Vulnerability early warning method and system based on asset fingerprint driving

Abstract

The invention provides a vulnerability early warning method and system based on asset fingerprint driving. The method comprises the following steps: acquiring vulnerability information data from a plurality of vulnerability information sources; asset fingerprint information of assets in the target system is collected; based on semantic analysis, version comparison and a fingerprint matching algorithm, performing fine-grained association matching on the vulnerability information data and asset fingerprint information, and identifying target assets affected by vulnerabilities; performing influence range analysis, risk level evaluation and repair priority ranking on the target assets to generate a vulnerability influence analysis report; based on the vulnerability impact analysis report, sending an early warning notification to a related person in charge, and automatically generating an electronic work order; the processing state of the electronic work order is tracked, the repair progress is recorded, and full-life-cycle closed-loop management of vulnerabilities from recognition to repair is achieved. The missing report rate and the false report rate are effectively reduced, and compared with manual matching, the full-automatic mode can form a complete closed loop, and the early warning efficiency is improved.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a vulnerability early warning method and system based on asset fingerprinting. Background Technology

[0002] In the field of cybersecurity operations and maintenance, timely and accurate discovery and remediation of asset vulnerabilities is a critical aspect of ensuring system security. Traditional vulnerability management methods typically rely on security personnel manually obtaining information from multiple vulnerability intelligence sources (such as CVE, CNVD, CNNVD, etc.) and comparing it with a known asset inventory. However, this approach has significant limitations.

[0003] First, the manual matching process is crude and prone to two extremes: one is a large number of false positives, marking irrelevant assets as affected and wasting valuable operational resources; the other is dangerous false negatives, failing to identify assets with real risks and creating security vulnerabilities. Second, from vulnerability identification and impact analysis to remediation tracking, multiple stages rely on manual intervention. This model is not only inefficient and slow to respond, but also struggles to guarantee the integrity and traceability of the process in complex network environments, making it impossible to achieve full lifecycle management of vulnerabilities. Summary of the Invention

[0004] This invention provides a vulnerability early warning method and system based on asset fingerprinting, which solves the defects of existing technology that rely on manual matching for vulnerability management, resulting in poor accuracy, low efficiency and inability to trace the source.

[0005] In a first aspect, the present invention provides a vulnerability early warning method based on asset fingerprinting, comprising: Obtain vulnerability intelligence data from multiple vulnerability intelligence sources; Collect asset fingerprint information of assets in the target system, wherein the asset fingerprint information includes at least one of the following: operating system, service version, open port, and middleware; Based on semantic analysis, version comparison and fingerprint matching algorithms, the vulnerability intelligence data and the asset fingerprint information are matched in a fine-grained manner to identify the target assets affected by the vulnerability. Perform impact scope analysis, risk level assessment and remediation priority ranking on the target assets, and generate a vulnerability impact analysis report; Based on the vulnerability impact analysis report, a warning notification is sent to the relevant responsible persons, and an electronic work order is automatically generated; Track the processing status of the electronic work orders, record the repair progress, and realize closed-loop management of the entire lifecycle of vulnerabilities from identification to repair.

[0006] According to the present invention, a vulnerability early warning method based on asset fingerprinting is provided, wherein the vulnerability intelligence data is finely correlated and matched with the asset fingerprint information based on semantic analysis, version comparison, and fingerprint matching algorithms, including: The affected software version information described in the vulnerability intelligence data is parsed and normalized to extract rule conditions containing version number ranges and specific version lists. The software version in the asset fingerprint information is matched with the rule conditions. If the software version falls within the version number range or exists in the specific version list, the asset is determined to be a potentially affected asset. Based on other attributes in the asset fingerprint information, a fingerprint matching algorithm is used for secondary verification to confirm whether the potentially affected asset is the target asset affected by the vulnerability.

[0007] According to the present invention, a vulnerability early warning method based on asset fingerprinting is provided, wherein matching the software version in the asset fingerprint information with the rule conditions includes: The software version number in the asset fingerprint information is parsed into a standard format that conforms to the semantic version specification; When the rule condition is a continuous version range, a comparison operator is applied to determine whether the software version number falls within the continuous version range; When the rule condition is a discrete list of specific versions, string matching or wildcard matching is applied to determine whether the software version number exists in the list of specific versions.

