Vulnerability report generation method and device based on field disambiguation and computer equipment

Abstract

The invention relates to a vulnerability report generation method and device based on field disambiguation and computer equipment. The method comprises the steps of obtaining a vulnerability report to be disambiguated, performing word segmentation and vectorization processing on the vulnerability report, and generating input field features corresponding to fields; inputting the input field features and standard field features contained in a preset standard template into a dual-channel attention network, and in the attention weight processing process in the dual-channel attention network, obtaining the attention weight of the dual-channel attention network based on topological bias represented by a pre-constructed field dependency relationship graph, adjusting a matching weight between the input field feature sequence and the standard field feature sequence; and according to the matching weight, mapping a field in the vulnerability report to a standard template field, and outputting a disambiguated structured vulnerability report. By adopting the method and the device, the field disambiguation can be accurately performed when the vulnerability report is generated.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus and computer equipment for generating vulnerability reports based on field disambiguation. Background Technology

[0002] In the field of cybersecurity, vulnerability reports are a crucial medium for security testers, penetration testers, and enterprise security teams to communicate security threat information and assess system security. As enterprises become increasingly information-driven, their network environments and business architectures become more complex, and enterprises typically need to receive vulnerability reports from multiple security vendors, third-party security testing platforms, and internal automated scanning tools simultaneously.

[0003] However, the industry currently lacks a unified, mandatory standard for vulnerability reporting templates. Report templates from different vendors exhibit significant differences in field naming conventions, data structure organization, and business format definitions. For example, the same semantic meaning may be named differently in different vendors' report templates, such as "Vulnerability Severity," "Impact Level," or "Severity." This inconsistent field naming and incompatible data structures directly limit the accuracy of field matching in automated systems when aligning fields from external templates and facilitating data flow across internal systems.

[0004] To address the aforementioned technical challenges, related technologies generally employ manual configuration or partially automated extraction methods, establishing fixed dictionary mapping rules for field filtering and matching. However, these technologies struggle to accurately disambiguate fields when generating vulnerability reports. Summary of the Invention

[0005] Therefore, it is necessary to provide a vulnerability report generation method, apparatus, and computer equipment that can accurately disambiguate fields when generating vulnerability reports, in order to address the above-mentioned technical problems.

[0006] Firstly, this application provides a vulnerability report generation method based on field disambiguation, the method comprising:

[0007] Obtain the vulnerability report to be disambiguated, perform word segmentation and vectorization on the vulnerability report, and generate the input field features corresponding to the fields; The input field features and the standard field features contained in the pre-built standard template are input into the dual-channel attention network. During the attention weight processing in the dual-channel attention network, the matching weight between the input field feature sequence and the standard field feature sequence is adjusted based on the topological bias represented by the pre-built field dependency graph. Based on the matching weights, the fields in the vulnerability report are mapped to standard template fields, and the disambiguated structured vulnerability report is output.

[0008] In one embodiment, adjusting the matching weights between the input field feature sequence and the standard field feature sequence includes: In a dual-channel attention network, the basic attention weights are determined; Extract the topological association parameters between input field features and standard field features from the field dependency graph; Topological association parameters are superimposed on the base attention weights to correct the matching weights.

[0009] In one embodiment, in a dual-channel attention network, determining the basic attention weights includes: Determine the hidden semantic feature vectors contained in the input field features, and the standard field feature vectors corresponding to the standard field features; Perform projection transformation on the hidden semantic feature vector and the standard field feature vector, and then perform a dot product operation between the projected hidden semantic feature vector and the standard field feature vector; The results of the dot product operation are scaled to obtain the basic attention weights.

[0010] In one embodiment, topological association parameters are superimposed on the base attention weights to correct the matching weights, including: The topological correlation parameters are weighted based on preset adjustment factors. The corrected matching weights are obtained by superimposing the basic attention weights with the weighted topological association parameters.

[0011] In one embodiment, the disambiguated structured vulnerability report is output, including: After determining the fields that have been mapped in the vulnerability report based on the matching weight, the matching status of the text fragments in the vulnerability report is detected by a dynamic cursor. If the matching state representation contains unmatched text fragments, then the step of inputting the input field features and the standard field features contained in the pre-set standard template into the dual-channel attention network is repeated. If the matching status indicates that there are no unmatched text fragments, the mapped fields will be output as a disambiguated structured vulnerability report.

[0012] In one embodiment, the input field features and the standard field features contained in the preset standard template are input into a dual-channel attention network, including: Input field features are fed into the first channel of the dual-channel attention network, and standard field features are fed into the second channel of the dual-channel attention network. In a dual-channel attention network, a multi-label classification network is used to perform multi-attribution prediction on the same input field feature, so that the input field feature can be matched to multiple standard field features at the same time.

[0013] In one embodiment, the disambiguated structured vulnerability report is output, including: Based on a pre-built data mapping dictionary, the mapped fields in the vulnerability report are assembled into a standardized format and output as a disambiguated structured vulnerability report.

[0014] In one embodiment, the vulnerability report is segmented and vectorized to generate input field features corresponding to the fields, including: An abstract syntax tree is used to perform structured parsing of vulnerability reports and extract vulnerability field features associated with security threats. By using a word vector model, the features of the vulnerability fields are converted into vectorized features to generate the features of the input fields.

[0015] In one embodiment, the field dependency graph is constructed as follows: Obtain multiple historical vulnerability report samples; Analyze the logical dependencies between fields in each historical vulnerability report; Fields are used as nodes, and logical dependencies between fields are used as relationship edges to construct a field dependency graph.

[0016] Secondly, this application also provides a vulnerability report generation device based on field disambiguation, the device comprising: The input feature generation module is used to obtain the vulnerability report to be disambiguated, perform word segmentation and vectorization processing on the vulnerability report, and generate input field features corresponding to the fields. The matching weight adjustment module is used to input the input field features and the standard field features contained in the pre-built standard template into the dual-channel attention network. During the attention weight processing in the dual-channel attention network, the matching weight between the input field feature sequence and the standard field feature sequence is adjusted based on the topological bias represented by the pre-built field dependency graph. The vulnerability report output module is used to map fields in the vulnerability report to standard template fields based on matching weights, and output a disambiguated structured vulnerability report.

[0017] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the above-described method.

[0018] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the above-described method.

[0019] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the above-described method.

