Semantic enhanced vulnerability information retrieval method and related equipment

Abstract

The invention discloses a semantic enhanced vulnerability information retrieval method and related equipment. The method comprises the following steps: acquiring a vulnerability retrieval request of a user; the vulnerability retrieval request of the user is input into the trained Sensor Transform model to be subjected to vectorization processing, and a vulnerability retrieval request vector of the user is obtained; and performing semantic similarity calculation on the vulnerability retrieval request vector of the user and a vulnerability vector set pre-stored in the vulnerability retrieval database by utilizing an ElasticSearch engine to obtain a vulnerability retrieval result. According to the method, semantic related results can be accurately understood and retrieved, and the retrieval accuracy and recall rate are remarkably improved.

Description

Technical Field

[0001] This invention relates to the field of vulnerability information retrieval technology, and in particular to a semantically enhanced vulnerability information retrieval method and related equipment. Background Technology

[0002] In the field of information system security, vulnerability retrieval is a fundamental and crucial step in threat analysis, risk assessment, and proactive protection. Currently, mainstream vulnerability retrieval methods mainly rely on the following two types of methods, both of which have significant limitations:

[0003] One type of retrieval method is based on standardized identifiers: this method relies on industry-recognized vulnerability identifiers, such as CVE_id or exploit_id. While these identifiers are unique, their coverage is limited. Many vulnerabilities lack standardized identifiers due to informal disclosure channels or exclusion from mainstream platforms, making them unsearchable through this method. Furthermore, there are significant information silos among various vulnerability databases, such as NVD (National Vulnerability Database), ExploitDB (The Exploit Database), and Openwall. Their data patterns and organizational logic differ, greatly reducing data interoperability and overall utilization efficiency.

[0004] Another type of method is keyword-based retrieval, which requires users to input keywords for their queries. Its core drawback lies in its reliance on simple literal matching strategies, lacking a deep semantic understanding of the natural language descriptions entered by users. This necessitates users accurately predicting the key feature words of vulnerabilities; otherwise, the recall and precision of search results are prone to being low. Furthermore, the information returned by this method is often isolated and fragmented, lacking connections to relevant vulnerabilities, attack techniques, or mitigation measures, making it difficult to meet users' needs for a systematic and in-depth understanding of vulnerabilities.

[0005] In addition, another solution is to unify CVE (Common Vulnerabilities and Exposures) vulnerability information and PoC (Proof of Concept) information into the TTP (Tactics, Techniques, and Procedures) standard format. For example, Chinese patent CN119783116A, "Vulnerability Information Identification Method and Device Based on Large Language Model," uses this formatting process to help remove noise from the original information and enhance the model's ability to identify key information, but it also loses some descriptive details.

[0006] While academia has established a certain research foundation for vulnerability analysis, these studies often do not directly focus on vulnerability descriptions. Instead, they indirectly use these descriptions as supplementary parts of vulnerability vulnerability reports, downplaying the information-rich content. This is clearly insufficient for the development and utilization of existing resources. Therefore, there is an urgent need for a semantically enhanced vulnerability information retrieval method and related equipment to meet users' needs for vulnerability information retrieval, helping them efficiently search, accurately link, and distribute relevant vulnerabilities, thus providing support for vulnerability protection, analysis, and exploitation. Summary of the Invention

[0007] The purpose of this invention is to provide a semantically enhanced vulnerability information retrieval method and related equipment. This method utilizes the Sentence Transformer model to map vulnerability descriptions to a high-dimensional space, capturing subtle semantic differences between vulnerability descriptions, thereby achieving more accurate similarity calculation. It can accurately understand and retrieve semantically related results, significantly improving the accuracy and recall of retrieval.

[0008] To achieve the above objectives, the present invention employs the following technical solution:

[0009] In a first aspect, the present invention provides a semantically enhanced vulnerability information retrieval method, comprising:

[0010] Obtain the user's vulnerability search request;

[0011] The user's vulnerability search request is input into the trained Sentence Transformer model and vectorized to obtain the user's vulnerability search request vector.

