Information security vulnerability management method, device and equipment and readable storage medium

Abstract

The invention discloses an information security vulnerability management method, device and equipment and a readable storage medium, and the method comprises the steps: obtaining vulnerability data and enterprise asset data, and generating an asset fingerprint according to the enterprise asset data; performing fingerprint matching and semantic association on the vulnerability data and the asset fingerprint to obtain asset associated vulnerability data; and generating a vulnerability repair task according to the asset associated vulnerability data, and after the vulnerability repair task is completed, performing vulnerability reproduction verification and fingerprint comparison verification to obtain a vulnerability repair verification result. In information security vulnerability management, vulnerability matching is performed through a double-association mechanism of fingerprint matching and semantic association, so that the matching accuracy of assets and vulnerabilities is improved; automatic repair verification is carried out through a dual verification mechanism of vulnerability reproduction and fingerprint comparison, so that verification efficiency is improved, misjudgment is avoided, and the reliability of information security vulnerability management is effectively improved.

Description

Technical Field

[0001] This application relates to the field of cybersecurity, specifically to an information security vulnerability management method, apparatus, device, and readable storage medium. Background Technology

[0002] In the field of cybersecurity, with the acceleration of enterprise digital transformation and the increasing complexity of IT infrastructure, vulnerability management has become a core aspect of ensuring enterprise information security. Currently, enterprises need to efficiently integrate multi-source vulnerability data and quickly remediate security vulnerabilities to avoid potential security risks and economic losses. Authoritative vulnerability information platforms include internationally recognized platforms that compile and provide basic descriptions of various discovered vulnerabilities, affected product versions, remediation suggestions, and related technical documentation.

[0003] Current vulnerability management technologies typically involve manually comparing vulnerability data obtained from various platforms with the company's asset inventory. This is then combined with CVSS (Common Vulnerability Scoring System) rating criteria to determine the impact of vulnerabilities on company assets and prioritize remediation efforts. Based on the assessment results, a remediation plan is developed, and technical personnel execute patch installations, configuration modifications, and other remediation operations. After remediation, the effectiveness is confirmed through manual review or rescanning.

[0004] However, current vulnerability management methods relying on manual matching are prone to omissions, creating security blind spots. On one hand, when enterprise assets change dynamically (e.g., adding cloud servers or upgrading application software versions), asset lists are not updated in a timely manner, resulting in new asset vulnerabilities not being included in management. On the other hand, vulnerability matching relies solely on simple keyword comparisons of "product name + version," failing to identify complex scenarios. Furthermore, existing vulnerability management methods require manual rescanning or review after remediation tasks are completed, leading to low verification efficiency and a high risk of misjudgments. Therefore, existing technologies suffer from technical problems: manual management is prone to vulnerability matching omissions, creating security blind spots, and remediation verification is inefficient and prone to misjudgments. Consequently, the reliability of existing information security vulnerability management solutions is low and needs improvement. Summary of the Invention

[0005] This application provides an information security vulnerability management method, apparatus, device, and readable storage medium, which can solve the technical problems of low reliability of existing information security vulnerability management schemes, such as the tendency for manual management to miss vulnerability matching, creating security blind spots, and the low efficiency and easy misjudgment of repair verification.

[0006] In a first aspect, embodiments of this application provide an information security vulnerability management method, including: Obtain vulnerability data and enterprise asset data, and generate asset fingerprints based on the enterprise asset data; The vulnerability data and asset fingerprints are matched and semantically associated to obtain asset-related vulnerability data. Vulnerability remediation tasks are generated based on asset-related vulnerability data. After the vulnerability remediation tasks are completed, vulnerability reproduction verification and fingerprint comparison verification are performed to obtain vulnerability remediation verification results.

[0007] In conjunction with the first aspect, in one implementation, generating asset fingerprints based on enterprise asset data includes: Generate a basic fingerprint based on static asset data in the enterprise's asset data; Dynamic fingerprints are generated based on dynamic asset data in the enterprise's asset data. Asset fingerprints are determined based on basic and dynamic fingerprints; Static asset data includes the hardware model, operating system version, application software list, and / or open ports of each asset. Dynamic asset data includes the network communication protocols and / or data transmission frequencies of each asset.