[0020] The vulnerability report generation method, apparatus, and computer equipment based on field disambiguation provided in this application, through word segmentation and vectorization of the vulnerability report to be disambiguated, enable the server to transform the raw text with varying formats and unstructured structure into unified, computable numerical input field features, providing a standardized data foundation for subsequent intelligent matching. By inputting the input field features and the standard field features contained in the pre-built standard template into a dual-channel attention network, and adjusting the matching weights between the input field feature sequence and the standard field feature sequence based on the topological bias represented by the pre-constructed field dependency graph during the attention weight processing of this network, the server can simultaneously incorporate the surface semantic information of the text and the inherent deep logical structure constraints between fields when calculating the degree of field matching, thereby improving the robustness and accuracy of the matching process. Finally, by mapping the fields in the vulnerability report to the standard template fields according to the above matching weights and outputting the disambiguated structured vulnerability report, the server completes the complete conversion link from non-standard input to standardized output. In this way, it is possible to accurately disambiguate fields when generating vulnerability reports, and output structured data with a unified format, clear fields, and direct usability for downstream systems. This breaks down data silos between multi-source vulnerability reports and the internal standardized management system, thereby improving the automation level and reliability of vulnerability information flow and processing. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 A flowchart illustrating a vulnerability report generation method based on field disambiguation provided in this application embodiment; Figure 2 A schematic diagram illustrating a process for adjusting matching weights, provided as an embodiment of this application; Figure 3 A flowchart illustrating the output of a structured vulnerability report, provided as an embodiment of this application; Figure 4 A flowchart illustrating the process of constructing a field dependency graph for the implementation of this application; Figure 5A schematic diagram of a vulnerability report generation device based on field disambiguation provided in this application embodiment; Figure 6 This is a schematic diagram of the internal structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0024] In the field of cybersecurity, vulnerability reports are a crucial medium for white-hat hackers, penetration testers, and enterprise security teams to exchange security threat information and assess system security. As enterprises become increasingly information-driven, their network environments and business architectures become more complex, and enterprises typically need to receive vulnerability reports from multiple different security vendors, crowdsourced testing platforms, and internal automated scanning tools simultaneously.

[0025] However, existing vulnerability report templates lack a unified and mandatory standard within the industry. Report templates from different vendors vary in field naming, data structure, and business format definitions (for example, the same meaning may be named "Vulnerability Severity," "Impact Level," or "Severity"). This lack of uniformity and incompatibility directly limits the accuracy of matching when machine systems align fields from external templates and transfer data across internal systems.

[0026] To address the aforementioned challenges, traditional methods generally employ a crude, manual approach involving fixed dictionary mappings and field filtering and matching. This method is not only time-consuming and labor-intensive, making it difficult to achieve economies of scale, but it is also prone to errors when faced with frequently updated vulnerability templates or the integration of new vendors. Even when some automated extraction methods exist, they often only focus on superficial dimensions such as calculating surface-level keyword similarity (e.g., edit distance), severely neglecting the inherent, deep logical constraints within the vulnerability report content (e.g., the strong dependency between the text block "reproduction steps" and "vulnerability type"). Due to this fragmented understanding of semantics and structure, current solutions are completely unable to overcome the highly challenging bottleneck of multi-vendor heterogeneous information fusion, and there is a severe lack of automated, accurate, and dynamic template disambiguation solutions.

[0027] In one exemplary embodiment, Figure 1 A flowchart illustrating a vulnerability report generation method based on field disambiguation provided in this application is shown below. Figure 1As shown, a vulnerability report generation method based on field disambiguation is provided. This method is illustrated using a server as an example. It is understood that this method can also be applied to terminals, and to systems including both terminals and servers, and is implemented through interaction between the terminal and the server. Terminals can be, but are not limited to, various personal computers, laptops, smartphones, and tablets. Servers can be independent physical servers, server clusters or distributed systems composed of multiple physical servers, or cloud servers providing cloud computing services. In this embodiment, the method includes the following steps S101 to S103: Wherein: S101. Obtain the vulnerability report to be disambiguated, perform word segmentation and vectorization processing on the vulnerability report, and generate the input field features corresponding to the fields.

[0028] In this context, a vulnerability report refers to a raw data document generated by white-hat hackers, penetration testers, or security scanning tools to describe information about cybersecurity threats. Word segmentation and vectorization refers to the process of dividing unstructured natural language text into independent semantic units (words or sub-words) and mapping these semantic units into numerical vector representations in a high-dimensional space. Input field features refer to the structured numerical representations extracted from the raw vulnerability report and obtained through vectorization, which characterize the semantic content of specific report fields.

[0029] For example, the server first obtains a raw vulnerability report from an external vendor, which may have an inconsistent format. Then, the server performs word segmentation on the text content of the vulnerability report, breaking down continuous sentences into individual words or phrases. Next, the server uses a pre-trained word vector model or semantic encoding model to convert each segmentation result into its corresponding semantic vector. Through this process, the server generates input field features for each potential field in the vulnerability report, which can then be directly computed by subsequent models.

[0030] As an example, the server can use the Word2Vec static word vector model to vectorize the segmented results, or use a transformer-based bidirectional encoder representation model to perform dynamic mask calculations to generate input field features in the form of a higher purity multi-kernel matrix.

[0031] Optionally, before segmenting the vulnerability report, the server can first perform text cleaning operations, such as removing HTML tags, unifying character encoding, and replacing special symbols, to improve the accuracy of segmentation and the quality of subsequent vectorized representation.

[0032] In step S101, by performing word segmentation and vectorization processing on the vulnerability reports to be disambiguated, the server can transform unstructured, differently formatted raw text into a unified, computable numerical feature representation. This lays the foundation for subsequent intelligent matching and mapping, enabling the server to accurately disambiguate fields when generating vulnerability reports, effectively overcoming the computational difficulties and semantic ambiguities caused by directly processing raw text.

[0033] S102. Input the input field features and the standard field features contained in the pre-built standard template into the dual-channel attention network. During the attention weight processing in the dual-channel attention network, adjust the matching weight between the input field feature sequence and the standard field feature sequence based on the topological bias represented by the pre-built field dependency graph.

