Automatic information system security vulnerability checking system and method based on artificial intelligence
By using an AI-based automated vulnerability screening system for information systems, which combines asset acquisition and encrypted transmission with deep learning algorithms, the system solves the problems of low efficiency, poor real-time performance, and non-standardized data management associated with traditional manual detection, thus achieving efficient and secure vulnerability management.
Patent Information
- Application Number
- CN202511945946.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-22
- Publication Date
- 2026-04-21
AI Technical Summary
Traditional methods of identifying vulnerabilities in information systems rely on manual detection, which is inefficient, lacks real-time performance, is costly, has outdated knowledge base updates, and suffers from non-standardized data management.
An AI-based automated information system security vulnerability screening system is adopted. System information is collected through an asset acquisition client and uploaded to a central database in encryption. The system is then analyzed using an AI module and combined with deep learning algorithms to identify vulnerabilities and generate remediation strategies. The system supports continuous learning and self-improvement.
It enables efficient, secure, and intelligent vulnerability screening, improves real-time performance and accuracy, reduces costs, and ensures standardized data management and dynamic system security.
Smart Images
Figure CN121902156A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of security management, and more specifically, to an automated system and method for identifying information system security vulnerabilities based on artificial intelligence. Background Technology
[0002] In the current field of information security, vulnerability investigation of information systems is a crucial task, directly related to the stability and security of the system. Traditional vulnerability investigation methods mainly rely on manual detection and analysis, which is not only time-consuming and labor-intensive but also inefficient and prone to overlooking potential security risks.
[0003] There are still no effective solutions to the problems of low efficiency, poor real-time performance, high cost, delayed knowledge base updates, and non-standardized data management in the manual operation of information system security vulnerability investigation in related technologies. Summary of the Invention
[0004] This application provides an automated information system security vulnerability investigation system and method based on artificial intelligence, which at least solves the problems of low efficiency, poor real-time performance, high cost, delayed knowledge base updates, and non-standardized data management in information system security vulnerability investigation in related technologies.
[0005] According to one embodiment of this application, an automated information system security vulnerability investigation system based on artificial intelligence is provided, comprising: an asset acquisition client, used to collect system information of a target information system and encapsulate the system information into a structured data format to obtain encapsulated system information; a data transmission module, connected to the asset acquisition client, used to upload the encapsulated system information to a central database through a secure encrypted channel; and an artificial intelligence module, connected to the central database, used to analyze the encapsulated system information to obtain a first vulnerability analysis result, wherein the first vulnerability analysis result includes at least one of the following: vulnerability data, vulnerability level, and vulnerability remediation strategy.
[0006] In one exemplary embodiment, the system further includes: an artificial intelligence learning module connected to the central database and the artificial intelligence module, for training an artificial intelligence model using the updated data when updated data is detected in the central database, wherein the artificial intelligence model is set in the artificial intelligence module.
[0007] In one exemplary embodiment, the system further includes: a human-computer interaction interface connected to the central database and the artificial intelligence module, configured to receive a first vulnerability query request for a target object; the central database configured to parse the first vulnerability query request to obtain a first query object, query target data corresponding to the first query object in the central database, and send the target data to the artificial intelligence module; the artificial intelligence module configured to analyze the target data to obtain a second vulnerability analysis result, wherein the second vulnerability analysis result is of the same category as the first vulnerability analysis result.
[0008] In an exemplary embodiment, the human-computer interaction interface is further configured to: display the first vulnerability analysis result and / or the second vulnerability analysis result.
[0009] In an exemplary embodiment, the artificial intelligence module is further configured to: generate multiple second vulnerability query requests based on the encapsulated system information, wherein the multiple second vulnerability query requests correspond one-to-one with multiple second query objects; match multiple vulnerability databases corresponding one-to-one with the multiple second query objects, wherein the vulnerability databases are used to store multiple historical vulnerability data of the corresponding second query objects; and perform vulnerability analysis on the multiple second query objects based on the multiple vulnerability databases and the multiple second vulnerability query requests using the artificial intelligence module to obtain multiple third vulnerability analysis results, wherein the first vulnerability analysis result includes the multiple third vulnerability analysis results, and the multiple third vulnerability analysis results correspond one-to-one with the multiple second query objects.
