Audit method, device and apparatus for vulnerability mechanism

Abstract

This application discloses a method, apparatus, and device for auditing vulnerability mechanisms, relating to the field of software security technology. The method includes: extracting vulnerability causal elements and sorting out causal relationships from multi-source evidence associated with vulnerabilities, which is linked to corresponding nodes in a causal graph through globally unique evidence citation identifiers; obtaining a causal graph with vulnerability causal elements as nodes and causal dependencies as edges; extracting observed variables from the multi-source evidence based on the causal graph and constructing a structural equation model based on causal dependencies; solving the structural equation model to obtain the quantitative contribution of each vulnerability causal element to the occurrence of the vulnerability; performing a bidirectional mapping match between the vulnerability causal elements and a pre-set security compliance clause library based on the quantitative contribution to obtain a bidirectional mapping relationship; and integrating multi-source evidence, quantitative contribution, and bidirectional mapping relationship to obtain a structured audit report. This enables complete tracing and accountability for the explanation of vulnerability mechanisms.

Description

Technical Field

[0001] This application relates to the field of software security technology, and in particular to auditing methods, apparatus and equipment for vulnerability mechanisms. Background Technology

[0002] Code security auditing can systematically analyze software source code to identify security vulnerabilities, logical defects, coding irregularities, and compliance issues, thereby ensuring the normal operation of the software.

[0003] Currently, code security audits typically rely on a combination of tool scanning and human experience. Vulnerability mechanism explanations are often just a list of evidence or subjective descriptions, lacking unified causal modeling and quantitative analysis, resulting in poor consistency and reusability. Furthermore, compliance clause comparisons only involve static clause matching, failing to establish effective connections between clauses and mechanism elements or audit evidence, making it impossible to reverse-check the completeness and coverage gaps of evidence. At the same time, audit reports lack unique identifiers and associated bindings for evidence, making it impossible to accurately trace the source of evidence, mechanism explanations, and compliance conclusions. Therefore, current code security audits cannot trace and hold accountable those responsible for the explanations of vulnerability mechanisms.

[0004] The above content is only used to help understand the technical solution of this application and does not represent an admission that the above content is prior art. Summary of the Invention

[0005] The main purpose of this application is to provide a method, apparatus and equipment for auditing vulnerability mechanisms, which aims to solve the technical problem that current code security audits cannot trace and hold accountable the explanation of vulnerability mechanisms.

[0006] To achieve the above objectives, this application proposes an auditing method for vulnerability mechanisms, the method comprising: Obtain multi-source evidence associated with the vulnerability, and extract vulnerability causal elements and sort out causal relationships for the multi-source evidence respectively to obtain a causal graph with vulnerability causal elements as nodes and causal dependencies as edges. Based on the causal graph, observed variables are extracted from the multi-source evidence, and a structural equation model is constructed by combining the causal dependencies. Solve the structural equation model to obtain the quantitative contribution of each of the vulnerability causative factors to the occurrence of the vulnerability; Based on the quantified contribution, the vulnerability causation factors are matched with a preset security compliance clause library in a two-way mapping to obtain a two-way mapping relationship. By integrating the multi-source evidence, the quantified contribution, and the bidirectional mapping relationship, a structured audit report is obtained. The multi-source evidence is associated and bound to the corresponding node of the causal graph through a globally unique evidence reference identifier.

[0007] In one embodiment, the step of extracting vulnerability causal elements and sorting out causal relationships from the multi-source evidence to obtain a causal graph with vulnerability causal elements as nodes and causal dependencies as edges includes: Based on the preset vulnerability types, vulnerability causal elements related to each vulnerability type are extracted from the multi-source evidence, and a minimum evidence set is constructed based on the vulnerability causal elements. The evidence elements in the minimum set of evidence are mapped to nodes in a causal graph, and the causal variable nodes include cause nodes, propagation nodes, and influence nodes. Based on a pre-defined causal chain model, causal dependencies between the nodes are established. Based on the causal dependencies, the corresponding nodes are connected to obtain a causal graph with vulnerability cause elements as nodes and causal dependencies as edges.

[0008] In one embodiment, before the step of extracting vulnerability causal elements related to each vulnerability type from the multi-source evidence based on preset vulnerability types, and constructing a minimal evidence set based on the vulnerability causal elements, the method further includes: Configure an evidence element catalog for each vulnerability type. The evidence element catalog includes entry point, verification, propagation, permissions, boundary, and impact elements. The step of extracting vulnerability causal elements related to each vulnerability type from the multi-source evidence based on preset vulnerability types, and constructing a minimal evidence set based on the vulnerability causal elements, includes: Based on the evidence element catalog, vulnerability causation elements related to each vulnerability type are extracted from the multi-source evidence. The integrity of the vulnerability causative factors is verified, and a minimum set of evidence corresponding to the vulnerability type is constructed.

[0009] In one embodiment, the step of extracting observed variables from the multi-source evidence based on the causal graph and constructing a structural equation model in conjunction with the causal dependencies includes: The vulnerability causal elements in the causal graph are divided into observed variables and latent variables. The observed variables are binary state values ​​or numerical parameters directly extracted from the multi-source evidence, and the latent variables are intermediate variables that characterize the vulnerability mechanism. Based on the causal dependencies between nodes in the causal graph, a measurement equation between the observed variable and the latent variable, as well as a structural relationship equation between the latent variables, are constructed. The measurement equations are combined with the structural relationship equations to construct a structural equation model for the quantitative analysis of vulnerability mechanisms.

