Automatic security vulnerability repairing method and device, electronic equipment and medium

Abstract

The invention relates to an automatic security vulnerability repairing method and device, electronic equipment and a medium. The method comprises the following steps: acquiring an original vulnerability report; analyzing the original vulnerability report to obtain standardized vulnerability information; matching the standardized vulnerability information with patch metadata in a patch library, and if a target pre-stored patch corresponding to the standardized vulnerability information is matched, directly calling the target pre-stored patch to perform vulnerability repair; and if the target pre-stored patch corresponding to the standardized vulnerability information is not matched, generating a candidate repair patch according to the standardized vulnerability information, and performing vulnerability repair based on the candidate repair patch. According to the scheme, through a single automatic path from acquisition, analysis, matching / generation to repair, 'second-level calling with patches and immediate self-making without patches' are simultaneously realized in a minute level, manual intervention and waiting are thoroughly avoided, a system exposure window is compressed to the maximum extent, and it is ensured that vulnerabilities must be repaired.

Description

Technical Field

[0001] This invention relates to the field of computer information security technology, and more specifically, to an automated security vulnerability repair method, apparatus, electronic device, and medium. Background Technology

[0002] Security vulnerabilities in software systems are one of the major security threats. Traditional vulnerability remediation processes heavily rely on manual intervention, typically including: security teams discovering vulnerabilities, manual analysis of root causes, developers writing patches, testers performing functional and regression testing, and operations personnel finally deploying the patches. This process has the following inherent flaws: 1. Inefficient and lengthy process: From the discovery of a vulnerability to its final fix, cross-departmental collaboration is required, and the process is cumbersome, which may result in critical vulnerabilities being exploited before they are fixed.

[0003] 2. High dependence on expert experience: Vulnerability analysis, patch development, and testing all heavily rely on the individual capabilities of security experts and developers, making it difficult to scale up to handle massive numbers of vulnerabilities.

[0004] 3. High risk of patching: Manually written patches may be poorly designed and may introduce new vulnerabilities, cause system compatibility issues, or lead to performance degradation. In other words, "fixing one vulnerability can bring more problems."

[0005] 4. Disorganized patch management: In large enterprises with thousands of servers and complex applications, manually tracking the scope of vulnerability impact, distributing and deploying patches is prone to errors, resulting in missed or incorrect patches.

[0006] Existing automated security tools (such as vulnerability scanners) can only detect problems, but cannot automatically and reliably resolve them. Therefore, there is an urgent need for a technical solution that can automate and intelligently manage the entire vulnerability remediation process while effectively controlling remediation risks. Summary of the Invention

[0007] The technical problem to be solved by the present invention is to provide an automated security vulnerability repair method, apparatus, electronic device and medium, which aims to solve at least one of the above-mentioned technical problems.

[0008] In a first aspect, the technical solution of the present invention to solve the above-mentioned technical problems is as follows: an automated security vulnerability repair method, the method comprising: Obtain the original vulnerability report; The original vulnerability report is parsed to obtain standardized vulnerability information; The standardized vulnerability information is matched with the patch metadata in the patch library. If a target pre-stored patch corresponding to the standardized vulnerability information is matched, the target pre-stored patch is directly called to fix the vulnerability. If no target pre-stored patch corresponding to the standardized vulnerability information is found, a candidate patch is generated based on the standardized vulnerability information, and the vulnerability is repaired based on the candidate patch.

[0009] The beneficial effects of this invention are as follows: By following the sequential process of "obtaining the original vulnerability report—parsing to obtain standardized vulnerability information—matching the standardized vulnerability information with patch metadata in the patch library—directly calling the patch to fix the vulnerability when a target pre-stored patch is matched, and generating candidate patching based on the standardized vulnerability information and fixing the vulnerability when no match is found," this solution simultaneously covers two scenarios within a single automated path: "using existing patches immediately" and "creating patches immediately when no patches are available." This ensures that vulnerability repair is no longer interrupted by waiting for manual writing or patch searching, thereby shortening the processing time from the traditional days to minutes. It also ensures that any standardized vulnerability information can be converted into an executable repair action, significantly reducing the risk of system exposure.