[0010] In an exemplary embodiment, the asset acquisition client is further configured to initiate an HTTPS connection request to the central database and establish a secure session with the central database, wherein the HTTPS connection request carries a digital certificate; the data transmission module is further configured to encrypt the encapsulated system information using the client's private key to obtain encrypted data, and send the encrypted data to the central database through the secure session, wherein the encrypted data carries the digital certificate; the central database is further configured to verify the digital certificate, and if the verification passes, decrypt the encrypted data using the public key corresponding to the client's private key to obtain the encapsulated system information.
[0011] According to another embodiment of the present application, an automated information system security vulnerability investigation method based on artificial intelligence is also provided, applied to the aforementioned automated information system security vulnerability investigation system based on artificial intelligence, comprising: collecting system information of the target information system and encapsulating the system information into a structured data format to obtain encapsulated system information; uploading the encapsulated system information to a central database through a secure encrypted channel; and analyzing the encapsulated system information to obtain a first vulnerability analysis result, wherein the first vulnerability analysis result includes at least one of the following: vulnerability data, vulnerability level, and vulnerability remediation strategy.
[0012] According to another aspect of the embodiments of this application, a computer-readable storage medium is also provided, wherein a computer program is stored in the computer-readable storage medium, and the computer program is configured to execute the above-described automated investigation method for information system security vulnerabilities based on artificial intelligence when it is run.
[0013] According to another aspect of the embodiments of this application, an electronic device is also provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the above-described automated information system security vulnerability investigation method based on artificial intelligence through the computer program.
[0014] According to another aspect of the embodiments of this application, a computer program product is also provided, including a computer program that, when executed by a processor, implements the steps of the methods described in various embodiments of this application.
[0015] This application proposes an automated information system security vulnerability investigation system based on artificial intelligence. A lightweight asset acquisition client is deployed in the target information system, automatically capturing system information through customized scripts. The collected system information is encrypted via a data transmission module connected to the asset acquisition client, ensuring data security and integrity during transmission. The encrypted data is uploaded to a central database through a secure encrypted channel, which is responsible for data storage and management. An artificial intelligence module, tightly connected to the central database, analyzes system information. Based on deep learning algorithms, the AI module can quickly identify the existence of known vulnerabilities in the system, assess the potential risk level of these vulnerabilities, and generate corresponding remediation suggestions, obtaining the first vulnerability analysis result. This system integrates three core technologies: automated acquisition, secure transmission, and intelligent analysis, constructing an efficient, secure, and intelligent information system vulnerability investigation solution. It significantly compensates for the shortcomings of traditional manual investigation methods, providing a more advanced and reliable vulnerability management tool for the network environment. Furthermore, it solves the problems of low efficiency, poor real-time performance, high cost, delayed knowledge base updates, and non-standardized data management in manual information system security vulnerability investigation. Attached Figure Description
[0016] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:
[0017] Figure 1 This is a hardware structure block diagram of an optional AI-based automated information system security vulnerability investigation system according to an embodiment of this application;
[0018] Figure 2 This is a structural block diagram (a) of an optional AI-based automated information system security vulnerability investigation system according to an embodiment of this application.
[0019] Figure 3 This is a structural block diagram (II) of an optional AI-based automated information system security vulnerability investigation system according to an embodiment of this application.
[0020] Figure 4 This is a schematic diagram of the structure of an optional automated information system vulnerability detection system according to an embodiment of this application;
[0021] Figure 5 This is a flowchart illustrating an optional automated information system security vulnerability investigation method according to an embodiment of this application;
[0022] Figure 6 This is a flowchart illustrating an optional security vulnerability identification method according to an embodiment of this application;
[0023] Figure 7 This is a flowchart of an automated information system security vulnerability investigation method based on artificial intelligence, according to an embodiment of this application. Detailed Implementation
[0024] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.