[0008] According to the present invention, a vulnerability early warning method based on asset fingerprinting is provided, wherein the step of performing secondary verification using a fingerprint matching algorithm based on other attributes in the asset fingerprint information to confirm whether the potentially affected asset is the target asset affected by the vulnerability includes: Obtain the vulnerability triggering conditions recorded in the vulnerability intelligence data, the triggering conditions including: open ports, service configurations, and system components; The corresponding attributes in the asset fingerprint information are compared with the vulnerability triggering conditions. The corresponding attributes include: the list of open ports of the asset, the configuration information of the running services, and the list of installed system components. If the corresponding attribute meets the vulnerability triggering condition, then the potentially affected asset is confirmed as the target asset affected by the vulnerability.

[0009] According to the present invention, a vulnerability early warning method based on asset fingerprinting is provided, wherein the step of performing impact scope analysis, risk level assessment, and remediation priority ranking on the target asset to generate a vulnerability impact analysis report includes: Based on the identity information of the target assets, the affected business systems, network areas and the number of assets are counted to achieve impact range analysis; By combining the baseline score of the vulnerability itself with the business importance weight of the target asset, a comprehensive risk value is calculated to achieve risk level assessment; Based on the comprehensive risk value, all affected target assets are sorted in descending order to generate a remediation priority list; wherein, the vulnerability impact analysis report includes at least the scope of impact, comprehensive risk value, and remediation priority list.

[0010] According to the vulnerability early warning method based on asset fingerprinting provided by the present invention, the automatic generation of electronic work orders includes: Call a predefined electronic work order template, which includes a vulnerability description field, an affected asset information field, a remediation suggestion field, and a responsible person field; Extract the corresponding information from the vulnerability impact analysis report and the fingerprint information of the target asset, and automatically fill it into the electronic work order template to generate an electronic work order.

[0011] According to the present invention, a vulnerability early warning method based on asset fingerprinting is provided, wherein tracking the processing status of the electronic work order and recording the remediation progress includes: Receive work order status update information returned by the processing terminal, the work order status update information includes pending, processing, repaired, and closed; The work order status update information is associated with the corresponding electronic work order and recorded in the vulnerability management database to update the vulnerability remediation progress. When the work order status is updated to "repaired", a repair verification process for the corresponding asset is triggered, and the work order status is updated based on the verification result.

[0012] According to the asset fingerprint-driven vulnerability early warning method provided by the present invention, the step of acquiring vulnerability intelligence data from multiple vulnerability intelligence sources includes: Vulnerability data is obtained in parallel from multiple vulnerability intelligence sources through API calls and web crawling technology. The vulnerability data is parsed to extract key field information, and fields from different sources are mapped to a unified standardized field structure to obtain vulnerability intelligence data.

[0013] According to the present invention, a vulnerability early warning method based on asset fingerprinting is provided, wherein collecting asset fingerprint information of assets in the target system includes: Actively scan to obtain information on open ports, running services, and version of assets in the network; Passive traffic analysis is used to obtain the asset communication characteristics and protocol fingerprints exposed in network traffic; Connect to the asset management system to obtain the configuration information and attribute data of registered assets; The asset data from the active scanning, passive traffic analysis, and management system are merged and processed to generate unified asset fingerprint information.

[0014] Secondly, the present invention provides a vulnerability early warning system based on asset fingerprinting, comprising: The acquisition module is used to acquire vulnerability intelligence data from multiple vulnerability intelligence sources; The acquisition module is used to acquire asset fingerprint information of assets in the target system. The asset fingerprint information includes at least one of the following: operating system, service version, open port, and middleware. The matching module is used to perform fine-grained association matching between the vulnerability intelligence data and the asset fingerprint information based on semantic analysis, version comparison and fingerprint matching algorithms, so as to identify the target assets affected by the vulnerability. The generation module is used to perform impact scope analysis, risk level assessment, and remediation priority ranking on the target asset, and generate a vulnerability impact analysis report. The early warning module is used to send early warning notifications to relevant responsible persons based on the vulnerability impact analysis report and automatically generate electronic work orders; The tracking module is used to track the processing status of the electronic work order, record the repair progress, and realize closed-loop management of the entire lifecycle of the vulnerability from identification to repair.

