Software security management platform

Abstract

The invention belongs to the technical field of software engineering, and particularly relates to a software security management platform which comprises an asset management agent, a threat retrieval agent and a threat analysis agent which are constructed based on a large model. The threat retrieval agent is used for capturing latest threat intelligence and vulnerability intelligence and generating a security risk list according to the threat intelligence and the vulnerability intelligence; the security risk list comprises software names and associated threat and vulnerability information; the asset management agent is used for retrieving asset attribute information corresponding to the software in a software asset database according to the software name in the security risk list so as to generate an asset attribute list; and the threat analysis agent is used for associating the security risk list with the asset attribute list, analyzing the security risk of each software managed by the platform, and generating a corresponding threat report.

Description

Technical Field

[0001] This invention belongs to the field of software engineering technology, and specifically relates to a software security management platform. Background Technology

[0002] For enterprise IT system software security management, on the one hand, it is necessary to conduct regular or irregular security tests on business software to detect existing security vulnerabilities and risks. On the other hand, it is necessary to monitor threat intelligence and vulnerability risk intelligence in real time, and to search and analyze a large amount of threat and vulnerability intelligence to match whether the system has corresponding vulnerability risks, whether it can be exploited, whether it poses a security risk to the business, and whether it can be upgraded or security protection measures can be formulated to prevent its application.

[0003] However, current process-oriented analysis of software security management mainly relies on manual testing by operations and maintenance personnel and solutions provided by experts, which is time-consuming and labor-intensive, and may even lead to security risks and exploitation of security vulnerabilities due to untimely handling. Summary of the Invention

[0004] In view of the shortcomings of the prior art described above, the purpose of this invention is to provide an automated software security management platform. Based on a large model, multiple intelligent agents are constructed. Through mutual cooperation, they can periodically capture the latest threat and vulnerability intelligence, verify whether it will affect the software managed by the platform, and provide corresponding rectification suggestions. No manual operation is required, which greatly improves the processing efficiency.

[0005] This invention provides a software security management platform, comprising: an asset management intelligent agent, a threat retrieval intelligent agent, and a threat analysis intelligent agent constructed based on a large model; the threat retrieval intelligent agent is used to capture the latest threat intelligence and vulnerability intelligence, and generate a security risk list based on the threat intelligence and vulnerability intelligence; the security risk list includes software names and their associated threat and vulnerability information; the asset management intelligent agent is used to retrieve the corresponding asset attribute information of the software in the software asset database based on the software names in the security risk list, so as to generate an asset attribute list; the threat analysis intelligent agent is used to associate the security risk list and the asset attribute list, analyze the security risks of each software managed by the platform, and generate corresponding threat reports.

[0006] In one embodiment of the present invention, the threat analysis agent is further configured to extract software names from the security risk list and send them to the asset management agent, and the asset management agent retrieves the corresponding asset attribute information of the software in the software asset database according to the software names transmitted by the threat analysis agent, so as to generate an asset attribute list.

[0007] In one embodiment of the present invention, the threat retrieval agent is used to call a large model to perform standardized format processing on the captured threat intelligence and vulnerability intelligence, and generate a security risk list based on the processed threat and vulnerability information through semantic understanding.

[0008] In one embodiment of the present invention, the threat retrieval agent is configured with multiple intelligence database interfaces for accessing threat intelligence databases and / or vulnerability intelligence databases from different sources.

[0009] In one embodiment of the present invention, it further includes: a resource server, used to provide an intelligence database interface for accessing threat intelligence databases and / or vulnerability intelligence databases from different external sources; wherein, the threat retrieval agent retrieves the latest threat intelligence and vulnerability intelligence from threat intelligence databases and / or vulnerability intelligence databases from different sources through the resource server.

[0010] In one embodiment of the present invention, the threat retrieval agent periodically retrieves the latest threat intelligence and / or vulnerability intelligence from various threat intelligence databases and / or vulnerability intelligence databases.