[0008] In conjunction with the first aspect, in one implementation, vulnerability data and asset fingerprints are matched and semantically correlated to obtain asset-related vulnerability data, including: Preliminary correlation results were obtained by comparing and matching the affected asset fields and asset fingerprints in the vulnerability data; Semantic analysis is performed on the vulnerability description field and asset fingerprint in the vulnerability data to obtain vulnerability semantic information and asset dependency relationship. Semantic similarity matching is then performed on the vulnerability semantic information and asset dependency relationship to obtain semantic similarity. Based on the preliminary association results and semantic similarity, confidence scores are used to filter and obtain the matching association relationships between each asset and vulnerability data in the asset fingerprint; Asset-related vulnerability data is determined based on vulnerability data, asset fingerprints, and matching relationships.

[0009] In conjunction with the first aspect, in one implementation method, vulnerability remediation verification and fingerprint comparison verification are performed to obtain vulnerability remediation verification results, including: Vulnerability simulation and verification were performed in the test environment to obtain the results of vulnerability reproduction and verification. The affected asset fields in the patched vulnerability data are compared with the asset fingerprints to obtain fingerprint comparison verification results. The vulnerability remediation verification results are determined based on the vulnerability reproduction verification results and the fingerprint comparison verification results.

[0010] In conjunction with the first aspect, in one implementation method, the information security vulnerability management method further includes: When a company's assets change, the asset fingerprint is updated and fingerprint matching and semantic association are performed again to obtain updated asset association vulnerability data.

[0011] In conjunction with the first aspect, in one implementation method, the information security vulnerability management method further includes: Asset grade labels are obtained by classifying assets based on their business importance, data sensitivity, and risk tolerance in the asset fingerprint.

[0012] In conjunction with the first aspect, in one implementation method, obtaining vulnerability data includes: Obtain initial vulnerability data from multiple data sources; The initial vulnerability data is standardized and cleaned to remove duplicates, resulting in vulnerability data.

[0013] Secondly, embodiments of this application provide an information security vulnerability management device, comprising: The asset fingerprint generation module is used to obtain vulnerability data and enterprise asset data, and generate asset fingerprints based on the enterprise asset data. The asset vulnerability association module is used to perform fingerprint matching and semantic association between vulnerability data and asset fingerprints to obtain asset-associated vulnerability data. The vulnerability remediation verification module is used to generate vulnerability remediation tasks based on asset-related vulnerability data, and after the vulnerability remediation tasks are completed, to perform vulnerability reproduction verification and fingerprint comparison verification to obtain vulnerability remediation verification results.

[0014] Thirdly, embodiments of this application provide an information security vulnerability management device, which includes a processor, a memory, and an information security vulnerability management program stored in the memory and executable by the processor. When the information security vulnerability management program is executed by the processor, it implements the steps of the information security vulnerability management method as described above.

[0015] Fourthly, embodiments of this application provide a computer-readable storage medium storing an information security vulnerability management program, wherein when the information security vulnerability management program is executed by a processor, it implements the steps of the information security vulnerability management method as described above.

[0016] The beneficial effects of the technical solutions provided in this application include: This application improves the accuracy of asset and vulnerability matching by using a dual association mechanism of fingerprint matching and semantic association in information security vulnerability management; and improves verification efficiency and avoids misjudgment by using a dual verification mechanism of vulnerability reproduction and fingerprint comparison for automatic repair verification, thereby effectively improving the reliability of information security vulnerability management. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating an embodiment of the information security vulnerability management method of this application; Figure 2 This is a schematic diagram illustrating the process of generating asset fingerprints according to an embodiment of this application; Figure 3 This is a schematic diagram illustrating the process of matching vulnerability data and asset fingerprints in an embodiment of this application. Figure 4 This is a schematic diagram illustrating the vulnerability remediation verification process in an embodiment of this application. Figure 5 This is a schematic diagram of the functional modules of an embodiment of the information security vulnerability management device of this application; Figure 6 This is a schematic diagram of the hardware structure of the information security vulnerability management device involved in the embodiments of this application. Detailed Implementation

[0018] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present application.

[0019] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0020] In a first aspect, embodiments of this application provide an information security vulnerability management method.