[0012] The ElasticSearch engine is used to calculate the semantic similarity between the user's vulnerability search request vector and the pre-stored vulnerability vector set in the vulnerability search database to obtain the vulnerability search results.

[0013] The training process of the Sentence Transformer model includes:

[0014] Obtain the vulnerability dataset and clean the vulnerability dataset to obtain the cleaned vulnerability dataset;

[0015] A pre-training dataset is constructed based on the cleaned vulnerability dataset;

[0016] The pre-trained dataset is divided into a training set, a validation set, and a test set according to a first preset ratio;

[0017] The training set is input into the Sentence Transformer model, and the model is trained using the contrastive loss function to obtain the optimal parameters. Based on the optimal parameters, the first Sentence Transformer model is obtained.

[0018] The validation set is input into the first Sentence Transformer model, and the hyperparameters of the model are tuned using a binary classification evaluator to obtain the second Sentence Transformer model.

[0019] The second Sentence Transformer model is evaluated based on the test set and a binary classifier evaluator to obtain the trained Sentence Transformer model.

[0020] Optionally, the vulnerability dataset includes vulnerability description datasets for KEV, CVE, NVD, ExploitDB, and Openwall; each vulnerability description dataset contains a corresponding vulnerability identifier, vulnerability type, release and update time, vulnerability description, and version information; the vulnerability description datasets for CVE, NVD, ExploitDB, and Openwall also include the names of the affected components.

[0021] Optionally, the construction of the pre-training dataset based on the cleaned vulnerability dataset includes:

[0022] Positive and negative samples are constructed based on the cleaned vulnerability dataset;

[0023] The positive and negative samples are combined according to a second preset ratio to obtain the pre-training dataset;

[0024] The construction of positive samples includes:

[0025] Extract similar data sets from the cleaned vulnerability dataset;

[0026] The similar dataset includes: a first similar dataset, a second similar dataset, and a third similar dataset;

[0027] The first similar dataset includes multiple vulnerability descriptions with the same vulnerability identifier in KEV and NVD; the second similar dataset includes multiple vulnerability descriptions with the same vulnerability identifier and the same affected component name in CVE, NVD, ExploitDB, and Openwall; and the third similar dataset includes multiple vulnerability descriptions with the same vulnerability type and the same affected component name in CVE, NVD, ExploitDB, and Openwall.

[0028] The data from the first similar dataset, the second similar dataset, and the third similar dataset are paired up as positive samples;

[0029] The construction of negative samples includes:

[0030] Extract vulnerability description data with different component names from the cleaned vulnerability dataset, and pair the vulnerability description data with different component names together as negative samples.

[0031] Optionally, the vulnerability retrieval database includes: a comprehensive vulnerability dataset and a pre-stored vulnerability vector set corresponding to the comprehensive vulnerability dataset; wherein, the comprehensive vulnerability dataset is obtained by completing the component names and vulnerability verification configuration requirements of the vulnerability dataset;

[0032] The acquisition of the pre-stored vulnerability vector set includes:

[0033] The vulnerability descriptions and affected component names in the vulnerability description dataset of the comprehensive vulnerability dataset are combined to obtain the combined dataset.

[0034] The combined dataset is vectorized to obtain a pre-stored vulnerability vector set.

[0035] Optionally, the contrastive loss function is expressed as follows:

[0036] ;

[0037] ;

[0038] in, Represents the contrastive loss function of the Sentence Transformer model; This represents the SentenceTransformer model; i represents the number of sequences; P represents the total number of samples; Let Y represent the loss of the i-th sample; Y represents the label between sample pairs; when Y=0, it means that the sample pairs are similar and are positive samples; when Y=1, it means that the sample pairs are dissimilar and are negative samples. and These are the loss functions for positive and negative samples, respectively. These are two different samples; This represents the distance between sample pairs calculated using the Sentence Transformer model W.