[0010] In one embodiment, the step of constructing the measurement equation between the observed variable and the latent variable, and the structural relationship equation between the latent variables, based on the causal dependencies between nodes in the causal graph, includes: Based on a preset minimum set of evidence, the evidence selection boundary for the observed variables is determined; Select target observation variables from the observed variables that satisfy the evidence selection boundary; Based on the causal dependencies between nodes in the causal graph, measurement equations are established one by one between each of the target observed variables and their corresponding latent variables. Based on the causal dependencies of the vulnerability causal factors in the causal graph, the structural constraint relationships between the latent variables are constructed layer by layer. Based on the structural constraints, structural relationship equations are constructed between the latent variables.

[0011] In one embodiment, the step of performing a bidirectional mapping match between the vulnerability causation factors and a preset security compliance clause library based on the quantified contribution to obtain a bidirectional mapping relationship includes: The matching weight of each of the aforementioned vulnerability causal factors is determined based on the quantified contribution. The target elements whose matching weights meet the preset weight requirements among the vulnerability cause elements are associated and matched with the verifiable points of the clauses in the preset security compliance clause library to generate a positive mapping relationship from mechanism to clause. Based on the key points verifiable by the aforementioned clauses, the corresponding verification evidence elements are deduced, and the completeness and coverage of the target multi-source evidence associated with the target elements are checked to generate a reverse mapping relationship from the clauses to the evidence gaps. The forward mapping relationship is combined with the reverse mapping relationship to obtain the bidirectional mapping relationship.

[0012] In one embodiment, the step of reverse-engineering the corresponding verification evidence elements based on the verifiable points of the clause, verifying the completeness and coverage of the target multi-source evidence associated with the target elements, and generating a reverse mapping relationship from clauses to evidence gaps includes: The minimum set of evidence corresponding to the key points can be verified by matching each of the aforementioned clauses; The multi-source evidence associated with the target element is compared and verified with the minimum set of evidence for the verifiable points of the corresponding clause. If the target multi-source evidence does not meet the configuration requirements of the corresponding minimum evidence set, an evidence gap is generated; If the target multi-source evidence has evidence conflicts or does not cover the requirements of the verifiable points, then coverage gaps and conflict gaps are generated. Based on the evidence gap, the coverage gap, and the conflict gap, a reverse mapping relationship is formed between the clause and the evidence gap.

[0013] Furthermore, to achieve the above objectives, this application also proposes a vulnerability mechanism auditing device, which includes: The first construction module is used to obtain multi-source evidence associated with the vulnerability, and to extract vulnerability causal elements and sort out causal relationships for the multi-source evidence respectively, so as to obtain a causal graph with vulnerability causal elements as nodes and causal dependencies as edges. The second construction module is used to extract observed variables from the multi-source evidence based on the causal graph, and to construct a structural equation model in combination with the causal dependencies; The calculation module is used to solve the structural equation model to obtain the quantitative contribution of each of the vulnerability causative factors to the occurrence of the vulnerability; The matching module is used to perform bidirectional mapping matching between the vulnerability cause elements and the preset security compliance clause library based on the quantified contribution degree, so as to obtain a bidirectional mapping relationship; The output module is used to integrate the multi-source evidence, the quantified contribution, and the bidirectional mapping relationship to obtain a structured audit report. The multi-source evidence is associated and bound to the corresponding node of the causal graph through a globally unique evidence reference identifier.

[0014] In addition, to achieve the above objectives, this application also proposes a vulnerability mechanism auditing device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the vulnerability mechanism auditing method as described above.

[0015] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the auditing method for the vulnerability mechanism as described above.

[0016] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the auditing method for the vulnerability mechanism described above.

[0017] One or more technical solutions proposed in this application have at least the following technical effects: By constructing a causal graph based on vulnerability causal factors and causal dependencies, and further establishing a structural equation model to solve for quantified contributions, the explanation of vulnerability causes no longer relies on subjective descriptions or isolated evidence listings, but possesses unified causal modeling and quantifiable attribution analysis capabilities, making vulnerability mechanism explanations consistent and reusable. Furthermore, by bidirectionally mapping and matching quantified contributions with a security compliance clause library, a bidirectional association is established between vulnerability causal factors and security compliance clauses. This not only supports verifying whether the required vulnerability causal factors are covered from the clauses, but also allows for reverse verification of the satisfaction of corresponding security compliance clauses from identified vulnerability causal factors, thereby effectively identifying evidence coverage gaps. Moreover, multi-source evidence is associated and bound to the corresponding nodes of the causal graph through a globally unique evidence citation identifier, enabling the final structured audit report to accurately trace back to the original multi-source evidence based on each vulnerability causal factor, quantified contribution, and bidirectional mapping relationship, thus achieving complete tracing and accountability for vulnerability mechanism explanations. Attached Figure Description

[0018] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0019] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 A flowchart illustrating an embodiment of the auditing method for the vulnerability mechanism in this application; Figure 2 A flowchart illustrating the second embodiment of the auditing method for the vulnerability mechanism of this application; Figure 3 A flowchart illustrating the third embodiment of the auditing method for the vulnerability mechanism of this application; Figure 4 A flowchart illustrating the fourth embodiment of the auditing method for the vulnerability mechanism of this application; Figure 5 This is a schematic diagram of the module structure of the auditing device for the vulnerability mechanism in an embodiment of this application; Figure 6 This is a schematic diagram of the device structure of the hardware operating environment involved in the auditing method for the vulnerability mechanism in the embodiments of this application.