[0025] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.
[0026] The methods and embodiments provided in this application can be executed in an AI-based automated information system security vulnerability investigation system or a similar computing system. Taking an AI-based automated information system security vulnerability investigation system as an example... Figure 1 This is a hardware structure block diagram of an automated information system security vulnerability investigation system based on artificial intelligence, according to an embodiment of this application. Figure 1 As shown, an AI-based automated information system security vulnerability investigation system may include one or more ( Figure 1 Only one is shown in the image. A processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data are also shown. In one exemplary embodiment, the aforementioned AI-based automated information system security vulnerability investigation system may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned AI-based automated information system security vulnerability detection system. For example, the AI-based automated information system security vulnerability detection system may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 Equivalent functions or ratios shown Figure 1 The functions shown have more different configurations.
[0027] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the AI-based automated vulnerability detection method for information systems in this embodiment. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, thus implementing the aforementioned method. The memory 104 may include high-speed random access memory and non-volatile memory, such as one or more magnetic storage systems, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to a secure network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.
[0028] The transmission system 106 is used to receive or send data via a network. Specific examples of the network described above may include wireless networks provided by the communication provider of an AI-based automated vulnerability detection system for information systems. In one example, the transmission system 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet.
[0029] This embodiment provides an automated information system security vulnerability investigation system based on artificial intelligence. Figure 2 This is a structural block diagram of an optional AI-based automated information system security vulnerability detection system according to an embodiment of this application. The system includes:
[0030] The asset acquisition client 22 is used to collect system information of the target information system and encapsulate the system information into a structured data format to obtain the encapsulated system information;
[0031] Data transmission module 24, connected to the asset acquisition client, is used to upload the encapsulated system information to the central database through a secure encrypted channel;
[0032] Artificial intelligence module 26 is connected to the central database and is used to analyze the encapsulated system information to obtain a first vulnerability analysis result, wherein the first vulnerability analysis result includes at least one of the following: vulnerability data, vulnerability level and vulnerability remediation strategy.
[0033] The aforementioned system deploys a lightweight asset acquisition client within the target information system. This client automatically captures system information via customized scripts. The collected system information is encrypted through a data transmission module connected to the asset acquisition client, ensuring data security and integrity during transmission. The encrypted data is then uploaded to a central database via a secure encrypted channel, which is responsible for data storage and management. An artificial intelligence module, tightly integrated with the central database, analyzes system information. Based on deep learning algorithms, the AI module quickly identifies known vulnerabilities in the system, assesses their potential risk levels, and generates corresponding remediation suggestions, resulting in the first vulnerability analysis. This system integrates three core technologies: automated acquisition, secure transmission, and intelligent analysis, constructing an efficient, secure, and intelligent information system vulnerability investigation solution. It significantly overcomes the shortcomings of traditional manual investigation methods, providing a more advanced and reliable vulnerability management tool for network environments. Furthermore, it addresses the problems of low efficiency, poor real-time performance, high cost, delayed knowledge base updates, and non-standardized data management in manual information system security vulnerability investigation.
[0034] Optional, such as Figure 3 As shown, the system further includes an artificial intelligence learning module 28, which is connected to the central database and the artificial intelligence module, and is used to train the artificial intelligence model using the updated data when the updated data is detected in the central database, wherein the artificial intelligence model is set in the artificial intelligence module.
[0035] Figure 3 The system architecture showcased incorporates an artificial intelligence learning module 28 to further enhance the accuracy and response speed of vulnerability identification. This module connects to the central database and the artificial intelligence module, enabling data-driven intelligent model optimization. When the central database detects new data updates, particularly information about newly discovered vulnerabilities or software version changes, the artificial intelligence learning module immediately extracts this updated data to retrain the artificial intelligence model pre-installed in the artificial intelligence module.