[0010] Based on the above technical solution, the present invention can be further improved as follows.

[0011] Furthermore, based on standardized vulnerability information, candidate patch remediation is generated, including: If the vulnerability type corresponding to the standardized vulnerability information is a common vulnerability, then according to the preset remediation rule library, the remediation rule matching the vulnerability type is called to generate a candidate remediation patch. If the standardized vulnerability information corresponds to a code-level vulnerability, then the vulnerable code line is located using static application security testing techniques, and a fix code is generated as a candidate patch using program analysis techniques.

[0012] Furthermore, the method also includes: Automated construction of an isolated test environment consistent with the target production environment; The target patch is verified in an isolated test environment. The target patch is either a candidate fix patch or a pre-stored target patch. The verification includes security effectiveness verification, functional regression verification, and performance and stability verification. Once the target patch passes verification, deploy it to the online production environment.

[0013] Furthermore, when target patch verification fails, the method also includes: Generate a failure log and send it to the patch repository, triggering an alarm notification.

[0014] Furthermore, after deploying the target patch to the online production environment, the method also includes: Monitor key metrics of the vulnerability corresponding to the original vulnerability report during the process of being patched by the target patch; Determine whether the vulnerability corresponding to the original vulnerability report has been patched by the target patch based on key indicators.

[0015] Secondly, to solve the above-mentioned technical problems, the present invention also provides an automated security vulnerability repair device, the device comprising: The acquisition module is used to obtain the original vulnerability report; The parsing module is used to parse the original vulnerability report to obtain standardized vulnerability information; The first repair module is used to match standardized vulnerability information with patch metadata in the patch library. If a target pre-stored patch corresponding to the standardized vulnerability information is matched, the target pre-stored patch is directly called to repair the vulnerability. The second repair module is used to generate candidate repair patches based on the standardized vulnerability information when no target pre-stored patch corresponding to the standardized vulnerability information is found, so as to repair the vulnerability based on the candidate repair patches.

[0016] Thirdly, in order to solve the above-mentioned technical problems, the present invention also provides an electronic device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the automated security vulnerability repair method of the present application.

[0017] Fourthly, in order to solve the above-mentioned technical problems, the present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the automated security vulnerability repair method of the present application.

[0018] Additional aspects and advantages of this application will be set forth in part in the description which follows, and will become apparent from the description or may be learned by practice of this application. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments of the present invention will be briefly introduced below.

[0020] Figure 1 This is a flowchart illustrating an automated security vulnerability repair method according to an embodiment of the present invention. Figure 2 This is a schematic diagram of the overall system architecture and data flow process provided in one embodiment of the present invention; Figure 3 This is a schematic diagram of an intelligent patch matching and generation process provided in one embodiment of the present invention; Figure 4 This is a schematic diagram of an automated security vulnerability repair device provided in one embodiment of the present invention; Figure 5This is a schematic diagram of the structure of an electronic device provided in one embodiment of the present invention. Detailed Implementation

[0021] The principles and features of the present invention are described below. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.

[0022] The technical solution of the present invention and how the technical solution of the present invention solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of the present invention will now be described with reference to the accompanying drawings.

[0023] The solutions provided in these embodiments of the invention are applicable to any application scenario requiring automated vulnerability patching. The solutions provided in these embodiments of the invention can be executed by any electronic device, such as a user's terminal device, including at least one of the following: smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, smart TV, or smart in-vehicle device.

[0024] This invention provides a possible implementation, such as... Figure 1 The diagram illustrates a flowchart of an automated security vulnerability remediation method. This method can be executed by any electronic device, such as a terminal device, or jointly by a terminal device and a server. For ease of description, the method provided in this embodiment will be described below using a terminal device as the execution subject. Figure 1 The flowchart shown indicates that the method may include the following steps: S10, obtain the original vulnerability report; S20: Parse the original vulnerability report to obtain standardized vulnerability information; S30 matches standardized vulnerability information with patch metadata in the patch library. If a target pre-stored patch corresponding to the standardized vulnerability information is matched, the target pre-stored patch is directly called to fix the vulnerability. S40. If no target pre-stored patch corresponding to the standardized vulnerability information is found, a candidate patch is generated based on the standardized vulnerability information, and the vulnerability is repaired based on the candidate patch.