[0021] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0022] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0023] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0024] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or an electronic device or code auditing platform capable of performing the above functions. The following description uses a code auditing platform as an example to illustrate this embodiment and the subsequent embodiments.

[0025] Based on this, embodiments of this application provide an auditing method for vulnerability mechanisms, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the auditing method for the vulnerability mechanism of this application.

[0026] In this embodiment, the auditing method for the vulnerability mechanism includes steps S10 to S50: Step S10: Obtain multi-source evidence associated with the vulnerability, and extract vulnerability causal elements and sort out causal relationships for the multi-source evidence respectively to obtain a causal graph with vulnerability causal elements as nodes and causal dependencies as edges. It should be noted that multi-source evidence refers to raw or intermediate data related to the target vulnerability obtained from different sources during code security auditing, including but not limited to: source code, call chains / data flows, permission chains, configuration items, log evidence, etc. Vulnerability causation elements describe the root cause, propagation path, or impact of the vulnerability; specifically, they can be divided into: causal nodes (e.g., unvalidated user input), propagation nodes (e.g., server-initiated external HTTP requests), and impact nodes (e.g., successful reading of internal network metadata). Cause-effect graphs are used to formally represent the complete logical chain from vulnerability triggering to causing harm.

[0027] Understandably, extracting vulnerability causal elements and sorting out causal relationships from multi-source evidence, and constructing a causal graph with elements as nodes and dependencies as edges, can transform scattered evidence into structured vulnerability mechanism knowledge, and clearly reveal the complete evolution path of a vulnerability from its introduction to its triggering.

[0028] Step S20: Based on the causal graph, extract observed variables from the multi-source evidence and construct a structural equation model by combining the causal dependencies; It should be noted that observed variables are those that can be directly extracted and quantified from multi-source evidence. Latent variables are used to characterize the intrinsic properties of vulnerability mechanisms, such as verification sufficiency and access control strength. Structural equation modeling is a statistical model composed of measurement equations and structural relation equations. The measurement equations describe the mapping relationship between observed variables and latent variables, while the structural relation equations describe the causal dependencies between latent variables.

[0029] Understandably, extracting observable variables from multi-source evidence based on causal graphs and constructing structural equation models by combining causal dependencies can transform qualitative causal logic into quantitative mathematical models, thereby facilitating the reuse of interpretation templates and consistency of interpretation across personnel and projects.

[0030] Step S30: Solve the structural equation model to obtain the quantitative contribution of each of the vulnerability causative factors to the occurrence of the vulnerability; It should be noted that the quantitative contribution is the standardized path coefficient of a certain vulnerability causal factor on the vulnerability occurrence outcome. The larger the value, the stronger the causal influence of the factor on the occurrence of the vulnerability.

[0031] Understandably, by solving structural equation modeling to obtain the quantitative contribution of each vulnerability causative factor, the key weak links leading to the vulnerability can be accurately identified, providing an objective and quantitative basis for prioritizing remediation, thereby enabling operations and maintenance personnel to allocate security resources efficiently.

[0032] Step S40: Based on the quantified contribution, perform a two-way mapping match between the vulnerability cause elements and the preset security compliance clause library to obtain a two-way mapping relationship; It should be noted that the security compliance clause library is a pre-built knowledge base containing verifiable clauses from various security standards. The two-way mapping relationship includes: a forward mapping from vulnerability causal factors to security compliance clauses, and a reverse mapping from security compliance clauses to evidentiary gaps.

[0033] Understandably, by positively mapping the factors contributing to a vulnerability to a pre-defined security compliance clause library based on quantified contribution, a clear compliance gap report can be automatically generated, clearly indicating which specific security requirements the vulnerability violates, thereby simplifying the compliance self-verification process.

[0034] Understandably, through reverse mapping, missing links in the current chain of evidence can be proactively identified based on compliance requirements, and targeted suggestions for supplementary evidence can be generated. This transforms passive compliance checks into proactive, closed-loop compliance governance, ensuring the effectiveness and verifiability of security measures.

[0035] Step S50: Integrate the multi-source evidence, the quantified contribution, and the bidirectional mapping relationship to obtain a structured audit report. The multi-source evidence is associated and bound to the corresponding node of the causal graph through a globally unique evidence reference identifier.

[0036] Understandably, by integrating multi-source evidence, quantified contribution, and two-way mapping relationships to generate a structured audit report, and by using globally unique evidence citation identifiers to strongly bind each piece of evidence to a specific node in the causal graph, the audit conclusions are ensured to be traceable and verifiable throughout the entire process.

[0037] In its implementation, the method can be applied to auditing "unauthorized access" vulnerabilities. First, the code auditing platform obtains data from multiple sources of evidence: a static code scanner report indicates that line 120 of UserService.java contains an operation that directly queries the database using the user ID; API gateway logs show that an attacker successfully obtained administrator data by modifying the URL parameter user_id=999; simultaneously, the project's Requirements Specification (SRS) explicitly requires that "ordinary users can only access their own data." Next, the code auditing platform extracts the causal elements of the vulnerability: "entry point (URL parameter user_id)," "missing validation (no permission validation logic)," and "impact (unauthorized access to administrator data)," and constructs a causal graph. Based on this causal graph, the code auditing platform uses "whether permission validation code exists" as an observation variable (with a value of 0) and constructs a structural equation model. After solving, the quantitative contribution of the "missing validation" element is 0.92. Subsequently, the code auditing platform performs a bidirectional mapping between this high-contribution element and the security compliance clause library, discovering that although the clause requirements are clear, the existing evidence lacks permission unit test cases for this interface, thus generating a "coverage gap." Ultimately, all the information was integrated into a structured report, in which each piece of evidence was linked to a corresponding node in the cause-effect graph through an evidence citation number, allowing auditors to trace it with a single click.