[0011] In one embodiment of the present invention, the software asset database is pre-constructed by the asset management intelligent agent based on the original data related to the asset attributes of each software managed by the platform; wherein, the original data related to the asset attributes of the software includes at least one of the following: software component information, operating environment information, business attribute information, security protection information, and the software's own security and repair information.

[0012] In one embodiment of the present invention, the software asset database is a vector database constructed based on the Embedding model, and the steps include: obtaining raw data related to the asset attributes of the software; preprocessing the raw data related to the asset attributes of the software; slicing the processed raw data related to the asset attributes, and inputting the several feature fragments obtained after slicing into the Embedding model for similarity quantification; and constructing the software asset database using the vector data output by the Embedding model.

[0013] In one embodiment of the present invention, the asset management agent is used to call a large model to perform standardized format processing on the retrieved software asset attribute information, and generate an asset attribute list based on the processed software asset attribute information through semantic understanding.

[0014] In one embodiment of the present invention, the asset management agent, the threat retrieval agent, and the threat analysis agent share the same underlying large language model, or are built based on different large models.

[0015] The beneficial effects of this invention are as follows: This invention constructs a software security management platform based on a large model. Through the collaborative operation of multiple intelligent agents, it can automatically capture the latest threat and vulnerability information and associate it with the business software managed by the platform. Then, it combines the asset attribute information of the software to comprehensively analyze the security risks of the software and provide corresponding rectification suggestions. This effectively reduces manual operation, avoids timeliness issues, and reduces the workload of operation and maintenance personnel.

[0016] Furthermore, the analysis of external threats and internal vulnerabilities is based on a comprehensive analysis of the software's multi-dimensional asset attributes, which can accurately determine the current security risks of the software and effectively prevent wasted efforts made to ensure software security by addressing threats and / or vulnerabilities. Attached Figure Description

[0017] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application. It is obvious that the drawings described below are merely some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0018] Figure 1 This is a schematic diagram of the structure of a software security management platform provided in one embodiment of the present invention; Figure 2 This is a schematic diagram illustrating the interaction of various intelligent agents in a software security management platform provided in one embodiment of the present invention; Figure 3 This is a schematic diagram of the interaction of a threat retrieval agent provided in one embodiment of the present invention; Figure 4 This is a schematic diagram illustrating the process of constructing a software asset database according to one embodiment of the present invention. Detailed Implementation

[0019] To facilitate understanding of this application, a more complete description will be provided below with reference to the accompanying drawings, which illustrate embodiments of the present application. However, the present application can be implemented in many different forms and is not limited to the embodiments described herein. Rather, these embodiments are provided so that the disclosure of this application will be thorough and complete.

[0020] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application.

[0021] The following specific examples illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that, unless otherwise specified, the following embodiments and features described therein can be combined with each other.

[0022] In the following description, numerous details are explored to provide a more thorough explanation of embodiments of the invention. However, it will be apparent to those skilled in the art that embodiments of the invention may be practiced without these specific details. In other embodiments, well-known structures and devices are shown in block diagram form rather than in detail to avoid obscuring embodiments of the invention.

[0023] Example 1 Please see Figure 1 , 2 As shown, a software security management platform manages various business software applications. To maintain software security, it regularly detects external threats and internal security vulnerabilities, and comprehensively assesses the software's security risks by considering asset attributes such as the software's operating environment, business attributes, and security protection measures. This assessment serves to remind operations and maintenance personnel to maintain each business software application in a timely manner.

[0024] Understandably, this software security management platform effectively reduces the workload of operations and maintenance personnel through automation. The detection process requires no manual intervention and can effectively identify whether threats and vulnerabilities in the intelligence will affect the platform's business software. For example, it can determine whether software security vulnerabilities can be exploited by the operating environment, or whether external attacks will affect the normal operation of the software. This significantly improves processing efficiency when dealing with massive amounts of threat and vulnerability intelligence. Simultaneously, by automatically generating threat reports, operations and maintenance personnel can intuitively understand the current status of each software and maintain and repair the software based on the remediation suggestions provided in the threat reports, thereby effectively reducing their workload.

