Risk repair method and device for information system, equipment and storage medium

Abstract

The invention relates to the technical field of information system safety protection, can be applied to the technical field of finance and medical treatment, and discloses a risk repair method and device for an information system, equipment and a storage medium. The method comprises the steps that based on a vulnerability recognition model, single-point vulnerabilities are recognized according to bottom layer codes, configuration parameters and operation data of an information system; on the basis of a graph convolutional network model, vulnerability propagation is identified according to a heterogeneous graph and single-point vulnerabilities constructed by an information system to obtain a risk state graph; determining each target repair strategy corresponding to each single-point vulnerability based on a multi-target optimization reward function according to the risk state diagram and a pre-configured candidate repair strategy; according to each target repair strategy, performing risk repair on the information system based on the code generation tool to obtain a repair system; and verifying the repair system, and when the verification is passed, determining that the information system is successfully repaired. And full-life-cycle intelligent management of the vulnerability of the information system is realized.

Description

Technical Field

[0001] This invention relates to the field of information system security protection technology, and is applied to the fields of finance and medical technology. In particular, it relates to a method, apparatus, equipment and storage medium for risk repair of information systems. Background Technology

[0002] As information systems become increasingly complex, various vulnerabilities have become core risks affecting their stable operation. Financial information systems are characterized by high-frequency transactions, highly sensitive data, and high business continuity; vulnerabilities in these systems can lead to data breaches and financial losses. Healthcare information systems are characterized by strong data privacy requirements and high system heterogeneity; vulnerabilities in these systems can lead to the leakage of diagnostic and treatment terminals and patient information.

[0003] Currently, mainstream information system security protection technologies in the industry mainly include the following core tools: commercial vulnerability scanners such as TenableNessus and Rapid7 Nexpose; open-source scanning frameworks such as OpenVAS and Nuclei; security information and event management (SIEM) platforms such as IBM QRadar and Splunk Enterprise Security; and patch management systems such as Red Hat Satellite and Microsoft WSUS. These solutions primarily rely on CVE (Common Vulnerabilities and Exposures) databases and CVSS (Common Vulnerability Scoring System) for vulnerability identification, matching known vulnerabilities.

[0004] The existing technical solutions mainly reveal the following defects and shortcomings in practical applications: 1. Low detection coverage and accuracy. Existing scanning tools are based on signature matching and can only identify vulnerabilities already entered into the CVE database. Furthermore, they lack sufficient ability to identify configuration and logic vulnerabilities. The accuracy rate is generally below 75%, with a false positive rate as high as 30-40%.

[0005] 2. Zero-day vulnerability blind spot. Traditional methods rely on CVE database updates, but the average cycle from vulnerability discovery to inclusion in the database is 45-90 days, presenting a serious security window. Traditional methods cannot identify undisclosed 0-day vulnerabilities.

[0006] 3. Lack of a systematic perspective. Existing scanning tools mostly perform single-point detection, failing to construct complete attack path maps and vulnerability propagation models, making it difficult to assess the risk of complex attacks.

[0007] 4. Limited remediation strategies. Existing patch management systems employ a "one-size-fits-all" approach, lacking tailored remediation strategies for different vulnerabilities and failing to provide targeted remediation based on varying vulnerability scenarios.

[0008] 5. The remediation efficiency is low and heavily reliant on manual intervention. The average remediation time from vulnerability discovery to completion is 72-168 hours, with manual analysis and decision-making accounting for more than 60% of the time. Summary of the Invention

[0009] This invention provides a method, apparatus, device, and storage medium for risk repair of information systems. Through a complete technical process of intelligent identification, risk analysis, decision optimization, automatic repair, and verification rollback, it realizes intelligent management of the entire lifecycle of information system vulnerabilities.

[0010] Firstly, a risk remediation method for information systems is provided, the method comprising: Obtain the underlying code, configuration parameters, and runtime data of the information system. Based on the underlying code, configuration parameters, and runtime data, identify single points of vulnerability using a pre-trained vulnerability identification model to obtain a list of vulnerability source nodes of the information system. The information system is constructed as a heterogeneous graph. Based on the heterogeneous graph and the list of vulnerability source nodes, the vulnerability propagation is identified using a graph convolutional network model, resulting in a risk state graph of the information system. Based on the risk status diagram and pre-configured candidate remediation strategies, the remediation strategies for each single vulnerability are determined by optimizing the multi-objective reward function. Based on the remediation strategies for each target and the list of vulnerability source nodes, the information system is remediated using code generation tools to obtain a remediated system. The repaired system undergoes functional verification, performance verification, and production verification. When all three verifications are passed, the information system is considered successfully repaired.

[0011] Secondly, a risk repair device for an information system is provided, the device comprising: The single-point vulnerability identification unit is used to obtain the underlying code, configuration parameters and runtime data of the information system. Based on the underlying code, configuration parameters and runtime data, it identifies single-point vulnerabilities using a pre-trained vulnerability identification model to obtain a list of vulnerability source nodes of the information system. The risk propagation analysis unit is used to construct the information system as a heterogeneous graph. Based on the heterogeneous graph and the list of vulnerability source nodes, it identifies vulnerability propagation based on the graph convolutional network model to obtain the risk status graph of the information system. The remediation strategy screening unit is used to determine the remediation strategy for each single vulnerability based on the risk status diagram and pre-configured candidate remediation strategies, and to optimize the reward function based on the multi-objective optimization. The information system repair unit is used to perform risk repair on the information system based on the repair strategies for each target and the list of vulnerability source nodes, using code generation tools to obtain a repaired system. The system repair verification unit is used to perform functional verification, performance verification, and production verification on the repaired system. When all three verifications are passed, the information system is considered successfully repaired.

[0012] Thirdly, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the risk repair method for the aforementioned information system.

[0013] Fourthly, a computer-readable storage medium is provided, which stores a computer program that, when executed by a processor, implements the steps of the risk repair method for the aforementioned information system.