[0036] The design of the artificial intelligence learning module emphasizes continuous learning and self-improvement capabilities. It not only utilizes new data to adjust model parameters and improve the accuracy of vulnerability identification, but also uses deep learning algorithms to uncover undiscovered vulnerability patterns from historical data and predict potential security threats. This process enables the AI model to quickly adapt to changing environments and enhances its ability to identify emerging vulnerabilities.
[0037] In this embodiment, the system expands upon an artificial intelligence learning module. This module collaborates closely with the central database and the artificial intelligence module, capturing updated data from the central database, such as the latest vulnerability reports or software version upgrade information. This data is then used to adjust and train the artificial intelligence model in real time. The model training process enhances the AI's ability to identify vulnerabilities, especially in handling emerging threats. Through deep learning technology, the model can learn and adapt autonomously, ensuring that the system's security protection keeps pace with technological developments and reducing security vulnerabilities caused by outdated knowledge base updates. As a result, the overall system performance is significantly improved, providing users with a real-time, dynamic vulnerability detection and remediation solution, effectively reducing cybersecurity risks.
[0038] Optional, such as Figure 3 As shown, the system further includes: a human-computer interaction interface 30, connected to the central database and the artificial intelligence module, for receiving a first vulnerability query request for a target object; the central database, for parsing the first vulnerability query request to obtain a first query object, querying the target data corresponding to the first query object in the central database, and sending the target data to the artificial intelligence module; the artificial intelligence module, for analyzing the target data to obtain a second vulnerability analysis result, wherein the second vulnerability analysis result is of the same category as the first vulnerability analysis result.
[0039] Figure 3 Among the enhanced features, the system adds a human-computer interaction interface 30. This interface forms a closed-loop communication path with the central database and the artificial intelligence module, allowing system administrators or security experts to submit a primary vulnerability query request, specifically targeting the vulnerability status of a particular software or middleware. In response to such requests, the central database randomly parses the request content, identifies the primary query target—the specified software or middleware name and version number—and then searches the database for corresponding target data, including but not limited to historical vulnerability records, risk ratings, and known remediation measures. After obtaining the target data, the database seamlessly forwards it to the artificial intelligence module, which uses a trained AI model to perform in-depth analysis of the data, producing a secondary vulnerability analysis result in the same category as the previous automatic analysis, covering vulnerability details, risk level, and remediation recommendations.
[0040] The integrated human-computer interaction interface in this embodiment enhances the interactivity with the central database and artificial intelligence module, enabling users to obtain customized security analysis results on demand. This improves the system's responsiveness and user satisfaction, ensures the timeliness and relevance of information security strategies, and provides strong support for precise security management.
[0041] Optionally, the human-computer interaction interface 30 is further configured to: display the first vulnerability analysis result and / or the second vulnerability analysis result.
[0042] The human-computer interface also serves as a display tool, intuitively presenting the first vulnerability analysis results derived from the artificial intelligence module, as well as the second vulnerability analysis results derived from the first vulnerability query request based on a user-specific query. This interface integrates multiple display modes, including graphics, tables, and text, ensuring users can quickly understand the system's security status, including the list of identified vulnerabilities, a detailed description of each vulnerability, its risk level, and recommended mitigation or remediation strategies.
[0043] It should be noted that the first vulnerability analysis result is a list of vulnerabilities and its assessment generated by the system after automatic scanning and analysis, covering all detected security issues and providing a basis for comprehensive security management; while the second vulnerability analysis result is an in-depth analysis of software or middleware specifically queried by the user, providing customized security recommendations to ensure the accurate implementation of management measures.
[0044] This embodiment enhances the display function of the human-computer interaction interface, enabling users to instantly obtain and understand the system's security analysis results. This helps to quickly formulate targeted security strategies, enhances the timeliness and accuracy of decision-making, and significantly improves the overall information security management efficiency.