[0038] Furthermore, to improve the accuracy of causal graph construction, a large language model can be introduced as an aid. That is, the code auditing platform can input raw, multi-source evidence into a large language model fine-tuned for security domains. The large language model generates preliminary descriptions of causal elements and causal hypotheses, which are then verified and structured by a rule engine to form an initial version of the causal graph. The final causal graph is then constructed based on this initial version to effectively handle unstructured evidence (such as developer comments and ticket descriptions), thereby improving the recall rate of element extraction.

[0039] This embodiment provides a method for auditing vulnerability mechanisms. By constructing a causal graph based on vulnerability causal elements and causal dependencies, and further establishing a structural equation model to solve for quantified contribution, the explanation of the causes of vulnerabilities no longer relies on subjective descriptions or isolated evidence listings, but has unified causal modeling and quantifiable attribution analysis capabilities, making vulnerability mechanism explanations consistent and reusable. Furthermore, by bidirectionally mapping and matching the quantified contribution with a security compliance clause library, a bidirectional association is established between vulnerability causal elements and security compliance clauses. This not only supports verifying whether the required vulnerability causal elements are covered from the clauses, but also allows for reverse verification of the satisfaction of corresponding security compliance clauses from the identified vulnerability causal elements, thereby effectively identifying evidence coverage gaps. Moreover, multi-source evidence is associated and bound to the corresponding nodes of the causal graph through a globally unique evidence citation identifier, so that the final structured audit report can accurately trace back to the original multi-source evidence based on each vulnerability causal element, quantified contribution, and bidirectional mapping relationship, thereby achieving complete tracing and accountability for vulnerability mechanism explanations.

[0040] Based on the first embodiment of this application, in the second embodiment of this application, the content that is the same as or similar to that in Embodiment 1 above can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 2 Step S10 also includes steps S01 to S04: Step S01: Based on the preset vulnerability types, extract vulnerability causal elements related to each vulnerability type from the multi-source evidence, and construct a minimum evidence set based on the vulnerability causal elements. Step S02: Map the evidence elements in the minimum evidence set to nodes of a causal graph, wherein the causal variable nodes include cause nodes, propagation nodes and influence nodes; Step S03: Based on the preset causal chain model, establish the causal dependency relationship between the nodes; Step S04: Connect the corresponding nodes based on the causal dependency relationship to obtain a causal graph with vulnerability cause elements as nodes and causal dependency relationships as edges.

[0041] It should be noted that vulnerability type refers to a set of known security vulnerability classification criteria that are built-in or specified by the user before the audit begins, including but not limited to: entry point type, verification type, propagation type, privilege type, boundary type, and impact type. The minimum set of evidence is the minimal and non-simplifiable combination of evidentiary elements necessary to fully prove the existence and complete mechanism of a specific vulnerability type. The causal chain model is a predefined knowledge template describing the typical cause-propagation-impact logical chain for each preset vulnerability type.

[0042] Understandably, by introducing pre-defined vulnerability types as a guide and building a minimal set of evidence based on these vulnerability types, the audit scope can be effectively focused, avoiding blind searches in massive amounts of code and logs. This not only improves the efficiency and accuracy of evidence extraction but also ensures the completeness of the causal graph construction, preventing errors in mechanism analysis due to the lack of key evidence.

[0043] Understandably, by clearly distinguishing the elements in the minimum set of evidence into three categories of nodes—cause, propagation, and impact—it is possible to structurally deconstruct the vulnerability mechanism, thereby making the complex vulnerability evolution process clear and orderly.

[0044] Understandably, using a pre-defined causal chain model to guide the establishment of causal dependencies avoids the false associations that may arise from purely data-driven methods, thereby ensuring the logical correctness and professional credibility of the constructed causal graph.

[0045] In its implementation, when a code auditing platform needs to audit a Server-Side Request Forgery (SSRF) vulnerability, it first activates a preset SSRF vulnerability type. The platform then extracts SSRF-related causal elements from multi-source evidence (such as static scan reports and network traffic logs), for example: user-controllable URL parameters, backend using curl to initiate HTTP requests, and the request target not being whitelisted. Based on the characteristics of SSRF vulnerabilities, after determining that these three elements constitute the minimum set of evidence proving the existence of the vulnerability, the platform maps these three elements into nodes in a causal graph. Specifically, user-controllable URL parameters are used as causal nodes, backend using curl to initiate HTTP requests as propagation nodes, the request target not being whitelisted as a causal node, and potential internal network services being probed as impact nodes. The platform then calls a preset SSRF causal chain model, which specifies the dependencies between causal nodes (user input) and propagation nodes (curl calls), causal nodes (no whitelist) and propagation nodes (curl calls), and propagation nodes (curl calls) and impact nodes (internal network probes). Based on this model, the code auditing platform establishes causal dependencies between corresponding nodes. Ultimately, all nodes are connected through these established causal dependencies to generate a complete causal graph.

