For the task The number of training iterations, For the k-th parameter in the task The gradient of the t-th training iteration. , For the task The total loss in the first stage of the t-th training iteration is For the k-th parameter in the task The value of the training iteration in the t-th iteration. For the k-th parameter in the task The change in the t-th training iteration.

[0085] The kth parameter completes the task. The overall importance of the following In the formula, Complete the task for the k-th parameter. The overall importance of the following Perform a task for the k-th parameter Previous overall importance, Complete the task for the k-th parameter. The contribution value, For the k-th parameter in completing the task The displacement during the process represents the displacement of the k-th parameter in the task. Previous value retrieval and task completion The difference between the subsequent values, is the damping coefficient, and is a constant to avoid a denominator of 0.

[0086] Regularization loss, In the formula, c is the regularization coefficient. In order to carry out the mission The overall importance of the k-th parameter previously, This represents the value of the k-th parameter in the current task. In order to carry out the mission The value of the kth parameter previously, where K is the total number of parameters.

[0087] It should be noted that a single sample vulnerability can be used as a training task for one round, or a group of sample vulnerabilities of the same type can be used as a training task for one round; there is no restriction here.

[0088] Step S024: Update the model parameters of the initial vulnerability assessment model according to the total loss of the first stage, and output the target vulnerability assessment model after achieving the first training objective.

[0089] Based on the total loss in the first stage, the gradient of the total loss in the first stage with respect to each model parameter is calculated using the chain rule. The model parameters of the initial vulnerability assessment model are updated in the opposite direction of the gradient. After the first training objective is achieved, the target vulnerability assessment model is output.

[0090] Understandably, the model parameters of the initial vulnerability assessment model are updated based on the total loss from the first stage, including updating the initial label embedding matrix. Each type of vulnerability sample has both commonalities and unique characteristics. The first training vulnerability feature vector for any given sample vulnerability is represented as... In the formula, for Common characteristics of sample vulnerabilities of different vulnerability types. This is a unique part of the vulnerability in the nth sample. When training with sample vulnerabilities of various vulnerability types, according to gradient descent, when the number of sample vulnerabilities is sufficient, the positive and negative errors will cancel each other out, and the initial label embedding matrix will be used. The update of the vector representation of vulnerability types always points to... The common characteristics of various vulnerability types eventually stabilized. .

[0091] In this embodiment, the first training objective includes the first training round objective. After the training rounds of the initial vulnerability assessment model reach the first training round objective, the first stage of training is considered complete, and the target vulnerability assessment module is output.

[0092] Furthermore, to verify the performance of the current initial vulnerability assessment model after updating the model parameters and to prevent overfitting, the first-stage sample set also includes a first validation set, and the first training objective also includes a first early training stopping objective. Specifically, after each training task, the performance of the current initial vulnerability assessment model is evaluated using the first validation set. If the model performance reaches the first early training stopping objective, training is stopped early to prevent overfitting.

[0093] For example, the sample vulnerabilities in the validation set are input into the current initial vulnerability assessment model. Referring to the calculation of the total loss in the first stage, the total validation loss is determined and recorded as one validation. The current validation round W and the current total validation loss L are recorded. check If the latest total validation loss is not less than the current total loss, the current validation round is incremented by 1, and the current total validation loss remains unchanged. If the latest total validation loss is less than the current total validation loss, the current validation round is reset to 1, and the current total validation loss is updated to the latest total validation loss. When the current validation round reaches the target validation round, the model performance is considered to have reached the first training early stopping target. The target validation round can be set before validation begins.

[0094] For example, in the first validation, the total validation loss is L. check_1 Record the current validation round as 1, i.e., W=1, and the current total validation loss is the total validation loss obtained from the first validation. In the second verification, the total verification loss was L. check_2 ,like Then L check_2 To update the current total verification loss L check ,Right now The current verification round is reset to 1. If the total loss of the current verification remains unchanged, the current verification round is incremented by 1, i.e., W=2.

[0095] The model parameters of the initial vulnerability assessment model are updated by using the total loss in the first stage. The model is then fine-tuned end-to-end on the original imbalanced dataset, allowing the model to learn high-quality feature representations in the vulnerability assessment domain.