[0014] The scheme implemented by the aforementioned information system risk remediation method, apparatus, equipment, and storage medium includes: acquiring the underlying code, configuration parameters, and operational data of the information system; identifying single-point vulnerabilities based on a pre-trained vulnerability identification model using the underlying code, configuration parameters, and operational data to obtain a list of vulnerability source nodes for the information system; constructing the information system as a heterogeneous graph; identifying vulnerability propagation based on a graph convolutional network model using the heterogeneous graph and the list of vulnerability source nodes to obtain a risk state graph of the information system; determining the target remediation strategy corresponding to each single-point vulnerability based on a multi-objective optimization reward function based on the risk state graph and pre-configured candidate remediation strategies; performing risk remediation on the information system based on the target remediation strategies and the list of vulnerability source nodes using a code generation tool to obtain a remediated system; and performing functional verification, performance verification, and production verification on the remediated system. When all three verifications pass, the information system is considered successfully remediated.

[0015] The method proposed in this invention achieves a leapfrog improvement from passive detection to proactive identification, from isolated analysis to system analysis, from manual decision-making to intelligent optimization, and from single-point repair to collaborative protection, constructing an intelligent management process for the entire lifecycle of information system vulnerabilities. This invention uses a pre-trained vulnerability identification model to identify single-point vulnerabilities based on underlying code, configuration parameters, and operational data, increasing the accuracy of single-point vulnerability identification from approximately 75% to approximately 92% using traditional methods, and achieving a zero-day vulnerability prediction accuracy of approximately 78%. This invention reduces the average repair time from approximately 120 hours to approximately 6 hours through an automated repair process, reduces the repair decision time from 2-4 hours of manual analysis to approximately 5 minutes, and achieves a repair strategy accuracy of approximately 89%. This invention uses a multi-layered verification mechanism to control the probability of introducing new problems through repair to below 3%, achieving a rollback success rate of approximately 99.5%, and a progressive deployment strategy to ensure business continuity, maintaining service availability above 99.9%. Based on the information system risk repair solution provided by this invention, the need for manual intervention is reduced by approximately 85%, the labor costs of operation and maintenance personnel are reduced by more than 60%, and the timeliness of risk repair is increased to approximately 98%. Attached Figure Description

[0016] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a flowchart illustrating a risk repair method for an information system according to an embodiment of the present invention; Figure 2 This is a flowchart illustrating a risk repair method for an information system according to another embodiment of the present invention; Figure 3 This is a schematic diagram of the structure of a risk repair device for an information system according to an embodiment of the present invention; Figure 4 This is a schematic diagram of the structure of a computer device according to an embodiment of the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] The present invention will now be described in detail through specific embodiments.

[0020] Please see Figure 1 As shown, Figure 1 A flowchart illustrating a risk remediation method for an information system provided in an embodiment of the present invention. The method includes the following steps: Step S110: Obtain the underlying code, configuration parameters, and runtime data of the information system. Based on the underlying code, configuration parameters, and runtime data, identify single-point vulnerabilities using a pre-trained vulnerability identification model to obtain a list of vulnerability source nodes for the information system.

[0021] This embodiment first performs intelligent identification of single points of vulnerability in the information system. The intelligent identification process uses underlying code, configuration parameters, and runtime data as its data foundation, and utilizes a vulnerability identification model for multimodal deep learning. It can not only identify consistent CVE vulnerabilities, but also has the ability to predict zero-day vulnerabilities.

[0022] Data is collected in parallel across three dimensions: static code analysis, configuration auditing, and behavior monitoring. Static code analysis collects underlying code, configuration auditing collects configuration parameters, and behavior monitoring collects runtime data.

[0023] The underlying code may include, but is not limited to, system kernel code and application source code. Configuration parameters may include, but are not limited to, system configuration, application configuration, and database configuration. Behavioral data may include, but is not limited to, system logs, business operation logs, and resource usage data.

[0024] The vulnerability identification model is a fusion neural network model that extracts semantic features from the underlying code, risk features from configuration parameters, and abnormal behavior features from behavioral data. It then performs deep learning on these multimodal features, replacing traditional signature-based matching methods. This vulnerability identification model can discover potential security risks through semantic understanding, thereby improving the accuracy and comprehensiveness of single-point vulnerability identification.

[0025] In some optional implementations, step S110 involves obtaining the underlying code, configuration parameters, and runtime data of the information system; identifying single points of vulnerability based on a pre-trained vulnerability identification model using the underlying code, configuration parameters, and runtime data to obtain a list of vulnerability source nodes for the information system; obtaining the underlying code of the information system and extracting semantic features of the code using a code feature extraction function; obtaining the configuration parameters of the information system and extracting configuration risk features using a configuration feature extraction function; obtaining the runtime data of the information system and extracting abnormal behavior features using a behavior feature function; and inputting the semantic features of the code, the configuration risk features, and the abnormal behavior features into the pre-trained vulnerability identification model to output a list of vulnerability source nodes for the information system through the vulnerability identification model.

[0026] Obtain the underlying code, configuration parameters, and runtime data of the information system. Before extracting features from the underlying code, configuration parameters, and runtime data, preprocessing can be performed on these data.

[0027] For example: preprocessing the underlying code by removing comments and blank lines; preprocessing the configuration parameters by performing structured transformations; and preprocessing the runtime data by word segmentation and smoothing the time sequence.

[0028] use Code feature extraction functions extract semantic features of the underlying code and utilize them. Configuration feature extraction functions extract configuration risk features, utilizing... The behavioral feature function extracts abnormal behavioral features. Then, the three types of feature vectors are input into the input layer of the vulnerability identification model.

[0029] The code feature extraction function is used to uncover potential vulnerability features from the underlying code's syntactic structure, logical connections, and security semantics. It preprocesses the original code file (e.g., removing comments, blank lines, and performing syntax correction) to generate a complete intermediate code file; it then calls a syntax parser to convert the intermediate code file into an abstract syntax tree (AS / RS) (each AS / RS node corresponds to a syntactic unit in the intermediate code file); it traverses the AS / RS and marks key syntactic nodes, recording node hierarchical relationships and dependencies to form a structured feature matrix; it performs semantic embedding on the AS / RS, converting each syntactic unit into a semantic vector containing contextual semantics; and finally, it concatenates the feature matrix and semantic vectors of the AS / RS to form the code semantic features.