[0045] In an exemplary embodiment, the artificial intelligence module 26 is further configured to: generate multiple second vulnerability query requests based on the encapsulated system information, wherein the multiple second vulnerability query requests correspond one-to-one with multiple second query objects; match multiple vulnerability databases corresponding one-to-one with the multiple second query objects, wherein the vulnerability databases are used to store multiple historical vulnerability data of the corresponding second query objects; and perform vulnerability analysis on the multiple second query objects through the artificial intelligence module based on the multiple vulnerability databases and the multiple second vulnerability query requests to obtain multiple third vulnerability analysis results, wherein the first vulnerability analysis result includes the multiple third vulnerability analysis results, and the multiple third vulnerability analysis results correspond one-to-one with the multiple second query objects.
[0046] Based on the encapsulated system information, the AI module generates a series of second vulnerability query requests corresponding to various assets within the system, with each request precisely targeting a specific asset or software component. The module then intelligently matches multiple vulnerability databases designed for different query objects. These databases store a large amount of historical vulnerability data, covering historical security issues across various software and hardware. Through deep AI analysis, the module performs vulnerability assessments on each second query object, generating multiple third vulnerability analysis results. These results not only include vulnerability identification but also severity assessments and remediation suggestions, with each result corresponding one-to-one with the query object. The final set of results constitutes a comprehensive first vulnerability analysis result, achieving a holistic diagnosis of security vulnerabilities across the entire system.
[0047] This embodiment utilizes the comprehensive vulnerability query and analysis of the artificial intelligence module to automatically generate in-depth security assessment reports for each asset, effectively avoiding omissions and errors in manual investigation, ensuring the comprehensiveness and accuracy of security strategies, and greatly improving the overall information system security management level.
[0048] In an exemplary embodiment, the asset acquisition client 22 is further configured to initiate an HTTPS connection request to the central database and establish a secure session with the central database, wherein the HTTPS connection request carries a digital certificate; the data transmission module is further configured to encrypt the encapsulated system information using the client's private key to obtain encrypted data, and send the encrypted data to the central database through the secure session, wherein the encrypted data carries the digital certificate; the central database is further configured to verify the digital certificate, and if the verification passes, decrypt the encrypted data using the public key corresponding to the client's private key to obtain the encapsulated system information.
[0049] In this embodiment, the asset acquisition client not only performs data collection but also proactively initiates an HTTPS connection request to the central database. This aims to establish a secure session based on digital certificate authentication, ensuring the privacy and security of subsequent data transmission. After receiving the encapsulated system information, the data transmission module further encrypts it using the client's private key, generating encrypted data. This encrypted data is then transmitted to the central database through the established secure session. Throughout the transmission process, the encrypted data always carries a digital certificate verifying its security. Upon arrival at the central database, the system first verifies the validity of the digital certificate. Once verification is successful, the system uses the public key matching the client's private key to decrypt the data packet, restoring the initially encapsulated system information, thus completing the secure data transmission process.
[0050] This embodiment establishes an HTTPS-based encrypted connection between the asset acquisition client and the central database, and uses a key pair to encrypt the transmission of system information, which significantly improves the security and reliability of data transmission, effectively prevents eavesdropping and tampering during the transmission process, strengthens the protection of user data, and enhances the credibility and efficiency of the overall system in the field of information security management.
[0051] In an optional embodiment, this application provides an automated information system vulnerability detection system, the structure of which is as follows: Figure 4 As shown, the system includes, but is not limited to, the following subsystems: asset acquisition module 42, data transmission module 44, central database 46, AI learning engine 48, and user interface 50. These subsystems communicate with each other via API interfaces, ensuring the system's flexibility and scalability.
[0052] Specifically, the functions of the above subsystems are as follows:
[0053] Asset Acquisition Module 42: Design a lightweight script to run on the target system and collect operating system information (such as kernel version), middleware (such as web server, database), and version numbers of open-source software. This information (equivalent to the aforementioned system information) will be encapsulated into a structured data format (such as JSON) for subsequent processing.
[0054] Data transmission module 44: Data collected by the client will be uploaded to the central database via a secure channel (HTTPS). The database adopts a relational design to ensure data consistency and integrity. Once the data is uploaded, the AI model's learning process is immediately triggered.
