Vulnerability information checking method, device, equipment and system

Abstract

The invention provides a vulnerability information checking method, device, equipment and system. The method comprises the following steps: receiving a vulnerability checking request, wherein the vulnerability checking request is generated based on vulnerability intelligence information of an open source component acquired by a production side; according to information of a to-be-checked vulnerability in the vulnerability checking request, creating a checking task on a research and development side; and calling a software material security tool integrated on a research and development side to enable the software material security tool to retrieve a created software component dependency information base according to the troubleshooting task, and determining a code block influenced by the vulnerability to be troubleshot. Wherein an SBOM of a research and development state software project of a research and development side is stored in the software component dependency information base, and the SBOM is generated by calling the software material safety tool. Through the method, quick checking and positioning of vulnerability information are realized, and artificial missing report is avoided.

Description

Technical Field

[0001] This application relates to the field of software supply chain security technology, specifically to a vulnerability intelligence investigation method, a vulnerability intelligence investigation device, a vulnerability intelligence investigation system, a machine-readable storage medium, a computer device, and a computer program product. Background Technology

[0002] Software supply chains are typically complex and frequently updated. A key characteristic is the extensive use of open-source components. Due to their freedom, openness, complexity, and diversity, open-source components present a range of security challenges and risks, such as inherent defects and software risks that can propagate through the supply chain. On one hand, with the continuous introduction of new components, many organizations struggle to clearly understand the composition of their software. On the other hand, open-source components are usually integrated into business applications as software dependencies. In real production environments, not all application functions are triggered, making it difficult to determine whether a component is dependent based on runtime behavior. Both of these factors exacerbate the difficulty of identifying and locating vulnerabilities in open-source components. Currently, when open-source component vulnerability intelligence emerges, it is usually necessary to redevelop and test environments to trace the code project and confirm its impact. Faced with massive amounts of code, traditional methods, relying on manual verification or manual verification with the assistance of the software product's SBOM (Site-Based Management Object) documentation, cannot promptly identify, locate, and rectify vulnerability risks, and are prone to human error in underreporting. Summary of the Invention

[0003] The purpose of this application is to provide a vulnerability intelligence investigation method, a vulnerability intelligence investigation device, a vulnerability intelligence investigation system, a machine-readable storage medium, a computer device, and a computer program product, in order to overcome the shortcomings of the prior art, which relies on manual confirmation or manual confirmation with the assistance of the SBOM attached to the software product, making it impossible to timely investigate, locate, and rectify vulnerability risks, and making it easy for human error to cause missed reports.

[0004] To achieve the above objectives, the first aspect of this application provides a vulnerability intelligence investigation method, the method comprising: receiving a vulnerability investigation request, the vulnerability investigation request being generated based on vulnerability intelligence information of open-source components obtained from the production side; creating an investigation task on the development side according to the information of the vulnerability to be investigated in the vulnerability investigation request; and invoking a software material security tool integrated on the development side, so that the software material security tool retrieves a created software component dependency information library according to the investigation task and determines the code block affected by the vulnerability to be investigated; wherein the software component dependency information library stores the SBOM of the development-state software project on the development side, the SBOM being generated by invoking the software material security tool.

[0005] In this embodiment of the application, receiving a vulnerability investigation request includes: receiving a vulnerability investigation request generated and initiated by the production-side security operations platform under preset triggering conditions through data interaction in the isolation zone; wherein the vulnerability investigation request is generated based on vulnerability intelligence information of open-source components obtained by the security operations platform.

[0006] In this embodiment of the application, the preset triggering conditions include at least new vulnerability intelligence information obtained by the security operation platform, or a manually initiated vulnerability investigation request obtained through the interactive interface, or the arrival of a periodic vulnerability investigation sequence.

[0007] In this embodiment of the application, the step of creating a vulnerability investigation task on the R&D side based on the vulnerability information to be investigated in the vulnerability investigation request includes: responding to the vulnerability investigation request by initiating a vulnerability investigation task creation request, so that the security testing integrated management system on the R&D side can create an investigation task based on the vulnerability information to be investigated in the vulnerability investigation request.

[0008] In this embodiment of the application, the step of calling the software material security tool integrated on the R&D side, so that the software material security tool can retrieve the created software component dependency information database according to the investigation task and determine the code block affected by the vulnerability to be investigated, includes: calling the software material security tool integrated on the R&D side to execute the investigation task, so that the software material security tool uses the GAV information of the open source component described by the information of the vulnerability to be investigated as the main query condition, generates a query statement, executes the query statement, and retrieves the code block affected by the vulnerability to be investigated from the created software component dependency information database.

[0009] In this embodiment of the application, generating the SBOM by invoking the software material safety tool includes: invoking the software material safety tool to cause the software material safety tool to create a component composition detection task and perform at least one of the following operations based on the configured software material safety detection engine to complete the component composition detection task: The first mapping strategy is issued so that the component component detection plugin integrated in the software development tool on the R&D side can perform component analysis on the R&D software project contained in the software development tool to obtain the first analysis result. Based on the first mapping strategy, the first analysis result is mapped to the SBOM of the software project. A second mapping strategy is issued to enable the component component detection SDK integrated in the R&D pipeline to perform component analysis on the R&D software projects contained in the pipeline, obtain a second analysis result, and map the second analysis result to the SBOM of the software project based on the second mapping strategy. A third mapping strategy is issued so that the pre-set scanning module performs component analysis by scanning the code of the R&D software project contained in the code repository, and obtains the third analysis result. Based on the third mapping strategy, the third analysis result is mapped to the SBOM of the software project.