[0025] The method of this invention, through the sequential process of "obtaining the original vulnerability report—parsing to obtain standardized vulnerability information—matching the standardized vulnerability information with patch metadata in the patch library—directly calling the patch to fix when a target pre-stored patch is matched, and generating candidate patching patches based on the standardized vulnerability information and fixing accordingly when no match is found," covers both "immediate use of existing patches" and "immediate creation of patches when none are available" scenarios within a single automated path. This ensures that vulnerability repair is no longer interrupted by waiting for manual patch writing or searching, thereby shortening the processing time from the traditional days to minutes. It also guarantees that any standardized vulnerability information can be converted into an executable repair action, significantly reducing the risk of system exposure.

[0026] The following specific embodiments further illustrate the solution of the present invention. In these embodiments, the purpose of the present invention is to overcome the shortcomings of the prior art and provide an automated and intelligent method for remediating security vulnerabilities. The present invention aims to: significantly shorten the response and handling time for vulnerability remediation, reducing the time window during which the system is exposed to risks; reduce reliance on human experts during the vulnerability remediation process, improving remediation efficiency and consistency; and ensure the effectiveness and security of remediation patches through an automated verification process, preventing system failures due to patch issues, and achieving unified and precise management of vulnerability remediation for large-scale IT assets.

[0027] To achieve the above objectives, in this example, combined with Figure 2 ,exist Figure 2 In the process, after the vulnerability information is accessed and parsed, it is sent to the intelligent patch management engine for processing. The generated patch undergoes rigorous testing in an isolated verification environment. Only after passing the verification is it securely deployed to the production system by the automated deployment module.

[0028] Based on this idea, this embodiment provides an automated security vulnerability remediation method, which may include the following steps: S10, obtain the original vulnerability report; The aforementioned original vulnerability reports may come from different vulnerability scanning tools, threat intelligence platforms, security bulletins, or asset management systems, and are received through a unified API interface.

[0029] S20: Parse the original vulnerability report to obtain standardized vulnerability information; The standardized vulnerability information mentioned above includes, but is not limited to: unique vulnerability identifier (such as CVE-ID), affected software name, affected version range, vulnerability type (such as SQL injection, buffer overflow), severity level (such as CVSS score), and vulnerability description.

[0030] S30 matches standardized vulnerability information with patch metadata in the patch library. If a target pre-stored patch corresponding to the standardized vulnerability information is matched, the target pre-stored patch is directly called to fix the vulnerability. The patch repository mentioned above stores not only patch files (also known as pre-stored patches), but also patch metadata (applicable conditions, a list of CVEs to be fixed) and patch generation rules. The stored pre-stored patches can be officially released upgrade packages or hotfix patches. The S30 matching process described above can be called exact matching.

[0031] S40. If no target pre-stored patch corresponding to the standardized vulnerability information is found, a candidate patch is generated based on the standardized vulnerability information, and the vulnerability is repaired based on the candidate patch.

[0032] The S30 and S40 mentioned above can be executed based on the smart patching engine. For detailed procedures, please refer to [link / reference needed]. Figure 3 . If no pre-existing patch corresponding to the standardized vulnerability information is found, for example, if the vulnerability has not yet been officially released or is targeting custom code, the smart patch generator is activated to execute the above S40. The process of generating patches using the above S40 can be called smart generation.

[0033] Optionally, in S40 above, generating candidate patch remediation based on standardized vulnerability information may include: S401, if the vulnerability type corresponding to the standardized vulnerability information is a common vulnerability, then according to the preset repair rule library, the repair rule matching the vulnerability type is called to generate a candidate repair patch. Common vulnerabilities include XSS vulnerabilities and path traversal. The aforementioned S401 can be executed based on a rule engine.