[0030] A feature extraction function is configured to identify configuration items that do not conform to security specifications from configuration parameters. This involves converting configuration parameters of different formats into a unified structured data format (e.g., JSON); building a security configuration rule base; using a forward matching algorithm to validate the configuration parameters according to the rules, obtaining rule matching results; constructing a configuration baseline based on historical configuration data; identifying configuration parameters that deviate from the configuration baseline, obtaining anomaly detection results; and converting the rule matching results and anomaly detection results into numerical features to generate configuration risk features.

[0031] Behavioral feature functions are used to identify abnormal operations that deviate from normal behavior patterns from runtime data. Unstructured logs are transformed into structured data using regular expressions, word segmentation, etc.; statistical features are extracted from the time domain and correlation dimensions; a normal behavior model is constructed, and the differences between real-time behavior and the normal behavior model are compared; based on the degree of difference and behavioral sensitivity attributes, abnormal behavior features are generated.

[0032] The vulnerability identification model's identification function is: Formula (1). That is, the vulnerability identification model can include three fully connected layers: The weight matrix of the first fully connected layer is: The activation function is The first fully connected layer is used to initially filter out effective features from the input multimodal features and convert the three types of cross-modal features into shallow fusion features.

[0033] The weight matrix of the second fully connected layer is: The activation function is The second fully connected layer is used to transform shallow-level fused features into deep-level correlated features and further compress the feature dimensions.

[0034] The weight matrix of the third fully connected layer is: The activation function is The third fully connected layer is used to convert deep-level correlated features into probability values.

[0035] The output layer of the vulnerability identification model outputs a list of vulnerability source nodes for the information system. The list of vulnerability source nodes can include multiple single vulnerabilities, and each single vulnerability can include a vulnerability node and a vulnerability type.

[0036] For example, vulnerability identification models identify nodes in an information system based on underlying code, configuration parameters, and runtime data. Vulnerability type A exists in a node of the information system. Vulnerability type B exists in the information system's nodes. The vulnerability type C exists. The aforementioned single point of vulnerability can be a CVE vulnerability or a zero-day vulnerability.

[0037] In some alternative implementations, in step S110, the vulnerability identification model is pre-trained based on federated learning.

[0038] This embodiment employs a federated learning framework to pre-train the vulnerability identification model. Each participant trains an initial model locally, encrypting and transmitting model parameters using differential privacy technology. The cloud securely aggregates and updates the model parameters transmitted by each participant before distributing the global model to all participants. Through multiple iterative optimizations of the "local training - parameter upload - cloud aggregation - model distribution" process, a pre-trained vulnerability identification model is finally obtained. The federated learning architecture protects the data privacy of each participant while enabling collaborative sharing of vulnerability knowledge across the entire network.

[0039] Step S120: Construct the information system as a heterogeneous graph. Based on the heterogeneous graph and the list of vulnerability source nodes, identify vulnerability propagation based on the graph convolutional network model to obtain the risk state graph of the information system.

[0040] This embodiment then proceeds to perform systemic risk analysis based on a single point of vulnerability. The systemic risk analysis process uses a vulnerability node list as its data foundation and employs a graph convolutional network model to perform vulnerability propagation analysis, thereby predicting the cascading effects of a single point of vulnerability.

[0041] Complex information systems are constructed as heterogeneous graphs, where each component of the information system serves as a node, and the dependencies between components form edges. Graph convolutional neural networks are used to analyze the propagation paths and impact range of vulnerabilities (i.e., single points of failure), thereby constructing a complete attack path graph. Furthermore, based on the propagation of vulnerabilities at each node, critical nodes can be identified, providing a systemic risk state diagram for subsequent remediation decisions.

[0042] In some optional real-time methods, step S120 involves constructing the information system as a heterogeneous graph, identifying vulnerability propagation based on the heterogeneous graph and a list of vulnerability source nodes, and obtaining a risk state diagram of the information system based on a graph convolutional network model. This includes: constructing the information system as a heterogeneous graph; determining the node feature matrix and corresponding adjacency matrix based on the heterogeneous graph; determining the probability value of vulnerability propagation from upstream nodes to downstream nodes based on the node feature matrix and corresponding adjacency matrix using a graph convolutional network model; selecting node pairs with probability values ​​higher than a first preset threshold, and constructing an attack path graph based on the list of vulnerability source nodes and node pairs; calculating the cumulative probability value of each target node as an upstream node propagating vulnerability to all downstream nodes for each target node in the attack path graph, and selecting key nodes with cumulative probability values ​​higher than a second preset threshold; and determining the risk state diagram of the information system based on the attack path graph and key nodes.

[0043] Using the components of the information system as nodes Using the dependencies between components as edges Through the attribute tags of each node and each dependency As a note, constructing a heterogeneous graph .

[0044] The attribute labels of each node and dependency attribute label of the heterogeneous graph are transformed into vector form and used as the input node feature matrix of the graph convolutional network model. At the same time, construct the adjacency matrix. To represent the relationships between nodes.

[0045] The dependency effects between nodes are learned using a graph convolutional network model. The probability value of vulnerability propagation from upstream nodes to downstream nodes is calculated using the following formula (2), and then the vulnerability propagation probability matrix is ​​obtained.

[0046] , formula (2).

[0047] In formula (2), Represents an upstream node. Indicates a downstream node. This indicates the upstream node. downstream nodes The probability value of propagation vulnerability. This represents a graph convolutional network. and All represent nodes For nodes The impact of its spread This indicates normalization. Indicates upstream node For any downstream node The impact of its spread Indicates upstream node To all possible downstream nodes The exponential summation of the propagation impact is used to ensure the upstream nodes... To all associated downstream nodes The sum of their propagation probability values ​​is 1.

[0048] A first preset threshold can be maintained in advance, serving as the standard for selecting node pairs with high propagation probability. The value of the first preset threshold can be flexibly set according to historical data. Based on the vulnerability propagation probability matrix calculated above, node pairs with probability values ​​higher than the first preset threshold are selected, forming a list of node pairs with high propagation probability.