[0021] In one embodiment, reference is made to Figure 1 , Figure 1 This is a flowchart illustrating an embodiment of the information security vulnerability management method of this application. Figure 1 As shown, information security vulnerability management methods include: S101. Obtain vulnerability data and enterprise asset data, and generate asset fingerprints based on enterprise asset data; S102. Perform fingerprint matching and semantic association between vulnerability data and asset fingerprints to obtain asset-related vulnerability data; S103. Generate vulnerability remediation tasks based on asset-related vulnerability data, and after completing the vulnerability remediation tasks, perform vulnerability reproduction verification and fingerprint comparison verification to obtain vulnerability remediation verification results.

[0022] Specifically, the implementation first requires acquiring vulnerability data and enterprise asset data. Vulnerability data can be obtained from various vulnerability information platforms and standardized using a unified vulnerability data standard model. Enterprise asset data is collected in real-time through scanning devices and analysis tools. This data includes static asset data such as hardware models, operating system versions, application software lists, and open ports, as well as dynamically changing asset data such as network communication protocols and data transmission frequencies.

[0023] Based on enterprise asset data, asset fingerprints can be constructed, including basic fingerprints built from static asset data and dynamic fingerprints built from dynamic asset data. Furthermore, when enterprise assets change, the asset fingerprints are updated in real time to ensure the timeliness of vulnerability management.

[0024] The implementation then identifies security vulnerabilities in the enterprise system by matching the acquired vulnerability data with asset fingerprints. This matching process includes fingerprint matching and semantic association. Fingerprint matching directly compares the asset-affecting fields in the vulnerability data with the asset fingerprints to obtain preliminary association results. Semantic association uses the BERT semantic analysis model to perform semantic analysis on the vulnerability description and asset details to identify complex scenarios not covered by fingerprint matching. Finally, a confidence score is calculated based on the results of fingerprint matching and semantic association. High-confidence results that meet the required confidence score are directly included in the vulnerability management list. Other results, based on their confidence scores, undergo manual review for those meeting the passing threshold but not the high-confidence requirement, while results with confidence scores below the passing threshold are simply marked as suspicious associations with the reasons recorded.

[0025] During the vulnerability remediation and verification phases, the task allocation process can utilize a genetic algorithm to optimize the task assignment scheme based on information such as asset ownership, vulnerability remediation difficulty, and the responsible personnel's skill tags. Furthermore, a remediation progress tracking component allows the responsible personnel to update the remediation status in real time.

[0026] After the remediation is completed, a secondary check is automatically performed to verify whether the vulnerability has been completely fixed. The verification process employs two methods: vulnerability reproduction and fingerprint comparison. Vulnerability reproduction involves simulating the vulnerability in a test environment; fingerprint comparison compares the affected asset fields in the remediated data with the asset fingerprints, i.e., performing fingerprint matching again. By combining these two verification methods, it is determined whether the risk has been completely eliminated, thus obtaining the vulnerability remediation verification result.

[0027] In this embodiment, vulnerability matching is performed through a dual association mechanism of fingerprint matching and semantic association in information security vulnerability management to improve the accuracy of asset and vulnerability matching; automatic repair verification is performed through a dual verification mechanism of vulnerability reproduction and fingerprint comparison to improve verification efficiency and avoid misjudgment, thereby effectively improving the reliability of information security vulnerability management.

[0028] Furthermore, in one embodiment, obtaining vulnerability data includes: Obtain initial vulnerability data from multiple data sources; The initial vulnerability data is standardized and cleaned to remove duplicates, resulting in vulnerability data.

[0029] Specifically, in this embodiment, vulnerability data is collected and integrated across multiple platforms through "standardized interface adaptation and data cleaning and fusion".

[0030] For various vulnerability information platforms, such as mainstream platforms like CVE, CNVD, and CNNVD, the implementation example uses an interface adaptation component to call the official open APIs of each platform (such as the REST API for CVE and the SDK interface for CNVD), or employs compliant web crawling technology (for platforms without APIs) to achieve real-time capture of vulnerability data. The interface adaptation component supports dynamic expansion; when adding a new vulnerability information platform, only the corresponding parameters need to be configured for integration, without modifying the core code.

[0031] Furthermore, considering the differences in vulnerability data formats across different platforms, standardization is necessary to establish a unified vulnerability data standard model. In this embodiment, the vulnerability data standard model defines 28 core fields, including fields such as vulnerability number, affected assets, risk level, CVSS score (a general vulnerability scoring system used to assess the severity of vulnerabilities), remediation plan, and verification method. This embodiment uses Natural Language Processing (NLP) technology to map fields of heterogeneous data from different platforms. For example, the "emergency response level" of the CNVD data source is mapped to the "risk level" field of the standard model, and the "CVSS V3.1 score" of NVD is synchronized to the "CVSS score" field of the standard model.