[0039] Optionally, the loss functions for the positive and negative samples are expressed as follows:

[0040] ;

[0041] ;

[0042] Where m is a preset boundary value.

[0043] Secondly, the present invention provides a semantically enhanced vulnerability information retrieval system, comprising:

[0044] The request retrieval module is used to retrieve users' vulnerability retrieval requests;

[0045] The vectorization module is used to input the user's vulnerability retrieval request into the trained SentenceTransformer model for vectorization processing to obtain the user's vulnerability retrieval request vector.

[0046] The retrieval module uses the ElasticSearch engine to perform semantic similarity calculations between the user's vulnerability retrieval request vector and the pre-stored vulnerability vector set in the vulnerability retrieval database, and obtains the vulnerability retrieval results.

[0047] Thirdly, the present invention provides an electronic device, comprising: a memory and a processor;

[0048] The memory is used to store programs;

[0049] The processor is configured to execute the program to implement the semantically enhanced vulnerability information retrieval method as described in the first aspect.

[0050] Fourthly, the present invention provides a readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, it implements the semantically enhanced vulnerability information retrieval method as described in the first aspect.

[0051] Fifthly, the present invention provides a computer program product, including a computer program that, when executed by a processor, implements the semantically enhanced vulnerability information retrieval method as described in the first aspect.

[0052] Compared with the prior art, the beneficial effects achieved by the present invention are as follows:

[0053] This invention provides a semantically enhanced vulnerability information retrieval method and related equipment. The method utilizes a trained Sentence Transformer model to vectorize the user's vulnerability retrieval request, obtaining the user's vulnerability retrieval request vector. Then, semantic similarity is calculated based on the user's vulnerability retrieval request vector and a pre-stored vulnerability vector set in a vulnerability retrieval database to obtain the vulnerability retrieval results. This invention is the first to use the Sentence Transformer model to process vulnerability descriptions, enabling a deeper understanding of the semantic information of the vulnerability text, rather than simply keyword matching. Through advanced sentence embedding technology, vulnerability descriptions are mapped to a high-dimensional space, capturing subtle semantic differences between vulnerability descriptions, thereby achieving more accurate similarity calculations. Users can describe their vulnerability needs using natural language, and the system can accurately understand and retrieve semantically relevant results, significantly improving retrieval accuracy and recall.

[0054] This invention provides a semantically enhanced vulnerability information retrieval method and related equipment. The vulnerability retrieval database and the pre-training dataset for training the Sentence Transformer model are both constructed based on a vulnerability dataset. This dataset includes multiple authoritative vulnerability databases such as CVE, NVD, ExploitDB, and Openwall, as well as a KEV (Known Exploited Vulnerabilities) vulnerability description dataset. This multi-source data integration not only enriches the retrieval resources but also ensures the authority and timeliness of the data. Furthermore, the vulnerability retrieval database includes supplementary component names and vulnerability verification configuration requirements, providing users with more comprehensive and detailed vulnerability information to help them better analyze and protect against vulnerabilities. Attached Figure Description

[0055] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0056] Figure 1 The diagram shown is a schematic of a semantically enhanced vulnerability information retrieval process according to the present invention.

[0057] Figure 2 The diagram shown is a schematic of the training process of the Sentence Transformer model in one embodiment of the present invention.

[0058] Figure 3The diagram shown is a flowchart illustrating the process of constructing a pre-trained dataset in one embodiment of the present invention. Detailed Implementation

[0059] The present invention will be further described below with reference to the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and should not be used to limit the scope of protection of the present invention.

[0060] Example 1

[0061] like Figure 1 As shown in the figure, this embodiment of the invention introduces a semantically enhanced vulnerability information retrieval method, including the following steps:

[0062] S1: Obtain the user's vulnerability search request;

[0063] S2: The user's vulnerability retrieval request is input into the trained Sentence Transformer model and vectorized to obtain the user's vulnerability retrieval request vector.