[0049] For example: , , , , , , It is higher than the first preset threshold.

[0050] Then, starting from each single vulnerability node in the vulnerability source node list, we search for high propagation probability node pairs with the single vulnerability node as the upstream node. We then use the downstream node of the high propagation probability node pair as the new upstream node to continue searching for high propagation probability node pairs until no more high propagation probability node pairs can be found, thus forming a complete attack path graph.

[0051] For example: In , and It is a single point of vulnerability. , , , , , , If the value exceeds the first preset threshold, one attack path is: One attack path is One attack path is One attack path is An attack path diagram is formed based on the four attack paths.

[0052] A second preset threshold can be maintained in advance, serving as a standard for selecting high-risk nodes. The size of the second preset threshold can be flexibly set based on historical data. Based on the vulnerability propagation probability matrix obtained above, key nodes with cumulative probability values ​​higher than the second preset threshold are selected, forming a list of key nodes. The cumulative probability value represents the sum of propagation probabilities to all downstream nodes when the target node is an upstream node.

[0053] For example: nodes When acting as an upstream node, its downstream nodes include and Then the node The cumulative probability value is ,when When the value is higher than the second preset threshold, the node It has been identified as a critical node.

[0054] Finally, a risk status diagram of the information system is determined based on the attack path diagram and key nodes. The risk status diagram can be a visual representation. In the risk status diagram, vulnerability source nodes and key nodes can be displayed in red to indicate a higher level of risk. Attack path diagrams can be drawn by connecting nodes with lines to visually display the path of vulnerability propagation.

[0055] Step S130: Based on the risk status diagram and pre-configured candidate remediation strategies, determine the remediation strategies for each single vulnerability based on the multi-objective optimization reward function.

[0056] Based on risk status diagrams and pre-configured candidate remediation strategies, the optimal remediation strategy for each single vulnerability is dynamically selected based on a multi-objective optimization reward function, thus breaking away from the traditional "one-size-fits-all" remediation model.

[0057] The current security posture of an information system can be defined based on a risk status diagram. Pre-configured candidate remediation strategies can be obtained, which may include, but are not limited to, code patching, configuration parameter adjustments, and node isolation.

[0058] For a single point of vulnerability, a multi-objective optimization reward function based on reinforcement learning is used to calculate the impact of each candidate remediation strategy on the current security posture of the information system. The multi-objectives may include, but are not limited to, security benefit objectives, stability objectives, and remediation cost objectives. The target remediation strategy that has the greatest positive impact on the current security posture of the information system is selected from the candidate remediation strategies.

[0059] For each single vulnerability in the vulnerability source node list, a corresponding target remediation strategy is selected.

[0060] In some optional implementations, step S130, based on the risk state diagram and pre-configured candidate remediation strategies, determines the target remediation strategy corresponding to each single point of vulnerability based on a multi-objective optimization reward function, including: defining the state space of the information system according to the risk state diagram; obtaining the pre-configured candidate remediation strategies as the action space; for a single point of vulnerability, calculating the reward value of each action to the state space according to the multi-objective optimization reward function; sorting the reward values ​​of each action, and selecting the action with the highest reward value as the target remediation strategy corresponding to the single point of vulnerability.

[0061] The current security posture of the information system is defined based on the risk state diagram, which serves as the state space S of the information system. Pre-configured candidate remediation strategies are obtained as the action space A. .

[0062] Since the vulnerability source node list of an information system usually includes multiple single points of vulnerability, a corresponding target remediation strategy is selected for each single point of vulnerability.

[0063] Taking a single point of vulnerability as an example, the multi-objective optimization reward function is defined as follows: , formula (3).

[0064] In this multi-objective optimization reward function, the multiple objectives include the security benefit objective, the stability objective, and the repair cost objective. Representing the state space Any action in, This represents the safety and return weighting coefficient. This indicates that stability affects the weighting coefficients. This represents the weighting coefficient for repair costs. Indicates the execution of an action Changes in the security benefits of the post-information system Indicates the execution of an action The stability change value of the information system after the fact Indicates the execution of an action The cost of repair.

[0065] For action space A Each action in Each action is calculated according to formula (3) to obtain a reward value, thereby selecting the action with the highest reward value as the target remediation strategy for the single vulnerability.

[0066] For example: for a single point of vulnerability node , =0.22, =0.15, =0.18, then the action will be... As a single point of vulnerability node Target remediation strategy; for single-point vulnerabilities , =0.12, =0.20, =0.15, then the action will be... As a single point of vulnerability node Target remediation strategy; for single-point vulnerabilities , =0.19, =0.17, =0.15, then the action will be... As a single point of vulnerability node The target repair strategy.

[0067] Step S140: Based on the remediation strategies for each target and the list of vulnerability source nodes, perform risk remediation on the information system using a code generation tool to obtain a remediated system.

[0068] Based on the remediation strategies for each target, the individual vulnerabilities corresponding to each target remediation strategy are remediated. Once all individual vulnerabilities included in the vulnerability source node list have been remediated using their corresponding target remediation strategies, the remediated system is obtained.

[0069] Code generation tools can be existing, well-established tools or pre-developed automated remediation tools for information systems. These tools can understand the upstream and downstream relationships of a single point of vulnerability and generate semantically correct remediation code.

[0070] In some optional implementations, step S140, based on each target remediation strategy and the vulnerability source node list, performs risk remediation on the information system using a code generation tool to obtain a remediation system, includes: for a target remediation strategy, determining the vulnerability cause of the single point of vulnerability corresponding to the target remediation strategy based on the vulnerability source node list; based on the target remediation strategy, calling the code generation tool to generate multiple candidate remediation schemes for the vulnerability causes; performing static analysis and syntax checking on each candidate remediation scheme to determine the optimal remediation scheme; using the optimal remediation scheme to perform risk remediation on the single point of vulnerability; after all vulnerability source node lists are remediated, the remediation system is obtained.

[0071] The following example illustrates the automated remediation process using the remediation of a single point of vulnerability. The automated remediation process is the same for all single points of vulnerability in the vulnerability source node list.