[0015] Thirdly, the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the asset fingerprint-driven vulnerability warning method as described above.

[0016] Fourthly, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the asset fingerprint-driven vulnerability warning method as described above.

[0017] Fifthly, the present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the asset fingerprint-driven vulnerability warning method as described above.

[0018] This invention provides a vulnerability early warning method and system based on asset fingerprinting. By collecting asset fingerprint information and performing fine-grained association based on semantic analysis, version comparison, and fingerprint matching algorithms, it significantly reduces false positives and false negatives compared to manual matching. Furthermore, it can automatically generate vulnerability impact analysis reports and electronic work orders, accelerating emergency response. By tracking the work order processing status, a complete management loop for the entire early warning process is formed, greatly improving the efficiency of network security early warning. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0020] Figure 1 This is a flowchart illustrating the vulnerability warning method based on asset fingerprinting provided in this embodiment; Figure 2 This is a schematic diagram of the structure of the vulnerability early warning system based on asset fingerprinting provided in this embodiment; Figure 3 This is a schematic diagram of the structure of the electronic device provided in this embodiment. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0022] Figure 1 This is a flowchart illustrating the vulnerability warning method based on asset fingerprinting provided in this embodiment.

[0023] like Figure 1 As shown in the embodiment of the present invention, the vulnerability early warning method based on asset fingerprinting is applied to an e-commerce platform. This platform includes various assets such as web servers, database servers, and middleware servers, covering core business lines such as transaction payment, user management, and product management. This embodiment is required to achieve full lifecycle management of vulnerabilities from identification to remediation, mainly including the following steps: 101. Obtain vulnerability intelligence data from multiple vulnerability intelligence sources.

[0024] Specifically, for intelligence sources that support API access (such as CVE and CNVD), first apply for API keys and access permissions through the intelligence source platform; then, according to the API documentation of each intelligence source, set the request parameters and periodically initiate HTTP / HTTPS requests to obtain structured vulnerability data.

[0025] For intelligence sources without API interfaces, a distributed crawling framework is adopted. First, crawling rules are defined; then, crawling strategies are set. The crawled content includes unstructured or semi-structured data such as vulnerability names, affected software and versions, vulnerability triggering conditions, and remediation suggestions.

[0026] The collected multi-source data undergoes unified format conversion and cleaning. First, key fields are extracted from the collected data, including unique vulnerability identifier, vulnerability name, affected software name, affected version range, vulnerability description, CVSS benchmark score, vulnerability triggering conditions, and remediation suggestions. Then, a unified standardized field structure is established, mapping fields from different sources to this structure. A rule engine is used to deduplicate and complete the data, ultimately generating structured vulnerability intelligence data, which is stored in the vulnerability intelligence database.

[0027] 102. Collect asset fingerprint information of assets in the target system. Asset fingerprint information includes at least one of the following: operating system, service version, open port, and middleware.

[0028] A triple data collection approach is adopted, combining active scanning, passive traffic analysis, and integration with the asset management system, covering all visible assets within the network. The specific operations are as follows: Active scanning and collection: Using network scanning tools, probes are initiated based on the TCP / UDP protocol.

[0029] Open port detection: Using TCP SYN scanning, SYN packets are sent to common ports in the target IP segment. The returned SYN-ACK packets determine whether the port is open, and the list of open ports is recorded.

[0030] Service and version detection: Send a specific protocol request to the open port to obtain the banner information returned by the service, and parse it to obtain the service name and version.

[0031] Operating system detection: By analyzing the TTL value, window size, and other characteristics of TCP packets, and combining this with an operating system fingerprint database, the operating system type of the asset can be inferred.

[0032] Passive traffic analysis and collection: Deploy traffic collection devices at core network nodes (such as switch mirror ports and firewall exits) to capture all network traffic packets and extract asset characteristics through a traffic analysis engine.