[0025] Specifically, the software security management platform includes: an asset management agent 10, a threat retrieval agent 20, and a threat analysis agent 30 built based on a large model. The asset management agent 10, threat retrieval agent 20, and threat analysis agent 30 can share the same underlying large language model instance. Each agent can invoke the same large model to perform different operations through different prompts and toolsets. Alternatively, the asset management agent 10, threat retrieval agent 20, and threat analysis agent 30 can access a large model specifically optimized or fine-tuned for them to better fulfill their respective responsibilities. This is not a limitation. Modifications and refinements made by those skilled in the art to the embodiments of this invention without departing from the spirit of this invention still fall within the scope of the invention application patent.

[0026] It should be noted that the large model mentioned in this embodiment refers to a large language model based on natural language processing, not a traditional machine learning model. Furthermore, the intelligent agent is a software entity built upon the large model, possessing specific responsibilities and action logic. It can be configured with dedicated tools, set clear goals, and define workflows to execute tasks according to preset expectations.

[0027] In this embodiment, the threat retrieval agent 20 can be used to periodically capture the latest threat intelligence and vulnerability intelligence, and generate a security risk list based on the software / components involved in the intelligence, that is, to associate the threat and vulnerability information in the intelligence with the corresponding software / components.

[0028] Understandably, software contains several components, and the threat and vulnerability information in intelligence will naturally involve these components. Accordingly, it is necessary to consider both the external threats faced by the software and its corresponding components, as well as its own security vulnerabilities, so as to comprehensively assess the security risks of the software at the component level.

[0029] Furthermore, threat intelligence provides information on which software and / or components have been subjected to what types of attacks, while vulnerability intelligence provides information on which software and / or components themselves have what security vulnerabilities. Since threat and vulnerability information is mixed together in the intelligence, a security risk list can be generated for each software or component based on its associated threat and vulnerability information, as shown in Table 1 below: Table 1,

[0030] Therefore, by sorting mixed threat and vulnerability information according to their related software or components, it is possible to analyze the threats and vulnerabilities currently faced by each software and component.

[0031] In one specific embodiment, the threat retrieval agent 20 is configured with a corresponding interface tool, namely a resource server, which is used to access threat intelligence databases and / or vulnerability intelligence databases from different sources.

[0032] Specifically, regarding the resource server, for example, an MCP Server can be used as a "standardized gateway" between the threat retrieval agent 20 and external resources.

[0033] Understandably, MCP Server is a server-side implementation of Model Context Protocol, which can provide standardized access to external resources and tool invocation capabilities for large models. It is based on JSON-RPC2.0 and supports transmission methods such as WebSocket / SSE / stdio, thereby unifying the interface for large models to call external tools and data.

[0034] Therefore, as Figure 3 As shown, external threat intelligence, vulnerability intelligence and other security intelligence resources are aggregated and integrated through the MCP Server for the threat retrieval agent 20 to access. The threat retrieval agent 20 accesses the MCP Server through the MCP Client and periodically retrieves the latest threat intelligence and vulnerability intelligence from it.

[0035] Furthermore, since the threat retrieval agent 20 is built on a large model, it extracts threat and vulnerability information from intelligence by calling the large model and relying on its semantic understanding capabilities. It then generates a security risk list according to a predefined format, namely, the name of each software and its corresponding threat and vulnerability information. This will not be described in detail here.

[0036] Furthermore, the threat retrieval agent 20 returns the generated security risk list to the threat analysis agent 30, which then extracts the names of various software and components from the security risk list and sends them to the asset management agent 10 for retrieval.

[0037] Accordingly, the asset management agent 10 can search the software asset database based on the names of each software and / or component to query whether the software or component recorded in the security risk list is the business software managed by this platform.

[0038] It is understandable that threat and vulnerability information obtained from external sources may involve other software applications, but in reality, only the business software managed by the platform needs to be of real concern. Unrelated software can be ignored to avoid causing panic among operations and maintenance personnel due to unimportant threat and vulnerability information.