[0034] Here, a pre-defined standard template refers to a standardized data structure that is predefined according to the data format requirements of the target system (such as a vulnerability tracking system or a security ticket system), containing a series of standard fields and their feature representations. Standard field features refer to the vectorized representations of the semantics of each standard field extracted from the pre-defined standard template. A dual-channel attention network refers to a deep learning network architecture containing two independent processing channels, used to encode the input sequence and the template sequence respectively, and to calculate the semantic association between them through an attention mechanism. A field dependency graph refers to graph-structured data constructed with fields as nodes and logical or semantic dependencies between fields as edges, used to represent strong associations or symbiotic patterns between different fields. Topological bias refers to the structural prior information extracted from the field dependency graph used to correct the standard attention weights. Matching weight refers to a numerical metric that measures the degree of matching or alignment probability between input field features and a certain standard field feature during the dual-channel attention network computation process.

[0035] For example, the server can provide a sequence of input field features and a sequence of standard field features extracted from an internally pre-built standard template as input to a dual-channel attention network. During the calculation of attention weights within this dual-channel attention network, the server does not rely solely on the surface semantic similarity between the input features and the template features; it also introduces a pre-constructed field dependency graph. This field dependency graph provides topological bias information between fields, such as a strong dependency between the vulnerability type field and the reproduction step field. The server uses this topological bias to dynamically adjust the original attention calculation score, thereby correcting and generating the final matching weights, assigning higher weights to matching pairs that conform to the inherent logical dependencies between fields.

[0036] As an example, the server can introduce a cross-opposition attention penalty term in the computation of a dual-channel attention network. Its core formula can include a topological association parameter extracted from the field dependency graph, which records the degree of strong topological association between input field nodes and standard template field nodes. The server can then add this topological association parameter to the base attention weights to adjust the final matching weights.

[0037] Optionally, the server can dynamically adjust the magnitude of the adjustment factor used to control the strength of topology bias based on the complexity and real-time requirements of the application scenario. For example, in environments with highly heterogeneous field formats and unreliable semantic information, the value of the adjustment factor can be increased to strengthen the corrective effect of the field dependency graph on the matching weights; while in scenarios where the field semantics are already very clear and the structural dependencies are relatively weak, the value of the adjustment factor can be appropriately decreased to reduce the intervention strength of topology bias on the matching results.

[0038] In step S102, by introducing the topological bias inherent in the field dependency graph into the dual-channel attention network to adjust the matching weights, the server can utilize the deep logical structure information in the vulnerability report, rather than relying solely on the surface-level lexical semantics. This enables the server to accurately disambiguate fields when generating vulnerability reports, especially when dealing with vulnerability texts with unusual literal expressions but structural patterns that conform to industry conventions, still accurately determining field attribution.

[0039] S103. Based on the matching weight, map the fields in the vulnerability report to standard template fields and output the disambiguated structured vulnerability report.

[0040] Mapping refers to the process of determining the most matching standard template field for each input field feature in the original vulnerability report based on the calculated matching weight. A structured vulnerability report refers to a data document that is uniformly formatted, clearly defined in its fields, and can be directly parsed and processed by downstream systems after reorganizing and filling in the original non-standard, unstructured vulnerability report content according to the field definitions of a pre-set standard template.

[0041] For example, the server can determine the best corresponding field in the standard template for each field feature in the vulnerability report based on the calculated matching weight. For instance, the standard field with the highest matching weight will be selected as the mapping target. The server then extracts, transforms, and fills the field content from the original report into the corresponding positions in the standard template according to this mapping relationship. Finally, the server outputs the filled template as a well-formatted, clearly defined, structured vulnerability report for direct use by downstream vulnerability management systems or ticketing systems.

[0042] As an example, the server can use a pre-built data mapping dictionary to systematically stitch together the non-standard fragment fields mapped in the vulnerability report into a standardized data chain according to the data format requirements of the final host, and finally output a high-quality vulnerability report that matches perfectly in one stop.

[0043] Optionally, after outputting a structured vulnerability report, the server can generate a mapping log that records in detail which standard field each original field is mapped to and its corresponding matching weight, so that security analysts can conduct post-event audits or manually review and correct the mapping results.

[0044] In step S103, by mapping fields to standard templates based on matching weights, the server completes the crucial transformation from non-standard input to standardized output. This directly solves the automation processing problem caused by inconsistent and incompatible vulnerability report formats from multiple vendors. It enables the server to accurately disambiguate fields when generating vulnerability reports and output standardized data that can be directly used in automated workflows, thereby breaking down data silos between multiple systems and significantly improving the efficiency and reliability of the vulnerability processing chain.

[0045] In this embodiment, by performing word segmentation and vectorization on the vulnerability reports to be disambiguated, the server can transform the raw text, which is of various formats and unstructured, into unified and computable numerical input field features, providing a standardized data foundation for subsequent intelligent matching. By inputting the input field features and the standard field features contained in the pre-built standard template into a dual-channel attention network, and adjusting the matching weights between the input field feature sequence and the standard field feature sequence based on the topological bias represented by the pre-constructed field dependency graph during the attention weight processing of this network, the server can simultaneously incorporate the surface semantic information of the text and the inherent deep logical structure constraints between fields when calculating the degree of field matching, thereby improving the robustness and accuracy of the matching process. Finally, by mapping the fields in the vulnerability report to the standard template fields according to the above matching weights and outputting the disambiguated structured vulnerability report, the server completes the complete conversion link from non-standard input to standardized output. In this way, it is possible to accurately disambiguate fields when generating vulnerability reports, and output structured data with a unified format, clear fields, and direct usability for downstream systems. This breaks down data silos between multi-source vulnerability reports and the internal standardized management system, thereby improving the automation level and reliability of vulnerability information flow and processing.

[0046] In one exemplary embodiment, Figure 2 This is a schematic diagram of a process for adjusting matching weights provided in an embodiment of this application, such as... Figure 2 As shown, in step S102, adjusting the matching weight between the input field feature sequence and the standard field feature sequence can specifically include: S201. In a dual-channel attention network, determine the basic attention weights.

[0047] S202. Extract the topological association parameters between input field features and standard field features from the field dependency graph.

[0048] S203. Add the topological association parameters to the basic attention weights to correct the matching weights.