[0033] Communication feature extraction: Analyze the source IP, destination IP, and port mapping relationships of TCP / UDP sessions to determine the network communication range of the asset.

[0034] Protocol fingerprint extraction: Parse application layer protocol data, such as obtaining the middleware version from the "Server" field of the HTTP header, extracting the operating system version information from the SMB protocol data packet, and obtaining the server domain name and the organization to which it belongs from the "Subject" field of the SSL certificate.

[0035] Asset management system integration: Obtain registered asset information through two methods.

[0036] API Integration: Call the open API of the asset management system to obtain the basic attributes of the asset (such as asset name, IP address, business system to which it belongs, responsible person, physical location) and configuration information (such as operating system version, list of installed software).

[0037] Direct database connection: After authorization, the system directly connects to the asset management system's database via JDBC / ODBC protocol to read asset data tables and supplement fields not covered by the API.

[0038] Asset data collected from multiple sources is integrated to generate unified asset fingerprint information. Specifically, using "asset IP address + MAC address" as a unique identifier, data on the same asset obtained from active scanning, passive traffic analysis, and the asset management system are associated to establish a unified data entry. When data in the same field from different sources is inconsistent, a priority rule is used to determine priority: service version and open port data from active scanning have the highest priority; middleware version and communication characteristics from passive traffic analysis are next; and basic attributes from the asset management system have the lowest priority. Missing fields are supplemented. For example, if the asset IP obtained from passive traffic analysis lacks "responsible person" information, it is extracted from the associated data in the asset management system; service versions not detected by active scanning are obtained by parsing the protocol data packets from passive traffic analysis. The final asset fingerprint information includes the following core fields: unique asset identifier, asset name, operating system type and version, list of open ports, service list, middleware list, affiliated business system, network area, responsible person and contact information, and is stored in the asset fingerprint database.

[0039] 103. Based on semantic analysis, version comparison and fingerprint matching algorithms, vulnerability intelligence data is correlated and matched with asset fingerprint information in a fine-grained manner to identify target assets affected by vulnerabilities.

[0040] Specifically, the "Affected Software and Versions" field in the vulnerability intelligence data is parsed to generate matching rules. The specific steps are as follows: Using a Named Entity Recognition (NLP) model, the name and version information of the affected software are extracted from the vulnerability description and the affected software field.

[0041] The extracted version information is converted into rule conditions in a unified format: Continuous version ranges are represented in the format "[starting version, ending version]". Discrete lists of specific versions are represented in the format "{version 1, version 2, ..., version n}".

[0042] The software version in the asset fingerprint is matched with normalized rule conditions to screen potentially affected assets. The specific steps are as follows: The software version number in the asset fingerprint is parsed into a format conforming to semantic versioning specifications, i.e., "major version number.minor version number.revision number"; for non-standard version numbers, the prefix is ​​removed before conversion. A "segmented comparison method" is used to determine if the asset version is within a range: the asset version number is compared sequentially with the start and end versions of the range in the order of "major version number → minor version number → revision number"; if the major version number of the asset version is greater than the major version number of the start version and less than the major version number of the end version, it is determined to be within the range; if the major version numbers are equal, the minor version numbers are compared; if the minor version number meets the above condition, it is determined to be within the range; if both the major and minor version numbers are equal, the revision numbers are compared; if the revision number is greater than or equal to the revision number of the start version and less than or equal to the revision number of the end version, it is determined to be within the range.

[0043] For lists without wildcards, exact string matching is used; if the asset version is exactly the same as any version in the list, a match is determined. For lists containing wildcards, a "prefix matching method" is used, comparing whether the major version number and the minor version number are the same, while the revision number is ignored.

[0044] By comparing the vulnerability trigger conditions with other attributes of the asset fingerprint, it is confirmed whether the potentially affected asset is the actual target asset. The specific operation is as follows: Extracting vulnerability trigger conditions: Extract trigger conditions other than version from vulnerability intelligence data, including open ports, service configurations, and system components; for example, the trigger conditions for a certain vulnerability are "open port 8080 + enable Tomcat management console + do not change the default password", and the trigger conditions for another vulnerability are "install JRE 1.8.0_201 or earlier + run Jenkins service".