[0039] It should also be noted that the software asset database is pre-built by the asset management intelligent agent 10 based on the original data related to the asset attributes of the business software managed by the platform, thereby fully clarifying the business software managed by the platform and the corresponding asset attribute information.

[0040] Specifically, such as Figure 4 As shown, the first step is to clarify the asset attribute information of the software. In this embodiment, five categories of attribute information are used as examples: software component information (code modules, dependent libraries, components), runtime environment information (hardware, system, deployment architecture), business attribute information (belonging system, function), security protection information (permission policies, firewalls), and its own security and remediation information (vulnerability patches / remediation records). In practical applications, this information can be obtained by connecting to other databases within the platform, operation and maintenance logs, security scanning tools, etc., or it can be manually entered directly; there are no restrictions on this.

[0041] Furthermore, preprocessing operations such as data cleaning (e.g., filtering duplicates and invalid data, and processing sensitive information) and format standardization (e.g., converting unstructured and semi-structured data into standardized text formats) are performed on the raw data related to the asset attributes of each software to facilitate subsequent slicing.

[0042] Accordingly, strategies such as "fixed size" for small-granular data, "semantic boundaries" for business attribute descriptions, and "recursive segmentation" for long documents can be used to slice the processed data. Each slice is then labeled with its original data dimensions and source to facilitate subsequent traceability. Finally, an embedding model is used to vectorize the sliced ​​data fragments.

[0043] Understandably, embedding models can be used to map discrete, high-dimensional, and difficult-to-compute abstract data to a continuous, low-dimensional, quantifiable vector space, ensuring that the distance / similarity in the vector space aligns with the semantic / feature similarity of the data. In the vector space, similar objects are closer together, while dissimilar objects are farther apart, and similarity can be directly measured using metrics such as cosine similarity and Euclidean distance.

[0044] Finally, a database is constructed based on the vectorized data, and indexes for corresponding fields are configured for software asset query scenarios to improve retrieval efficiency. Additionally, scheduled synchronization tasks can be set up to correlate updates with the original data source, ensuring real-time updates to the asset attribute information of each business software.

[0045] Therefore, the asset management agent 10 can convert the name to be queried into standardized text, i.e., the corresponding query vector, based on the software or component name and using the Embedding model, to ensure semantic clarity, thereby matching and calculating similarity with the software or component names recorded in the software asset database, i.e., vector data.

[0046] It is understandable that if the match is successful, the asset management agent 10 will retrieve the asset attribute information corresponding to the software or component from the library and generate an asset attribute list accordingly.

[0047] Similarly, since the asset management agent 10 is also built on a large model, the above operation process is also achieved by calling the large model and relying on its semantic understanding capabilities. For example, the large model is called to standardize the software or component asset attribute information extracted from the library to generate an asset attribute list, which is then returned to the threat analysis agent 30. This will not be described in detail here.

[0048] Therefore, the asset management agent 10 determines whether the software involved in the threat and vulnerability information is business software managed by the platform, and then provides the asset attribute information of the business software that needs attention to the threat analysis agent 30, so that it can comprehensively assess the security risk of the software by combining the threat and vulnerability information and the asset attribute information.

[0049] It is also understandable that if the name of the software or component sent by the threat analysis agent 30 to the asset management agent 10 is not found in the software asset database, the asset management agent 10 can mark the software or component during the generation of the asset attribute list, indicating that the software or component does not need to be paid attention to and the corresponding threat and vulnerability information can be ignored, or the name of the software or component can be directly removed from the asset attribute list, and the asset attribute list only records the business software that needs to be paid attention to and its asset attribute information.

[0050] In response, the threat analysis agent 30 can conduct a comprehensive analysis based on the security risk list and the asset attribute list. First, based on the name of the software or component recorded in the asset attribute list, it retrieves the threat and vulnerability information corresponding to the name of the software or component from the security risk list. Then, it combines the asset attribute information and threat and vulnerability information of the software or component to assess the security risk of the software or component and generate a corresponding threat report.

[0051] For example, a certain business software is installed in both Windows and Linux environments, and this business software has a security vulnerability that poses a risk of exploitation because it provides internet access. Furthermore, this business software has no security measures in place.