[0055] AI Learning Engine 48: An artificial intelligence model trained using deep learning algorithms. This model is trained on a large database of known vulnerabilities and can effectively identify potential vulnerabilities in various software versions. The model is updated regularly to adapt to new vulnerability discoveries and software version changes.
[0056] With the above system, when a user queries whether a specific software or middleware is risky through the client, the system first retrieves relevant information from the database and then submits it to the AI model for analysis.
[0057] The AI model uses historical data and the current knowledge base to determine whether the software / middleware version has known vulnerabilities and returns the results to the user, including vulnerability details, severity, and recommended remediation measures.
[0058] It should be noted that, for security reasons, all sensitive operations require authentication and authorization to prevent unauthorized access. Furthermore, encryption technology is used to protect data security during data transmission.
[0059] In an optional embodiment, this application also provides an optional automated information system security vulnerability investigation method, applied to... Figure 4 In the automated information system vulnerability detection system shown, the method is as follows: Figure 5 As shown, the process includes the following steps:
[0060] 5.1 Data is collected through the asset acquisition module 42. Data collection can be performed simultaneously on multiple system platforms, supporting operating systems such as Windows and Linux.
[0061] 5.2 Collect equipment information, operating system information, middleware information, and open-source software information (equivalent to the above system information) periodically through the asset acquisition module (on a weekly basis).
[0062] 5.3 Supplement with additional information, such as the system administrator and system location.
[0063] 5.4. Import the data into the artificial intelligence vulnerability knowledge base (equivalent to the aforementioned vulnerability database) through the data transmission module 44.
[0064] 5.5 The AI learning engine, combined with the machine learning module, identifies security vulnerabilities.
[0065] Furthermore, the implementation process of security vulnerability identification is as follows: Figure 6 As shown:
[0066] 6.1. Keywords for identifying security vulnerabilities by AI clients, such as software middleware names or open-source software names and version numbers;
[0067] 6.2 Display the names of all systems involved in this vulnerability, their owners, and the location of their respective data centers;
[0068] 6.3. Provide the vulnerability risk level and generate a vulnerability mitigation solution.
[0069] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods of the various embodiments of this application.
[0070] Figure 7 This application discloses an automated information system security vulnerability detection method based on artificial intelligence, applied to the aforementioned automated information system security vulnerability detection system based on artificial intelligence. The method includes the following steps:
[0071] Step S702: Collect system information of the target information system and encapsulate the system information into a structured data format to obtain the encapsulated system information;
[0072] Step S704: Upload the packaged system information to the central database through a secure encrypted channel;
[0073] Step S706: Analyze the encapsulated system information to obtain a first vulnerability analysis result, wherein the first vulnerability analysis result includes at least one of the following: vulnerability data, vulnerability level, and vulnerability remediation strategy.
[0074] The above solution automatically captures system information from the target information system using customized scripts, encapsulates the system information into a structured data format, and obtains the encapsulated system information. The encapsulated system information is then encrypted and uploaded to a central database via a secure encrypted channel. This database is responsible for data storage and management. Finally, the encapsulated system information is analyzed to obtain the first vulnerability analysis results, quickly identifying whether known vulnerabilities exist in the system, assessing the potential risk level of the vulnerabilities, and generating corresponding remediation suggestions. This solution integrates three core technologies: automated data collection, secure transmission, and intelligent analysis, constructing an efficient, secure, and intelligent information system vulnerability investigation solution. It significantly compensates for the shortcomings of traditional manual investigation methods, providing a more advanced and reliable vulnerability management tool for the network environment. Furthermore, it solves the problems of low efficiency, poor real-time performance, high cost, delayed knowledge base updates, and non-standardized data management in manual operations for information system security vulnerability investigation.
[0075] In one exemplary embodiment, the method further includes: training an artificial intelligence model using the updated data when updated data is detected in the central database, wherein the artificial intelligence model is set in the artificial intelligence module.