[0032] In addition, to remove invalid and sufficient data, vulnerability data needs to be cleaned and deduplicated. Data cleaning and deduplication employs a dual cleaning mechanism of rule validation and machine learning. Rule validation removes invalid data such as empty vulnerability descriptions and incorrect number formats. The machine learning model (based on the Naive Bayes algorithm) identifies duplicate vulnerabilities. For example, if the same vulnerability is numbered in both CVE and CNVD, similarity matching is performed based on features such as vulnerability description, affected assets, and exploitation methods (data with a similarity greater than or equal to 90% is considered duplicate data). The most complete record among the identified duplicate data is retained. This ultimately generates a unified enterprise vulnerability knowledge base, with an update cycle reduced to 10 minutes per update.

[0033] In this embodiment, the automated collection of data from multiple platforms is achieved through standardized interface adaptation components, shortening the data update cycle from several days to 10 minutes. The unified data model and dual cleaning mechanism improve the accuracy of vulnerability data to over 95% and reduce the duplicate data rate to below 3%, solving the problems of low efficiency and poor data quality in traditional manual integration.

[0034] Furthermore, in this embodiment, Figure 2 This is a schematic diagram illustrating the process of generating asset fingerprints according to an embodiment of this application, such as... Figure 2 As shown, asset fingerprints are generated based on enterprise asset data, including: S201. Generate a basic fingerprint based on the static asset data in the enterprise asset data; S202. Generate dynamic fingerprints based on dynamic asset data in the enterprise asset data; S203. Determine the asset fingerprint based on the basic fingerprint and dynamic fingerprint; Static asset data includes the hardware model, operating system version, application software list, and / or open ports of each asset. Dynamic asset data includes the network communication protocols and / or data transmission frequencies of each asset.

[0035] Furthermore, in this embodiment, the information security vulnerability management method also includes: When a company's assets change, the asset fingerprint is updated and fingerprint matching and semantic association are performed again to obtain updated asset association vulnerability data.

[0036] Specifically, in order to accurately identify which data in the vulnerability data represents vulnerabilities in the enterprise system, it is necessary to build a dynamic asset fingerprint to achieve comprehensive collection and real-time updates of enterprise asset information.

[0037] During the enterprise asset data collection process, this embodiment combines active scanning and passive monitoring technologies to collect asset information. Active scanning uses web crawlers and port scanning tools (based on the ZMap engine) to obtain static asset data such as hardware models, operating system versions, application software lists, and / or open ports. Passive monitoring uses traffic analysis tools to capture dynamic asset data such as network communication protocols and / or data transmission frequencies.

[0038] In addition, asset data collection also supports integration with enterprise CMDB (Configuration Management Database) and cloud platform APIs to synchronize management information such as asset ownership departments, responsible persons, and business relationships.

[0039] The implementation then generates a unique asset fingerprint based on the collected enterprise asset data. The asset fingerprint includes a basic fingerprint and a dynamic fingerprint. The basic fingerprint (such as CPU model and OS version) is determined based on the collected static asset data, while the dynamic fingerprint (such as the average traffic over the past 7 days and open service change records) is obtained by processing the collected dynamic data. To ensure security, the asset fingerprint is encrypted and stored using a hash algorithm.

[0040] Furthermore, the asset fingerprint in this embodiment also features dynamic updates; that is, when enterprise assets change, the asset fingerprint automatically updates and triggers vulnerability association re-examination. It should be noted that the conditions for determining changes differ between static and dynamic asset data. For static asset data, when the data is updated (e.g., a software version upgrade), the condition for enterprise asset changes is triggered, the asset fingerprint is updated, and vulnerability association re-examination is triggered. For dynamic data, update conditions are set (e.g., updating at set intervals based on the average traffic over the past 7 days) to proactively update the asset fingerprint dynamically.

[0041] In this embodiment, by using dynamically updatable asset fingerprints, compared to traditional enterprise asset lists, asset data can be updated more efficiently, and new asset vulnerabilities can be quickly updated and identified when new assets appear.

[0042] Furthermore, in one embodiment, the information security vulnerability management method further includes: Asset grade labels are obtained by classifying assets based on their business importance, data sensitivity, and risk tolerance in the asset fingerprint.

