A vulnerability life cycle sla management and intelligent repair suggestion method

Abstract

The application relates to the technical field of network security vulnerability management, and discloses a vulnerability life cycle SLA management and intelligent repair suggestion method, wherein a directed weight graph is constructed by collecting micro-service calling traffic through a bypass agent; a global network center degree of a node is calculated by using a weighted graph network algorithm to quantify a cascading damage radius; an external in-the-wild utilization probability is obtained when the vulnerability is in a confirmed state; a dynamic remaining repair time limit of the target vulnerability is calculated by using exponential decay logic in combination with a basic static severity score, the network center degree and the in-the-wild utilization probability, trigger bottom check logic of a finite state machine, automatically execute over-level scheduling of an emergency repair state and synchronously write a structured audit log. The application executes dynamic SLA recalculation by fusing the global network center degree of the micro-service and real-time threat intelligence, so that high-risk vulnerabilities can trigger over-level scheduling to break through the delay of regular approval and meet the safety requirements in a high-frequency release environment.

Description

Technical Field

[0001] This invention relates to the field of network security vulnerability management technology, specifically a method for vulnerability lifecycle SLA management and intelligent remediation recommendations. Background Technology

[0002] Network security vulnerability management is a fundamental support mechanism for ensuring the operation of cloud-native architectures. Among them, vulnerability lifecycle SLA (Service Level Agreement) management refers to setting and enforcing remediation time limits for the lifecycle of a vulnerability, from detection, confirmation, remediation to retesting, in order to control the physical exposure window of the vulnerability and reduce potential security exploitation risks.

[0003] Current vulnerability lifecycle management methods in this field mainly employ static rule-based SLA calculation and work order scheduling schemes. The mainstream solutions typically rely on a Common Vulnerability Scoring System (CVSS) to obtain a basic severity score for a vulnerability, and combine this with a static compliance baseline to assign a fixed basic SLA time to vulnerabilities of different severity levels. A representative technical approach involves mapping the vulnerability's basic severity to a preset single countdown threshold after vulnerability detection, and generating a corresponding remediation task in the operations and maintenance work order system. Before the fixed countdown limit is reached, periodic vulnerability scanning and retesting are used to verify the remediation status, thereby maintaining the state machine flow of vulnerability management.

[0004] However, existing vulnerability lifecycle management solutions are still inadequate for large-scale, dynamically scaling microservice mesh environments. They suffer from issues such as easily invalidated static SLAs, delayed threat perception of core nodes, and difficulty adapting to high-frequency deployments in continuous integration / continuous deployment. This is because traditional solutions are limited by isolated management based on static vulnerability levels, failing to consider the global network centrality of microservice nodes within the overall topology, and lacking access to and calculation of external multi-source exploitation probabilities. Consequently, remaining remediation deadlines consistently exhibit static countdown characteristics. For nodes in the core topology of the microservice call chain, when the real-time exploitation risk of their associated vulnerabilities surges, the system cannot execute adaptive vulnerability SLA convergence control, easily leading to delayed remediation of core node vulnerabilities and triggering a larger cascading damage radius. Simultaneously, due to the inability to break the static countdown limitation, finite state machines struggle to trigger effective cross-level scheduling at the underlying physical execution stage, causing a disconnect between overall security operation response and the high-concurrency dynamic environment. Therefore, a vulnerability lifecycle SLA management and intelligent remediation recommendation method is urgently needed to address these issues. Summary of the Invention

[0005] To address the problems in related technologies, this invention provides a vulnerability lifecycle SLA management and intelligent remediation suggestion method to overcome the aforementioned technical problems in existing related technologies.

[0006] To solve the aforementioned technical problem, the present invention is achieved through the following technical solution:

[0007] In a first aspect, embodiments of the present invention provide a method for vulnerability lifecycle SLA management and intelligent remediation recommendations, specifically including:

[0008] Microservice call chain topology graph construction: By continuously collecting remote procedure call traffic logs between services through a bypass proxy, and extracting the effective call relationships within a specific time sliding window, a directed weighted graph of the microservice call chain is constructed.