[0049] Here, the basic attention weight refers to the original matching score calculated by the dual-channel attention network based on the semantic similarity between the input field features and the standard field features, without considering any external prior knowledge (such as field dependencies). The topological association parameter refers to the value extracted from the pre-constructed field dependency graph, used to quantify the strength of the logical or semantic association between two specific field nodes. The corrected matching weight refers to the adjusted matching score obtained by superimposing the topological association parameter as a bias term onto the basic attention weight, used for the final field mapping decision.

[0050] For example, the server can first calculate the basic attention weights reflecting the semantic similarity between the input field features and the standard field features within the dual-channel attention network, based solely on the vector representations of these features. Then, the server queries a pre-built field dependency graph to obtain the topological association parameters between the currently matched input field and the candidate standard field. Finally, the server can add these topological association parameters to the basic attention weights through summation or other fusion methods to obtain the corrected matching weights, allowing field pairs with strong logical dependencies to achieve higher matching scores.

[0051] As an example, the server can determine the basic attention weights in a two-channel attention network. Then, it extracts topological association parameters between input field features and standard field features from the field dependency graph. Finally, these topological association parameters are added to the basic attention weights to correct the matching weights.

[0052] Optionally, before overlaying the topology association parameters, the server can first normalize the basic attention weights and perform the same scaling transformation on the topology association parameters to ensure that the two have comparable dimensions when overlaid, thus avoiding one factor dominating the matching result.

[0053] In this embodiment, by superimposing basic attention weights with structured topological association parameters to correct matching weights, a dual-driven disambiguation mechanism of semantics and structure can be achieved for vulnerability report fields. This mechanism can accurately disambiguate fields when generating vulnerability reports, and even if the semantic expression of the input field is ambiguous or has multiple possibilities, it can still lock the correct standard template field based on its structural dependency relationship with the context fields.

[0054] In an exemplary embodiment, in a dual-channel attention network, determining the basic attention weights includes: Determine the hidden semantic feature vectors contained in the input field features, and the standard field feature vectors corresponding to the standard field features; Perform projection transformation on the hidden semantic feature vector and the standard field feature vector, and then perform a dot product operation between the projected hidden semantic feature vector and the standard field feature vector; The results of the dot product operation are scaled to obtain the basic attention weights.

[0055] In this context, the hidden semantic feature vector refers to the vector representation extracted by the encoding layer of the dual-channel attention network from the input field features, containing its deep contextual information. The standard field feature vector refers to the deep vector representation extracted similarly from the standard field features of a pre-defined standard template. Projection transformation refers to the process of linearly transforming the original feature vector using learnable weight matrices (such as query projection matrix and key projection matrix), mapping the original feature vector to a new feature space to calculate the attention score. The dot product operation refers to the operation of multiplying corresponding elements of two vectors after projection transformation and summing them; the result of the dot product operation can be used to measure the similarity between the two vectors. Scaling refers to dividing the result of the dot product operation by a scaling factor to prevent the dot product value from becoming too large, which could cause the subsequent normalization function to enter the gradient saturation region.

[0056] For example, in the first channel of the dual-channel attention network (for processing the input field), the server transforms the hidden semantic feature vector of the input field into a query vector using a query projection matrix. Simultaneously, in the second channel (for processing the standard template field), it transforms the feature vector of the standard field into a key vector using a key projection matrix. The server then computes the dot product between the query vector and the key vector to obtain a raw similarity score. Finally, the server divides this dot product result by a scaling factor related to the vector dimension to obtain stable and easily trainable base attention weights.

[0057] As an example, the server can determine the hidden semantic feature vector contained in the input field features, and the standard field feature vector corresponding to the standard field features. A projection transformation is performed on the hidden semantic feature vector and the standard field feature vector, and then a dot product is performed between the projected hidden semantic feature vector and the standard field feature vector. The dot product result is scaled to obtain the basic attention weights.

[0058] Optionally, the server can use a variety of different combinations of projection matrices (i.e., multi-head attention mechanisms) to perform the above projection transformation, dot product operation and scaling in parallel, and then concatenate or average the multiple calculation results to obtain richer and more stable base attention weights.

[0059] In this embodiment, the basic attention weights are calculated by performing projection transformation, dot product operations, and scaling, which quantifies the degree of matching between the input field and the standard field in a high-dimensional semantic space. This provides a reliable semantic benchmark for subsequent overlay of topological biases, enabling accurate disambiguation of fields when generating vulnerability reports, and ensuring that the final matching weights reflect both surface semantic similarity and deep structural logic.

[0060] In an exemplary embodiment, step S203, which involves overlaying the topological association parameters onto the base attention weights to correct the matching weights, includes: The topological correlation parameters are weighted based on a preset adjustment factor.

[0061] The corrected matching weights are obtained by superimposing the basic attention weights with the weighted topological association parameters.

[0062] Here, the adjustment factor is a configurable hyperparameter used to control the strength of the correction of the topology association parameters to the final matching weights. Weighting refers to the operation of multiplying the topology association parameters by the adjustment factor. Superposition refers to the operation of numerically adding the weighted topology association parameters to the base attention weights.

[0063] For example, after obtaining the topological association parameters extracted from the field dependency graph, the server multiplies these parameters by a preset adjustment factor. The value of this adjustment factor can be adjusted according to the actual application scenario; for example, a larger value can be set in scenarios with strong field structural dependencies. Then, the server can add the result of the multiplication element-wise to the previously calculated basic attention weights to obtain the corrected matching weights. This corrected weight simultaneously encodes information on semantic similarity and structural dependencies.

[0064] As an example, the server can weight the topology association parameters based on a preset adjustment factor. The base attention weights are then superimposed with the weighted topology association parameters to obtain the corrected matching weights. The adjustment factor is used to flexibly adjust the intensity of intervention penalties.

[0065] Alternatively, in addition to simple linear superposition, the server can employ more complex fusion strategies, such as inputting the basic attention weights and the weighted topological association parameters into a small neural network (such as a single-layer perceptron), allowing the network to automatically learn the optimal fusion ratio between the two.

[0066] In this embodiment, the topological association parameters are weighted by an adjustment factor and then superimposed with the basic attention weights. This allows for fine-grained control over the matching process. This enables precise disambiguation of fields when generating vulnerability reports, effectively utilizing the strong logical constraints provided by the field dependency graph while avoiding the risk of ignoring the semantics of the text itself due to over-reliance on structural information.