[0045] Asset Attribute Comparison: Compare the corresponding attributes in the asset fingerprint with the trigger conditions one by one. Open Port Comparison: Check if the "Open Port List" of the asset fingerprint contains the ports specified in the trigger conditions. Service Configuration Comparison: Determine if the trigger conditions are met by actively scanning service configuration information. System Component Comparison: Check if the "Installed Software List" and "Middleware List" of the asset fingerprint contain the system components and versions specified in the trigger conditions. Target Asset Confirmation: Only when an asset meets the criteria of "version matching + all trigger conditions satisfied" is it confirmed as a "target asset affected by the vulnerability"; if any trigger condition is not met, the asset is excluded to avoid false positives.

[0046] 104. Conduct impact scope analysis, risk level assessment, and remediation priority ranking for the target assets, and generate a vulnerability impact analysis report.

[0047] Specifically, the impact scope analysis involves analyzing the target asset's identity information and its business relationships. This includes statistically analyzing the business and network scope affected by the vulnerability. For example, using the "belonging business system" field in the asset fingerprint as the key, the database of the business systems is linked to count the number of affected assets under each business system. Based on the "network region" field in the asset fingerprint, the number of affected assets in different regions is categorized and statistically analyzed. The impact scope is presented in tabular form in the report, including fields such as "business system name, number of affected assets, network region, and asset IP list," clearly demonstrating the extent to which the vulnerability impacts business operations.

[0048] Risk Level Assessment. Considering both the inherent harm of the vulnerability and the importance of the asset to the business, calculate the overall risk value of the target asset. Specifically, extract the CVSS 3.1 baseline score from the vulnerability intelligence data; this score reflects the severity of the vulnerability itself. Establish a weighted assessment system, setting weight values ​​based on the core nature of the business system to which the asset belongs, data sensitivity, and service availability requirements. This includes core business assets, important business assets, and general business assets. Calculate the overall risk value using the formula: "Overall Risk Value = CVSS Baseline Score × Business Importance Weight," and round the result to one decimal place.

[0049] Prioritization of remediation. Target assets are sorted based on their overall risk value, generating a remediation priority list. Specifically, they are sorted from highest to lowest overall risk value, with higher overall risk values ​​indicating higher remediation priority. If multiple assets have the same overall risk value, they are sorted from highest to lowest number of affected assets; if the number of affected assets is also the same, they are sorted by the risk level of the network region to which the asset belongs. The remediation priorities are presented in a list format in the report, including fields such as "priority ranking, asset IP, overall risk value, CVSS score, business system, and remediation recommendation," clearly specifying the remediation order for each asset.

[0050] The final report is generated. In addition to the above, the vulnerability impact analysis report should also include "basic vulnerability information" (unique vulnerability identifier, vulnerability name, vulnerability description, release time), "overall statistics" (total number of affected assets, percentage of assets at each risk level), and "remediation timeframe recommendations." The report format should be PDF or HTML, and it will be automatically stored in the report database and synchronized to the security management platform.

[0051] 105. Based on the vulnerability impact analysis report, send early warning notices to relevant responsible persons and automatically generate electronic work orders.

[0052] Specifically, the system extracts the "responsible person and contact information" of the target asset from the asset fingerprint, and simultaneously links it to the information of the business system's responsible person. Notification recipients include the person directly responsible for the asset, the business system's responsible person, and the security operations team. It supports multi-channel notifications, allowing recipients to choose based on their preset preferences: Emergency Notification: Sends SMS, corporate messages, and emails simultaneously to ensure immediate receipt; Regular Notification: Sends corporate messages and emails; Common Notification: Sends email only. The notification content includes "warning title, basic vulnerability information, details of affected assets, comprehensive risk value, suggested remediation timeframe, and a link to view the full report," ensuring concise information and highlighting key details.

[0053] Call a predefined template, extract information from the report and asset fingerprint to populate and generate a standardized work order. For example, call the "Vulnerability Repair Work Order Template" from the work order template library. This template contains fixed fields: work order number, vulnerability information area, asset information area, repair requirements area, and work order status.