[0034] As an example, for XSS vulnerabilities, the rules engine will automatically add an HTML encoding function before outputting the data to HTML.

[0035] S402 If the vulnerability type corresponding to the standardized vulnerability information is a code-level vulnerability, then the vulnerable code line is located by static application security testing technology, and repair code is generated as a candidate repair patch by combining program analysis technology.

[0036] For code-level vulnerabilities, Static Application Security Testing (SAST) can be used to locate vulnerable lines of code, and then combined with program analysis techniques (such as data flow analysis) to generate fixes. For example, an insecure strcpy call can be replaced with a secure strncpy_s call.

[0037] Optionally, the above method further includes: S50 automates the construction of an isolated test environment that is consistent with the target production environment; specifically, it automates the construction of an isolated test environment that is highly consistent with the target production environment, for example, using Docker containers or virtual machine snapshot technology. The target patch is then deployed to this isolated test environment.

[0038] S60 verifies target patches through an isolated test environment. The target patches are either candidate fix patches or target pre-stored patches. The verification includes security effectiveness verification, functional regression verification, and performance and stability verification. Specifically, security effectiveness testing involves simulating attacks using proof-of-concept (PoC) code corresponding to the vulnerability to verify whether the vulnerability has been successfully patched.

[0039] Functional regression testing: Automated test cases that run core business functions to ensure that the target patch does not break the normal function of the system.

[0040] Performance and stability testing: Conduct benchmark performance tests (such as throughput and response time) and long-term operation tests to ensure that the target patch does not have a negative impact.

[0041] S70 deploys the target patch to the online production environment once the target patch passes verification.

[0042] To ensure patch security and reliability, all patches (whether matched or generated) must be verified. Only target patches that pass all the above tests are marked as "verified" and enter the deployment process. In case target patch verification fails, this method also includes: Generate a failure log and send it to the patch repository, triggering an alarm notification.

[0043] If the verification fails, the failure log will be sent to the smart patch library, and an alarm will be triggered to notify the administrator for manual intervention.

[0044] Optionally, after deploying the target patch to the online production environment, the method further includes: Monitor key metrics of the vulnerability corresponding to the original vulnerability report during the process of being patched by the target patch; Determine whether the vulnerability corresponding to the original vulnerability report has been patched by the target patch based on key indicators.

[0045] In this way, "verified" target patches can be deployed to the online production environment in batches and on a rolling basis through automated operation and maintenance tools (such as Ansible, SaltStack) or CI / CD pipelines to minimize potential impact.

[0046] After the target patch is deployed, key system metrics (such as error logs, CPU / memory usage, and the presence of new attack attempts) can be continuously monitored by integrating with Application Performance Monitoring (APM) and Security Information and Event Management (SIEM) systems. Once system stability is confirmed and the vulnerability has been fully patched, this remediation process concludes.

[0047] To better illustrate and understand the principle of the method provided by this invention, the following description uses an optional specific embodiment to illustrate the solution of this invention. It should be noted that the specific implementation of each step in this specific embodiment should not be construed as a limitation of the solution of this invention. Other implementations that can be conceived by those skilled in the art based on the principle of the solution provided by this invention should also be considered within the scope of protection of this invention.

[0048] In this embodiment, the objective is to fix the remote code execution vulnerability (CVE-2017-5638) in the Apache Struts framework, including the following steps: S1: An urgent notification regarding CVE-2017-5638 was received through a subscribed threat intelligence source. Key information obtained after analysis: Affected software includes Apache Struts versions 2.3.5 to 2.3.31 and 2.5 to 2.5.10; the vulnerability type is remote code execution; the CVSS score is 10.0 (critical).

[0049] S2.1: The smart patch management engine searches the smart patch repository using "CVE-2017-5638" and the affected version number as keywords. The patch repository includes official Apache patch releases (such as upgrade guides and related JAR files for versions 2.3.32 or 2.5.10.1).