[0043] Specifically, for each enterprise's assets in the asset fingerprint, the implementation example also classifies assets from multiple dimensions, including business importance, data sensitivity, and risk tolerance. In determining business importance, for example, core transaction systems involving fund security are classified as Tier 1 assets; data sensitivity is categorized as high-sensitivity assets, such as those storing customer privacy data; and in determining risk tolerance, assets without redundant backups are classified as high-risk assets. The implementation example uses the Analytic Hierarchy Process (AHP) to analyze multiple dimensions, classify and grade assets, and generate asset level labels, which can provide a basis for vulnerability priority assessment.

[0044] In this embodiment, by classifying and grading assets, a basis can be provided when analyzing the priority of vulnerabilities. In vulnerability management, priority should be given to handling vulnerabilities of important assets, thereby further improving the reliability of vulnerability management and ensuring the information security of important assets.

[0045] Furthermore, in one embodiment, Figure 3 This is a schematic diagram illustrating the process of associating and matching vulnerability data and asset fingerprints in an embodiment of this application. Figure 3 As shown, fingerprint matching and semantic association are performed between vulnerability data and asset fingerprints to obtain asset-related vulnerability data, including: S301. Compare and match the affected asset fields and asset fingerprints in the vulnerability data to obtain preliminary association results; S302. Perform semantic analysis on the vulnerability description field and asset fingerprint in the vulnerability data to obtain vulnerability semantic information and asset dependency relationship, and perform semantic similarity matching on the vulnerability semantic information and asset dependency relationship to obtain semantic similarity. S303. Based on the preliminary association results and semantic similarity, confidence scores are used to filter and obtain the matching association relationships between each asset and vulnerability data in the asset fingerprint; S304. Determine the asset-related vulnerability data based on vulnerability data, asset fingerprints, and matching relationships.

[0046] Specifically, by associating acquired vulnerability data with asset fingerprints, vulnerabilities existing in an enterprise system can be identified. In the association process, this embodiment employs a dual association mechanism of fingerprint matching and semantic analysis to achieve accurate matching between vulnerabilities and assets.

[0047] Fingerprint matching involves comparing the affected asset field in the vulnerability data with the asset fingerprint. For example, if the affected asset field of the vulnerability is "Windows Server 2019 Standard Edition + open port 445", the system will automatically match all assets containing this feature in the asset fingerprint to achieve preliminary association.

[0048] Semantic association addresses complex scenarios not covered by fingerprint matching by performing in-depth matching through semantic analysis. It uses the BERT semantic analysis model to identify vulnerability semantic information in the vulnerability description field and the asset dependencies between assets in the asset fingerprint. Then, it performs similarity recognition on the vulnerability semantic information and asset dependencies to obtain semantic similarity.

[0049] Finally, the preliminary association results of fingerprint matching and the semantic similarity from semantic analysis are assigned confidence scores. For preliminary association, a confidence score of 1 is assigned to successful associations, and 0 to unsuccessful associations. For semantic analysis, the semantic similarity output by the model is used as the confidence score. The final confidence score is then obtained by weighted summing of the confidence scores from the preliminary association and semantic analysis.

[0050] For the final confidence score, the implementation example directly includes association results with scores of 80 or higher in management, those with scores of 60 or higher but less than 80 require manual review, and those with scores less than 60 are marked as suspicious associations with the reasons recorded. In the weighted addition of confidence scores, semantic similarity has a higher weight. Vulnerability data with initially successful associations generally also has a high semantic similarity, resulting in a high final confidence score, and can be directly included in management. For vulnerability data with initially failed associations, after weighted calculation, the parts with high semantic similarity require manual review, while the parts with low semantic similarity are marked as suspicious associations.

[0051] In this embodiment, a dual-association mechanism combining fingerprint matching and semantic analysis significantly improves the accuracy of matching vulnerabilities with assets. Simultaneously, the dynamic updating mechanism of asset fingerprints ensures that vulnerabilities arising from the addition or modification of assets are promptly detected, effectively reducing security blind spots and avoiding potential data leakage risks.