[0076] In one exemplary embodiment, the method further includes: receiving a first vulnerability query request for a target object; parsing the first vulnerability query request to obtain a first query object, and querying the target data corresponding to the first query object in the central database; analyzing the target data to obtain a second vulnerability analysis result, wherein the second vulnerability analysis result is of the same category as the first vulnerability analysis result.
[0077] In one exemplary embodiment, the method further includes: displaying the first vulnerability analysis result and / or the second vulnerability analysis result through a human-computer interaction interface.
[0078] In one exemplary embodiment, the method further includes: generating a plurality of second vulnerability query requests based on the encapsulated system information, wherein the plurality of second vulnerability query requests correspond one-to-one with a plurality of second query objects; matching a plurality of vulnerability databases corresponding one-to-one with the plurality of second query objects, wherein the vulnerability databases are used to store a plurality of historical vulnerability data for the corresponding second query objects; and performing vulnerability analysis on the plurality of second query objects respectively through an artificial intelligence module based on the plurality of vulnerability databases and the plurality of second vulnerability query requests to obtain a plurality of third vulnerability analysis results, wherein the first vulnerability analysis result includes the plurality of third vulnerability analysis results, and the plurality of third vulnerability analysis results correspond one-to-one with the plurality of second query objects.
[0079] In one exemplary embodiment, the method further includes: initiating an HTTPS connection request to the central database and establishing a secure session with the central database, wherein the HTTPS connection request carries a digital certificate; encrypting the encapsulated system information using a client private key to obtain encrypted data, and sending the encrypted data to the central database through the secure session, wherein the encrypted data carries the digital certificate; verifying the digital certificate through the central database, and if the verification passes, decrypting the encrypted data using the public key corresponding to the client private key to obtain the encapsulated system information.
[0080] Embodiments of this application also provide a storage medium including a stored program, wherein the program executes any of the methods described above when it is run.
[0081] Optionally, in this embodiment, the storage medium may be configured to store program code for performing the following steps:
[0082] S1, collect system information of the target information system, and encapsulate the system information into a structured data format to obtain the encapsulated system information;
[0083] S2, the packaged system information is uploaded to the central database through a secure encrypted channel;
[0084] S3, analyze the encapsulated system information to obtain a first vulnerability analysis result, wherein the first vulnerability analysis result includes at least one of the following: vulnerability data, vulnerability level, and vulnerability remediation strategy.
[0085] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.
[0086] Specific examples in this embodiment can be found in the examples described in the above embodiments and exemplary implementations, and will not be repeated here.
[0087] Embodiments of this application also provide an electronic device including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above method embodiments.
[0088] Optionally, in this embodiment, the processor can be configured to perform the following steps via a computer program:
[0089] S1, collect system information of the target information system, and encapsulate the system information into a structured data format to obtain the encapsulated system information;
[0090] S2, the packaged system information is uploaded to the central database through a secure encrypted channel;
[0091] S3, analyze the encapsulated system information to obtain a first vulnerability analysis result, wherein the first vulnerability analysis result includes at least one of the following: vulnerability data, vulnerability level, and vulnerability remediation strategy.
[0092] Optionally, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor and the input / output device is connected to the processor.
[0093] Embodiments of this application also provide a computer program product, including a non-volatile computer-readable storage medium storing the computer program product, wherein the computer program, when executed by a processor, implements the steps of the methods described in various embodiments of this application.
[0094] Optionally, in this embodiment, the computer program described above can be configured to perform the following steps when executed by the processor:
[0095] S1, collect system information of the target information system, and encapsulate the system information into a structured data format to obtain the encapsulated system information;
[0096] S2, the packaged system information is uploaded to the central database through a secure encrypted channel;
[0097] S3, analyze the encapsulated system information to obtain a first vulnerability analysis result, wherein the first vulnerability analysis result includes at least one of the following: vulnerability data, vulnerability level, and vulnerability remediation strategy.
[0098] Optionally, specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementations, and will not be repeated here.