[0050] S2.2: The engine directly calls this upgrade solution as a fix patch.

[0051] S3.1: Based on the asset management system, find a test server image running Struts 2.3.30, and quickly clone a Docker container based on it as an isolated verification environment.

[0052] S3.2: In the container, execute the official upgrade steps to upgrade the Struts framework to version 2.3.32.

[0053] S3.3: Startup of automated verification script: Security testing: Execute the publicly available CVE-2017-5638 exploit code to confirm that the attack fails in the upgraded environment.

[0054] Functional testing: Run automated test cases for the main functions of the web application on the server to ensure that the business logic is normal.

[0055] Performance testing: Perform simple stress tests on the application to confirm that the response time is within the normal range.

[0056] S3.4: All tests passed, and the patch was marked as "verified".

[0057] S4.1: The automated deployment module uses automated operation and maintenance tools to distribute upgrade scripts and files to all online application servers affected by the vulnerability that are running the vulnerable version of Struts, and performs the upgrade operation in batches.

[0058] S4.2: After the upgrade, the system monitoring platform focused on the application server's error logs and abnormal traffic. During the 24-hour post-evaluation period, no business anomalies caused by this upgrade were detected, and the original attack attempts disappeared, indicating that the vulnerability remediation was successfully completed.

[0059] Compared with the prior art, the present invention has the following significant advantages: It achieves full-process automation: It integrates multiple discrete steps of vulnerability remediation (analysis, patch acquisition, testing, deployment) into a seamless automated pipeline, reducing the remediation cycle from days / weeks to hours / minutes.

[0060] It enhances the intelligence level of remediation: Through intelligent patch library and rule engine, it can automatically handle a large number of known and unknown vulnerabilities, reduce the dependence on scarce security experts, and enable ordinary operation and maintenance teams to handle complex vulnerabilities efficiently.

[0061] Significantly reduces remediation risks: By mandating isolation environment verification, potential problems are fully exposed before patches are applied to production systems, effectively avoiding business interruptions caused by patch quality issues and achieving "safe remediation of security vulnerabilities".

[0062] Possesses self-learning and evolutionary capabilities: The intelligent patch library can accumulate knowledge and rules from each successful fix and failed verification, enabling the system's repair capabilities to continuously evolve and improve over time.

[0063] Based on and Figure 1 Using the same principle as the method shown, this embodiment of the invention also provides an automated security vulnerability repair device 20, such as... Figure 4 As shown, the automated security vulnerability repair device 20 may include an acquisition module 210 (corresponding to...) Figure 2 The system comprises a vulnerability information access module, a parsing module 220, a first repair module 230, and a second repair module 240, wherein: Module 210 is used to obtain the original vulnerability report; The parsing module 220 is used to parse the original vulnerability report to obtain standardized vulnerability information; The first repair module 230 is used to match standardized vulnerability information with patch metadata in the patch library. If a target pre-stored patch corresponding to the standardized vulnerability information is matched, the target pre-stored patch is directly called to repair the vulnerability. The second repair module 240 is used to generate candidate repair patches based on the standardized vulnerability information when no target pre-stored patch corresponding to the standardized vulnerability information is configured, so as to perform vulnerability repair based on the candidate repair patches.

[0064] The processes of matching the target pre-stored patch and generating candidate repair patches in the first repair module 230 and the second repair module 240 mentioned above can be achieved through... Figure 2 The intelligent patch management engine is implemented in [the system / platform].

[0065] Optionally, when generating candidate patch repairs based on standardized vulnerability information, the second repair module 240 is specifically used for: If the vulnerability type corresponding to the standardized vulnerability information is a common vulnerability, then according to the preset remediation rule library, the remediation rule matching the vulnerability type is called to generate a candidate remediation patch. If the standardized vulnerability information corresponds to a code-level vulnerability, then the vulnerable code line is located using static application security testing techniques, and a fix code is generated as a candidate patch using program analysis techniques.