[0052] Furthermore, in one embodiment, Figure 4 This is a flowchart illustrating the vulnerability remediation verification process in an embodiment of this application, as shown below. Figure 4 As shown, vulnerability reproduction verification and fingerprint comparison verification are performed to obtain vulnerability remediation verification results, including: S401. Conduct vulnerability simulation verification in the test environment to obtain vulnerability reproduction verification results; S402. Compare and verify the affected asset fields in the patched vulnerability data with the asset fingerprints to obtain fingerprint comparison verification results. S403. Determine the vulnerability remediation verification result based on the vulnerability reproduction verification result and the fingerprint comparison verification result.

[0053] Specifically, in the process of patching vulnerabilities, the implementation also provides a closed-loop patching process of "intelligent allocation - progress tracking - automatic verification - archiving and review".

[0054] In the intelligent allocation of remediation tasks, the implementation example extracts information from asset-related vulnerability data, such as the department to which the asset belongs, the difficulty of vulnerability remediation (based on historical remediation time and required technical skills), the skill tags of the responsible person, and the asset level tags, to determine optimization objectives (e.g., prioritizing the remediation of high-risk vulnerabilities and assigning them to personnel with corresponding skills) and constraints (e.g., workload limits for each person). A genetic algorithm is then used to optimize the task allocation scheme. For example, high-risk vulnerabilities (CVSS score ≥ 9.0) in core business systems are automatically assigned to responsible persons with system architecture and security hardening skills, and are prioritized for personnel with the top 30% historical remediation efficiency.

[0055] For real-time progress tracking, the system supports responsible personnel to update the repair status (not started, in progress, repaired, and unable to be repaired) in real time via web or mobile devices through a repair progress tracking component. The system automatically records the time and reason for status changes. Managers can view the repair progress of each department and asset type in real time through a visual dashboard. For overdue repair tasks (with time limits set according to vulnerability level, high risk ≤ 24 hours, medium risk ≤ 72 hours), the system automatically sends early warning notifications (email + SMS).

[0056] In the automated verification of the remediation effect, after the remediation is completed, the system automatically triggers a secondary detection, employing dual verification through vulnerability reproduction and fingerprint comparison. Vulnerability reproduction involves simulating the vulnerability in a test environment and using code to detect its existence. Fingerprint comparison involves updating the asset fingerprint and comparing it with the affected asset field in the vulnerability data, i.e., performing fingerprint matching again to determine whether the risk has been completely eliminated. If verification passes, it is automatically marked as "remediation complete"; if it fails, a verification report is pushed, prompting the responsible person to investigate the problem.

[0057] Finally, the archiving and review process involves archiving vulnerability information, the remediation process, verification results, and other data to a historical database after the remediation is completed, generating a vulnerability remediation report. Monthly reviews of the remediation data analyze metrics such as average remediation time, reasons for non-remediation, and frequently occurring vulnerability types, providing a basis for optimizing vulnerability management strategies.

[0058] In this embodiment, a closed-loop management process for remediation is constructed. Intelligent task allocation can improve the response speed of high-risk vulnerability remediation, automated progress tracking can track and provide timely feedback on vulnerability remediation progress, and the dual verification mechanism can significantly improve the verification efficiency of vulnerability remediation while avoiding misjudgments.

[0059] In another embodiment, a predictive model was built based on historical data to provide early warning of high-risk vulnerabilities.

[0060] During the model building process, it is necessary to extract predictive features including historical vulnerability data (frequency of vulnerability outbreaks on various platforms in the past year, and repair rate of similar vulnerabilities), historical asset data (asset usage years, number of historical vulnerabilities, and version update frequency), vulnerability repair statistics (average repair time of historical vulnerabilities for enterprises, and timely repair rate of high-risk vulnerabilities), and external risk data (industry vulnerability outbreak trends and types of assets that are hotspots for hacker attacks).

[0061] The risk prediction model is built using the LSTM (Long Short-Term Memory) algorithm, taking feature data from the past 12 months as input to train the model to predict high-risk vulnerabilities (CVSS score ≥ 7.0) that the company's various asset types may face within the next 3 months. The model is iteratively optimized quarterly by adding new historical data to ensure prediction accuracy.

[0062] For predicted high-risk vulnerabilities, the system generates early warning notifications and pushes them to the relevant asset holders. Simultaneously, it automatically recommends protective measures based on historical vulnerability remediation data, such as "A certain router model is predicted to be vulnerable to a certain type of vulnerability; it is recommended to upgrade the version in advance, referring to historical remediation case IDs."