[0072] To automatically patch single-point vulnerabilities, it is necessary to first locate the cause of the vulnerability, and then adopt the corresponding target patching strategy based on the root cause. This includes: cause analysis, generation of candidate patching solutions, selection of the optimal patching solution, and automatic patching.

[0073] Root cause analysis: Locate the root cause of the single point of vulnerability by analyzing the vulnerability source node list.

[0074] For example: The root cause of a vulnerability is determined by matching the vulnerability type against a root cause database. This is then verified using runtime logs and other data to ultimately pinpoint the cause of the single-point vulnerability. For instance, identifying the single-point vulnerability node... The vulnerability was caused by "incorrect parameter configuration" and other reasons.

[0075] Candidate remediation solution generation: The code generation tool is invoked to generate multiple candidate remediation solutions based on the cause of the vulnerability.

[0076] When calling the code generation tool, the cause of the vulnerability and the semantic features of the upstream and downstream relationships of the single point of vulnerability extracted based on the risk state diagram can be input into the code generation tool so that the code generation tool takes into account the vulnerability context semantics when generating candidate remediation solutions for the cause of the vulnerability.

[0077] For example: targeting a single point of vulnerability node Based on the cause of the vulnerability and the semantic context of the single point of vulnerability, three candidate remediation solutions are generated. Each candidate remediation solution has a different remediation approach, but all candidate remediation solutions belong to the single point of vulnerability. The corresponding target repair strategy.

[0078] Optimal repair solution selection: Static analysis and syntax checking are performed on candidate repair solutions to select the optimal repair solution.

[0079] Static analysis checks the code quality of candidate fixes, while syntax checking checks the syntactic correctness of the code. Weighting coefficients for static analysis and syntax checking can be preset. Based on the static analysis and syntax check scores of the candidate fixes, a score is calculated using these weighting coefficients. The optimal fix is ​​then selected based on these scores.

[0080] For example: if the static analysis weight coefficient is 0.6 and the syntax check weight coefficient is 0.4; if the code quality score of the first candidate repair solution is 90 and the syntax correctness score is 80, then the score of the candidate repair solution is 86; if the code quality score of the second candidate repair solution is 70 and the syntax correctness score is 100, then the score of the candidate repair solution is 82; if the code quality score of the third candidate repair solution is 80 and the syntax correctness score is 90, then the score of the candidate repair solution is 84; then the first repair solution is selected as the optimal repair solution.

[0081] Automatic remediation: Employs the optimal remediation solution to fix the corresponding single point of vulnerability, and can also back up vulnerability-related files.

[0082] Step S150: Perform functional verification, performance verification, and production verification on the repaired system. When all three verifications are passed, the information system is confirmed to be successfully repaired.

[0083] Once all individual vulnerabilities in the vulnerability source node list of the information system have been patched, a patched system is obtained. The patched system cannot directly replace the information system; instead, it requires multi-layered verification. These multi-layered verifications include: functional verification, performance verification, and production verification.

[0084] If all multi-level verifications pass, it indicates that the repaired system is performing well, and the repaired system can be used to replace the information system.

[0085] If any verification in the multi-layered verification fails, it indicates that the system repair has failed. Based on the backup vulnerability-related files, the repaired system will be rolled back to the information system, and a reminder can be sent to the operations and maintenance personnel.

[0086] In some optional implementations, step S150 involves performing functional verification, performance verification, and production verification on the repair system. When all three verifications pass, the information system repair is deemed successful. This includes: testing the functional correctness of the repair system in an isolation sandbox; deploying the repair system to a shadow system and testing its performance; deploying the repair system to a small-scale production node and testing its operational status; monitoring key indicators of the repair system in real time in the isolation sandbox, shadow system, and small-scale production node; determining that the information system repair has failed when any key indicator exceeds its corresponding anomaly threshold and restoring the repair system to its original state; and determining that the information system repair is successful when all key indicators do not exceed their corresponding anomaly thresholds.

[0087] First, test the functionality of the repair system in an isolated sandbox.

[0088] A sandbox environment consistent with the production environment can be set up to verify whether key metrics are normal by executing test cases. In this case, the key metrics being monitored tend to characterize the core functions of the system being fixed, such as vulnerability reproduction rate and functional error rate.

[0089] If the key metrics are normal, the functional verification passes. If the key metrics are abnormal, the functional verification fails. If the functional verification fails, performance verification and production verification will not be performed, and the repaired system will be rolled back to the information system state.

[0090] If the functionality verification passes, the patched system will be deployed to the shadow system to test the performance impact.

[0091] A remediation system can be deployed in a shadow system to simulate production traffic and monitor critical performance indicators. In this case, the key metrics monitored will be those characterizing the remediation system's performance, such as response time, throughput, and CPU utilization.

[0092] If the key metrics are normal, the performance verification passes. If the key metrics are abnormal, the performance verification fails. If the performance verification fails, production verification will not be conducted, and the repaired system will be rolled back to the information system state.

[0093] If the performance verification passes, the repaired system will be deployed to a small number of production nodes to verify the production operation status.

[0094] Small-scale production verification can be performed using canary deployments to monitor whether key performance indicators are normal. At this stage, the key metrics monitored tend to characterize the system's operational status after repairs, such as message processing success rate.

[0095] If the key performance indicators (KPIs) are normal, production validation passes. If the KPIs are abnormal, production validation fails. If production validation fails, the repaired system will be rolled back to the information system state.

[0096] To determine whether key indicators are normal, we use whether they exceed corresponding anomaly thresholds. The anomaly thresholds are calculated using anomaly detection formulas. , formula (4).

[0097] in, This represents the historical average of any key indicator. This represents the historical standard deviation of any key indicator; Denotes the confidence coefficient and For example, for more core key indicators, the confidence coefficient For more common key indicators, the confidence coefficient .

[0098] For example: response time is a core key indicator, and the confidence coefficient... Its historical average is Its standard deviation is The abnormal threshold for the key indicator of response time is: If the system repair response time is If the response time is normal, then the key indicator of response time is normal; if the response time of the repair system is... If so, the key indicator of response time is abnormal.