[0096] In this embodiment, the initial vulnerability assessment model, based on the initial vector acquisition module, adds two classification heads for vulnerability type classification and vulnerability threat level classification tasks. Then, the model is fine-tuned end-to-end using a dual-mode mixed input template. During training, type classification loss, level loss, and regularization loss are used as the first-stage total loss. Attention is paid to the correlation and strong coupling between the initial linear classification head and the initial ordinal regression classification head. The parameters of the initial vector acquisition module and the two initial classification heads are synchronously adjusted through the first-stage total loss to ensure the consistency and rationality of the output vulnerability types and vulnerability threat levels, and to reduce processing latency.

[0097] Meanwhile, considering that many vulnerabilities in reality have multiple vulnerability type attributes, this embodiment constructs an initial label embedding matrix by mapping vulnerability types to a high-dimensional vector space. Through training, the matrix learns autonomously and captures the complex intrinsic relationships between different vulnerability types. The resulting target label embedding matrix can accurately represent different vulnerability types and reflects the intrinsic relationships between different vulnerability types through geometric proximity in the matrix, thereby improving the comprehensiveness and accuracy of vulnerability type assessment and retaining more comprehensive information.

[0098] Furthermore, after achieving the first training objective, the initial linear classifier head and the initial ordinal regression classifier head can be rebalanced, freezing the model parameters of the initial vector acquisition module and training only the initial linear classifier head and the initial ordinal regression classifier head. This aims to correct classifier bias caused by the long-tail distribution of data. By decoupling the training strategy, each component of the model can achieve better optimization, resulting in improved overall performance.

[0099] Specifically, the initial vulnerability assessment model includes an initial vector acquisition module, an initial linear classification head, and an initial ordinal regression classification head; after achieving the first training objective, the target vulnerability assessment model is output, including steps A1-A6.

[0100] Step A1: Based on the vulnerability sample set, perform balanced sampling based on the vulnerability type labels to determine the second-stage sample set.

[0101] Based on the vulnerability sample set, the vulnerability type label of each sample vulnerability is sampled evenly to ensure that the different vulnerability type labels are evenly distributed in the second-stage sample set, thereby improving the ability of the initial vulnerability assessment model to identify minority sample vulnerabilities in the vulnerability type labels.

[0102] Step A2: Freeze the model parameters of the initial vector acquisition module.

[0103] After achieving the first training objective, the model parameters of the initial vector acquisition module are frozen, and the initial vulnerability assessment model is trained in the second stage using the second-stage sample set to update the model parameters of the initial linear classification head and the initial ordinal regression classification head.

[0104] Step A3: Input the second-stage sample set into the initial vulnerability assessment model to obtain the second-stage output results.

[0105] The second-stage sample set is input into the initial vulnerability assessment model after the first-stage training and update to obtain the second-stage output result. The principle is the same as step S022, and will not be repeated here.

[0106] Step A4: Calculate the total loss of the second stage based on the output of the second stage.

[0107] The total loss in the second stage includes category classification loss and ranking loss. For example, the total loss in the second stage is calculated through... Calculate, where, This represents the total loss for the second phase. For category classification loss, This refers to the loss based on classification. The calculation principles for category loss and grade loss are the same as in step S023, and will not be repeated here.

[0108] Step A5: Update the model parameters of the initial linear classifier head and the model parameters of the initial ordinal regression classifier head based on the total loss of the second stage.

[0109] Based on the total loss in the second stage, the gradient of the total loss in the second stage with respect to each model parameter is calculated using the chain rule. Then, the model parameters of the initial linear classifier head (including the update of the initial label embedding matrix) and the model parameters of the initial ordinal regression classifier head are updated in the opposite direction of the gradient.

[0110] Step A6: After achieving the second training objective, output the target vulnerability assessment model.

[0111] Upon achieving the second training objective, the second phase of training is considered complete, and the target vulnerability assessment model is output, including a target vector acquisition module, a target linear classification head, and a target ordinal regression classification head. The second training objective includes the second training round objective. Furthermore, the second phase sample set also includes a second validation set, and the second training objective also includes a second early stopping objective. The principle is the same as step S024, and will not be repeated here.

[0112] like Figure 3 The diagram shown is a flowchart illustrating the training process of the initial vulnerability assessment model in an embodiment of the present invention, demonstrating the first-stage training and second-stage training processes of the initial vulnerability assessment model.