[0066] Optionally, the device further includes: The verification module is used to automatically build an isolated test environment consistent with the target production environment; the target patch is verified in the isolated test environment, and the target patch is either a candidate patch or a pre-stored patch. The verification includes security effectiveness verification, functional regression verification, and performance and stability verification; when the target patch passes the verification, the target patch is deployed to the online production environment.

[0067] Optionally, the device further includes: The alarm module is used to generate failure logs and send them back to the patch library to trigger alarm notifications.

[0068] Optionally, after the target patch is deployed to the online production environment, the device also includes: The monitoring module is used to monitor key indicators of the vulnerability corresponding to the original vulnerability report during the process of being patched by the target patch; and to determine whether the vulnerability corresponding to the original vulnerability report has been patched by the target patch based on the key indicators.

[0069] The automated security vulnerability repair device of this invention can execute the automated security vulnerability repair method provided in this invention. The implementation principle is similar. The actions performed by each module and unit in the automated security vulnerability repair device in each embodiment of this invention correspond to the steps in the automated security vulnerability repair method in each embodiment of this invention. For detailed functional descriptions of each module of the automated security vulnerability repair device, please refer to the descriptions in the corresponding automated security vulnerability repair methods shown above, which will not be repeated here.

[0070] The aforementioned automated security vulnerability repair device can be a computer program (including program code) running on a computer device, such as an application software; the device can be used to execute the corresponding steps in the method provided in the embodiments of the present invention.

[0071] In some embodiments, the automated security vulnerability repair device provided in this invention can be implemented using a combination of hardware and software. As an example, the automated security vulnerability repair device provided in this invention can be a processor in the form of a hardware decoding processor, which is programmed to execute the automated security vulnerability repair method provided in this invention. For example, the processor in the form of a hardware decoding processor can be one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), or other electronic components.

[0072] In other embodiments, the automated security vulnerability repair device provided in this invention can be implemented in software. Figure 4 An automated security vulnerability repair device stored in a memory is shown. It can be software in the form of programs and plug-ins, and includes a series of modules, including an acquisition module 210, a parsing module 220, a first repair module 230 and a second repair module 240, for implementing the automated security vulnerability repair method provided in the embodiments of the present invention.

[0073] The modules described in the embodiments of the present invention can be implemented in software or hardware. The names of the modules are not, in some cases, limiting the scope of the module itself.

[0074] Based on the same principles as the methods shown in the embodiments of the present invention, the embodiments of the present invention also provide an electronic device, which may include, but is not limited to: a processor and a memory; the memory for storing computer programs; and the processor for executing the methods shown in any embodiment of the present invention by invoking the computer programs.

[0075] In one alternative embodiment, an electronic device is provided, such as Figure 5 As shown, Figure 5 The illustrated electronic device 4000 includes a processor 4001 and a memory 4003. The processor 4001 and the memory 4003 are connected, for example, via a bus 4002. Optionally, the electronic device 4000 may further include a transceiver 4004, which can be used for data interaction between the electronic device and other electronic devices, such as sending and / or receiving data. It should be noted that in practical applications, the transceiver 4004 is not limited to one type, and the structure of the electronic device 4000 does not constitute a limitation on the embodiments of the present invention.

[0076] Processor 4001 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this invention. Processor 4001 may also be a combination that implements computational functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0077] Bus 4002 may include a pathway for transmitting information between the aforementioned components. Bus 4002 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. Bus 4002 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 5 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0078] The memory 4003 may be ROM (Read Only Memory) or other types of static storage devices capable of storing static information and instructions, RAM (Random Access Memory) or other types of dynamic storage devices capable of storing information and instructions, or EEPROM (Electrically Erasable Programmable Read Only Memory), CD-ROM (Compact Disc Read Only Memory) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto.

[0079] The memory 4003 stores application code (computer program) for executing the present invention, and its execution is controlled by the processor 4001. The processor 4001 executes the application code stored in the memory 4003 to implement the content shown in the foregoing method embodiments.

[0080] Among these, electronic devices can also be terminal devices. Figure 5 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments of the present invention.