[0009] Global network centrality quantification calculation: An asynchronous offline task is used to execute a weighted graph network algorithm based on the directed weight graph to calculate the global network centrality of each service node, so as to quantify the cascading damage radius after a node is compromised;

[0010] Wild exploit probability calculation: When a vulnerability progresses to the confirmed state, the wild exploit probability of the external vulnerability exploitation prediction and scoring system is obtained;

[0011] Dynamic SLA recalculation: Introducing the baseline service level agreement time and static basic severity score, combined with the global network centrality and the probability of exploitation in the wild, the calculation is performed through exponential decay logic with a time-dimensional reference constant to obtain the dynamic remaining remediation time limit for the target vulnerability;

[0012] Finite state machine skip scheduling: Based on the recalculated dynamic remaining repair time limit, the underlying verification logic of the finite state machine is triggered, and skip scheduling of the emergency repair state is automatically executed and synchronously written to the structured audit log.

[0013] As a preferred embodiment of the vulnerability lifecycle SLA management and intelligent remediation suggestion method described in this invention, the step of continuously collecting remote procedure call traffic logs between services through a bypass proxy includes:

[0014] The service mesh's bypass proxy uses a layer 7 network filter to extract the general service identity carried in the application layer protocol header as the unique node mapping key of the topology graph, and configures static bypass filtering rules in the proxy layer to intercept periodic requests that are not related to business attributes.

[0015] A fixed-length hash table with a preset maximum capacity is allocated within the process where the bypass agent is located. The extracted source service identifier and target service identifier are concatenated as the hash key. The number of calls within the time window is used as the hash value for micro-batch topology aggregation. When the capacity of the fixed-length hash table reaches the upper limit, long-tail calls are removed based on the least recently used eviction algorithm. At the same time, the cumulative number of calls of the removed long-tail calls is added to the global overflow traffic counter.

[0016] The system monitors the backlog depth of the asynchronous reporting queue in real time. When the backlog depth is between the warning threshold and the maximum depth, it calculates an exponentially increasing dynamic truncation threshold based on the backlog depth, removes edge call data below the dynamic truncation threshold, and adds the removed data to the global overflow traffic counter. When the backlog depth reaches the maximum depth or a network timeout occurs, it clears the topology detail log and reports a heartbeat probe payload containing the global overflow traffic counter value.

[0017] As a preferred embodiment of the vulnerability lifecycle SLA management and intelligent remediation suggestion method described in this invention, the construction of the directed weighted graph of the microservice call chain includes:

[0018] Extract the total number of calls from the source node to the target node within the sliding window, and calculate the basic query rate per second by combining the duration of the sliding window;

[0019] Extract the upper limit of the maximum empirical query rate of a single link carried by the current cluster architecture, introduce a smoothing compensation factor, and use log normalization mapping logic to smooth and compress the basic query rate per second and the upper limit of the maximum empirical query rate of a single link to generate edge weights that are robust against instantaneous traffic surges.

[0020] When extreme overload causes the basic query rate per second to reach the maximum empirical query rate limit of a single link, a segmentation truncation mechanism is triggered to force the output of the preset maximum weight boundary value.

[0021] Set a background noise threshold for the underlying environment, traverse the initially generated set of edge weights, and perform a pruning operation on weak connections that are below the background noise threshold, forcibly setting their weights to zero and removing them from the graph edge set, so as to generate the directed weighted graph under the condition of limited computing power.

[0022] As a preferred embodiment of the vulnerability lifecycle SLA management and intelligent remediation recommendation method described in this invention, the global network center metric calculation includes:

[0023] Extract a global read-only snapshot of the directed weighted graph, and construct a weighted adjacency matrix and a Markov random walk transition matrix containing surviving nodes based on the global read-only snapshot;

[0024] A damping factor and a penalty compensation term for dangling nodes with no subsequent call behavior are introduced. The original centrality score of each microservice node is continuously updated iteratively through matrix multiplication until the global error convergence condition is met or the preset maximum number of iterations is reached.