[0099] Depend on Figure 1As shown in the method, the information system risk remediation method proposed in this invention obtains the underlying code, configuration parameters, and operational data of the information system. Based on the underlying code, configuration parameters, and operational data, single-point vulnerabilities are identified using a pre-trained vulnerability identification model to obtain a list of vulnerability source nodes for the information system. The information system is constructed as a heterogeneous graph. Based on the heterogeneous graph and the list of vulnerability source nodes, vulnerability propagation is identified using a graph convolutional network model to obtain a risk state graph of the information system. Based on the risk state graph and pre-configured candidate remediation strategies, a multi-objective optimization reward function is used to determine the remediation strategy corresponding to each single-point vulnerability. Based on the remediation strategies and the list of vulnerability source nodes, the information system is remediated using a code generation tool to obtain a remediated system. The remediated system undergoes functional verification, performance verification, and production verification. When all three verifications pass, the information system is considered successfully remediated.

[0100] The method proposed in this invention achieves a leapfrog improvement from passive detection to proactive identification, from isolated analysis to system analysis, from manual decision-making to intelligent optimization, and from single-point repair to collaborative protection, and constructs an intelligent management process for the entire lifecycle of information system vulnerability.

[0101] The method proposed in this invention has the following beneficial effects: 1. Significantly improved identification capabilities. This invention uses a pre-trained vulnerability identification model to identify single points of vulnerability based on underlying code, configuration parameters, and runtime data. The accuracy of single point of vulnerability identification is increased from approximately 75% to approximately 92% using traditional methods, and the accuracy of zero-day vulnerability prediction reaches approximately 78%.

[0102] 2. Significantly improved response efficiency. This invention reduces the average repair time from approximately 120 hours to approximately 6 hours through an automated repair process, and reduces the repair decision time from 2-4 hours of manual analysis to approximately 5 minutes, achieving a repair strategy accuracy rate of approximately 89%.

[0103] 3. Enhanced system stability. This invention uses a multi-layered verification mechanism to control the probability of introducing new problems through repair to below 3%, achieving a rollback success rate of approximately 99.5%. The incremental deployment strategy ensures business continuity, and service availability is maintained above 99.9%.

[0104] 4. Significantly reduced operating costs. Based on the information system risk remediation solution provided by this invention, the need for manual intervention is reduced by approximately 85%, the labor costs of operation and maintenance personnel are reduced by more than 60%, and the timeliness of risk remediation is increased to approximately 98%.

[0105] Please see Figure 2 As shown, Figure 2 Another flowchart illustrating a risk remediation method for an information system provided in an embodiment of the present invention. The method includes the following steps: Step S201: Obtain the underlying code of the information system and extract its semantic features. Proceed to step S205.

[0106] Step S202: Obtain the configuration parameters of the information system and extract configuration risk characteristics. Proceed to step S205.

[0107] Step S203: Obtain the operational data of the information system and extract abnormal behavior characteristics. Proceed to step S205.

[0108] Step S204: Train the vulnerability identification model based on federated learning. Proceed to step S205.

[0109] Step S205: Input the code semantic features, configuration risk features, and abnormal behavior features into the vulnerability identification model to output a list of vulnerability source nodes for the information system. Proceed to step S206.

[0110] Step S206: Construct the information system as a heterogeneous graph, and determine the node feature matrix and corresponding adjacency matrix based on the heterogeneous graph. Proceed to step S207.

[0111] Step S207: Based on the node feature matrix and the corresponding adjacency matrix, determine the probability value of vulnerability propagation from upstream nodes to downstream nodes using a graph convolutional network model. Proceed to step S208.

[0112] Step S208: Filter out node pairs with probability values ​​higher than the first preset threshold, and construct an attack path graph based on the vulnerability source node list and node pairs. Proceed to step S209.

[0113] Step S209: For each target node in the attack path graph, calculate the cumulative probability value of each target node as an upstream node propagating its vulnerability to all downstream nodes, and filter out key nodes whose cumulative probability value is higher than the second preset threshold. Proceed to step S210.

[0114] Step S210: Determine the risk status diagram of the information system based on the attack path diagram and key nodes. Proceed to step S211.

[0115] Step S211: Define the state space of the information system according to the risk state diagram, and obtain the pre-configured candidate remediation strategies as the action space. Proceed to step S212.

[0116] Step S212: For a single point of vulnerability, calculate the reward value for each action based on the multi-objective optimization reward function, sort the reward values ​​of each action, and select the action with the highest reward value as the target remediation strategy corresponding to the single point of vulnerability. Determine the target remediation strategies corresponding to each single point of vulnerability in turn based on the vulnerability source node count. Proceed to step S213.

[0117] Step S213: Based on the vulnerability source node list, determine the cause of a single point of vulnerability. According to the target remediation strategy corresponding to this single point of vulnerability, use a code generation tool to generate multiple candidate remediation schemes for the vulnerability cause. Perform static analysis and syntax checks on each candidate remediation scheme to determine the optimal remediation scheme. Use the optimal remediation scheme to remediate the single point of vulnerability. After all vulnerability source nodes in the list have been remediated, the remediated system is obtained. Proceed to step S214.

[0118] Step S214: Perform functional verification on the repair system in an isolation sandbox to determine whether the functional verification passes. If it passes, proceed to step S215; if it fails, proceed to step S218.

[0119] Step S215: Perform performance verification on the repair system in the shadow system to determine whether the performance verification passes. If it passes, proceed to step S216; if it fails, proceed to step S218.

[0120] Step S216: Perform production verification of the repair system in a small-scale production node to determine whether the production verification passes. If it passes, proceed to step S217; if it fails, proceed to step S218.

[0121] Step S217: Confirm that the information system has been successfully repaired.

[0122] Step S218: Restore the repaired system to an information system.