[0064] S3: Use the ElasticSearch engine to calculate the semantic similarity between the user's vulnerability search request vector and the pre-stored vulnerability vector set in the vulnerability search database to obtain the vulnerability search results;

[0065] This invention introduces a semantically enhanced vulnerability information retrieval method. By combining the semantic similarity calculation capability of the SentenceTransformer model with the efficient retrieval capability of the ElasticSearch engine, the vulnerability semantics are enhanced for retrieval. This method can accurately understand and retrieve results that are semantically related to the user's description of vulnerability needs in natural language, resulting in higher retrieval efficiency.

[0066] In this embodiment, as Figure 2 As shown, the training process of the Sentence Transformer model includes:

[0067] S01: Obtain the vulnerability dataset and clean the vulnerability dataset to obtain the cleaned vulnerability dataset;

[0068] S02: Construct a pre-training dataset based on the cleaned vulnerability dataset;

[0069] S03: Divide the pre-trained dataset into a training set, a validation set, and a test set according to a first preset ratio;

[0070] S04: Input the training set into the Sentence Transformer model and train it using the contrastive loss function to obtain the optimal parameters of the model. Based on the optimal parameters, obtain the first Sentence Transformer model.

[0071] S05: Input the validation set into the first Sentence Transformer model and use the binary classification evaluator to fine-tune the model hyperparameters to obtain the second Sentence Transformer model.

[0072] S06: Evaluate the second Sentence Transformer model based on the test set and the binary classification evaluator to obtain the trained Sentence Transformer model.

[0073] Specifically, the vulnerability dataset in step S01 includes vulnerability description datasets for KEV, CVE, NVD, ExploitDB, and Openwall; each vulnerability description dataset contains a corresponding vulnerability identifier CVE_id, vulnerability type CWE_id, release and update time, vulnerability description, and version information; the vulnerability description datasets for CVE, NVD, ExploitDB, and Openwall also include the names of the affected components.

[0074] Furthermore, since the vulnerability description data in the vulnerability dataset is disorganized, it is necessary to perform data cleaning to extract useful vulnerability description data. The data cleaning steps include noise removal and text standardization, which are technical features commonly used by those skilled in the art and will not be described in detail here.

[0075] In this embodiment, as Figure 3 As shown, the steps in step S02 to construct the pre-training dataset include:

[0076] S021: Extract the first similar data set, the second similar data set, and the third similar data set from the cleaned vulnerability dataset;

[0077] The first similar dataset includes multiple vulnerability descriptions with the same vulnerability identifier CVE_id in KEV and NVD; the second similar dataset includes multiple vulnerability descriptions with the same vulnerability identifier CVE_id in CVE, NVD, ExploitDB, and Openwall, and the same affected component names; the third similar dataset includes multiple vulnerability descriptions with the same vulnerability type CWE_id in CVE, NVD, ExploitDB, and Openwall, and the same affected component names.

[0078] S022: Pair up data from the first similar dataset, the second similar dataset, and the third similar dataset to form positive samples;

[0079] S023: Extract vulnerability description data with different component names from the cleaned vulnerability dataset, and pair the vulnerability description data with different component names as negative samples.

[0080] S024: Mix the positive and negative samples to obtain the pre-training dataset.

[0081] Specifically, the mixing ratio of positive and negative samples, i.e., the second preset ratio, is: ;

[0082] Specifically, pre-trained dataset Represented as:

[0083]

[0084] In the formula: Indicates a mixed operation. Represents the set of positive samples; This represents the set of negative samples.

[0085] Specifically, vulnerability description data extraction is fundamental to vulnerability report analysis and understanding. The structured extraction of key aspects from vulnerability descriptions often employs natural language processing (NLP) methods, as vulnerability descriptions can essentially be viewed as entity and relation extraction tasks within NLP. Instead of using traditional keywords for vulnerability identification, we directly utilize the complete vulnerability description text. By enhancing the contextual understanding capabilities of the SentenceTransformer model through positive and negative samples, we can improve the model's generalization ability and robustness, optimize the effectiveness of contrastive learning, and enhance the diversity and performance of the SentenceTransformer model.