[0025] Extract the maximum and minimum scores from the original centrality score set, and force the original centrality scores of each node to converge to a preset numerical range through linear range transformation logic to obtain the global network centrality, and record the baseline traffic density of each microservice node within the calculation period.

[0026] As a preferred embodiment of the vulnerability lifecycle SLA management and intelligent remediation recommendation method described in this invention, the in-the-wild exploitation probability calculation includes:

[0027] When the finite state machine updates the state of a specific vulnerability to confirmed, it encapsulates the payload containing the vulnerability number and context characteristics into a standard event message and pushes it asynchronously into the distributed message middleware. The background consumer process then pulls the event from the queue according to the concurrent rate token bucket algorithm.

[0028] First, query the local distributed memory cache system to obtain the probability of exploitation in the wild. If the cache is not hit, push the vulnerability number into the micro-batch waiting queue. After the queue length or waiting time meets the set conditions, synthesize a single network request to initiate a batch query to the external vulnerability exploitation prediction and scoring system.

[0029] For zero-day vulnerabilities that have not yet been analyzed and included, or for situations where response times out due to network hard isolation, the static basic score normalized value associated with the vulnerability is extracted, and a basic probability estimate is generated by a linear mapping formula in combination with the preset unknown threat penalty coefficient as a substitute variable for forced injection.

[0030] As a preferred embodiment of the vulnerability lifecycle SLA management and intelligent remediation suggestion method described in this invention, the dynamic SLA recalculation includes:

[0031] Based on the enterprise's security compliance baseline, set the static baseline service level agreement time corresponding to the current vulnerability level, and extract the initial timestamp of vulnerability detection and the current system calculation timestamp to calculate the physical elapsed time of vulnerability exposure;

[0032] Extract the real-time query rate per second and the number of live replicas at the current moment, calculate the real-time traffic density, and calculate the real-time topology mutation compensation factor based on the real-time traffic density and the baseline traffic density;

[0033] The global network centrality, in-the-wild exploitation probability, and static basic severity score normalization values ​​are extracted and assigned corresponding topological weights, intelligence weights, and static baseline weights, respectively. Based on the current vulnerability status, a vulnerability status confidence parameter is introduced. Combined with the real-time topological mutation compensation factor, a multi-dimensional risk comprehensive penalty factor is constructed by performing a summation operation through weighted linear combination logic.

[0034] Extract the time decay penalty parameter that controls the steepness of the overall decay curve and the preset time dimension reference constant, and divide the physical elapsed time by the time dimension reference constant to obtain the time variable;

[0035] The multidimensional risk comprehensive penalty factor, time variable, and time decay penalty parameter are put together into the natural exponential function term and multiplied to obtain the nonlinear decay result. The nonlinear decay result is then multiplied with the static baseline service level agreement time to calculate the dynamic total allowable time limit.

[0036] The physical elapsed time is deducted from the total dynamic allowable time limit, and a boundary truncation operation is performed by wrapping the maximum value function in the outermost layer to output the non-negative dynamic remaining repair time limit.

[0037] As a preferred embodiment of the vulnerability lifecycle SLA management and intelligent remediation suggestion method described in this invention, the determination of the topology weight, intelligence weight, and static baseline weight includes:

[0038] Extract the business attribute tags of the current microservice mesh, and construct an offline evaluation model based on the business attributes using the analytic hierarchy process;

[0039] A subjective judgment matrix is ​​constructed based on three dimensions: topological centrality, in-the-wild exploitation threat, and static severity. The topological centrality represents the cascading explosion radius, the in-the-wild exploitation threat represents the external attack heat, and the static severity represents the inherent attributes of the vulnerability.

[0040] Calculate the largest eigenvalue and its corresponding eigenvector of the subjective judgment matrix, and perform a consistency ratio test;

[0041] If the verification passes, the feature vector is normalized, and the three extracted components are proportionally fixed as the topological weight, the intelligence weight, and the static benchmark weight.