[0113] This invention provides a dual-task intelligent vulnerability assessment system, such as... Figure 4 As shown, it includes: The data encoding module is used to acquire the vulnerability description text and vulnerability source code fragment of the vulnerability to be evaluated, and encode the vulnerability description text and the vulnerability source code fragment according to the preset encoding rules to obtain the corresponding vulnerability encoding sequence. The target vector acquisition module is used to extract the feature vector of the vulnerability encoding sequence to obtain the vulnerability feature vector. A target linear classification head is used to determine the vulnerability type of the vulnerability to be evaluated based on the vulnerability characteristic vector. The target ordinal regression classification header is used to determine the vulnerability threat level of the vulnerability to be evaluated based on the vulnerability feature vector.

[0114] The above-described method and system embodiments are based on the same principles, and their related aspects can be referenced from each other to achieve the same technical effects. For specific implementation processes, please refer to the foregoing embodiments, which will not be repeated here.

[0115] In summary, the dual-task vulnerability intelligent assessment method and system of this invention has at least one of the following beneficial effects: 1. By using a vulnerability encoding sequence composed of vulnerability description text and vulnerability source code fragments as bimodal input, a vulnerability feature vector is obtained. This vector is synchronously transmitted to the target linear classification head and the target ordinal regression classification head. This ensures that the classification task (determining the type of vulnerability to be assessed) and the classification task (determining the threat level of the vulnerability to be assessed) are based on the same vulnerability feature vector. This enables efficient, accurate, and multi-label vulnerability type assessment of massive vulnerabilities, and simultaneously outputs an integrated and high-precision assessment of the vulnerability threat level. This improves the robustness and accuracy of vulnerability assessment, as well as the logical consistency between assessing vulnerability type and assessing vulnerability threat level. At the same time, by sharing the model backbone network, processing latency and computational overhead are reduced.

[0116] 2. Based on vulnerability feature vectors and target label embedding matrices, the vulnerability types are determined and evaluated in a more refined manner through multi-label learning. The vulnerability types are mapped to a high-dimensional vector space, and a target label embedding matrix is ​​constructed to accurately capture the inherent correlation between different vulnerability types and improve the accuracy of vulnerability type evaluation.

[0117] 3. During training, the category classification loss, rank loss, and regularization loss are used as the total loss in the first stage. Attention is paid to the correlation and strong coupling between the initial linear classification head and the initial ordinal regression classification head. The parameters of the initial vector acquisition module and the two initial classification heads are adjusted synchronously through the total loss in the first stage to ensure the consistency and rationality of the output vulnerability types and vulnerability threat levels, and to reduce processing latency.

[0118] In this invention, the above-described technical solutions can be combined with each other to achieve more preferred combinations. Other features and advantages of this invention will be set forth in the following description, and some advantages may become apparent from the description or be learned by practicing the invention. The objects and other advantages of this invention can be realized and obtained from what is particularly pointed out in the description and drawings.

[0119] Those skilled in the art will understand that all or part of the processes of the methods described in the above embodiments can be implemented by a computer program instructing related hardware, and the program can be stored in a computer-readable storage medium. The computer-readable storage medium may be a disk, optical disk, read-only memory, or random access memory, etc.

[0120] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A dual-task intelligent vulnerability assessment method, characterized in that, include: Obtain the vulnerability description text and vulnerability source code fragment of the vulnerability to be evaluated, and encode the vulnerability description text and the vulnerability source code fragment according to the preset encoding rules to obtain the corresponding vulnerability encoding sequence; Using the target vector acquisition module, the feature vector of the vulnerability encoding sequence is extracted to obtain the vulnerability feature vector; Based on the vulnerability characteristic vector, the target linear classification head is used to determine the vulnerability type to be evaluated. Based on the vulnerability characteristic vector, the target ordinal regression classification head is used to determine the vulnerability threat level of the vulnerability to be evaluated.

2. The method according to claim 1, characterized in that, The preset encoding rules include preset splicing rules; According to preset encoding rules, the vulnerability description text and the vulnerability source code fragment are encoded to obtain the corresponding vulnerability encoding sequence, including: According to the preset splicing rules, a first modal identifier is added to the front of the vulnerability description text, and a second modal identifier is added to the front of the vulnerability source code fragment. Following the structure of task instruction-vulnerability description text-vulnerability source code fragment, the vulnerability description text and the vulnerability source code fragment are concatenated to obtain the vulnerability encoding sequence.

3. The method according to claim 1, characterized in that, The target vector acquisition module includes an encoder and an aggregator; Using the target vector acquisition module, the feature vector of the vulnerability encoding sequence is extracted to obtain the vulnerability feature vector, including: The vulnerability encoding sequence is divided into multiple encoding sub-blocks according to the length threshold; Using the encoder, each coded sub-block is converted into a corresponding local feature vector; The aggregator is used to aggregate all the local feature vectors to obtain the vulnerability feature vector.