[0086] In this embodiment, unlike the pre-trained dataset, the vulnerability retrieval database aims to provide users with a broader range of information. In addition to vulnerability descriptions, we also need to supplement the vulnerability retrieval database with vulnerability verification configuration requirements, such as the software version information of the testing platform, patch information, and relevant operating system information. This information is crucial for users to further exploit and protect against vulnerabilities.

[0087] Specifically, the vulnerability retrieval database includes: a comprehensive vulnerability dataset and a pre-stored vulnerability vector set corresponding to the comprehensive vulnerability dataset; the comprehensive vulnerability dataset is obtained by completing the component names and vulnerability verification configuration requirements of the vulnerability dataset.

[0088] The acquisition of the pre-stored vulnerability vector set includes:

[0089] The vulnerability descriptions and affected component names in the vulnerability description dataset of the comprehensive vulnerability dataset are combined to obtain the combined dataset.

[0090] The combined dataset is vectorized (embedding) to obtain a pre-stored vulnerability vector set.

[0091] Specifically, the purpose of embedding the combined dataset is to speed up the retrieval process. After a user enters a request, only one statement needs to be embedded, eliminating the need to calculate the vector value for the description in all the data each time, which greatly shortens the retrieval time.

[0092] In this embodiment, the Sentence Transformer model is a sentence embedding model based on the MiniLM architecture, used to map the input sentence to a 384-dimensional dense vector space, including:

[0093] a) Embedding layer: Converts the input text into a vector representation.

[0094] b) Transformer encoder layer: Captures long-distance dependencies within a sentence through a self-attention mechanism.

[0095] c) Pooling layer: Apply pooling operations to the output of the Transformer encoder to obtain the final sentence embedding vector.

[0096] The Transformer encoder utilizes deep self-attention distillation. This involves extracting the depth of the last Transformer layer in the teacher model, reducing the complexity of layer mapping between the teacher and student models. This allows for more flexible layer configurations in the student model. In the self-attention module, in addition to the regular dot product between queries and keys, a scaled dot product operation between values ​​is introduced as a novel form of deep self-attention knowledge. Using the scaled dot product between self-attention values ​​can also transform representations of different dimensions into relational matrices of the same dimension, transforming the student model's representation without additional parameters. This allows the student model to use hidden layers of any dimension.

[0097] In this embodiment, step S03: the pre-training dataset is divided into a training set, a validation set, and a test set according to a first preset ratio; wherein, the first preset ratio is that the data ratio of the training set, the validation set, and the test set is 8:1:1;

[0098] In this embodiment, step S04 employs contrastive loss, which is mainly used to train the model to learn embedding representations that can distinguish different text pairs. It is very effective in tasks such as semantic-based similarity problem recognition.

[0099] The core idea of ​​the contrastive loss function is to minimize the distance between similar sample pairs while maximizing the distance between dissimilar sample pairs. Specifically, given a pair of samples... and And their labels Y (Y = 0 indicates that the sample pairs are similar, Y = 1 indicates that the sample pairs are dissimilar), the contrastive loss function L(W) can be expressed as:

[0100] ;

[0101] ;

[0102] in, Represents the contrastive loss function of the Sentence Transformer model; This represents the SentenceTransformer model; i represents the number of sequences; P represents the total number of samples; Let Y represent the loss of the i-th sample; Y represents the label between sample pairs; when Y=0, it means that the sample pairs are similar and are positive samples; when Y=1, it means that the sample pairs are dissimilar and are negative samples. and These are the loss functions for positive and negative samples, respectively. These are two different samples; This represents the distance between sample pairs calculated using the Sentence Transformer model W.

[0103] For similarity pairs (Y=0), the loss function for positive samples is expressed as follows:

[0104] ;

[0105] This indicates a desire to reduce the distance between similar sample pairs.