[0010] In this embodiment of the application, in response to the vulnerability investigation request, an investigation task creation request is initiated, so that the security testing integrated management system on the R&D side can create an investigation task based on the information of the vulnerability to be investigated in the vulnerability investigation request. This includes: in response to the vulnerability investigation request, initiating an investigation task creation request, so that the security testing integrated management system on the R&D side generates an interaction instruction. The interaction instruction is used to obtain the result of reconfiguring the severity level of the vulnerability to be investigated in the vulnerability investigation request and re-sorting the severity levels from high to low after reconfiguration. Multiple investigation tasks are then created based on the re-sorted information of the vulnerability to be investigated, wherein: If, among any two vulnerabilities to be investigated, the severity level of the first vulnerability after reconfiguration is higher than that of the second vulnerability after reconfiguration, then the investigation of the first vulnerability to be investigated shall precede the investigation of the second vulnerability to be investigated.

[0011] In this embodiment of the application, multiple investigation tasks are created based on the information of the reordered vulnerabilities to be investigated, including: determining whether the number of reordered vulnerabilities to be investigated is greater than a first threshold; if the number of reordered vulnerabilities to be investigated is greater than the first threshold, multiple timed investigation tasks are created based on the information of the reordered vulnerabilities to be investigated.

[0012] A second aspect of this application provides a vulnerability intelligence screening device, comprising: a first module for receiving a vulnerability screening request, the vulnerability screening request being generated based on vulnerability intelligence information of open-source components obtained from the production side; a second module for creating a screening task on the development side based on the information of the vulnerability to be screened in the vulnerability screening request; and a third module for invoking a software material security tool integrated on the development side, so that the software material security tool retrieves a created software component dependency information database based on the screening task and determines the code block affected by the vulnerability to be screened. The software component dependency information database stores the SBOM of the R&D-side software projects, which is generated by calling the software material safety tool.

[0013] A third aspect of this application provides a vulnerability intelligence screening system, the vulnerability intelligence screening system comprising: The security operations platform located on the production side is used to obtain vulnerability intelligence information of open source components, and to generate and initiate vulnerability investigation requests based on the vulnerability intelligence information when preset triggering conditions are met. The vulnerability intelligence investigation device described in the second aspect of this application is used to receive vulnerability investigation requests, create investigation tasks on the R&D side based on the information of the vulnerabilities to be investigated in the vulnerability investigation requests, and receive investigation results. The software material security tool integrated into the R&D side is used to generate the SBOM of the R&D-state software project, and to retrieve the created software component dependency information database according to the investigation task, determine the code block affected by the vulnerability to be investigated, generate the investigation result based on the information of the retrieved code block affected by the vulnerability to be investigated, and feed the investigation result back to the vulnerability intelligence investigation device. The software component dependency information repository is used to store the SBOM.

[0014] In this embodiment of the application, the vulnerability intelligence investigation system further includes a security testing integrated management system located on the R&D side. The vulnerability intelligence investigation device is also used to initiate an investigation task creation request and create an investigation task through the security testing integrated management system. The security testing integrated management system is used to create an investigation task based on the information of the vulnerability to be investigated in the vulnerability investigation request after receiving the investigation task creation request, and to initiate a request to call the software material security tool, so as to trigger the software material security tool to retrieve the created software component dependency information database according to the investigation task and determine the code block affected by the vulnerability to be investigated.

[0015] In this embodiment of the application, the vulnerability intelligence investigation device receives the vulnerability investigation request transmitted by the work order through isolated zone data interaction.

[0016] In this embodiment, the software material safety tool includes an SBOM generation module. The SBOM generation module is used to create a component composition detection task and perform at least one of the following operations based on a configured software material safety detection engine to complete the component composition detection task: The first mapping strategy is issued so that the component component detection plugin integrated in the software development tool on the R&D side can perform component analysis on the R&D software project contained in the software development tool to obtain the first analysis result. Based on the first mapping strategy, the first analysis result is mapped to the SBOM of the software project. A second mapping strategy is issued to enable the component component detection SDK integrated in the R&D pipeline to perform component analysis on the R&D software projects contained in the pipeline, obtain a second analysis result, and map the second analysis result to the SBOM of the software project based on the second mapping strategy. A third mapping strategy is issued so that the pre-set scanning module performs component analysis by scanning the code of the R&D software project contained in the code repository, and obtains the third analysis result. Based on the third mapping strategy, the third analysis result is mapped to the SBOM of the software project.

[0017] In this embodiment of the application, the software material security tool includes an investigation module. The investigation module is used to generate a query statement by taking the GAV information of the open-source component described by the vulnerability to be investigated as the main query condition, and executing the query statement to retrieve the code block affected by the vulnerability to be investigated from the created software component dependency information database.

[0018] In this embodiment, the software material security tool includes a screening result generation module. The screening result generation module is used to generate screening results based on the retrieved information of code blocks affected by the vulnerability to be screened, and feed the screening results back to the vulnerability intelligence screening device through the security testing integrated management system. The vulnerability intelligence screening device is also used to transmit the screening results to the security operation platform through isolated zone data interaction. The security operation platform is also used to fill the screening results into the work order.

[0019] A fourth aspect of this application provides a computer device including a memory and a processor, the memory being configured to store instructions, and the processor being configured to retrieve the instructions from the memory. The instructions enable the vulnerability intelligence screening method according to the first aspect of this application to be implemented when the instructions are executed.

[0020] The fifth aspect of this application provides a machine-readable storage medium storing instructions, characterized in that, when executed by a processor, the instructions cause the processor to be configured to perform the vulnerability intelligence screening method according to the first aspect of this application.

[0021] The sixth aspect of this application provides a computer program product, including a computer program, characterized in that the computer program, when executed by a processor, implements the vulnerability intelligence screening method according to the first aspect of this application.