[0046] Furthermore, prior to step S01, the auditing method for the vulnerability mechanism further includes: Configure an evidence element catalog for each vulnerability type. The evidence element catalog includes entry point, verification, propagation, permissions, boundary, and impact elements. The step of extracting vulnerability causal elements related to each vulnerability type from the multi-source evidence based on preset vulnerability types, and constructing a minimal evidence set based on the vulnerability causal elements, includes: Based on the evidence element catalog, vulnerability causation elements related to each vulnerability type are extracted from the multi-source evidence. The integrity of the vulnerability causative factors is verified, and a minimum set of evidence corresponding to the vulnerability type is constructed.

[0047] It should be noted that the evidence element catalog is a pre-configured, structured list of vulnerability causation elements for each preset vulnerability type. Entry point elements are the initial interaction points where an attacker can inject malicious data or instructions into the target system. Verification elements are the logic or mechanisms by which the software system checks the legitimacy and security of data from the entry point. Propagation elements are the process by which unverified dangerous data flows, is processed, or transformed within the system. Permission elements are the security mechanisms used by the software system to control the access rights of subjects (users, processes) to objects (resources, data, functions). Boundary elements are the key control points in the program used to define data ranges, loop counts, or memory allocation sizes. Impact elements are the direct negative security consequences resulting from the successful exploitation of a vulnerability. Integrity verification, after extracting the initial vulnerability causation elements, checks whether the extracted elements cover all necessary categories according to the evidence element catalog for the corresponding vulnerability type, ensuring that the constructed minimum evidence set can completely describe the vulnerability mechanism without missing any critical links.

[0048] Understandably, by pre-configuring an evidence element catalog containing six categories of elements—entry point, verification, propagation, permissions, boundaries, and impact—for each vulnerability type, and using this catalog as a guideline to extract and verify the completeness of vulnerability causal elements, the vulnerability audit process can be standardized and structured. This ensures that the analysis of any vulnerability follows a comprehensive and thorough checklist, facilitating the reuse of interpretation templates and consistent interpretation across personnel and projects.

[0049] Understandably, constructing a minimal set of evidence eliminates the possibility of false alarms or incomplete analytical conclusions due to broken chains of evidence, thereby ensuring the professional rigor of the final causal diagram and audit report.

[0050] Based on the first and second embodiments of this application, the same or similar content as the above embodiments in the third embodiment of this application can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 3 Step S20 also includes steps S21 to S23: Step S21: Divide the vulnerability causal elements in the causal graph into observed variables and latent variables. The observed variables are binary state values ​​or numerical parameters directly extracted from the multi-source evidence, and the latent variables are intermediate variables that characterize the vulnerability mechanism. Step S22: Based on the causal dependencies between nodes in the causal graph, construct the measurement equation between the observed variable and the latent variable, as well as the structural relationship equation between the latent variables; Step S23: Combine the measurement equation with the structural relationship equation to construct a structural equation model for the quantitative analysis of vulnerability mechanisms.

[0051] Understandably, by scientifically dividing the elements in the causal diagram into observable entity indicators (observed variables) and abstract concepts representing the mechanism (latent variables), and constructing a structural equation model containing measurement equations and structural relationship equations based on the observed and latent variables, the qualitative causal logic of vulnerabilities can be transformed into a calculable and verifiable quantitative analysis framework, thereby improving the accuracy of the assessment of vulnerability risk and its contribution to causes.

[0052] Understandably, distinguishing between observed and latent variables can effectively separate the objective facts of the original evidence from the security semantics that need to be comprehensively inferred. By using latent variables, the vulnerability mechanism can be abstracted and generalized at a higher dimension, so that subsequent quantitative analysis can be based on actual evidence and can also gain insight into the inherent laws of the vulnerability, thereby improving the accuracy of auditing.

[0053] Furthermore, step S22 may also include: Based on a preset minimum set of evidence, the evidence selection boundary for the observed variables is determined; Select target observation variables from the observed variables that satisfy the evidence selection boundary; Based on the causal dependencies between nodes in the causal graph, measurement equations are established one by one between each of the target observed variables and their corresponding latent variables. Based on the causal dependencies of the vulnerability causal factors in the causal graph, the structural constraint relationships between the latent variables are constructed layer by layer. Based on the structural constraints, structural relationship equations are constructed between the latent variables.

[0054] It should be noted that the evidence selection boundary is a rule or standard used to screen observed variables based on a small set of evidence. This clarifies that when constructing a structural equation model, relevant observed variables must be extracted from multi-source evidence, ensuring that the model focuses on core causal elements and avoids introducing irrelevant noise. Structural constraints are logical or mathematical constraints on the interaction patterns between latent variables, derived layer by layer from the causal dependencies between the loophole causal elements in the causal graph.

[0055] Understandably, by introducing a pre-defined minimum set of evidence to guide the determination of evidence selection boundaries, and by screening target observed variables based on this, the construction process of structural equation modeling can be ensured to be highly focused and the data pure. Furthermore, by rigorously establishing measurement equations and constructing structural relationship equations layer by layer based on causal dependencies, the qualitative causal graph can be successfully and accurately transformed into a quantifiable and verifiable mathematical model. This improves the scientific rigor and objectivity of vulnerability mechanism analysis, enabling complete tracing and accountability for vulnerability mechanism explanations.