[0063] By using risk prediction models to extract and predict high-risk vulnerabilities, we can proactively prevent high-risk system vulnerabilities in vulnerability management, avoid subsequent network attacks, and further improve the reliability of vulnerability management.

[0064] Secondly, embodiments of this application also provide an information security vulnerability management device.

[0065] In one embodiment, reference is made to Figure 5 , Figure 5 This is a schematic diagram of the functional modules of an embodiment of the information security vulnerability management device of this application. Figure 5 As shown, the information security vulnerability management device includes: The asset fingerprint generation module 501 is used to obtain vulnerability data and enterprise asset data, and generate asset fingerprints based on the enterprise asset data. The asset vulnerability association module 502 is used to perform fingerprint matching and semantic association between vulnerability data and asset fingerprints to obtain asset-associated vulnerability data. The vulnerability remediation verification module 503 is used to generate vulnerability remediation tasks based on asset-related vulnerability data, and after completing the vulnerability remediation tasks, to perform vulnerability reproduction verification and fingerprint comparison verification to obtain vulnerability remediation verification results.

[0066] The functions of each module in the aforementioned information security vulnerability management device correspond to the steps in the aforementioned information security vulnerability management method embodiment, and their functions and implementation processes will not be described in detail here.

[0067] Thirdly, embodiments of this application provide an information security vulnerability management device, which can be a personal computer (PC), laptop computer, server, or other device with data processing capabilities.

[0068] Reference Figure 6 , Figure 6 This is a schematic diagram of the hardware structure of the information security vulnerability management device involved in the embodiments of this application. In this embodiment, the information security vulnerability management device may include a processor, a memory, a communication interface, and a communication bus.

[0069] The communication bus can be of any type and is used to interconnect the processor, memory, and communication interface.

[0070] Communication interfaces include input / output (I / O) interfaces, physical interfaces, and logical interfaces used for interconnecting internal components of the information security vulnerability management device, as well as interfaces used for interconnecting the information security vulnerability management device with other devices (such as other computing devices or user devices). Physical interfaces can be Ethernet interfaces, fiber optic interfaces, ATM interfaces, etc.; user devices can be displays, keyboards, etc.

[0071] Memory can be various types of storage media, such as random access memory (RAM), read-only memory (ROM), non-volatile RAM (NVRAM), flash memory, optical storage, hard disk, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), etc.

[0072] The processor can be a general-purpose processor, which can call the information security vulnerability management program stored in the memory and execute the information security vulnerability management method provided in the embodiments of this application. For example, the general-purpose processor can be a central processing unit (CPU). The method executed when the information security vulnerability management program is called can be referred to in the various embodiments of the information security vulnerability management method of this application, and will not be repeated here.

[0073] Those skilled in the art will understand that Figure 6The hardware structure shown does not constitute a limitation of this application and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0074] Fourthly, embodiments of this application also provide a computer-readable storage medium.

[0075] The computer-readable storage medium of this application stores an information security vulnerability management program, wherein when the information security vulnerability management program is executed by a processor, it implements the steps of the information security vulnerability management method described above.

[0076] The method implemented when the information security vulnerability management program is executed can be referred to in various embodiments of the information security vulnerability management method of this application, and will not be repeated here.

[0077] It should be noted that the sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0078] The terms "comprising" and "having," and any variations thereof, in the specification, claims, and accompanying drawings of this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to such process, method, product, or apparatus. The terms "first," "second," and "third," etc., are used to distinguish different objects, etc., and do not indicate a sequence, nor do they limit "first," "second," and "third" to different types.

[0079] In the description of the embodiments of this application, terms such as "exemplary," "for example," or "for instance" are used to indicate examples, illustrations, or explanations. Any embodiment or design described as "exemplary," "for example," or "for instance" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of terms such as "exemplary," "for example," or "for instance" is intended to present the relevant concepts in a concrete manner.

[0080] In the description of the embodiments of this application, unless otherwise stated, " / " means "or". For example, A / B can mean A or B. The "and / or" in the text is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist simultaneously, and B exists alone. In addition, in the description of the embodiments of this application, "multiple" means two or more.

[0081] In some processes described in the embodiments of this application, multiple operations or steps are included in a specific order. However, it should be understood that these operations or steps may not be executed in the order they appear in the embodiments of this application, or they may be executed in parallel. The sequence number of the operation is only used to distinguish different operations, and the sequence number itself does not represent any execution order. In addition, these processes may include more or fewer operations, and these operations or steps may be executed sequentially or in parallel, and these operations or steps may be combined.