[0022] In the above technical solution, based on the construction of a software component dependency information database and software material security tools, vulnerability intelligence information is transmitted through vulnerability intelligence requests. This breaks down the information barriers between the production and R&D sides, overcoming the problem of excessively long vulnerability intelligence transmission times. Then, vulnerability intelligence screening is directly performed on the R&D side using software material security tools. That is, the vulnerability to be screened is screened using the software component dependency information database that has accumulated software materials and their dependencies, rather than developing and testing the test environment for vulnerability intelligence screening during the runtime phase. This improves the efficiency of open source component vulnerability intelligence screening, achieves accurate code-level positioning, and avoids human error in missing reports.

[0023] Other features and advantages of the embodiments of this application will be described in detail in the following detailed description section. Attached Figure Description

[0024] The accompanying drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the following detailed description to explain the embodiments of this application, but do not constitute a limitation on the embodiments of this application. In the drawings: Figure 1 This illustration schematically shows an application environment diagram of the vulnerability intelligence screening method according to an embodiment of this application; Figure 2 The schematic diagram illustrates a flowchart of a vulnerability intelligence investigation method according to an embodiment of this application; Figure 3 This illustration schematically shows the principle of generating a SBOM using a software material safety tool according to an embodiment of this application; Figure 4 This schematic diagram illustrates the internal structure of a computer device according to an embodiment of the present application; Figure 5 The diagram illustrates the structure of a vulnerability intelligence investigation system according to an embodiment of this application. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only for illustration and explanation of the embodiments of this application and are not intended to limit the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0026] It should be noted that if the embodiments of this application involve directional indicators (such as up, down, left, right, front, back, etc.), the directional indicators are only used to explain the relative positional relationship and movement of each component in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indicators will also change accordingly.

[0027] Furthermore, if the embodiments of this application involve descriptions such as "first" or "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, features defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, the technical solutions of various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed in this application.

[0028] The acquisition, transmission, storage, use, and processing of data in this application comply with relevant laws and regulations. Furthermore, it should be noted that certain software, components, models, and other existing industry solutions may be mentioned in the embodiments of this application. These should be considered exemplary, intended only to illustrate the feasibility of implementing the technical solution of this application, and do not imply that the applicant has already used or necessarily used such solutions.

[0029] The technical terms used in the specific embodiments are explained as follows.

[0030] SBOM: Software Bill of Materials. A Software Bill of Materials is a formal, machine-readable metadata record that is a standardized record containing details of multiple software building components and their supply chain relationships. It lists information about software components, related components, and their supply chain relationships, providing software developers, buyers, and operators with information about all the "raw materials" used in the software development process and their upstream and downstream supply chain dependencies. The three standard formats for SBOM are SPDX, CycloneDX, and SWID.

[0031] Production side: refers to the production environment. The production environment includes the operating environment and the maintenance environment.

[0032] Development side: refers to the development and testing environment. The term "development and testing environment" is a collective term for both the development and testing environments.

[0033] Software projects in the development and testing phases refer to all software projects in the development and testing phases.

[0034] Software dependency: One or more other software components, libraries, frameworks, or tools that a software project depends on during its construction, operation, or testing.

[0035] The vulnerability intelligence investigation method provided in this application can be applied to, for example... Figure 1 In the application environment shown, terminal 102 communicates with server 104 via a network. Terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, and portable wearable devices, and server 104 can be a standalone server or a server cluster consisting of multiple servers.

[0036] The vulnerability intelligence investigation method provided in this application achieves the investigation of vulnerability intelligence of open source components through the following technical approach: receiving a vulnerability investigation request, wherein the vulnerability investigation request is generated based on vulnerability intelligence information of open source components obtained from the production side; creating an investigation task on the development side according to the information of the vulnerability to be investigated in the vulnerability investigation request; and calling a software material security tool integrated on the development side, so that the software material security tool retrieves the created software component dependency information library according to the investigation task, and determines the code block affected by the vulnerability to be investigated, wherein the software component dependency information library stores the SBOM of the development-state software project on the development side, and the SBOM is generated by calling the software material security tool.

[0037] It is important to understand that the code blocks affected by the vulnerabilities to be investigated mentioned above can be code projects within the physical subsystem, or code branches, etc.

[0038] This application constructs a software component dependency information database to accumulate software materials and their dependencies, and builds a software material security tool for task execution and SBOM generation. Based on the software component dependency information database and the software material security tool, the production side first obtains vulnerability intelligence information of open-source components, then initiates a vulnerability investigation request based on this information, and creates an investigation task on the development side. The software material security tool is then used to search the software component dependency information database to identify the code blocks on the development side affected by the vulnerabilities to be investigated. On one hand, by carrying the vulnerability information obtained from the production side through the vulnerability investigation request, the information barrier between the production and development sides is broken down, and vulnerability intelligence investigation is directly performed on the development side, rather than investigating code blocks in a redevelopment testing environment during the runtime phase. On the other hand, the software component dependency information database, which accumulates software materials and their dependencies, is used to investigate the vulnerabilities to be investigated. Combining the two aspects mentioned above improves the efficiency of identifying vulnerability intelligence in open-source components. The identification results pinpoint the specific organization, physical subsystem, code project, and code branch of the component affected by the identified vulnerability, achieving precise code-level localization. Simultaneously, it avoids human error in missing detections.

[0039] Based on the above technical approach, such as Figure 2 As shown, in one embodiment of this application, a vulnerability intelligence investigation method is provided. This embodiment mainly applies this method to the above-mentioned... Figure 1 Taking terminal 102 as an example, the process includes the following steps 202 to 208. Step 202: Integrate software material safety tools on the R&D side.

[0040] Software Material Safety (SBOM) tools are used to perform tasks such as identifying potential vulnerabilities in software projects and generating SBOM files. They communicate with a software component dependency information repository (SDI), utilize this repository for SBOM file storage, and retrieve data from the SDI by creating queries.