[0042] As a preferred embodiment of the vulnerability lifecycle SLA management and intelligent remediation suggestion method described in this invention, the finite state machine cross-level scheduling includes:

[0043] The system scheduling service updates the dynamic remaining repair time for all unpatched vulnerabilities in batches at fixed intervals.

[0044] Determine whether the calculated dynamic remaining repair time limit is less than or equal to the set warning threshold. When the condition is met, trigger the underlying verification logic of the state machine and automatically mark the vulnerability as an emergency repair status in the operation and maintenance work order system, bypassing the regular approval queue.

[0045] The conditions that trigger out-of-level scheduling are encapsulated as structured data. The structured data includes a snapshot of the global network centrality value and the probability of exploitation in the wild. The structured data, along with the old and new states of the vulnerability, are written into an audit table at once to maintain the traceability of the dynamic contraction process.

[0046] As a preferred embodiment of the vulnerability lifecycle SLA management and intelligent remediation recommendation method described in this invention, the method for determining the early warning threshold includes:

[0047] Extract the physical execution time corresponding to the preset percentile of the statistical distribution data of the monitoring logs of the continuous integration system that executes historical emergency hotfix pipelines within a fixed period in the past, and use it as the pipeline's basic construction time.

[0048] Based on the underlying computing environment, extract concurrent deployment parameters and convergence time parameters, and calculate the generalized deployment convergence time required for the entire business traffic to switch to the repaired version image;

[0049] Extract the baseline time for manual approval of routine security events set in the enterprise's standard operation and maintenance procedures, introduce an emergency response compression factor to perform multiplication calculation, and obtain the baseline time for emergency verification.

[0050] The warning threshold is determined by linearly summing the pipeline infrastructure construction time, the generalized deployment convergence time, the emergency verification baseline time, and the fault tolerance buffer time for cross-availability zone infrastructure fluctuations.

[0051] Secondly, embodiments of the present invention provide a vulnerability lifecycle SLA management and intelligent remediation suggestion system, comprising: a topology graph construction module, used to continuously collect remote procedure call traffic logs between services through a bypass agent and extract effective call relationships to generate a directed weighted graph of microservice call chains; a global network centrality calculation module, used to use an asynchronous offline task to execute a weighted graph network algorithm based on the directed weighted graph to calculate the global network centrality of each service node; an in-the-wild exploitation probability calculation module, used to obtain the in-the-wild exploitation probability of an external vulnerability exploitation prediction scoring system when the vulnerability flows to the confirmation state; a dynamic SLA recalculation module, used to combine the baseline service level agreement time, global network centrality, in-the-wild exploitation probability and static basic severity score, and calculate the dynamic remaining remediation time limit through exponential decay logic; and a finite state machine skip-level scheduling module, used to trigger the underlying verification logic of the finite state machine according to the dynamic remaining remediation time limit to generate skip-level scheduling instructions and synchronously write them to the structured audit log.

[0052] The present invention has the following beneficial effects:

[0053] 1. This invention employs a dual-scale hybrid sensing and dynamic hierarchical filtering map construction mechanism. During the bypass traffic acquisition phase, a global overflow traffic counter and a truncation threshold that varies exponentially with the asynchronous queue depth are introduced. When the system encounters sudden network congestion, high-pass filtering is performed to proactively and physically strip long-tail edge calls and maintain the conservation of macroscopic traffic characteristics, ensuring the integrity of the core business backbone map under extreme conditions. Simultaneously, by fusing offline global network centrality benchmarks and real-time traffic density compensation factors, the system can achieve agile perception of the cascading damage potential transfer caused by instantaneous scaling, downtime, or load skew in microservices without frequent reconstruction of the entire network matrix. This solves the problem of delayed threat perception due to the lack of global topology considerations in existing technologies, as well as the topology fragmentation and data distortion caused by high-concurrency network fluctuations.