[0123] In one embodiment, a risk repair device for an information system is provided, which corresponds one-to-one with the risk repair methods for information systems described in the above embodiments. For example... Figure 3 As shown, the risk repair device 300 for this information system includes: The single point vulnerability identification unit 310 is used to obtain the underlying code, configuration parameters and running data of the information system, and to identify single points of vulnerability based on the pre-trained vulnerability identification model according to the underlying code, configuration parameters and running data, so as to obtain a list of vulnerability source nodes of the information system. The risk propagation analysis unit 320 is used to construct the information system as a heterogeneous graph, and based on the heterogeneous graph and the list of vulnerability source nodes, it identifies vulnerability propagation based on the graph convolutional network model to obtain the risk status graph of the information system. The remediation strategy screening unit 330 is used to determine the remediation strategy for each single vulnerability based on the risk status diagram and pre-configured candidate remediation strategies, and based on the multi-objective optimization reward function. The information system repair unit 340 is used to perform risk repair on the information system based on the repair strategies for each target and the list of vulnerability source nodes, using code generation tools to obtain a repaired system. The system repair verification unit 350 is used to perform functional verification, performance verification, and production verification on the repair system. When all three verifications are passed, the information system is determined to be successfully repaired.

[0124] In some optional implementations, in device 300, the single-point vulnerability identification unit 310 is specifically used to: acquire the underlying code of the information system and extract semantic features of the code using a code feature extraction function; acquire the configuration parameters of the information system and extract configuration risk features using a configuration feature extraction function; acquire the operating data of the information system and extract abnormal behavior features using a behavior feature function; input the semantic features of the code, the configuration risk features, and the abnormal behavior features into a pre-trained vulnerability identification model, so as to output a list of vulnerability source nodes of the information system through the vulnerability identification model.

[0125] In some alternative implementations, the vulnerability identification model is pre-trained based on federated learning.

[0126] In some optional implementations, in device 300, the risk propagation analysis unit 320 is specifically used to: construct the information system as a heterogeneous graph; determine the node feature matrix and the corresponding adjacency matrix based on the heterogeneous graph; determine the probability value of upstream nodes propagating vulnerabilities to downstream nodes based on a graph convolutional network model according to the node feature matrix and the corresponding adjacency matrix; filter out node pairs with probability values ​​higher than a first preset threshold, and construct an attack path graph based on the vulnerability source node list and node pairs; for each target node in the attack path graph, calculate the cumulative probability value of each target node as an upstream node propagating vulnerabilities to all downstream nodes, and filter out key nodes with cumulative probability values ​​higher than a second preset threshold; and determine the risk status graph of the information system based on the attack path graph and key nodes.

[0127] In some optional implementations, in the above-described apparatus 300, the remediation strategy screening unit 330 is specifically used for: defining the state space of the information system according to the risk state diagram; obtaining pre-configured candidate remediation strategies as the action space; for a single point of vulnerability, calculating the reward value of each action to the state space according to the multi-objective optimization reward function; sorting the reward values ​​of each action, and screening the action with the highest reward value as the target remediation strategy corresponding to the single point of vulnerability.

[0128] In some optional implementations, in the above-described apparatus 300, the information system repair unit 340 is specifically used for: determining the cause of a single point of vulnerability corresponding to a target repair strategy based on a list of vulnerability source nodes; generating multiple candidate repair schemes for the cause of the vulnerability by calling a code generation tool according to the target repair strategy; performing static analysis and syntax checking on each candidate repair scheme to determine the optimal repair scheme; using the optimal repair scheme to repair the single point of vulnerability; and obtaining the repaired system after all the vulnerability source nodes in the list have been repaired.

[0129] In some optional implementations, in the above-described apparatus 300, the repair system verification unit 350 is specifically used for: testing the functional correctness of the repair system in an isolation sandbox; deploying the repair system to a shadow system to test its performance; deploying the repair system to a small-scale production node to test its operational status; monitoring the key indicators of the repair system in real time in the isolation sandbox, shadow system, and small-scale production node; determining that the information system repair has failed when any key indicator exceeds the corresponding abnormal threshold, and restoring the repair system to the original information system; and determining that the information system repair has been successful when all key indicators have not exceeded the corresponding abnormal thresholds.

[0130] Specific limitations regarding the risk remediation device for information systems can be found in the limitations of the risk remediation methods for information systems described above, and will not be repeated here. Each unit in the aforementioned risk remediation device for information systems can be implemented entirely or partially through software, hardware, or a combination thereof. These units can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each of the above modules.

[0131] In one embodiment, a computer device is provided, the internal structure of which can be shown as follows: Figure 4 As shown. The computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile and / or volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The network interface is used for communication with external systems via a network connection. When the computer program is executed by the processor, it implements the functions or steps of a risk remediation method for the information system.

[0132] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to perform the following steps: Obtain the underlying code, configuration parameters, and runtime data of the information system. Based on the underlying code, configuration parameters, and runtime data, identify single points of vulnerability using a pre-trained vulnerability identification model to obtain a list of vulnerability source nodes of the information system. The information system is constructed as a heterogeneous graph. Based on the heterogeneous graph and the list of vulnerability source nodes, the vulnerability propagation is identified using a graph convolutional network model, resulting in a risk state graph of the information system. Based on the risk status diagram and pre-configured candidate remediation strategies, the remediation strategies for each single vulnerability are determined by optimizing the multi-objective reward function. Based on the remediation strategies for each target and the list of vulnerability source nodes, the information system is remediated using code generation tools to obtain a remediated system. The repaired system undergoes functional verification, performance verification, and production verification. When all three verifications are passed, the information system is considered successfully repaired.

[0133] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor: Obtain the underlying code, configuration parameters, and runtime data of the information system. Based on the underlying code, configuration parameters, and runtime data, identify single points of vulnerability using a pre-trained vulnerability identification model to obtain a list of vulnerability source nodes of the information system. The information system is constructed as a heterogeneous graph. Based on the heterogeneous graph and the list of vulnerability source nodes, the vulnerability propagation is identified using a graph convolutional network model, resulting in a risk state graph of the information system. Based on the risk status diagram and pre-configured candidate remediation strategies, the remediation strategies for each single vulnerability are determined by optimizing the multi-objective reward function. Based on the remediation strategies for each target and the list of vulnerability source nodes, the information system is remediated using code generation tools to obtain a remediated system. The repaired system undergoes functional verification, performance verification, and production verification. When all three verifications are passed, the information system is considered successfully repaired.