[0041] In some embodiments, the software material safety tool can run on a server on the R&D side, serving as a software material management platform built on SBOM, responsible for the standardized management of software components, system safety status, etc. in the supply chain.

[0042] Step 204: Receive a vulnerability investigation request, which is generated based on vulnerability intelligence information of open-source components obtained from the production side.

[0043] In some embodiments, a security operations platform is integrated on the production side. The security operations platform refers to a system used to manage and coordinate the activities of the security operations center, integrating functions such as vulnerability intelligence, monitoring, incident response, and compliance management. The security operations platform can run on a server on the production side. Specifically, relying on the security operations platform, step 204 includes the following steps: Step a1: Receive vulnerability investigation requests generated and initiated by the production-side security operations platform under preset triggering conditions through data interaction in the isolation zone. The vulnerability investigation requests are generated based on vulnerability intelligence information, which is vulnerability intelligence information of open-source components obtained by the security operations platform.

[0044] The development and testing environment is isolated from the production environment. This isolation includes, but is not limited to, physical storage addresses of data, task execution clusters, and data job scripts. Therefore, vulnerability investigation requests initiated by the security operations platform on the production side are received through data interaction in the isolated area.

[0045] As an example, the preset trigger condition could be: new vulnerability intelligence information obtained by the security operations platform.

[0046] As another example, the preset trigger condition could be a vulnerability investigation request initiated manually through the interactive interface. Specifically, this could be initiated by vulnerability intelligence management personnel, organizational leaders, or project leaders.

[0047] As another example, the preset trigger condition could be the arrival of a periodic vulnerability screening sequence.

[0048] In some embodiments, the vulnerability investigation request can be initiated from the development side. Specifically, step 204 includes the following steps: Step b1: Receive vulnerability intelligence information of open-source components sent by the security operations platform on the production side through data interaction in the isolation zone; Step b2: If the target triggering conditions are met, initiate a vulnerability investigation request based on the vulnerability intelligence information.

[0049] As an example, the target triggering condition could be: the obtained vulnerability intelligence information includes new vulnerability intelligence of open source components.

[0050] As another example, the target triggering condition could be a vulnerability investigation request initiated manually through an interactive interface. Specifically, this could be initiated by vulnerability intelligence management personnel, organizational leaders, or project leaders.

[0051] As another example, the target triggering condition could be the arrival of a periodic vulnerability screening sequence.

[0052] In some embodiments, when a vulnerability investigation request is initiated by the production side, the vulnerability investigation request is transmitted through a work order, that is, it flows between the security operations platform and the R&D side in the form of a work order.

[0053] Step 206: Based on the information of the vulnerability to be investigated in the vulnerability investigation request, create an investigation task on the R&D side.

[0054] In some embodiments, a comprehensive security testing management system is integrated on the R&D side. The comprehensive security testing management system refers to a system used to manage and coordinate security activities in the R&D phase. It can be a system that integrates various types of security testing functions, such as static monitoring, dynamic monitoring, and mobile terminal testing, along with supporting management functions. The comprehensive security testing management system can run on front-end terminal devices. Specifically, relying on the comprehensive security testing management system, step 206 includes the following steps: Step c1: In response to the vulnerability investigation request, initiate an investigation task creation request so that the security testing integrated management system on the R&D side can create an investigation task based on the information of the vulnerability to be investigated in the vulnerability investigation request.

[0055] Specifically, the task management module in the security testing integrated management system is used to create investigation tasks. When a vulnerability investigation request is transmitted via a work order, the work order records information such as the vulnerability name, vulnerability number, and work order number. The task management module creates investigation tasks based on this information.

[0056] In some embodiments, step c1 includes: responding to a vulnerability investigation request, initiating an investigation task creation request, so that the security testing integrated management system on the R&D side generates an interaction instruction. The interaction instruction is used to obtain the result of reconfiguring the severity level of the vulnerabilities to be investigated in the vulnerability investigation request and reordering the severity levels from high to low after reconfiguration. Multiple investigation tasks are then created based on the reordered information of the vulnerabilities to be investigated. Wherein: if the severity level of the first vulnerability to be investigated after reconfiguration is higher than that of the second vulnerability to be investigated after reconfiguration, then the investigation of the first vulnerability to be investigated precedes the investigation of the second vulnerability to be investigated.

[0057] For example, after receiving the interactive instructions through the interactive interface provided by the security testing integrated management system, project personnel can reconfigure the severity level of the vulnerabilities to be investigated in the vulnerability investigation request and reorder the severity levels from high to low.

[0058] By reconfiguring and reordering the severity levels, multiple investigation tasks are created, and each investigation task is executed in descending order of severity level of the vulnerabilities to be investigated contained in the investigation task. This allows for differentiation of the severity level of the same vulnerabilities to be investigated based on the differences in development and testing environments, and prioritizes the investigation of vulnerabilities with higher severity levels, thereby improving the timeliness of their remediation and repair and reducing the impact of high-severity vulnerabilities on the software supply chain.

[0059] Furthermore, the specific steps for creating multiple investigation tasks based on the reordered information of the vulnerabilities to be investigated include: Step d1: Determine whether the number of vulnerabilities to be investigated after reordering is greater than the first threshold. Step d2: If the number of vulnerabilities to be investigated after reordering is greater than the first threshold, create multiple timed investigation tasks based on the information of the vulnerabilities to be investigated after reordering.

[0060] It is important to understand that if the number of vulnerabilities to be investigated after reordering is less than or equal to the first threshold, multiple scheduled or non-scheduled investigation tasks are created based on the information of the vulnerabilities to be investigated after reordering.

[0061] When there are a large number of vulnerabilities to be investigated, the efficiency of vulnerability investigation can be improved by creating scheduled investigation tasks.