[0067] In one exemplary embodiment, Figure 3 This application provides a flowchart illustrating the output of a structured vulnerability report, as shown in the embodiments of the present application. Figure 3 As shown, in step S103, the disambiguated structured vulnerability report is output, including: S301. After determining the fields that have been mapped in the vulnerability report based on the matching weight, the matching status of the text fragments in the vulnerability report is detected by a dynamic cursor.

[0068] S302. If there are unmatched text fragments in the matching state representation, then repeat the step of inputting the input field features and the standard field features contained in the preset standard template into the dual-channel attention network.

[0069] S303. If the matching status indicates that there are no unmatched text fragments, then the mapped fields will be output as a disambiguated structured vulnerability report.

[0070] In this context, a dynamic cursor refers to a logical pointer or counter that continuously tracks and records the position or status of successfully matched and consumed segments in the vulnerability report text, as well as the remaining segments that have not yet been processed, during the field mapping process. The matching status refers to the flag information indicated by the dynamic cursor regarding whether the current vulnerability report text has been fully processed or whether there are any unmatched text segments. A text segment refers to a continuous unit of text with relatively complete semantics, obtained after segmenting and vectorizing the vulnerability report, that has not yet been successfully mapped to standard template fields; this text segment can be an independent sentence, a phrase, or an unconsumed segmented sequence, and its granularity corresponds to the unmatched text blocks tracked and marked by the dynamic cursor when traversing the vulnerability report content.

[0071] For example, after mapping some fields in the vulnerability report to a standard template based on matching weights, the server can also initiate a dynamic cursor mechanism. This dynamic cursor can traverse the entire text content of the original vulnerability report, marking which parts of the text have been successfully mapped and marked as processed. The server determines whether there are any unmatched text segments based on the state of the dynamic cursor. If so, a loop mechanism is triggered, and the remaining text segments are resubmitted to the dual-channel attention network for a new round of mapping processing. Only when the dynamic cursor confirms that all text segments have been successfully matched or processed and there are no unmatched segments does the server proceed to the final output stage.

[0072] As an example, after the fragment mapping is output, the server can continuously audit the length of the remaining text block through a dynamically configured cursor within the mechanism. This is done by determining if there is any new user input that has not yet been fully consumed; if an unregistered portion is found, the protection stack is activated and the data is re-submitted to the dual-channel attention network for further processing; if the entire stream segment has been consumed without a new pointer being thrown, the logic gate allows flow to the final step.

[0073] Optionally, the server can set a maximum loop count threshold to prevent infinite loops caused by text fragments failing to match. When the maximum loop count is reached, the server can either record the unmatched fragment as a known field or trigger a manual intervention alarm.

[0074] In this embodiment, by introducing a dynamic cursor mechanism to repeatedly reprocess unmatched text fragments, the complete consumption of the entire vulnerability report text can be achieved. This ensures that no hidden or non-standard fields are omitted, enabling the server to accurately disambiguate fields when generating the vulnerability report, completing the standardized mapping of all report content with high recall, and avoiding information loss due to incomplete field parsing.

[0075] In an exemplary embodiment, input field features and standard field features contained in a pre-set standard template are input into a dual-channel attention network, including: Input field features are fed into the first channel of the dual-channel attention network, and standard field features are fed into the second channel of the dual-channel attention network. In a dual-channel attention network, a multi-label classification network is used to perform multi-attribution prediction on the same input field feature, so that the input field feature can be matched to multiple standard field features at the same time.

[0076] In this context, the first channel refers to the encoding path in the dual-channel attention network used to receive and process the features of the raw input vulnerability report field. The second channel refers to the encoding path in the dual-channel attention network used to receive and process the features of the pre-set standard template field. A multi-label classification network is a neural network structure capable of simultaneously predicting multiple class labels for the same input sample. Multiple independent activation functions can be used in its output layer to achieve multi-classification prediction. Multi-classification prediction refers to the process of simultaneously classifying a single input field feature as belonging to multiple different standard field categories.

[0077] For example, the server can input the processed input field feature vector sequence into the first channel of a dual-channel attention network, and simultaneously input the standard field feature vector sequence into the second channel. After completing attention calculation and weight correction, the server can pass the fused features to a multi-label classification network. In this multi-label classification network, for the same input field feature, the server can simultaneously output multiple probability values, each representing the likelihood that the input field belongs to a specific standard field. When multiple probability values ​​exceed a preset threshold, multi-attribution prediction is achieved, allowing an input field to match multiple standard field features simultaneously.

[0078] As an example, the server feeds the input field features into the first channel of a dual-channel attention network and the standard field features into the second channel. In the dual-channel attention network, a multi-label classification network performs multi-attribution prediction on the same input field features, allowing the input field features to simultaneously match multiple standard field features. For example, a long text segment can be predicted to belong to both "Security Critical Announcement Baseline" and "Associated Operation and Maintenance Upgrade Annotations," two different template fields.

[0079] Optionally, the server can employ an ensemble learning strategy to run multiple multi-label classification networks with different configurations in parallel, and then fuse their prediction results through voting or averaging to improve the robustness and accuracy of multi-attribution prediction.

[0080] In this embodiment, by employing a multi-label classification network to achieve multi-attribution prediction of input fields, long text paragraphs that incorporate information from multiple standard fields in the original report can be effectively handled. This allows for accurate field disambiguation during vulnerability report generation, intelligently splitting complex information and assigning it to multiple target fields, avoiding information loss or misclassification caused by forced single-selection.

[0081] In one exemplary embodiment, the output of the disambiguated structured vulnerability report includes: Based on a pre-built data mapping dictionary, the mapped fields in the vulnerability report are assembled into a standardized format and output as a disambiguated structured vulnerability report.

[0082] The data mapping dictionary refers to a pre-configured dictionary or lookup table that records the correspondence between non-standard field names in the original vulnerability report and standard field names in the target system. Standardized format refers to the data organization form that conforms to the interface specifications of the target vulnerability management system or ticketing system, such as JSON, XML, or database record rows with a specific structure.

[0083] For example, after completing the matching and attribution determination of all fields, the server can obtain a series of mapping pairs. The server can invoke a pre-defined data mapping dictionary, which defines specific rules on how to populate non-standard field values ​​from different sources into the standard output template. According to these rules, the server extracts and verifies the field content from the original vulnerability report, assembles, splices, and formats it according to the standardized format required by the target system. Finally, the server outputs a complete, compliant, and directly usable structured vulnerability report by downstream business systems.