[0056] Based on the above embodiments of this application, in the fourth embodiment of this application, the same or similar content as the above embodiments can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 4 Step S40 also includes steps S1 to S4: Step S1: Determine the matching weight of each of the vulnerability causal factors based on the quantified contribution. Step S2: The target elements in the vulnerability cause elements that meet the preset weight requirements are associated and matched with the verifiable points of the clauses in the preset security compliance clause library to generate a positive mapping relationship from mechanism to clause. Step S3: Based on the verifiable points of the clause, reverse the corresponding verification evidence elements, check the completeness and coverage of the target multi-source evidence associated with the target elements, and generate a reverse mapping relationship from clause to evidence gap; Step S4: Combine the forward mapping relationship with the reverse mapping relationship to obtain the bidirectional mapping relationship.

[0057] It should be noted that the matching weight is used as a basis for prioritizing and determining the strength of the match when subsequently matching with security compliance clauses. The preset weight requirements are pre-defined thresholds or rules used to filter out sufficiently important vulnerability causal factors. Verifiable clause points are specific inspection items or control objectives extracted and refined from each clause in the security compliance clause library, which can be proven or disproven by objective evidence.

[0058] Understandably, by introducing quantitative contribution to guide the precise correlation between vulnerability causal factors and security compliance clauses, and further through a two-way mapping mechanism, a complete link can be established from technical mechanisms to management compliance, and then from compliance requirements back to the state of evidence, thereby achieving complete tracing and accountability for the explanation of vulnerability mechanisms.

[0059] Furthermore, step S3 may also include: The minimum set of evidence corresponding to the key points can be verified by matching each of the aforementioned clauses; The multi-source evidence associated with the target element is compared and verified with the minimum set of evidence for the verifiable points of the corresponding clause. If the target multi-source evidence does not meet the configuration requirements of the corresponding minimum evidence set, an evidence gap is generated; If the target multi-source evidence has evidence conflicts or does not cover the requirements of the verifiable points, then coverage gaps and conflict gaps are generated. Based on the evidence gap, the coverage gap, and the conflict gap, a reverse mapping relationship is formed between the clause and the evidence gap.

[0060] It should be noted that an evidentiary gap occurs when comparing the target multi-source evidence with the minimum set of evidence required for the verifiable points of the clause, and finds that the target evidence completely lacks one or more evidentiary elements required by the minimum set of evidence. A coverage gap occurs when the target multi-source evidence exists, but its scope does not fully cover all the requirements of the verifiable points of the clause. A conflict gap occurs when there is logically contradictory information within the target multi-source evidence, or between the target evidence and the requirements implicit in the minimum set of evidence.

[0061] Understandably, by meticulously comparing the target multi-source evidence with the minimum set of evidence verifiable points of the clauses, and distinguishing gaps of three different natures—incomplete evidence, inadequate coverage, and logical conflicts—the validity of compliance evidence can be examined with unprecedented depth and breadth, thereby achieving a multi-dimensional and comprehensive assessment of evidence quality.

[0062] In its implementation, the code auditing platform uses structural equation modeling to analyze unauthorized access vulnerabilities and calculates the quantitative contribution of each contributing factor. Specifically, the contribution of missing permission verification is 0.85, and the contribution of improper session management is 0.35. Based on this contribution, the code auditing platform determines the corresponding matching weights of 0.85 and 0.35, respectively. The platform sets a weight requirement of 0.5. After screening, missing permission verification (weight 0.85 > 0.5) is identified as the target factor, while improper session management is excluded. The platform then searches the security compliance clause library, associating missing permission verification with verifiable points of clauses in security standards such as separation of duties review and information access restrictions, generating a positive mapping relationship. Furthermore, based on the matched verifiable points, the platform deduces that the corresponding verification evidence elements should include: role definition files, access control policy code, and authorization check logs. The code auditing platform then verified the target multi-source evidence (currently only authorization check logs) associated with the missing permission verification. It discovered missing role definition files and access control policy code, thus identifying the evidence gap and generating a reverse mapping relationship. Finally, the code auditing platform combined the forward and reverse mapping relationships to obtain a complete bidirectional mapping relationship. This relationship clearly demonstrates the overall picture of technical vulnerabilities, compliance risks, and evidence status.

[0063] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the auditing method of the vulnerability mechanism of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0064] This application also provides an auditing device for vulnerability mechanisms; please refer to [reference needed]. Figure 5 The auditing device for the vulnerability mechanism includes: The first construction module 10 is used to obtain multi-source evidence associated with the vulnerability, and to extract vulnerability causal elements and sort out causal relationships for the multi-source evidence respectively, so as to obtain a causal graph with vulnerability causal elements as nodes and causal dependencies as edges. The second construction module 20 is used to extract observed variables from the multi-source evidence based on the causal graph, and to construct a structural equation model in combination with the causal dependencies; Calculation module 30 is used to solve the structural equation model to obtain the quantitative contribution of each of the vulnerability causative factors to the occurrence of the vulnerability; Matching module 40 is used to perform bidirectional mapping matching between the vulnerability cause elements and the preset security compliance clause library based on the quantified contribution degree to obtain a bidirectional mapping relationship; Output module 50 is used to integrate the multi-source evidence, the quantified contribution degree and the bidirectional mapping relationship to obtain a structured audit report. The multi-source evidence is associated and bound to the corresponding node of the causal graph through a globally unique evidence reference identifier.