[0062] Step 208: Invoke the Software Material Safety Tool to retrieve the created Software Component Dependency Information Database based on the investigation task and identify the code blocks affected by the vulnerability to be investigated. The Software Component Dependency Information Database stores the SBOM files of the development-stage software projects on the R&D side, and the SBOM files are generated by invoking the Software Material Safety Tool.

[0063] In this application, the code block affected by the vulnerability to be investigated may be a code project or specific code branch under the physical subsystem of one or more organizations.

[0064] In some embodiments, the SBOM file adopts the SPDX format. After the SPDX format SBOM file reflecting software components and dependency information is converted into a machine-readable format, it is centrally stored in the software component dependency information library. Preferably, the SPDX format used has a certain degree of extensibility and can meet different SBOM generation requirements through configuration.

[0065] In some embodiments, the security testing integrated management system calls the software material security tool to perform an investigation task. The software material security tool uses the GAV information of the open-source component described by the vulnerability to be investigated as the main query condition to generate a query statement and executes the query statement to retrieve the code block affected by the vulnerability to be investigated from the created software component dependency information database.

[0066] The GAV information for open-source components includes Group ID, Artifact ID, Version, and Packaging.

[0067] For example, the main table fields provided by the investigation task include, but are not limited to: the name of the vulnerability to be investigated, the description of the vulnerability to be investigated, the person who assessed the vulnerability to be investigated, the vulnerability number of the vulnerability to be investigated, the severity level of the vulnerability to be investigated, the disclosure time of the vulnerability to be investigated, whether the vulnerability to be investigated is a 0-day vulnerability, whether the vulnerability to be investigated is a PoC, the mitigation measures, the security version, the creation time, the tracker, the update time, whether the vulnerability exists in the knowledge base, the review date, the start date of analysis, the component tag, and the work order number. The severity level can be set to six levels: 1 for extremely high risk, 2 for high risk, 3 for medium risk, 4 for low risk, 5 for unknown risk, and 6 for no vulnerability. If the vulnerability exists in the knowledge base, it is represented as 1; if it does not exist in the knowledge base, it is represented as 2. The component tag type includes 1 for vulnerability type components and 2 for malicious component types.

[0068] Based on the above example, the main fields recorded in the investigation results include, but are not limited to: intelligence ID, creation date, number of code projects, code project, code branch affected by the intelligence, name of the physical subsystem affected by the intelligence, ID of the physical subsystem affected by the intelligence, name of the component affected by the intelligence, ID of the component affected by the intelligence, investigation channel type, investigation result, and vulnerability analysis. The investigation channel type can be one or more of IDE, pipeline, platform, and artifact. The investigation result type includes 1 indicating the existence of affected code blocks and 2 indicating the absence of affected code blocks.

[0069] In some embodiments, the specific steps for generating an SBOM file by invoking a software material safety tool include: Step e1: Invoke the software material safety tool to create a component composition detection task and perform at least one of the following operations based on the configured software material safety detection engine to complete the component composition detection task: The first mapping strategy is issued so that the component component detection plugin integrated in the software development tool on the R&D side can perform component analysis on the R&D software project contained in the software development tool, obtain the first analysis result, and map the first analysis result to the SBOM of the software project based on the first mapping strategy. A second mapping strategy is issued to enable the component component detection SDK integrated in the R&D pipeline to perform component analysis on the R&D software projects contained in the pipeline, obtain a second analysis result, and map the second analysis result to the SBOM of the software project based on the second mapping strategy. A third mapping strategy is issued so that the pre-set scanning module performs component analysis by scanning the code of the R&D software project contained in the code repository, obtains the third analysis result, and maps the third analysis result to the SBOM of the software project based on the third mapping strategy.

[0070] It is important to understand that the first, second, and third mapping strategies can be the same or different. The first, second, and third mapping strategies all refer to the mapping strategies that map the component analysis results to an SBOM (Structured Basic Analysis Object). That is, after obtaining the component analysis results, how to fill the corresponding fields in the SBOM structure with the data from the component analysis results based on the SBOM structure specified in the mapping strategy.

[0071] As an example, software development tools can include IDE (Integrated Development Environment) software.

[0072] In some embodiments, the specific steps for generating an SBOM file by invoking a software material safety tool include: Step f1 involves invoking the Software Material Safety (SMS) tool to create a component composition detection task and execute it based on the configured SMS detection engine. This task detects the components and dependencies within the development-stage software project in the target channel, generating the SBOM file for the software project as described above. The target channel includes at least one of the following: software development tools, pipelines, and code repositories.

[0073] Specifically, the action of calling the software material safety tool to generate a SBOM can be triggered either actively or passively. Active triggering can be due to the arrival of a periodic SBOM generation schedule. Passive triggering can be due to a manually initiated SBOM generation request obtained through the interactive interface.

[0074] Preferably, such as Figure 3 As shown, the software material safety detection engine executes the first, second, and third mapping strategies to enable the component component detection plugin integrated in the software development tool on the R&D side to perform component analysis on the R&D software projects contained in the software development tool, obtain a first analysis result, and map the first analysis result to the first sub-SBOM of the software product based on the first mapping strategy. Additionally, the component component detection SDK integrated in the pipeline on the R&D side performs component analysis on the R&D software projects contained in the pipeline, obtains a second analysis result, and maps the second analysis result to the second sub-SBOM of the software product based on the second mapping strategy. Furthermore, the pre-set scanning module performs component analysis by scanning the code of the R&D software projects contained in the code repository, obtains a third analysis result, and maps the third analysis result to the third sub-SBOM of the software product based on the third mapping strategy. The first, second, and third sub-SBOMs constitute the SBOM file of the software product.