[0084] As an example, the server can use a pre-built data mapping dictionary to systematically stitch together the various non-standard fragment fields mapped in the vulnerability report into a standardized data chain, and finally output a high-quality vulnerability report that matches perfectly in one stop.

[0085] Optionally, the server can be designed with a dynamically updatable data mapping dictionary. When a new vulnerability reporting vendor or template is connected, the security administrator does not need to modify the core algorithm code, but only needs to update the mapping rules and standard field definitions in the dictionary.

[0086] In this embodiment, by using a data mapping dictionary to assemble the mapped fields into a standardized format, the field matching analysis results can be transformed into a structured vulnerability report that can be directly used by downstream systems. This not only ensures the accuracy of the disambiguation results but also guarantees the usability and compatibility of the output results, enabling the server to accurately disambiguate fields when generating vulnerability reports and directly serve the actual vulnerability remediation process management.

[0087] In one exemplary embodiment, the vulnerability report is segmented and vectorized to generate input field features corresponding to the fields, including: An abstract syntax tree is used to perform structured parsing of vulnerability reports and extract vulnerability field features associated with security threats. By using a word vector model, the features of the vulnerability fields are converted into vectorized features to generate the features of the input fields.

[0088] Here, an abstract syntax tree (AST) refers to an abstract description of the syntactic structure of source code or specific structured text, represented by a tree-like data structure. In this application, ASTs can be used for in-depth analysis of code snippets or highly structured threat descriptions contained in vulnerability reports. The vulnerability field features associated with security threats refer to the field content extracted through AST analysis that directly corresponds to security-related concepts such as attack vectors, dangerous functions, and anomalous code patterns.

[0089] For example, upon receiving a vulnerability report containing code snippets or complex technical descriptions, the server can first use Abstract Syntax Tree (AST) technology to perform structured parsing of that content. AST can decompose code or code-like text into a tree of nodes with clearly defined syntactic relationships. The server traverses this AST, identifying and extracting node information highly relevant to security threats, such as invoked dangerous system functions, unverified user input variables, or specific error handling patterns. Subsequently, the server can convert these extracted security threat features into numerical vector representations using a word vector model, thereby generating input field features rich in deep semantics.

[0090] As an example, the server can use an abstract syntax tree (AST) security threat phrase slicing structure extraction method to parse vulnerability reports. With this logical probe segmentation technique, even if the report uses bizarre assembly code or foreign language combinations to allude to security vulnerabilities, the network channel can correctly translate its core attack vectors and send them to the feature embedding layer.

[0091] Optionally, for plain text vulnerability reports that do not contain code, the server can switch to using a deep semantic text understanding model for feature extraction, forming a hybrid feature extractor that supports both code and plain text parsing modes.

[0092] In this embodiment, by combining abstract syntax tree parsing and word vector models, core security threat characteristics can be accurately captured from highly technical vulnerability reports. This enables precise disambiguation of fields when generating vulnerability reports, especially for attack descriptions containing complex code examples, effectively avoiding semantic loss and field misjudgment caused by general word segmentation models' inability to understand code syntax.

[0093] In one exemplary embodiment, such as Figure 4 As shown, Figure 4 A flowchart illustrating the construction of a field dependency graph is provided for implementation of this application, wherein the field dependency graph is constructed in the following manner: S401. Obtain multiple historical vulnerability report samples.

[0094] S402. Analyze the logical dependencies between fields in each historical vulnerability report.

[0095] S403. Use fields as nodes and logical dependencies between fields as relation edges to construct a field dependency graph.

[0096] Historical vulnerability report samples refer to a large amount of vulnerability report data accumulated by the server from various security vendors, crowdsourced testing platforms, or internal scanning tools. This data is used to mine co-occurrence and dependency patterns between fields. Logical dependencies refer to the inherent connections between different fields in terms of content, timing, or business logic. For example, the "Vulnerability Type" field determines the value range of the "Remediation Suggestion" field, or the "Reproduction Steps" field is necessarily followed by the "Vulnerability Impact" field. Nodes are the basic building blocks of the field dependency graph. Each node represents an independent field that may appear in a vulnerability report (such as "Vulnerability Title," "Threat Level," etc.). Relationship edges are directed or undirected lines connecting two nodes, used to indicate a logical dependency between nodes (fields), and can be assigned weights to characterize the strength of this dependency.

[0097] For example, when the server is offline, it can first acquire a large number of historical vulnerability report samples from different vendors. The server performs statistical analysis on the fields in these historical vulnerability report samples, using association rule mining or sequence pattern mining algorithms to trace the inevitable co-occurrence relationships between different report entries. For instance, the server can calculate the conditional probability that the "reproduction steps" field also appears when the "exploitation proof" field appears. Based on these discovered strong correlation patterns, the server abstracts each identified independent field as a node in a graph, abstracts the logical dependencies between fields as directed edges connecting nodes, and assigns corresponding weights to the edges according to the strength of the dependency. Finally, the server outputs a structured "field dependency graph" that can represent the common field dependency patterns in vulnerability reports.

[0098] As an example, the server can unsupervisedly extract hundreds of historical reports from the same source to form queues of "field keys" and "attribute values," and then perform statistical tracking by running a Hidden Markov Model and a frequent itemset miner. Each extracted usable template field is treated as a detached node in the graph structure, and the frequency of this objectively revealed logical dependency is transformed into a weighted directed entanglement edge between the two. The system thus smoothly generates the core "field dependency graph" that must be referenced at the underlying level.

[0099] Optionally, after constructing the initial field dependency graph, the server can incorporate human expert knowledge for modification and enhancement. For example, security experts can manually add dependencies that are not frequent in historical samples but are crucial to the business logic, or prune weakly linked edges discovered.

[0100] In this embodiment, by utilizing historical data mining and constructing a field dependency graph, the server solidifies human expert experience and big data statistical patterns into computable structured knowledge. This enables the server to accurately disambiguate fields when generating vulnerability reports, providing valuable prior topological biases for the subsequent dual-channel attention network, fundamentally solving the structural heterogeneity problem that cannot be overcome by relying solely on shallow semantic matching.