[0054] Information is extracted from the vulnerability impact analysis report and asset fingerprint database through the data interface and populated into the corresponding fields of the template: "Vulnerability Unique Identifier, Vulnerability Name, CVSS Score, and Vulnerability Description" are extracted from the vulnerability intelligence data, and "Remediation Suggestions" are extracted from the report; Asset Information Area: "Affected Asset IP, Belonging Business System, and Responsible Person" are extracted from the asset fingerprint, and "Network Area" is extracted from the report; Remediation Requirements Area: The remediation time limit is set according to the comprehensive risk value, and the acceptance standard is uniformly set as "Rescan to confirm that the vulnerability no longer exists after remediation".

[0055] After an electronic work order is generated, it is automatically pushed to the work order management system and simultaneously pushed to the work order system account of the asset manager; at the same time, the work order information is stored in the vulnerability management database and associated with vulnerability information.

[0056] 106. Track the processing status of electronic work orders, record the repair progress, and realize closed-loop management of the entire lifecycle of vulnerabilities from identification to repair.

[0057] Specifically, it receives work order status updates in real time and synchronizes them to the vulnerability management database. Specific operations include: Status update triggered. The responsible person logs into the work order management system and manually selects the status (pending, processing, pending verification, closed, rejected) when processing a work order, and fills in a status change description. When the work order is not processed by the repair deadline, the system automatically updates the status from "pending" to "timeout" and sends a timeout reminder to the responsible person.

[0058] Status information reception and association. The work order management system pushes status update information (including work order number, updated status, update time, operator, and change description) to the vulnerability warning system via API interface; the system associates the "work order number" with the corresponding work order record in the vulnerability management database and updates the "work order status", "last update time", and "status change log" fields.

[0059] The entire vulnerability remediation process is recorded using multi-dimensional information. Specific operations include extracting key progress node information from the work order status change log, including "work order receipt time (time when status changes to 'pending'), processing start time (time when status changes to 'processing'), remediation completion time (time when status changes to 'pending verification'), and verification pass time (time when status changes to 'closed')." The vulnerability management platform's dashboard displays the remediation progress of each work order in a timeline format, including "node name, time, operator, and change description," allowing security administrators to view remediation progress in real time. Simultaneously, daily / weekly "vulnerability remediation progress statistics reports" are generated, including metrics such as "number of closed work orders, number of work orders in progress, number of overdue work orders, and average remediation time."

[0060] Verify assets claimed to be repaired to ensure vulnerabilities are truly eliminated, forming a closed-loop management system. Specific operations include: when a work order status is updated to "Pending Verification," the system automatically triggers the verification process, generates a verification task, and assigns it to security verification personnel. Verification employs a combination of automated scanning and manual spot checks: vulnerability scanning tools are invoked to re-execute vulnerability detection on the target asset to check if vulnerabilities still exist; if the scan result shows "No vulnerability detected," verification is preliminarily considered successful; if vulnerabilities are still detected, verification is considered a failure. For core business assets, after automated scanning passes, security personnel log in to the asset and manually check whether remediation measures have been implemented to ensure no omissions. The work order status is updated to "Closed," and the vulnerability is marked as "Repair Completed" in the vulnerability management database, recording the verification time and verifier. The work order status is rolled back to "Processing," and a "Verification Failure Notification" is sent to the responsible person, explaining the reason for the failure and requesting reprocessing; after the responsible person resubmits the remediation, the verification process is retried until verification passes.

[0061] Once the work order status changes to "closed" or "rejected", the system archives the entire lifecycle data of the vulnerability (vulnerability intelligence, asset fingerprint, matching results, analysis report, work order record, verification results) to the historical database and retains it for at least 3 years for subsequent auditing and vulnerability trend analysis.

[0062] This embodiment employs fine-grained matching through "version comparison + secondary fingerprint verification," significantly reducing false positive and false negative rates compared to traditional manual matching. The entire process—vulnerability intelligence gathering, asset matching, report generation, and work order push—is automated, reducing the time from vulnerability discovery to triggering an alert to minutes, effectively improving efficiency compared to manual processing. Through work order tracking, remediation verification, and archiving, it ensures that each vulnerability is tracked to a closed loop, avoiding the problem of "discovering but not fixing," and enhancing overall network security protection capabilities.