[0134] It should be noted that the functions or steps that can be implemented by the computer-readable storage medium or computer device described above can be referred to the relevant descriptions on the server side in the foregoing method embodiments. To avoid repetition, they will not be described one by one here.

[0135] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided by this invention can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0136] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0137] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A method of risk remediation for an information system, characterized by, The method comprises: obtaining the underlying code, configuration parameters and running data of the information system, identifying single-point vulnerabilities based on a pre-trained vulnerability identification model according to the underlying code, the configuration parameters and the running data, and obtaining a vulnerability source node list of the information system; constructing the information system into a heterogeneous graph, identifying vulnerability propagation based on a graph convolution network model according to the heterogeneous graph and the vulnerability source node list, and obtaining a risk state graph of the information system; determining a target repair strategy corresponding to each single-point vulnerability based on a multi-objective optimization reward function according to the risk state graph and a preconfigured candidate repair strategy; performing risk repair on the information system based on a code generation tool according to the target repair strategy and the vulnerability source node list, and obtaining a repaired system; when the function verification, the performance verification and the production verification all pass, determining that the information system is successfully repaired.

2. The risk remediation method of an information system according to claim 1, wherein, The method comprises: obtaining the underlying code, configuration parameters and running data of the information system, identifying single-point vulnerabilities based on a pre-trained vulnerability identification model according to the underlying code, the configuration parameters and the running data, and obtaining a vulnerability source node list of the information system; obtaining the underlying code of the information system, and extracting code semantic features by using a code feature extraction function; obtaining the configuration parameters of the information system, and extracting configuration risk features by using a configuration feature extraction function; obtaining the running data of the information system, and extracting behavior abnormality features by using a behavior feature function; 3. The risk remediation method of an information system according to claim 1, wherein, inputting the code semantic features, the configuration risk features and the behavior abnormality features into the pre-trained vulnerability identification model, so as to output the vulnerability source node list of the information system by the vulnerability identification model.

4. The risk remediation method of an information system according to claim 1, wherein, The vulnerability identification model is pre-trained based on federated learning. The method comprises: constructing the information system into the heterogeneous graph, determining a node feature matrix and a corresponding adjacency matrix according to the heterogeneous graph; determining a probability value of vulnerability propagation from an upstream node to a downstream node based on the graph convolution network model according to the node feature matrix and the corresponding adjacency matrix; screening out node pairs with a probability value higher than a first preset threshold, and constructing an attack path graph according to the vulnerability source node list and the node pairs; calculating a probability cumulative value of vulnerability propagation from each target node as the upstream node to all the downstream nodes for each target node in the attack path graph, and screening out key nodes with a probability cumulative value higher than a second preset threshold; 5. The risk remediation method of an information system according to claim 1, wherein, determining the risk state graph of the information system according to the attack path graph and the key nodes. The method comprises: determining a target repair strategy corresponding to each single-point vulnerability based on a multi-objective optimization reward function according to the risk state graph and a preconfigured candidate repair strategy. defining a state space of the information system according to the risk state graph; obtaining pre-configured candidate repair strategies as an action space; for one single-point vulnerability, calculating a reward value of each action on the state space according to the multi-objective optimization reward function; ranking the reward values of each action, and screening an action with the highest reward value as the target repair strategy corresponding to the single-point vulnerability.

6. The risk remediation method of an information system according to claim 1, wherein, the risk repair of the information system based on a code generation tool according to each target repair strategy and the vulnerability source node list, to obtain a repaired system, including: for one target repair strategy, determining a vulnerability cause of the single-point vulnerability corresponding to the target repair strategy according to the vulnerability source node list; generating a plurality of candidate repair schemes for the vulnerability cause by calling the code generation tool according to the target repair strategy; performing static analysis and syntax checking on each candidate repair scheme to determine an optimal repair scheme; performing risk repair on the single-point vulnerability by using the optimal repair scheme; after the vulnerability source node list is completely repaired, the repaired system is obtained.

7. The risk remediation method of an information system according to claim 1, wherein, the function verification, performance verification and production verification of the repaired system, when the function verification, performance verification and production verification all pass, it is determined that the information system repair is successful, including: testing the function correctness of the repaired system in an isolated sandbox; deploying the repaired system to a shadow system to test the performance of the repaired system; deploying the repaired system to a small-scale production node to test the running state of the repaired system; monitoring each key indicator of the repaired system in the isolated sandbox, the shadow system and the small-scale production node in real time; when any key indicator exceeds the corresponding abnormal threshold, it is determined that the information system repair fails, and the repaired system is restored to the information system; when all the key indicators do not exceed the corresponding abnormal threshold, it is determined that the information system repair is successful.

8. A risk remediation apparatus for an information system, characterized by, the device includes: a single-point vulnerability identification unit configured to obtain underlying code, configuration parameters and running data of the information system, and identify single-point vulnerabilities based on a pre-trained vulnerability identification model according to the underlying code, the configuration parameters and the running data, to obtain a vulnerability source node list of the information system; a risk propagation analysis unit configured to construct the information system as a heterogeneous graph, and identify vulnerable propagation based on a graph convolution network model according to the heterogeneous graph and the vulnerability source node list, to obtain a risk state graph of the information system; a repair strategy screening unit configured to determine each target repair strategy corresponding to each single-point vulnerability based on a multi-objective optimization reward function according to the risk state graph and pre-configured candidate repair strategies; an information system repair unit configured to perform risk repair on the information system based on a code generation tool according to each target repair strategy and the vulnerability source node list, to obtain a repaired system. A repair system verification unit is configured to perform function verification, performance verification and production verification on the repair system, and when the function verification, the performance verification and the production verification are all passed, it is determined that the information system is successfully repaired.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, The computer program, when executed by a processor, implements the steps of the risk repair method of the information system according to any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, the computer program comprising instructions that, when executed by a computer, cause the computer to perform the method of any one of claims 1 to 9. The computer program, when executed by a processor, implements the steps of the risk repair method of the information system according to any one of claims 1 to 7.

Images