[0081] This invention provides a computer-readable storage medium storing a computer program that, when run on a computer, enables the computer to execute the corresponding content in the aforementioned method embodiments.

[0082] According to another aspect of the present invention, a computer program product or computer program is also provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods provided in the various embodiments described above.

[0083] Computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0084] It should be understood that the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of methods and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0085] The computer-readable storage medium provided in this invention can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0086] The aforementioned computer-readable storage medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to perform the method shown in the above embodiments.

[0087] The above description is merely a preferred embodiment of the present invention and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of disclosure in this invention is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-disclosed concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this invention.

Claims

1. An automated security vulnerability remediation method, characterized in that, include: Obtain the original vulnerability report; The original vulnerability report is parsed to obtain standardized vulnerability information; The standardized vulnerability information is matched with the patch metadata in the patch library. If a target pre-stored patch corresponding to the standardized vulnerability information is matched, the target pre-stored patch is directly called to fix the vulnerability. If no target pre-stored patch corresponding to the standardized vulnerability information is found, a candidate patch is generated based on the standardized vulnerability information, and the vulnerability is repaired based on the candidate patch.

2. The method according to claim 1, characterized in that, The step of generating candidate patch remediation based on the standardized vulnerability information includes: If the vulnerability type corresponding to the standardized vulnerability information is a common vulnerability, then according to the preset repair rule library, the repair rule matching the vulnerability type is called to generate a candidate repair patch. If the vulnerability type corresponding to the standardized vulnerability information is a code-level vulnerability, then the vulnerable code line is located by static application security testing technology, and repair code is generated as a candidate repair patch by combining program analysis technology.

3. The method according to claim 1, characterized in that, The method further includes: Automated construction of an isolated test environment consistent with the target production environment; The target patch is verified in the isolated test environment. The target patch is a candidate repair patch or a target pre-stored patch. The verification includes security effectiveness verification, functional regression verification, and performance and stability verification. Once the target patch passes verification, it is deployed to the online production environment.

4. The method according to claim 3, characterized in that, When the target patch verification fails, the method further includes: A failure log is generated and fed back to the patch library, triggering an alarm notification.

5. The method according to claim 3, characterized in that, After deploying the target patch to the online production environment, the method further includes: Monitor key metrics of the vulnerability corresponding to the original vulnerability report during the process of being patched by the target patch; Based on the key indicators, determine whether the vulnerability corresponding to the original vulnerability report has been fixed by the target patch.

6. An automated security vulnerability repair device, characterized in that, include: The acquisition module is used to obtain the original vulnerability report; The parsing module is used to parse the original vulnerability report to obtain standardized vulnerability information; The first repair module is used to match the standardized vulnerability information with the patch metadata in the patch library. If a target pre-stored patch corresponding to the standardized vulnerability information is matched, the target pre-stored patch is directly called to repair the vulnerability. The second repair module is used to generate candidate repair patches based on the standardized vulnerability information when no target pre-stored patch corresponding to the standardized vulnerability information is matched, so as to repair the vulnerability based on the candidate repair patches.

7. The apparatus according to claim 6, characterized in that, When the second repair module generates candidate repair patches based on the standardized vulnerability information, it is specifically used for: If the vulnerability type corresponding to the standardized vulnerability information is a common vulnerability, then according to the preset repair rule library, the repair rule matching the vulnerability type is called to generate a candidate repair patch. If the vulnerability type corresponding to the standardized vulnerability information is a code-level vulnerability, then the vulnerable code line is located by static application security testing technology, and repair code is generated as a candidate repair patch by combining program analysis technology.

8. The apparatus according to claim 6, characterized in that, The device further includes: The verification module is used to automatically build an isolated test environment consistent with the target production environment; the target patch is verified through the isolated test environment, the target patch being a candidate fix patch or a target pre-stored patch, and the verification includes security effectiveness verification, functional regression verification, and performance and stability verification; when the target patch passes verification, the target patch is deployed to the online production environment.

9. An electronic device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method of any one of claims 1-5.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method of any one of claims 1-5.

Images