[0101] In some exemplary embodiments, for extremely heterogeneous scenarios involving large-scale, multi-vendor environments, such as when processing reports from more than ten vendors with vastly different logical structures simultaneously, the construction of the aforementioned field dependency graph can be extended. Instead of constructing a single dependency graph, the system can integrate security expert vocabulary decision trees and graph convolutional neural networks to conduct three-dimensional fusion exploration, generating a complex, centrally radiating, general macro-ring topology graph encompassing aspects such as: detailed vulnerability profiling blocks, derived test environment bases, and finalized end-point risk indices. This general macro-ring topology graph can successfully extract the core, homogeneous skeleton that, despite differing representational forms, shares a unified business essence.

[0102] In some exemplary embodiments, the computation process of the dual-channel attention network described above can be precisely described by the following formula. Its core arithmetic underlying formula is expanded as follows:

[0103] The formula clearly defines the meaning of each variable to maintain strict self-consistency of the model: The first character representing the user's input to be disambiguated Each data stream slice (Token) hides a semantic feature vector; while The value deep within the template matrix is ​​the first Feature vector of the core slot under inspection in the layer; and Attention query key projection operator matrix refined through long-term iterative evolution of the network; smoothing factor To prevent drastic gradient changes caused by the surge in dimensionality of the dot product; as for the most crucial point... This involves injecting the record number derived from the "field dependency graph" into it. With the The connection bias constant is used to determine the degree of strong correlation in node topology; this is determined by the scaling tolerance hyperparameter. The intensity of the intervention penalty can be flexibly adjusted. It is this composite formula, which includes external conditional intervention, that protects the system so that even if the vulnerability text segment has strange literal expressions (such as geek slang), as long as its text environment and layout characteristics implicitly match the external logic network structure of a certain predetermined slot (such as being thrown along with the threat category), the attention pointing score will still soar, ensuring that the system accurately locates its correct affiliation.

[0104] In some exemplary embodiments, the aforementioned dynamic cursor mechanism and loop re-entry process can be specifically implemented as follows: after the segment mapping is output, a dynamic cursor is assembled internally to continuously audit the length of the remaining text block. This is done by determining whether there is new user input that has not yet been fully consumed; if an unregistered portion is found, the protection stack is activated and the data is re-submitted to the dual-channel attention network for further processing; if the entire stream segment has been consumed without a new pointer being thrown, the logic gate allows flow to the final assembly step.

[0105] In some exemplary embodiments, the effectiveness of the above-described vulnerability report generation method based on field disambiguation can be verified through experimental data. The disambiguation success rate of traditional literal ranging methods (such as edit distance and keyword matching) is approximately 68%. However, the method proposed in this application, which integrates field dependency graphs and a dual-channel attention mechanism, can achieve a disambiguation registration rate of 95% or higher under the coordinated operation of multiple algorithms, reaching an extremely stable plateau. This demonstrates that the method can smoothly parse any pipeline in the industry, balancing speed and precision.

[0106] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0107] The vulnerability report generation apparatus based on field disambiguation provided in the embodiments of this application is described below. The vulnerability report generation apparatus based on field disambiguation has the same inventive concept as the vulnerability report generation method based on field disambiguation described above. The solution provided by this apparatus is similar to the solution described in the above method. Therefore, the specific limitations of one or more embodiments of the vulnerability report generation apparatus based on field disambiguation provided below can be found in the limitations of the vulnerability report generation method based on field disambiguation described above. The vulnerability report generation apparatus based on field disambiguation described below and the vulnerability report generation method based on field disambiguation described above can be referred to each other, and will not be repeated here.

[0108] In one exemplary embodiment, Figure 5 A schematic diagram of a vulnerability report generation device based on field disambiguation provided in this application embodiment is shown below. Figure 5As shown, the vulnerability report generation device 50 based on field disambiguation includes: an input feature generation module 510, a matching weight adjustment module 520, and a vulnerability report output module 530, wherein: The input feature generation module 510 is used to obtain the vulnerability report to be disambiguated, perform word segmentation and vectorization processing on the vulnerability report, and generate input field features corresponding to the fields.

[0109] The matching weight adjustment module 520 is used to input the input field features and the standard field features contained in the pre-built standard template into the dual-channel attention network. During the attention weight processing in the dual-channel attention network, the matching weight between the input field feature sequence and the standard field feature sequence is adjusted based on the topological bias represented by the pre-built field dependency graph.

[0110] The vulnerability report output module 530 is used to map fields in the vulnerability report to standard template fields according to the matching weight, and output a disambiguated structured vulnerability report.

[0111] In an exemplary embodiment, the matching weight adjustment module 520 is used to determine the basic attention weights in a dual-channel attention network; extract the topological association parameters between the input field features and the standard field features from the field dependency graph; and superimpose the topological association parameters onto the basic attention weights to correct the matching weights.

[0112] In an exemplary embodiment, the matching weight adjustment module 520 is used to determine the hidden semantic feature vector contained in the input field features and the standard field feature vector corresponding to the standard field features; to perform projection transformation on the hidden semantic feature vector and the standard field feature vector, and to perform a dot product operation on the projected hidden semantic feature vector and the standard field feature vector; and to scale the dot product operation result to obtain the basic attention weight.

[0113] In an exemplary embodiment, the matching weight adjustment module 520 is used to weight the topology association parameters based on a preset adjustment factor; and to superimpose the basic attention weights with the weighted topology association parameters to obtain the corrected matching weights.

[0114] In an exemplary embodiment, the vulnerability report output module 530 is used to determine the fields that have been mapped in the vulnerability report according to the matching weight, and then detect the matching status of the text fragments in the vulnerability report through a dynamic cursor; if the matching status indicates that there are unmatched text fragments, the step of inputting the input field features and the standard field features contained in the preset standard template into the dual-channel attention network is re-executed; if the matching status indicates that there are no unmatched text fragments, the mapped fields are output as a disambiguated structured vulnerability report.

[0115] In an exemplary embodiment, the vulnerability report output module 530 is used to input the input field features into the first channel of the dual-channel attention network and input the standard field features into the second channel of the dual-channel attention network; in the dual-channel attention network, the same input field features are subject to multiple attribution predictions through a multi-label classification network, so that the input field features are simultaneously matched to multiple standard field features.

[0116] In an exemplary embodiment, the vulnerability report output module 530 is used to assemble the mapped fields in the vulnerability report into a standardized format based on a preset data mapping dictionary, and output it as a disambiguated structured vulnerability report.