[0065] The vulnerability mechanism auditing device provided in this application, employing the vulnerability mechanism auditing method in the above embodiments, can solve the technical problem that current code security auditing cannot trace and assign responsibility for the interpretation of vulnerability mechanisms. Compared with the prior art, the beneficial effects of the vulnerability mechanism auditing device provided in this application are the same as those of the vulnerability mechanism auditing method provided in the above embodiments, and other technical features in the vulnerability mechanism auditing device are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0066] This application provides a vulnerability mechanism auditing device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the vulnerability mechanism auditing method in the above embodiment 1.

[0067] The following is for reference. Figure 6 The diagram illustrates a structural schematic of an auditing device suitable for implementing the vulnerability mechanism in the embodiments of this application. The auditing device for the vulnerability mechanism in the embodiments of this application may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 6 The audit device illustrating the vulnerability mechanism is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0068] like Figure 6As shown, the vulnerability mechanism auditing device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage device 1003 into a random access memory (RAM) 1004. The RAM 1004 also stores various programs and data required for the operation of the vulnerability mechanism auditing device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touchscreen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; storage devices 1003 including, for example, magnetic tape, hard disk, etc.; and communication devices 1009. Communication device 1009 allows the vulnerability mechanism auditing device to communicate wirelessly or wiredly with other devices to exchange data. While the figure shows vulnerability mechanism auditing devices with various systems, it should be understood that implementation or possession of all the systems shown is not required. More or fewer systems may be implemented alternatively.

[0069] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0070] The vulnerability mechanism auditing device provided in this application, employing the vulnerability mechanism auditing method described in the above embodiments, can solve the technical problem that current code security auditing cannot trace and assign responsibility for the interpretation of vulnerability mechanisms. Compared with the prior art, the beneficial effects of the vulnerability mechanism auditing device provided in this application are the same as those of the vulnerability mechanism auditing method provided in the above embodiments, and other technical features in this vulnerability mechanism auditing device are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0071] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0072] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0073] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, which are used to execute the auditing method for the vulnerability mechanism in the above embodiments.

[0074] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0075] The aforementioned computer-readable storage medium may be included in the vulnerability mechanism auditing device; or it may exist independently and not assembled into the vulnerability mechanism auditing device.

[0076] The aforementioned computer-readable storage medium carries one or more programs. When these programs are executed by the vulnerability mechanism auditing device, the vulnerability mechanism auditing device performs the following: acquires multi-source evidence associated with the vulnerability, and extracts vulnerability causal elements and sorts out causal relationships for each of the multi-source evidence to obtain a causal graph with vulnerability causal elements as nodes and causal dependencies as edges; based on the causal graph, extracts observed variables from the multi-source evidence and constructs a structural equation model in combination with the causal dependencies; solves the structural equation model to obtain the quantitative contribution of each vulnerability causal element to the occurrence of the vulnerability; based on the quantitative contribution, performs bidirectional mapping matching between the vulnerability causal elements and a preset security compliance clause library to obtain a bidirectional mapping relationship; and integrates the multi-source evidence, the quantitative contribution, and the bidirectional mapping relationship to obtain a structured audit report, wherein the multi-source evidence is associated and bound to the corresponding node of the causal graph through a globally unique evidence reference identifier.

[0077] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0078] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0079] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0080] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., computer programs) for executing the auditing method for the aforementioned vulnerability mechanism. This addresses the technical problem that current code security auditing cannot trace or assign responsibility for the interpretation of vulnerability mechanisms. Compared to existing technologies, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the vulnerability mechanism auditing method provided in the above embodiments, and will not be elaborated upon here.

[0081] The above description is only a part of the embodiments of this application and does not limit the scope of protection of this application. All equivalent structural transformations made under the technical concept of this application and using the content of this application specification and drawings, or direct / indirect applications in other related technical fields, are included in the scope of protection of this application.

Claims

1. A method for auditing vulnerability mechanisms, characterized in that, The method includes: Obtain multi-source evidence associated with the vulnerability, and extract vulnerability causal elements and sort out causal relationships for the multi-source evidence respectively to obtain a causal graph with vulnerability causal elements as nodes and causal dependencies as edges. Based on the causal graph, observed variables are extracted from the multi-source evidence, and a structural equation model is constructed by combining the causal dependencies. Solve the structural equation model to obtain the quantitative contribution of each of the vulnerability causative factors to the occurrence of the vulnerability; Based on the quantified contribution, the vulnerability causation factors are matched with a preset security compliance clause library in a two-way mapping to obtain a two-way mapping relationship. By integrating the multi-source evidence, the quantified contribution, and the bidirectional mapping relationship, a structured audit report is obtained. The multi-source evidence is associated and bound to the corresponding node of the causal graph through a globally unique evidence reference identifier.

2. The auditing method for vulnerability mechanisms as described in claim 1, characterized in that, The step of extracting vulnerability causal elements and sorting out causal relationships from the multi-source evidence to obtain a causal graph with vulnerability causal elements as nodes and causal dependencies as edges includes: Based on the preset vulnerability types, vulnerability causal elements related to each vulnerability type are extracted from the multi-source evidence, and a minimum evidence set is constructed based on the vulnerability causal elements. The evidence elements in the minimum set of evidence are mapped to nodes in a causal graph, and the causal variable nodes include cause nodes, propagation nodes, and influence nodes. Based on a pre-defined causal chain model, causal dependencies between the nodes are established. Based on the causal dependencies, the corresponding nodes are connected to obtain a causal graph with vulnerability cause elements as nodes and causal dependencies as edges.