[0075] In the preferred embodiments described above, by comprehensively considering other components, libraries, frameworks, or tools that the software project depends on in software development tools, pipelines, and code repositories, a comprehensive SBOM file is obtained, thereby improving the accuracy of vulnerability intelligence investigation results.

[0076] Figure 2 This is a flowchart illustrating a vulnerability intelligence screening method in one embodiment. It should be understood that, although... Figure 2 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figure 2 At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0077] Based on the vulnerability intelligence investigation method provided in the above embodiments, this application provides a vulnerability intelligence investigation device, including: a first module for receiving a vulnerability investigation request, wherein the vulnerability investigation request is generated based on vulnerability intelligence information of open-source components obtained from the production side; a second module for creating an investigation task on the development side according to the information of the vulnerability to be investigated in the vulnerability investigation request; and a third module for calling a software material security tool integrated on the development side, so that the software material security tool retrieves a created software component dependency information library according to the investigation task and determines the code block affected by the vulnerability to be investigated. The software component dependency information library stores the SBOM of the development-state software project on the development side, and the SBOM is generated by calling the software material security tool.

[0078] As one embodiment of this application, the vulnerability intelligence screening device can achieve the following: Figure 2 The embodiments shown and other related method embodiments in this application. The process by which each module in the vulnerability intelligence screening device provided in this application implements its respective function can be specifically referred to the foregoing. Figure 2 The descriptions of the embodiments shown and other related method embodiments are not repeated here.

[0079] It should be noted that the information interaction and execution process between the above modules are based on the same concept as the method embodiments of this application. For details on their specific functions and technical effects, please refer to the method embodiments section, which will not be repeated here.

[0080] This application provides a machine-readable storage medium storing a program that, when executed by a processor, implements the aforementioned vulnerability intelligence investigation method.

[0081] This application provides a processor for running a program, wherein the program executes the aforementioned vulnerability intelligence investigation method during runtime.

[0082] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 4As shown in the figure, the computer device includes a processor A01, a network interface A02, a display screen A04, an input device A05, and a memory (not shown) connected via a system bus. The processor A01 provides computing and control capabilities. The memory includes internal memory A03 and a non-volatile storage medium A06. The non-volatile storage medium A06 stores an operating system B01 and a computer program B02. The internal memory A03 provides an environment for the operation of the operating system B01 and the computer program B02 stored in the non-volatile storage medium A06. The network interface A02 is used for communication with external terminals via a network connection. When the computer program is executed by the processor A01, it implements a vulnerability intelligence investigation method. The display screen A04 can be an LCD screen or an e-ink display screen. The input device A05 can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the computer device casing, or an external keyboard, touchpad, or mouse.

[0083] Those skilled in the art will understand that Figure 4 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0084] In one embodiment, the vulnerability intelligence detection device provided in this application can be implemented as a computer program, and the computer program can be implemented in the form of, for example, Figure 4 The device operates on the computer shown. The computer device's memory can store various program modules that make up the vulnerability intelligence detection apparatus. The computer program, composed of the various program modules, causes the processor to execute the steps in the vulnerability intelligence detection methods of the various embodiments of this application described in this specification.

[0085] This application provides a vulnerability intelligence investigation system, which includes: The security operations platform located on the production side is used to obtain vulnerability intelligence information of open source components, and to generate and initiate vulnerability investigation requests based on the vulnerability intelligence information when preset triggering conditions are met. The vulnerability intelligence investigation device described above is used to receive vulnerability investigation requests, create investigation tasks on the R&D side based on the information of the vulnerabilities to be investigated in the vulnerability investigation request, and receive investigation results. The software material security tool integrated into the R&D side is used to generate the SBOM of the R&D-state software project, and to retrieve the created software component dependency information database according to the investigation task, determine the code block affected by the vulnerability to be investigated, generate the investigation result based on the information of the retrieved code block affected by the vulnerability to be investigated, and feed the investigation result back to the vulnerability intelligence investigation device. The software component dependency information repository is used to store the SBOM.

[0086] In some embodiments, the vulnerability intelligence investigation system further includes a security testing integrated management system located on the R&D side. The vulnerability intelligence investigation device is also used to initiate an investigation task creation request and create an investigation task through the security testing integrated management system. The security testing integrated management system is used to create an investigation task based on the information of the vulnerability to be investigated in the vulnerability investigation request after receiving the investigation task creation request, and to initiate a request to call the software material security tool, so as to trigger the software material security tool to retrieve the created software component dependency information database according to the investigation task and determine the code block affected by the vulnerability to be investigated.

[0087] In some embodiments, the vulnerability intelligence investigation device receives the vulnerability investigation request transmitted by the work order through isolated zone data interaction.

[0088] In some embodiments, the software material safety tool includes an SBOM generation module, wherein: The SBOM generation module is used to create a component composition detection task and perform at least one of the following operations based on the configured software material safety detection engine to complete the component composition detection task: The first mapping strategy is issued so that the component component detection plugin integrated in the software development tool on the R&D side can perform component analysis on the R&D software project contained in the software development tool to obtain the first analysis result. Based on the first mapping strategy, the first analysis result is mapped to the SBOM of the software project. A second mapping strategy is issued to enable the component component detection SDK integrated in the R&D pipeline to perform component analysis on the R&D software projects it contains, obtain a second analysis result, and map the second analysis result to the SBOM of the software project based on the second mapping strategy. A third mapping strategy is issued so that the pre-set scanning module performs component analysis by scanning the code of the R&D software project contained in the code repository, and obtains the third analysis result. Based on the third mapping strategy, the third analysis result is mapped to the SBOM of the software project.

[0089] In some embodiments, the software material security tool includes a screening module. This screening module is used to generate a query statement by using the GAV information of the open-source component described by the vulnerability to be screened as the main query condition, and then executing the query statement to retrieve the code blocks affected by the vulnerability from an existing software component dependency information database.