[0117] In an exemplary embodiment, the input feature generation module 510 is used to perform structured parsing of the vulnerability report using an abstract syntax tree, extract vulnerability field features associated with security threats, and convert the vulnerability field features into vectorized features using a word vector model to generate input field features.

[0118] In one exemplary embodiment, the apparatus further includes a relationship graph construction module. The relationship graph construction module is used to acquire multiple historical vulnerability report samples; parse the logical dependencies between fields in each historical vulnerability report; and construct a field dependency relationship graph by using fields as nodes and the logical dependencies between fields as relationship edges.

[0119] The modules in the aforementioned vulnerability report generation device based on field disambiguation can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can invoke and execute the corresponding operations of each module.

[0120] In one exemplary embodiment, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the field-disambiguation-based vulnerability report generation methods described above.

[0121] In one exemplary embodiment, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of any of the field disambiguation-based vulnerability report generation methods described above.

[0122] In one exemplary embodiment, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of any of the field disambiguation-based vulnerability report generation methods described in the above embodiments.

[0123] Indicatively, such as Figure 6 As shown, Figure 6 This is a schematic diagram of the internal structure of a computer device 600 provided in an embodiment of this application. The computer device 600 can be provided as a server. (Refer to...) Figure 6 The computer device 600 includes a processor 602, which further includes one or more processors, and memory resources represented by memory 601 for storing instructions executable by the processor 602, such as a computer program. The computer program stored in memory 601 may include one or more modules, each corresponding to a set of instructions. Furthermore, the processor 602 is configured to execute instructions to perform the field-disambiguation-based vulnerability report generation method of any of the above embodiments. The computer device 600 may operate on an operating system stored in memory 601, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, or similar.

[0124] Computer device 600 may also include a power supply component 603 configured to perform power management of computer device 600, a wired or wireless network interface 604 configured to connect computer device 600 to a network, and an input / output (I / O) interface 605. Wireless operation may be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When executed by a processor, the computer program implements a field-disambiguation-based vulnerability report generation method.

[0125] Those skilled in the art will understand that Figure 6 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0126] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0127] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0128] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0129] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A vulnerability report generation method based on field disambiguation, characterized in that, The method includes: Obtain the vulnerability report to be disambiguated, perform word segmentation and vectorization processing on the vulnerability report, and generate input field features corresponding to the fields; The input field features and the standard field features contained in the preset standard template are input into a dual-channel attention network. During the attention weight processing in the dual-channel attention network, the matching weight between the input field feature sequence and the standard field feature sequence is adjusted based on the topological bias represented by the pre-constructed field dependency graph. Based on the matching weights, the fields in the vulnerability report are mapped to standard template fields, and a disambiguated structured vulnerability report is output.

2. The method according to claim 1, characterized in that, The adjustment of the matching weight between the input field feature sequence and the standard field feature sequence includes: In the dual-channel attention network, the basic attention weights are determined; Extract the topological association parameters between the input field features and the standard field features from the field dependency graph; The topological association parameters are superimposed on the basic attention weights to correct the matching weights.

3. The method according to claim 2, characterized in that, In the dual-channel attention network, determining the basic attention weights includes: Determine the hidden semantic feature vector contained in the input field features, and the standard field feature vector corresponding to the standard field features; The hidden semantic feature vector and the standard field feature vector are subjected to projection transformation, and the projected hidden semantic feature vector and the standard field feature vector are then multiplied by a dot product. The dot product result is scaled to obtain the basic attention weights.

4. The method according to claim 3, characterized in that, The step of superimposing the topological association parameters onto the basic attention weights to correct the matching weights includes: The topological correlation parameters are weighted based on a preset adjustment factor. The basic attention weights are superimposed with the weighted topological association parameters to obtain the corrected matching weights.

5. The method according to claim 1, characterized in that, The output of the disambiguated structured vulnerability report includes: After determining the fields that have been mapped in the vulnerability report based on the matching weight, the matching status of the text fragments in the vulnerability report is detected by a dynamic cursor; If the matching state indicates that there are unmatched text fragments, then the step of inputting the input field features and the standard field features contained in the preset standard template into the dual-channel attention network is executed again. If the matching status indicates that there are no unmatched text fragments, the mapped fields will be output as a disambiguated structured vulnerability report.

6. The method according to claim 1 or 5, characterized in that, The step of inputting the input field features and the standard field features contained in the preset standard template into the dual-channel attention network includes: The input field features are input into the first channel of the dual-channel attention network, and the standard field features are input into the second channel of the dual-channel attention network. In the dual-channel attention network, a multi-label classification network is used to perform multi-attribution prediction on the same input field feature, so that the input field feature is matched to multiple standard field features at the same time.

7. The method according to claim 1, characterized in that, The output of the disambiguated structured vulnerability report includes: Based on a pre-built data mapping dictionary, the mapped fields in the vulnerability report are assembled into a standardized format and output as a disambiguated structured vulnerability report.

8. The method according to claim 1, characterized in that, The step of segmenting and vectorizing the vulnerability report to generate input field features includes: An abstract syntax tree is used to perform structured parsing on the vulnerability report and extract vulnerability field features associated with security threats. The vulnerability field features are converted into vectorized features using a word vector model to generate input field features.

9. The method according to claim 1, characterized in that, The field dependency graph is constructed in the following way: Obtain multiple historical vulnerability report samples; Analyze the logical dependencies between the fields in each of the historical vulnerability reports; Fields are used as nodes, and logical dependencies between fields are used as relationship edges to construct a field dependency graph.

10. A vulnerability report generation device based on field disambiguation, characterized in that, The device includes: The input feature generation module is used to obtain the vulnerability report to be disambiguated, perform word segmentation and vectorization processing on the vulnerability report, and generate input field features corresponding to the fields. The matching weight adjustment module is used to input the input field features and the standard field features contained in the preset standard template into the dual-channel attention network. During the attention weight processing in the dual-channel attention network, the matching weight between the input field feature sequence and the standard field feature sequence is adjusted based on the topological bias represented by the pre-constructed field dependency graph. The vulnerability report output module is used to map the fields in the vulnerability report to standard template fields according to the matching weight, and output a disambiguated structured vulnerability report.

11. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 9.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 9.

13. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 9.

Images