[0063] Figure 2 This is a schematic diagram of the structure of the vulnerability early warning system based on asset fingerprinting provided in this embodiment.

[0064] like Figure 2 As shown in the figure, this embodiment provides a vulnerability early warning system based on asset fingerprinting, including: The acquisition module 201 is used to acquire vulnerability intelligence data from multiple vulnerability intelligence sources; The acquisition module 202 is used to acquire asset fingerprint information of assets in the target system. The asset fingerprint information includes at least one of the following: operating system, service version, open port, and middleware. The matching module 203 is used to perform fine-grained association matching between the vulnerability intelligence data and the asset fingerprint information based on semantic analysis, version comparison and fingerprint matching algorithms, and identify the target assets affected by the vulnerability. The generation module 204 is used to perform impact scope analysis, risk level assessment and remediation priority ranking on the target asset, and generate a vulnerability impact analysis report. The early warning module 205 is used to send early warning notifications to relevant responsible persons based on the vulnerability impact analysis report and automatically generate electronic work orders; The tracking module 206 is used to track the processing status of the electronic work order, record the repair progress, and realize closed-loop management of the entire lifecycle of the vulnerability from identification to repair.

[0065] Figure 3 This is a schematic diagram of the structure of the electronic device provided in this embodiment.

[0066] like Figure 3As shown, the electronic device may include a processor 301, a communications interface 302, a memory 303, and a communication bus 304. The processor 301, communications interface 302, and memory 303 communicate with each other via the communication bus 304. The processor 301 can invoke logical instructions stored in the memory 303 to execute a vulnerability alerting method based on asset fingerprinting.

[0067] Furthermore, the logical instructions in the aforementioned memory 303 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0068] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is able to execute the asset fingerprint-driven vulnerability warning method provided by the above methods.

[0069] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the asset fingerprint-driven vulnerability warning method provided by the above methods.

[0070] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0071] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0072] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A vulnerability early warning method based on asset fingerprinting, characterized in that, include: Obtain vulnerability intelligence data from multiple vulnerability intelligence sources; Collect asset fingerprint information of assets in the target system, wherein the asset fingerprint information includes at least one of the following: operating system, service version, open port, and middleware; Based on semantic analysis, version comparison and fingerprint matching algorithms, the vulnerability intelligence data and the asset fingerprint information are matched in a fine-grained manner to identify the target assets affected by the vulnerability. Perform impact scope analysis, risk level assessment and remediation priority ranking on the target assets, and generate a vulnerability impact analysis report; Based on the vulnerability impact analysis report, a warning notification is sent to the relevant responsible persons, and an electronic work order is automatically generated; Track the processing status of the electronic work orders, record the repair progress, and realize closed-loop management of the entire lifecycle of vulnerabilities from identification to repair.

2. The vulnerability early warning method based on asset fingerprinting according to claim 1, characterized in that, The method of performing fine-grained association matching between the vulnerability intelligence data and the asset fingerprint information based on semantic analysis, version comparison, and fingerprint matching algorithms includes: The affected software version information described in the vulnerability intelligence data is parsed and normalized to extract rule conditions containing version number ranges and specific version lists. The software version in the asset fingerprint information is matched with the rule conditions. If the software version falls within the version number range or exists in the specific version list, the asset is determined to be a potentially affected asset. Based on other attributes in the asset fingerprint information, a fingerprint matching algorithm is used for secondary verification to confirm whether the potentially affected asset is the target asset affected by the vulnerability.

3. The vulnerability early warning method based on asset fingerprinting according to claim 2, characterized in that, The step of matching the software version in the asset fingerprint information with the rule conditions includes: The software version number in the asset fingerprint information is parsed into a standard format that conforms to the semantic version specification; When the rule condition is a continuous version range, a comparison operator is applied to determine whether the software version number falls within the continuous version range; When the rule condition is a discrete list of specific versions, string matching or wildcard matching is applied to determine whether the software version number exists in the list of specific versions.