[0082] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes several instructions to cause a terminal device to execute the methods of the various embodiments of this application.

[0083] The above are merely preferred embodiments of this application and do not limit the patent scope of this application. Any equivalent structural or procedural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of this application.

Claims

1. An information security vulnerability management method characterized by comprising: include: Obtain vulnerability data and enterprise asset data, and generate asset fingerprints based on the enterprise asset data; The vulnerability data and the asset fingerprint are matched and semantically associated to obtain asset-related vulnerability data. Based on the asset-related vulnerability data, a vulnerability remediation task is generated, and after the vulnerability remediation task is completed, vulnerability reproduction verification and fingerprint comparison verification are performed to obtain the vulnerability remediation verification result.

2. The information security vulnerability management method according to claim 1, characterized by, The step of generating asset fingerprints based on the enterprise asset data includes: A basic fingerprint is generated based on the static asset data in the enterprise asset data; A dynamic fingerprint is generated based on the dynamic asset data in the enterprise asset data. Determine the asset fingerprint based on the basic fingerprint and the dynamic fingerprint; The static asset data includes the hardware model, operating system version, application software list and / or open ports of each asset. The dynamic asset data includes the network communication protocols and / or data transmission frequencies of each asset.

3. The information security vulnerability management method of claim 1, wherein The step of performing fingerprint matching and semantic association between the vulnerability data and the asset fingerprint to obtain asset-related vulnerability data includes: Preliminary association results are obtained by comparing and matching the affected asset fields in the vulnerability data with the asset fingerprints. Semantic analysis is performed on the vulnerability description field and the asset fingerprint in the vulnerability data to obtain vulnerability semantic information and asset dependency relationship. Semantic similarity matching is performed on the vulnerability semantic information and the asset dependency relationship to obtain semantic similarity. Based on the preliminary association results and the semantic similarity, a confidence score is used to filter and obtain the matching association relationship between each asset in the asset fingerprint and the vulnerability data; The asset-related vulnerability data is determined based on the vulnerability data, the asset fingerprint, and the matching association.

4. The information security vulnerability management method of claim 1, wherein, The vulnerability remediation verification results obtained through vulnerability reproduction verification and fingerprint comparison verification include: Vulnerability simulation and verification were performed in the test environment to obtain the results of vulnerability reproduction and verification. The affected asset fields in the patched vulnerability data are compared and verified with the asset fingerprint to obtain the fingerprint comparison verification results. The vulnerability remediation verification result is determined based on the vulnerability reproduction verification result and the fingerprint comparison verification result.

5. The information security vulnerability management method of claim 1, wherein, The method further includes: When a company's assets change, the asset fingerprint is updated and fingerprint matching and semantic association are performed again to obtain updated asset association vulnerability data.

6. The information security vulnerability management method of claim 1, wherein, The method further includes: Asset grade labels are obtained by classifying each asset in the asset fingerprint based on its business importance, data sensitivity, and risk tolerance using the analytic hierarchy process.

7. The information security vulnerability management method of claim 1, wherein, The acquisition of vulnerability data includes: Obtain initial vulnerability data from multiple data sources; The initial vulnerability data is standardized and cleaned to remove duplicates, resulting in vulnerability data.

8. An information security vulnerability management device, characterized in that, include: The asset fingerprint generation module is used to acquire vulnerability data and enterprise asset data, and generate asset fingerprints based on the enterprise asset data. The asset vulnerability association module is used to perform fingerprint matching and semantic association between the vulnerability data and the asset fingerprint to obtain asset-associated vulnerability data. The vulnerability remediation verification module is used to generate vulnerability remediation tasks based on the asset-related vulnerability data, and after completing the vulnerability remediation tasks, to perform vulnerability reproduction verification and fingerprint comparison verification to obtain vulnerability remediation verification results.

9. An information security vulnerability management device, characterized in that, The information security vulnerability management device includes a processor, a memory, and an information security vulnerability management program stored in the memory and executable by the processor, wherein when the information security vulnerability management program is executed by the processor, it implements the steps of the information security vulnerability management method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores an information security vulnerability management program, wherein when the information security vulnerability management program is executed by a processor, it implements the steps of the information security vulnerability management method as described in any one of claims 1 to 7.

Images