[0106] For dissimilar pairs (Y=1), the loss function for negative samples is expressed as follows:

[0107] ;

[0108] Where m is a preset boundary value, indicating that the distance between dissimilar sample pairs is expected to be at least m;

[0109] The main functions of the comparison loss function in this embodiment include:

[0110] 1) By minimizing the distance between similar sample pairs and maximizing the distance between dissimilar sample pairs, the model learns to distinguish between different texts.

[0111] 2) The embedding space was optimized so that similar texts are closer together and dissimilar texts are further apart, thereby improving the model’s performance in various downstream tasks (such as text classification, information retrieval, etc.).

[0112] 3) By using different distance metrics (such as Euclidean distance, Manhattan distance, cosine distance, etc.), this loss function can be adapted to different application scenarios and needs.

[0113] 4) Preventing model collapse: By introducing a boundary m, this loss function prevents the model from collapsing into a constant function, i.e., all outputs are the same, which is crucial for learning effective feature representations.

[0114] In this embodiment, in step S05, the class BinaryClassificationEvaluator, which is used to evaluate binary classification tasks, is used as the evaluator and inherits from the SentenceEvaluator class. The binary classification evaluator is mainly used to assess the model's accuracy in identifying similar and dissimilar sentence pairs; the accuracy is calculated using different similarity metrics (such as cosine similarity, dot product, Euclidean distance, and Manhattan distance).

[0115] Cosine similarity measures the similarity between two vectors by calculating the cosine of the angle between them. It is insensitive to the length of the vectors and focuses primarily on directional similarity. Therefore, it can effectively capture semantic similarity when processing text data, especially when comparing vectors in high-dimensional spaces.

[0116] Manhattan distance is the sum of the absolute differences between the coordinates of two points on each axis. It performs well when dealing with sparse data because its calculation is unaffected by dimensionality differences, making it suitable for scenarios with a wide distribution of feature values.

[0117] Euclidean distance is the straight-line distance between two points in space and is the most intuitive distance metric. It is sensitive to the scale of the data, so the data is usually normalized before use. Euclidean distance is suitable when features are relatively independent and the data is uniformly distributed.

[0118] The dot product directly calculates the sum of the products of corresponding components of two vectors. It reflects not only the directional similarity of the vectors but is also affected by their lengths. Therefore, when the vector lengths differ significantly, the dot product may be greatly affected. However, in certain specific scenarios, such as calculating the similarity of text vectors, it can still provide valuable similarity information.

[0119] To comprehensively evaluate the performance of these similarity calculation strategies in vulnerability semantic similarity calculation tasks, this embodiment compares their performance on different datasets through experiments.

[0120] In this embodiment, in step S06, the second SentenceTransformer model is evaluated based on the test set and the binary classification evaluator to obtain the trained SentenceTransformer model. The evaluation parameters include accuracy, accuracy threshold, F1 score, F1 score threshold, precision, recall, and average precision.

[0121] Specifically, accuracy:

[0122] ;

[0123] Precision rate represents the proportion of samples that are actually positive out of all samples that are predicted to be positive.

[0124] Accuracy:

[0125] ;

[0126] In this context, TP represents true positives, TN represents true negatives, FP represents false positives, and FN represents false negatives.

[0127] Recall:

[0128] ;

[0129] Recall rate represents the proportion of samples that are actually positive that are correctly predicted as positive.

[0130] F1 Score:

[0131] ;

[0132] The F1 score is the harmonic mean of precision and recall, used to measure the balance between precision and recall in a model.

[0133] Average Precision:

[0134] ;

[0135] In the formula, P(R) represents the average precision; P(R) is a function of precision with respect to recall R.

[0136] In this embodiment, the Elasticsearch search engine is used, which is more suitable for scenarios with comprehensive search functions, such as full-text search, vector search, and data analysis. It exhibits excellent performance in vector search, especially on large-scale datasets. It further enhances performance through techniques such as concurrent segment search. In some tests, Elasticsearch's vector search speed is 12 times faster than OpenSearch.