[0090] In some embodiments, the software material safety tool includes a screening result generation module. The investigation result generation module is used to generate investigation results based on the information of the code blocks affected by the vulnerability to be investigated, and to feed the investigation results back to the vulnerability intelligence investigation device through the security testing integrated management system.

[0091] In some embodiments, the vulnerability intelligence investigation device is further configured to transmit the investigation results to the security operation platform through data interaction in the isolation zone, and the security operation platform is further configured to fill the investigation results into the work order.

[0092] In some embodiments, the comprehensive security testing management system includes an interactive instruction generation module and an investigation task creation module.

[0093] The interaction instruction generation module generates interaction instructions to obtain the results of reconfiguring the severity level of the vulnerabilities to be investigated in the vulnerability investigation request and reordering them from high to low severity levels. The investigation task creation module creates multiple investigation tasks based on the reordered information of the vulnerabilities to be investigated, wherein: for any two vulnerabilities to be investigated, if the severity level of the first vulnerabilities after reconfiguration is higher than that of the second vulnerabilities after reconfiguration, then the investigation of the first vulnerabilities takes precedence over the investigation of the second vulnerabilities.

[0094] In some embodiments, the task creation module includes a judgment module and a scheduled task generation module. Specifically: the judgment module determines whether the number of reordered vulnerabilities to be investigated exceeds a first threshold; the scheduled task generation module creates multiple scheduled investigation tasks based on the information of the reordered vulnerabilities if the number exceeds the first threshold, and creates multiple non-scheduled or scheduled investigation tasks based on the information of the reordered vulnerabilities if the number is less than or equal to the first threshold.

[0095] like Figure 5The diagram illustrates the components of a vulnerability intelligence investigation system. The security operations platform includes a work order management module and an intelligence management module. The work order management module generates and initiates vulnerability investigation requests via work orders based on the vulnerability intelligence information when preset triggering conditions are met. The intelligence management module acquires vulnerability intelligence information from open-source components. Component analysis and detection access channels include IDEA, pipelines, and code repositories.

[0096] This application also provides a computer program product that, when executed on a data processing device, is suitable for executing a program that initializes the above-described vulnerability intelligence investigation method steps.

[0097] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0098] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0099] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0100] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0101] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0102] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, like read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0103] Computer-readable media include both permanent and non-permanent, removable and non-removable media, which can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0104] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0105] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A vulnerability intelligence investigation method, characterized in that, The vulnerability intelligence investigation methods include: Receive vulnerability investigation requests, which are generated based on vulnerability intelligence information of open-source components obtained from the production side; Based on the information of the vulnerabilities to be investigated in the vulnerability investigation request, an investigation task is created on the R&D side; The software material security tool integrated on the R&D side is invoked so that the software material security tool can retrieve the created software component dependency information database according to the investigation task and determine the code block affected by the vulnerability to be investigated. The software component dependency information database stores the SBOM of the R&D-side software projects, which is generated by calling the software material safety tool.

2. The vulnerability intelligence investigation method according to claim 1, characterized in that, The receiving of vulnerability investigation requests includes: The system receives vulnerability investigation requests generated and initiated by the production-side security operations platform under preset trigger conditions through data interaction in the isolation zone. The vulnerability investigation request is generated based on vulnerability intelligence information of open-source components obtained by the security operations platform.

3. The vulnerability intelligence investigation method according to claim 2, characterized in that, The preset triggering conditions include at least new vulnerability intelligence information obtained by the security operation platform, or a vulnerability investigation request initiated manually through the interactive interface, or the arrival of a periodic vulnerability investigation sequence.

4. The vulnerability intelligence investigation method according to claim 1, characterized in that, The step of creating a vulnerability investigation task on the development side based on the vulnerability information in the vulnerability investigation request includes: In response to the vulnerability investigation request, an investigation task creation request is initiated so that the security testing integrated management system on the R&D side can create an investigation task based on the information of the vulnerability to be investigated in the vulnerability investigation request.

5. The vulnerability intelligence investigation method according to claim 1, characterized in that, The invocation of the software material security tool integrated on the R&D side enables the tool to retrieve a created software component dependency information database based on the investigation task, and determine the code blocks affected by the vulnerability to be investigated, including: The software material security tool integrated on the R&D side is invoked to perform the investigation task, so that the software material security tool uses the GAV information of the open source component described by the vulnerability to be investigated as the main query condition, generates a query statement, executes the query statement, and retrieves the code block affected by the vulnerability to be investigated from the created software component dependency information database.

6. The vulnerability intelligence investigation method according to claim 1, characterized in that, The SBOM is generated by invoking the software material safety tool, including: The software material safety tool is invoked to create a component composition detection task and, based on the configured software material safety detection engine, perform at least one of the following operations to complete the component composition detection task: The first mapping strategy is issued so that the component component detection plugin integrated in the software development tool on the R&D side can perform component analysis on the R&D software project contained in the software development tool to obtain the first analysis result. Based on the first mapping strategy, the first analysis result is mapped to the SBOM of the software project. A second mapping strategy is issued to enable the component component detection SDK integrated in the R&D pipeline to perform component analysis on the R&D software projects contained in the pipeline, obtain a second analysis result, and map the second analysis result to the SBOM of the software project based on the second mapping strategy. A third mapping strategy is issued so that the pre-set scanning module performs component analysis by scanning the code of the R&D software project contained in the code repository, and obtains the third analysis result. Based on the third mapping strategy, the third analysis result is mapped to the SBOM of the software project.