[0052] However, although the business software poses security risks, the risk level is low because it only provides intranet services to the testing environment. Furthermore, the exploitation of this risk is currently limited to Windows environments.

[0053] Therefore, the only necessary action is to remind operations and maintenance personnel to repair the business software in the Windows environment and provide the corresponding community-published patch. At the same time, since this is not an official patch, caution should be exercised when verifying and upgrading the business software.

[0054] In summary, current software management is mostly done manually, which has effectiveness issues and is not conducive to the real-time detection of security risks in IT business systems. This may result in security vulnerabilities going undetected or being exploited due to delayed detection.

[0055] Furthermore, associating the large amount of new vulnerability and threat information that is released every day with the corresponding software in the IT business systems is time-consuming, labor-intensive, and inefficient.

[0056] At the same time, a lot of time needs to be spent verifying whether the software associated with new vulnerabilities and threat intelligence will affect business security, whether the vulnerability can be exploited by the software's environment, etc., which may result in untimely vulnerability patching, or vulnerabilities that do not affect IT business risks but consume a lot of time to patch.

[0057] Furthermore, current storage of threat intelligence, vulnerability intelligence, software asset, and other information data still adopts the traditional database model, which can only provide a query mode based on database interaction language and cannot realize interactive query of large models.

[0058] Therefore, this invention constructs a software security management platform based on a large model. Through the collaborative operation of multiple intelligent agents, it can automatically capture the latest threat and vulnerability information and associate it with the business software managed by the platform. Then, it combines the software's asset attribute information to comprehensively analyze the software's security risks and provide corresponding rectification suggestions. This effectively reduces manual operation, avoids timeliness issues, and reduces the workload of operation and maintenance personnel.

[0059] Furthermore, the analysis of external threats and internal vulnerabilities is based on a comprehensive analysis of the software's multi-dimensional asset attributes, which can accurately determine the current security risks of the software and effectively prevent wasted efforts made to ensure software security by addressing threats and / or vulnerabilities.

[0060] The above embodiments are merely illustrative of the principles and effects of the present invention and are not intended to limit the invention. Any person skilled in the art can modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by those skilled in the art without departing from the spirit and technical concept disclosed in the present invention should still be covered by the claims of the present invention.

[0061] Throughout this specification, the terms "an embodiment," "embodiment," or "specific embodiment" refer to a particular feature, structure, or characteristic described in connection with an embodiment that is included in at least one embodiment of the invention, but not necessarily in all embodiments. Therefore, the various representations of the phrases "in one embodiment," "in an embodiment," or "in a specific embodiment" in different places throughout the specification do not necessarily refer to the same embodiment. Furthermore, a particular feature, structure, or characteristic of any specific embodiment of the invention can be combined with one or more other embodiments in any suitable manner. It should be understood that other variations and modifications of the embodiments of the invention described and illustrated herein may be based on the teachings herein and will be considered part of the spirit and scope of the invention.

[0062] Furthermore, unless otherwise expressly stated, any arrows in the accompanying drawings should be considered illustrative only and not limiting. Additionally, unless otherwise stated, the term "or" as used herein is generally intended to mean "and / or". Where a term is anticipated to provide a separation or combination capability that is unclear, a combination of components or steps will also be considered as indicated.

[0063] As used herein and throughout the claims below, unless otherwise specified, “a” and “the” include the plural references. Similarly, as used herein and throughout the claims below, unless otherwise specified, “in” means “in” and “on”.

[0064] The above description of the embodiments shown in this invention (including the content set forth in the abstract of the specification) is not intended to be an exhaustive enumeration or to limit the invention to the precise forms disclosed herein. Although specific embodiments and examples of the invention have been described herein for illustrative purposes only, various equivalent modifications are possible within the spirit and scope of the invention, as will be recognized and understood by those skilled in the art. As indicated, these modifications can be made to the invention in accordance with the above description of the embodiments described herein, and such modifications will be within the spirit and scope of the invention.