[0137] Currently, there are no commercially available methods using Sentence Transformer for semantically enhanced vulnerability retrieval. Using Sentence Transformer trained on a Siamese network architecture, sentence pairs are taken as input, and pooling layers simplify the BERT output into fixed-length sentence vectors, thereby optimizing sentence similarity calculation. This approach is primarily used for tasks requiring efficient sentence similarity computation. The semantically enhanced vulnerability information retrieval method provided in this embodiment uses the Sentence Transformer model to predict the similarity of vulnerability descriptions and achieves better performance than linear models. This improves the performance of automated vulnerability description similarity assessment, explores the effectiveness of language models in extracting key aspects from PoC reports, and provides a new approach to combining language models with security vulnerability analysis.

[0138] In summary, this embodiment introduces a semantically enhanced vulnerability information retrieval method. Furthermore, this invention is the first attempt to apply SentenceTransformer to the field of vulnerability retrieval, pioneering the combination of natural language processing technology and vulnerability information retrieval, bringing a completely new solution to the vulnerability retrieval field. Experimental verification shows that the semantically enhanced retrieval method of this invention significantly outperforms traditional keyword matching and linear models, providing a more efficient and accurate method for automated vulnerability description similarity assessment.

[0139] Example 2

[0140] This invention provides a semantically enhanced vulnerability information retrieval system, comprising:

[0141] The request retrieval module is used to retrieve users' vulnerability retrieval requests;

[0142] The vectorization module is used to input the user's vulnerability retrieval request into the trained SentenceTransformer model for vectorization processing to obtain the user's vulnerability retrieval request vector.

[0143] The retrieval module uses the ElasticSearch engine to perform semantic similarity calculations between the user's vulnerability retrieval request vector and the pre-stored vulnerability vector set in the vulnerability retrieval database, and obtains the vulnerability retrieval results.

[0144] The specific functions of each module described above are explained in the relevant content of the method in Embodiment 1, and will not be repeated here.

[0145] Example 3

[0146] This embodiment describes an electronic device, including: a memory and a processor;

[0147] The memory is used to store programs;

[0148] The processor is used to execute the program to implement the semantically enhanced vulnerability information retrieval method in Embodiment 1.

[0149] Example 4

[0150] This embodiment also introduces a readable storage medium on which a computer program is stored, characterized in that, when the computer program is executed by a processor, it implements the semantically enhanced vulnerability information retrieval method in Embodiment 1.

[0151] Example 5

[0152] This embodiment also introduces a computer program product, including a computer program that, when executed by a processor, implements the semantically enhanced vulnerability information retrieval method in Embodiment 1.

[0153] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0154] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0155] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0156] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims. All of these forms are within the protection scope of the present invention.

Claims

1. A semantically enhanced vulnerability information retrieval method, characterized in that, include: Obtain the user's vulnerability search request; The user's vulnerability search request is input into the trained Sentence Transformer model and vectorized to obtain the user's vulnerability search request vector. The ElasticSearch engine is used to calculate the semantic similarity between the user's vulnerability search request vector and the pre-stored vulnerability vector set in the vulnerability search database to obtain the vulnerability search results. The training process of the Sentence Transformer model includes: Obtain the vulnerability dataset and clean the vulnerability dataset to obtain the cleaned vulnerability dataset; A pre-training dataset is constructed based on the cleaned vulnerability dataset; The pre-trained dataset is divided into a training set, a validation set, and a test set according to a first preset ratio; The training set is input into the Sentence Transformer model, and the model is trained using the contrastive loss function to obtain the optimal parameters. Based on the optimal parameters, the first Sentence Transformer model is obtained. The validation set is input into the first Sentence Transformer model, and the hyperparameters of the model are tuned using a binary classification evaluator to obtain the second Sentence Transformer model. The second Sentence Transformer model is evaluated based on the test set and a binary classifier evaluator to obtain the trained Sentence Transformer model.