4. The vulnerability early warning method based on asset fingerprinting according to claim 2, characterized in that, The step of using a fingerprint matching algorithm for secondary verification based on other attributes in the asset fingerprint information to confirm whether the potentially affected asset is the target asset affected by the vulnerability includes: Obtain the vulnerability triggering conditions recorded in the vulnerability intelligence data, the triggering conditions including: open ports, service configurations, and system components; The corresponding attributes in the asset fingerprint information are compared with the vulnerability triggering conditions. The corresponding attributes include: the list of open ports of the asset, the configuration information of the running services, and the list of installed system components. If the corresponding attribute meets the vulnerability triggering condition, then the potentially affected asset is confirmed as the target asset affected by the vulnerability.

5. The vulnerability early warning method based on asset fingerprinting according to claim 1, characterized in that, The process of analyzing the impact scope, assessing the risk level, and prioritizing remediation for the target asset, and generating a vulnerability impact analysis report, includes: Based on the identity information of the target assets, the affected business systems, network areas and the number of assets are counted to achieve impact range analysis; By combining the baseline score of the vulnerability itself with the business importance weight of the target asset, a comprehensive risk value is calculated to achieve risk level assessment; Based on the comprehensive risk value, all affected target assets are sorted in descending order to generate a remediation priority list; wherein, the vulnerability impact analysis report includes at least the scope of impact, comprehensive risk value, and remediation priority list.

6. The vulnerability early warning method based on asset fingerprinting according to claim 1, characterized in that, The automatic generation of electronic work orders includes: Call a predefined electronic work order template, which includes a vulnerability description field, an affected asset information field, a remediation suggestion field, and a responsible person field; Extract the corresponding information from the vulnerability impact analysis report and the fingerprint information of the target asset, and automatically fill it into the electronic work order template to generate an electronic work order.

7. The vulnerability early warning method based on asset fingerprinting according to claim 1, characterized in that, The tracking of the processing status of the electronic work order and recording of the repair progress includes: Receive work order status update information returned by the processing terminal, the work order status update information includes pending, processing, repaired, and closed; The work order status update information is associated with the corresponding electronic work order and recorded in the vulnerability management database to update the vulnerability remediation progress. When the work order status is updated to "repaired", a repair verification process for the corresponding asset is triggered, and the work order status is updated based on the verification result.

8. The vulnerability early warning method based on asset fingerprinting according to claim 1, characterized in that, The acquisition of vulnerability intelligence data from multiple vulnerability intelligence sources includes: Vulnerability data is obtained in parallel from multiple vulnerability intelligence sources through API calls and web crawling technology. The vulnerability data is parsed to extract key field information, and fields from different sources are mapped to a unified standardized field structure to obtain vulnerability intelligence data.

9. The vulnerability early warning method based on asset fingerprinting according to claim 1, characterized in that, The asset fingerprint information of the assets in the target system being collected includes: Actively scan to obtain information on open ports, running services, and version of assets in the network; Passive traffic analysis is used to obtain the asset communication characteristics and protocol fingerprints exposed in network traffic; Connect to the asset management system to obtain the configuration information and attribute data of registered assets; The asset data from the active scanning, passive traffic analysis, and management system are merged and processed to generate unified asset fingerprint information.

10. A vulnerability early warning system based on asset fingerprinting, characterized in that, include: The acquisition module is used to acquire vulnerability intelligence data from multiple vulnerability intelligence sources; The acquisition module is used to acquire asset fingerprint information of assets in the target system. The asset fingerprint information includes at least one of the following: operating system, service version, open port, and middleware. The matching module is used to perform fine-grained association matching between the vulnerability intelligence data and the asset fingerprint information based on semantic analysis, version comparison and fingerprint matching algorithms, so as to identify the target assets affected by the vulnerability. The generation module is used to perform impact scope analysis, risk level assessment, and remediation priority ranking on the target asset, and generate a vulnerability impact analysis report. The early warning module is used to send early warning notifications to relevant responsible persons based on the vulnerability impact analysis report and automatically generate electronic work orders; The tracking module is used to track the processing status of the electronic work order, record the repair progress, and realize closed-loop management of the entire lifecycle of the vulnerability from identification to repair.

Images