[0065] This document has generally described the systems and methods in detail to aid in understanding the invention. Furthermore, various specific details have been set forth to provide a general understanding of embodiments of the invention. However, those skilled in the art will recognize that embodiments of the invention can be practiced without one or more specific details, or using other means, systems, accessories, methods, components, materials, parts, etc. In other instances, well-known structures, materials, and / or operations have not been specifically shown or described in detail to avoid obscuring aspects of embodiments of the invention.

[0066] Therefore, although the invention has been described herein with reference to specific embodiments thereof, freedom of modification, various changes and substitutions are also within the scope of the foregoing disclosure, and it should be understood that in some cases, certain features of the invention may be adopted without departing from the scope and spirit of the invention and without corresponding use of other features. Thus, many modifications can be made to adapt a particular environment or material to the essential scope and spirit of the invention. The invention is not intended to be limited to the specific terminology used in the following claims and / or the specific embodiments disclosed as the best mode for carrying out the invention, but the invention will include any and all embodiments and equivalents falling within the scope of the appended claims. Therefore, the scope of the invention will be defined only by the appended claims.

Claims

1. A software security management platform, characterized in that, include: The asset management intelligent agent, threat retrieval intelligent agent, and threat analysis intelligent agent are built based on the large model; The threat retrieval agent is used to capture the latest threat intelligence and vulnerability intelligence, and generate a security risk list based on the threat intelligence and vulnerability intelligence; the security risk list includes software names and their associated threat and vulnerability information; The asset management intelligent agent is used to retrieve the corresponding asset attribute information of the software in the software asset database based on the software name in the security risk list, so as to generate an asset attribute list; The threat analysis agent is used to associate the security risk list and the asset attribute list, analyze the security risks of each software managed by the platform, and generate corresponding threat reports.

2. The software security management platform according to claim 1, characterized in that, The threat analysis agent is also used to extract software names from the security risk list and send them to the asset management agent. The asset management agent retrieves the corresponding asset attribute information of the software in the software asset database based on the software names transmitted by the threat analysis agent to generate an asset attribute list.

3. The software security management platform according to claim 1, characterized in that, The threat retrieval agent is used to call a large model to process the captured threat and vulnerability intelligence in a standardized format, and generate a security risk list based on the processed threat and vulnerability information through semantic understanding.

4. The software security management platform according to claim 1, characterized in that, The threat retrieval agent is configured with multiple intelligence database interfaces for accessing threat intelligence databases and / or vulnerability intelligence databases from different sources.

5. The software security management platform according to claim 4, characterized in that, Also includes: Resource server, used to provide intelligence database interfaces for accessing threat intelligence databases and / or vulnerability intelligence databases from different external sources; The threat retrieval agent retrieves the latest threat and vulnerability intelligence from threat intelligence databases and / or vulnerability intelligence databases from different sources through the resource server.

6. The software security management platform according to claim 1, characterized in that, The software asset database is pre-built by the asset management intelligent agent based on the original data related to the asset attributes of each software managed by the platform; The original data related to the asset attributes of the software includes at least one of the following: software component information, operating environment information, business attribute information, security protection information, and the software's own security and repair information.

7. The software security management platform according to claim 6, characterized in that, The software asset database is a vector database built based on the Embedding model, and the steps include: Obtain raw data related to the asset attributes of the software; Preprocess the raw data related to the asset attributes of the software; The raw data related to the processed asset attributes are sliced, and the resulting feature fragments are input into the Embedding model for similarity measurement. The software asset database is constructed using the vector data output by the Embedding model.

8. The software security management platform according to claim 1, characterized in that, The asset management agent converts software names into query vectors using an Embedding model and retrieves the corresponding software from the software asset database based on these vectors.

9. The software security management platform according to claim 1, characterized in that, The asset management agent is used to call a large model to standardize the retrieved software asset attribute information and generate an asset attribute list based on the processed software asset attribute information through semantic understanding.

10. The software security management platform according to claim 1, characterized in that, The asset management agent, the threat retrieval agent, and the threat analysis agent share the same underlying large language model, or are built based on different large models.

Images