4. The method according to claim 1, characterized in that, The target linear classification head includes a target label embedding matrix; Based on the vulnerability characteristic vector, the target linear classification head is used to determine the vulnerability type to be evaluated, including: Based on the vulnerability feature vector and the target label embedding matrix, the similarity between the vulnerability feature vector and each vulnerability type is determined; wherein, the target label embedding matrix includes a vector representation of each vulnerability type; The types of vulnerabilities to be assessed are determined based on the similarity of all the aforementioned types.

5. The method according to claim 1, characterized in that, The target ordinal regression classification head includes multiple classifiers; Based on the vulnerability characteristic vector, the target ordinal regression classification head is used to determine the vulnerability threat level of the vulnerability to be evaluated, including: The vulnerability feature vector is input into each classifier to obtain the corresponding threat score; The threat level of the assessed vulnerability is determined based on all the threat scores.

6. The method according to claim 5, characterized in that, Before extracting the feature vector of the vulnerability encoding sequence using the target vector acquisition module, the method further includes: Construct a vulnerability sample set; wherein, the vulnerability sample set includes multiple sample vulnerability tagging sequences, vulnerability type tags, and vulnerability threat level tags; The initial vulnerability assessment model is trained based on the vulnerability sample set to obtain the target vulnerability assessment model; wherein, the target vulnerability assessment model includes the target vector acquisition module, the target linear classification head, and the target ordinal regression classification head.

7. The method according to claim 6, characterized in that, The initial vulnerability assessment model is trained based on the vulnerability sample set to obtain the target vulnerability assessment model, including: Based on the vulnerability sample set, hierarchical sampling is performed according to the vulnerability type labels to determine the first-stage sample set; Input the first-stage sample set into the initial vulnerability assessment model to obtain the first-stage output results; Calculate the total loss of the first stage based on the output of the first stage; Based on the total loss in the first stage, the model parameters of the initial vulnerability assessment model are updated, and after the first training objective is achieved, the target vulnerability assessment model is output.

8. The method according to claim 7, characterized in that, The total loss in the first stage was achieved through Calculate, where, This represents the total loss in the first phase. For category classification loss, For level loss, This is the regularization loss; The category classification loss is through Calculate, where, Let be the balancing parameter for the i-th type corresponding to the sample vulnerability. The correction probability for the i-th vulnerability type corresponding to the sample vulnerability. To focus on the parameter, I represents the total number of vulnerability types; The level of loss is through Calculate, where, Let j be the true label value of the j-th binary category corresponding to the sample vulnerability. Let J be the probability of the j-th level corresponding to the sample vulnerability, and J be the total number of classifiers. The regularization loss is obtained through Calculate, where c is the regularization coefficient. In order to carry out the mission The overall importance of the first k-th parameter, This represents the value of the k-th parameter in the current task. In order to carry out the mission The value of the kth parameter, where K is the total number of parameters.

9. The method according to claim 7, characterized in that, The initial vulnerability assessment model includes an initial vector acquisition module, an initial linear classification head, and an initial ordinal regression classification head; After achieving the first training objective, the target vulnerability assessment model is output, including: Based on the vulnerability sample set, balanced sampling is performed based on the vulnerability type labels to determine the second-stage sample set; After achieving the first training objective, the model parameters of the initial vector acquisition module are frozen. Input the second-stage sample set into the initial vulnerability assessment model to obtain the second-stage output results; Calculate the total loss of the second stage based on the output of the second stage; Based on the total loss of the second stage, update the model parameters of the initial linear classifier head and the model parameters of the initial ordinal regression classifier head; After achieving the second training objective, the target vulnerability assessment model is output.

10. A dual-task intelligent vulnerability assessment system, characterized in that, include: The data encoding module is used to acquire the vulnerability description text and vulnerability source code fragment of the vulnerability to be evaluated, and encode the vulnerability description text and the vulnerability source code fragment according to the preset encoding rules to obtain the corresponding vulnerability encoding sequence. The target vector acquisition module is used to extract the feature vector of the vulnerability encoding sequence to obtain the vulnerability feature vector. The target linear classification head is used to determine the assessment vulnerability type of the vulnerability to be assessed based on the vulnerability characteristic vector. The target ordinal regression classification head is used to determine the vulnerability threat level of the vulnerability to be evaluated based on the vulnerability feature vector.

Images