3. The auditing method for vulnerability mechanisms as described in claim 2, characterized in that, Before the step of extracting vulnerability causal elements related to each vulnerability type from the multi-source evidence based on preset vulnerability types, and constructing a minimal evidence set based on the vulnerability causal elements, the method further includes: Configure an evidence element catalog for each vulnerability type. The evidence element catalog includes entry point, verification, propagation, permissions, boundary, and impact elements. The step of extracting vulnerability causal elements related to each vulnerability type from the multi-source evidence based on preset vulnerability types, and constructing a minimal evidence set based on the vulnerability causal elements, includes: Based on the evidence element catalog, vulnerability causation elements related to each vulnerability type are extracted from the multi-source evidence. The integrity of the vulnerability causative factors is verified, and a minimum set of evidence corresponding to the vulnerability type is constructed.

4. The auditing method for vulnerability mechanisms as described in claim 1, characterized in that, The step of extracting observed variables from the multi-source evidence based on the causal graph and constructing a structural equation model in conjunction with the causal dependencies includes: The vulnerability causal elements in the causal graph are divided into observed variables and latent variables. The observed variables are binary state values ​​or numerical parameters directly extracted from the multi-source evidence, and the latent variables are intermediate variables that characterize the vulnerability mechanism. Based on the causal dependencies between nodes in the causal graph, a measurement equation between the observed variable and the latent variable, as well as a structural relationship equation between the latent variables, are constructed. The measurement equations are combined with the structural relationship equations to construct a structural equation model for the quantitative analysis of vulnerability mechanisms.

5. The auditing method for vulnerability mechanisms as described in claim 4, characterized in that, The step of constructing the measurement equation between the observed variable and the latent variable, and the structural relationship equation between the latent variables, based on the causal dependencies between nodes in the causal graph, includes: Based on a preset minimum set of evidence, the evidence selection boundary for the observed variables is determined; Select target observation variables from the observed variables that satisfy the evidence selection boundary; Based on the causal dependencies between nodes in the causal graph, measurement equations are established one by one between each of the target observed variables and their corresponding latent variables. Based on the causal dependencies of the vulnerability causal factors in the causal graph, the structural constraint relationships between the latent variables are constructed layer by layer. Based on the structural constraints, structural relationship equations are constructed between the latent variables.

6. The auditing method for vulnerability mechanisms as described in claim 1, characterized in that, The step of performing a two-way mapping and matching between the vulnerability causation factors and a preset security compliance clause library based on the quantified contribution to obtain a two-way mapping relationship includes: The matching weight of each of the aforementioned vulnerability causal factors is determined based on the quantified contribution. The target elements whose matching weights meet the preset weight requirements among the vulnerability cause elements are associated and matched with the verifiable points of the clauses in the preset security compliance clause library to generate a positive mapping relationship from mechanism to clause. Based on the key points verifiable by the aforementioned clauses, the corresponding verification evidence elements are deduced, and the completeness and coverage of the target multi-source evidence associated with the target elements are checked to generate a reverse mapping relationship from the clauses to the evidence gaps. The forward mapping relationship is combined with the reverse mapping relationship to obtain the bidirectional mapping relationship.

7. The auditing method for vulnerability mechanisms as described in claim 6, characterized in that, The step of reverse-engineering the corresponding verification evidence elements based on the verifiable points of the clause, verifying the completeness and coverage of the target multi-source evidence associated with the target elements, and generating a reverse mapping relationship from clauses to evidence gaps includes: The minimum set of evidence corresponding to the key points can be verified by matching each of the aforementioned clauses; The multi-source evidence associated with the target element is compared and verified with the minimum set of evidence for the verifiable points of the corresponding clause. If the target multi-source evidence does not meet the configuration requirements of the corresponding minimum evidence set, an evidence gap is generated; If the target multi-source evidence has evidence conflicts or does not cover the requirements of the verifiable points, then coverage gaps and conflict gaps are generated. Based on the evidence gap, the coverage gap, and the conflict gap, a reverse mapping relationship is formed between the clause and the evidence gap.

8. An auditing device for vulnerability mechanisms, characterized in that, The device includes: The first construction module is used to obtain multi-source evidence associated with the vulnerability, and to extract vulnerability causal elements and sort out causal relationships for the multi-source evidence respectively, so as to obtain a causal graph with vulnerability causal elements as nodes and causal dependencies as edges. The second construction module is used to extract observed variables from the multi-source evidence based on the causal graph, and to construct a structural equation model in combination with the causal dependencies; The calculation module is used to solve the structural equation model to obtain the quantitative contribution of each of the vulnerability causative factors to the occurrence of the vulnerability; The matching module is used to perform bidirectional mapping matching between the vulnerability cause elements and the preset security compliance clause library based on the quantified contribution degree, so as to obtain a bidirectional mapping relationship; The output module is used to integrate the multi-source evidence, the quantified contribution, and the bidirectional mapping relationship to obtain a structured audit report. The multi-source evidence is associated and bound to the corresponding node of the causal graph through a globally unique evidence reference identifier.

9. An auditing device for vulnerability mechanisms, characterized in that, The device includes: a memory, a processor, and a computer program stored on the memory and executable on the processor, the computer program being configured to implement the steps of the auditing method for the vulnerability mechanism as described in any one of claims 1 to 7.

10. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the auditing method for the vulnerability mechanism as described in any one of claims 1 to 7.

Images