7. The vulnerability intelligence investigation method according to claim 4, characterized in that, In response to the vulnerability investigation request, an investigation task creation request is initiated, so that the security testing integrated management system on the R&D side can create an investigation task based on the information of the vulnerability to be investigated in the vulnerability investigation request, including: In response to the vulnerability investigation request, an investigation task creation request is initiated, causing the security testing integrated management system on the R&D side to generate interactive instructions. These instructions are used to obtain a reconfiguration of the severity level of the vulnerabilities to be investigated in the vulnerability investigation request, and to execute a reordering of the severity levels from high to low after reconfiguration. Multiple investigation tasks are then created based on the reordered vulnerability information, wherein: If, among any two vulnerabilities to be investigated, the severity level of the first vulnerability after reconfiguration is higher than that of the second vulnerability after reconfiguration, then the investigation of the first vulnerability to be investigated shall precede the investigation of the second vulnerability to be investigated.

8. The vulnerability intelligence investigation method according to claim 7, characterized in that, Multiple investigation tasks are created based on the reordered information of the vulnerabilities to be investigated, including: Determine whether the number of vulnerabilities to be investigated after reordering is greater than the first threshold; If the number of vulnerabilities to be investigated after reordering exceeds the first threshold, multiple timed investigation tasks are created based on the information of the vulnerabilities to be investigated after reordering.

9. A vulnerability intelligence screening device, characterized in that, The vulnerability intelligence screening device includes: The first module is used to receive vulnerability investigation requests, which are generated based on vulnerability intelligence information of open source components obtained from the production side. The second module is used to create a vulnerability investigation task on the R&D side based on the information of the vulnerability to be investigated in the vulnerability investigation request. The third module is used to call the software material security tool integrated on the R&D side, so that the software material security tool can retrieve the created software component dependency information database according to the investigation task and determine the code block affected by the vulnerability to be investigated. The software component dependency information database stores the SBOM of the R&D-side software projects, which is generated by calling the software material safety tool.

10. A vulnerability intelligence investigation system, characterized in that, The vulnerability intelligence investigation system includes: The security operations platform located on the production side is used to obtain vulnerability intelligence information of open source components, and to generate and initiate vulnerability investigation requests based on the vulnerability intelligence information when preset triggering conditions are met. The vulnerability intelligence investigation device according to claim 9 is used to receive a vulnerability investigation request, create an investigation task on the R&D side according to the information of the vulnerability to be investigated in the vulnerability investigation request, and receive the investigation results. The software material security tool integrated into the R&D side is used to generate the SBOM of the R&D-state software project, and to retrieve the created software component dependency information database according to the investigation task, determine the code block affected by the vulnerability to be investigated, generate the investigation result based on the information of the retrieved code block affected by the vulnerability to be investigated, and feed the investigation result back to the vulnerability intelligence investigation device. The software component dependency information repository is used to store the SBOM.

11. The vulnerability intelligence investigation system according to claim 10, characterized in that, The vulnerability intelligence investigation system also includes a security testing integrated management system located on the R&D side. The vulnerability intelligence investigation device is also used to initiate an investigation task creation request and create an investigation task through the security testing integrated management system. The security testing integrated management system is used to create an investigation task based on the information of the vulnerability to be investigated in the vulnerability investigation request after receiving the investigation task creation request, and to initiate a request to call the software material security tool, so as to trigger the software material security tool to retrieve the created software component dependency information database according to the investigation task and determine the code block affected by the vulnerability to be investigated.

12. The vulnerability intelligence investigation system according to claim 10, characterized in that, The vulnerability intelligence investigation device receives the vulnerability investigation request transmitted by the work order through data interaction in the isolation zone.

13. The vulnerability intelligence investigation system according to claim 10, characterized in that, The software material safety tool includes an SBOM generation module, wherein: The SBOM generation module is used to create a component composition detection task and perform at least one of the following operations based on the configured software material safety detection engine to complete the component composition detection task: The first mapping strategy is issued so that the component component detection plugin integrated in the software development tool on the R&D side can perform component analysis on the R&D software project contained in the software development tool to obtain the first analysis result. Based on the first mapping strategy, the first analysis result is mapped to the SBOM of the software project. A second mapping strategy is issued to enable the component component detection SDK integrated in the R&D pipeline to perform component analysis on the R&D software projects contained in the pipeline, obtain a second analysis result, and map the second analysis result to the SBOM of the software project based on the second mapping strategy. A third mapping strategy is issued so that the pre-set scanning module performs component analysis by scanning the code of the R&D software project contained in the code repository, and obtains the third analysis result. Based on the third mapping strategy, the third analysis result is mapped to the SBOM of the software project.

14. The vulnerability intelligence investigation system according to claim 10, characterized in that, The software material safety tool includes a screening module, wherein: The investigation module is used to take the GAV information of the open-source component described by the vulnerability to be investigated as the main query condition, generate a query statement, and execute the query statement to retrieve the code block affected by the vulnerability to be investigated from the created software component dependency information database.

15. The vulnerability intelligence investigation system according to claim 12, characterized in that, The software material security tool includes a vulnerability detection result generation module. This module generates detection results based on information about the code blocks affected by the vulnerability to be detected, and feeds the detection results back to the vulnerability intelligence detection device via the security testing integrated management system. The vulnerability intelligence detection device also transmits the detection results to the security operation platform through isolated zone data interaction. The security operation platform further fills the detection results into the work order.

16. A computer device, characterized in that, include: The memory is configured to store instructions; as well as A processor is configured to retrieve the instructions from the memory and, when executing the instructions, to implement the vulnerability intelligence screening method according to any one of claims 1 to 8.

17. A machine-readable storage medium storing instructions thereon, characterized in that, When executed by a processor, this instruction causes the processor to be configured to perform the vulnerability intelligence screening method according to any one of claims 1 to 8.

18. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the vulnerability intelligence screening method according to any one of claims 1 to 8.

Images