[0099] Obviously, those skilled in the art should understand that the modules or steps of this application described above can be implemented using general-purpose computing systems. They can be centralized on a single computing system or distributed across a network of multiple computing systems. Optionally, they can be implemented using computer-executable program code, thereby storing them in a storage system for execution by the computing system. In some cases, the steps shown or described can be performed in a different order than those presented here, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, this application is not limited to any particular combination of hardware and software.
[0100] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the principles of this application should be included within the protection scope of this application.
Claims
1. An automated information system security vulnerability investigation system based on artificial intelligence, characterized in that, include: An asset acquisition client is used to collect system information of a target information system and encapsulate the system information into a structured data format to obtain the encapsulated system information. The data transmission module, connected to the asset acquisition client, is used to upload the packaged system information to the central database through a secure encrypted channel. An artificial intelligence module, connected to the central database, is used to analyze the encapsulated system information to obtain a first vulnerability analysis result, wherein the first vulnerability analysis result includes at least one of the following: vulnerability data, vulnerability level, and vulnerability remediation strategy.
2. The automated information system security vulnerability investigation system according to claim 1, characterized in that, The system also includes: An artificial intelligence learning module, connected to the central database and the artificial intelligence module, is used to train the artificial intelligence model using the updated data when updated data is detected in the central database, wherein the artificial intelligence model is set in the artificial intelligence module.
3. The automated information system security vulnerability investigation system according to claim 1, characterized in that, The system also includes: The human-computer interaction interface is connected to the central database and the artificial intelligence module, and is used to receive the first vulnerability query request of the target object; The central database is used to parse the first vulnerability query request, obtain the first query object, query the target data corresponding to the first query object in the central database, and send the target data to the artificial intelligence module. The artificial intelligence module is used to analyze the target data to obtain a second vulnerability analysis result, wherein the second vulnerability analysis result is of the same category as the first vulnerability analysis result.
4. The automated information system security vulnerability investigation system according to claim 3, characterized in that, The human-computer interaction interface is also used for: Display the results of the first vulnerability analysis and / or the results of the second vulnerability analysis.
5. The automated information system security vulnerability investigation system according to claim 1, characterized in that, The artificial intelligence module is also used for: Multiple second vulnerability query requests are generated based on the encapsulated system information, wherein each of the multiple second vulnerability query requests corresponds one-to-one with a multiple second query object; Each of the multiple second query objects is matched with a multiple vulnerability database, wherein the vulnerability database is used to store multiple historical vulnerability data of the corresponding second query object; Based on the multiple vulnerability databases and the multiple second vulnerability query requests, the multiple second query objects are analyzed by the artificial intelligence module to obtain multiple third vulnerability analysis results. The first vulnerability analysis result includes the multiple third vulnerability analysis results, and the multiple third vulnerability analysis results correspond one-to-one with the multiple second query objects.
6. The automated information system security vulnerability investigation system according to claim 1, characterized in that: The asset acquisition client is also used to initiate an HTTPS connection request to the central database and establish a secure session with the central database, wherein the HTTPS connection request carries a digital certificate; The data transmission module is further configured to encrypt the encapsulated system information using a client private key to obtain encrypted data, and send the encrypted data to the central database through the secure session, wherein the encrypted data carries the digital certificate; The central database is also used to verify the digital certificate, and if the verification is successful, to decrypt the encrypted data using the public key corresponding to the client's private key to obtain the encapsulated system information.
7. An automated method for identifying information system security vulnerabilities based on artificial intelligence, characterized in that, The information system security vulnerability automated investigation system based on artificial intelligence, as described in any one of claims 1 to 6, comprises: Collect system information of the target information system and encapsulate the system information into a structured data format to obtain the encapsulated system information; The packaged system information is uploaded to the central database through a secure encrypted channel; The encapsulated system information is analyzed to obtain a first vulnerability analysis result, wherein the first vulnerability analysis result includes at least one of the following: vulnerability data, vulnerability level, and vulnerability remediation strategy.
8. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein the program, when executed, performs the method of claim 7.
9. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to execute the method of claim 7 through the computer program.
10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method of claim 7.