2. The semantically enhanced vulnerability information retrieval method according to claim 1, characterized in that, The vulnerability dataset includes vulnerability description datasets for KEV, CVE, NVD, ExploitDB, and Openwall; each vulnerability description dataset contains a corresponding vulnerability identifier, vulnerability type, release and update time, vulnerability description, and version information; the vulnerability description datasets for CVE, NVD, ExploitDB, and Openwall also include the names of the affected components.

3. The semantically enhanced vulnerability information retrieval method according to claim 2, characterized in that, The pre-training dataset constructed based on the cleaned vulnerability dataset includes: Positive and negative samples are constructed based on the cleaned vulnerability dataset; The positive and negative samples are combined according to a second preset ratio to obtain the pre-training dataset; The construction of positive samples includes: Extract similar data sets from the cleaned vulnerability dataset; The similar dataset includes: a first similar dataset, a second similar dataset, and a third similar dataset; The first similar dataset includes multiple vulnerability descriptions with the same vulnerability identifier in KEV and NVD; the second similar dataset includes multiple vulnerability descriptions with the same vulnerability identifier and the same affected component name in CVE, NVD, ExploitDB, and Openwall; and the third similar dataset includes multiple vulnerability descriptions with the same vulnerability type and the same affected component name in CVE, NVD, ExploitDB, and Openwall. The data from the first similar dataset, the second similar dataset, and the third similar dataset are paired up as positive samples; The construction of negative samples includes: Extract vulnerability description data with different component names from the cleaned vulnerability dataset, and pair the vulnerability description data with different component names together as negative samples.

4. The semantically enhanced vulnerability information retrieval method according to claim 3, characterized in that, The vulnerability retrieval database includes: a comprehensive vulnerability dataset and a pre-stored vulnerability vector set corresponding to the comprehensive vulnerability dataset; wherein, the comprehensive vulnerability dataset is obtained by completing the component names and vulnerability verification configuration requirements of the vulnerability dataset; The acquisition of the pre-stored vulnerability vector set includes: The vulnerability descriptions and affected component names in the vulnerability description dataset of the comprehensive vulnerability dataset are combined to obtain the combined dataset. The combined dataset is vectorized to obtain a pre-stored vulnerability vector set.

5. The semantically enhanced vulnerability information retrieval method according to claim 4, characterized in that, The contrastive loss function is expressed as follows: ； ； in, Represents the contrastive loss function of the Sentence Transformer model; This represents the SentenceTransformer model; i represents the number of sequences; P represents the total number of samples; Let Y represent the loss of the i-th sample; Y represents the label between sample pairs; when Y=0, it means that the sample pairs are similar and are positive samples; when Y=1, it means that the sample pairs are dissimilar and are negative samples. and These are the loss functions for positive and negative samples, respectively. These are two different samples; This represents the distance between sample pairs calculated using the Sentence Transformer model W.

6. The semantically enhanced vulnerability information retrieval method according to claim 5, characterized in that, The loss functions for the positive and negative samples are expressed as follows: ； ； Where m is a preset boundary value.

7. A semantically enhanced vulnerability information retrieval system, characterized in that, include: The request retrieval module is used to retrieve users' vulnerability retrieval requests; The vectorization module is used to input the user's vulnerability retrieval request into the trained Sentence Transformer model for vectorization processing to obtain the user's vulnerability retrieval request vector. The retrieval module uses the ElasticSearch engine to perform semantic similarity calculations between the user's vulnerability retrieval request vector and the pre-stored vulnerability vector set in the vulnerability retrieval database, and obtains the vulnerability retrieval results.

8. An electronic device, characterized in that, include: Memory and processor; The memory is used to store programs; The processor is used to execute the program to implement the semantically enhanced vulnerability information retrieval method as described in any one of claims 1-6.

9. A readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the semantically enhanced vulnerability information retrieval method as described in any one of claims 1-6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the semantically enhanced vulnerability information retrieval method as described in any one of claims 1-6.

Images