[0054] 2. This invention constructs a dynamic SLA evaluation engine that integrates pre-emptive threat intelligence access with nonlinear time decay. By asynchronously retrieving the in-the-wild exploit probability from an external vulnerability exploitation prediction and scoring system during the initial detection phase of a vulnerability's lifecycle, it eliminates the time blind spot of SLA constraints during traditional secondary confirmation. It also collaboratively introduces a confidence parameter bound to the vulnerability's status, ensuring that constraints are triggered early for extremely high-risk vulnerabilities while suppressing ineffective scheduling fluctuations caused by false positives from automated scanning tools. Furthermore, by using a time decay penalty parameter to adjust the decay slope of the natural exponential function, it transforms multidimensional comprehensive risk into a nonlinear contraction rate of physical remediation time limits, forcing the time limits of high-profile vulnerabilities to converge within the enterprise's compliance boundaries. This overcomes the problem of existing technologies using static basic SLA times easily failing during dynamic exposure windows.

[0055] 3. This invention addresses the physical characteristics of high-frequency deployment environments in Continuous Integration / Continuous Deployment (CI / CD) by mathematically mapping SLA warning thresholds to system computing power limits and underlying environments. This enables compatibility with container mesh rolling deployment and physical machine concurrent restart strategies. Furthermore, it introduces an emergency response compression factor, transforming breakthroughs that bypass conventional management processes into precise time reductions readable by the state machine. This allows extremely high-risk vulnerabilities to overcome conventional process delays and trigger mandatory execution instructions in the underlying operations and maintenance work order system that are consistent with the computing power limits of the physical environment. This solves the problem in existing technologies where finite state machines struggle to trigger cross-level scheduling at the underlying physical execution stage, leading to a disconnect between security operation responses and the dynamic environment of high-frequency deployments.

[0056] Of course, any product implementing this invention does not necessarily need to achieve all of the advantages described above at the same time. Attached Figure Description

[0057] To more clearly illustrate the technical solutions of the embodiments of the invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the invention. For those skilled in the art, the drawings can be obtained from these drawings without creative effort.

[0058] Figure 1 The present invention provides a flowchart of a vulnerability lifecycle SLA management and intelligent remediation suggestion method.

[0059] Figure 2 This is a schematic diagram of the process S3 provided by the present invention.

[0060] Figure 3 This is a schematic diagram of the S5 process provided by the present invention.

[0061] Figure 4 This is a schematic diagram of a vulnerability lifecycle SLA management and intelligent remediation suggestion system provided by the present invention. Detailed Implementation

[0062] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0063] Example 1

[0064] When dealing with large-scale, dynamically scaling microservice mesh environments, existing vulnerability lifecycle management solutions are not yet perfect. They still suffer from problems such as static SLAs (Service Level Agreements) being prone to failure, delayed threat perception of core link nodes, and difficulty in adapting to the high-frequency release of continuous integration / continuous deployment (CI / CD).

[0065] To solve the above technical problems, such as Figure 1 As shown, Embodiment 1 of the present invention provides a method for vulnerability lifecycle SLA management and intelligent remediation recommendations. Specifically, Embodiment 1 takes a microservice mesh environment under a cloud-native architecture as an example. It constructs a dynamic SLA calculation engine based on service topology and real-time threat intelligence to form an adaptive security operation scheduling framework. The specific steps include:

[0066] S1. Construction of microservice call chain topology under constrained working conditions: Continuously collect remote process call traffic logs between services through a bypass proxy, extract the effective call relationships within a specific time sliding window, and construct a directed weighted graph;

[0067] S2. Asynchronous Global Network Centrality Measurement Calculation: A weighted graph network algorithm is executed using asynchronous offline tasks to calculate the global network centrality of each service node and quantify the cascading destruction radius after a node is compromised.

[0068] S3, Multi-source heterogeneous threat intelligence adaptive access: When a vulnerability progresses to the confirmation stage, obtain the probability of exploitation in the wild from the external vulnerability exploitation prediction and scoring system, and configure a downgrade protection mechanism;

[0069] S4. Dynamic SLA recalculation based on time decay variable: Combining baseline SLA time, global network centrality, in-the-wild utilization probability and static baseline severity score, dynamic recalculation of remaining repair time is performed through an exponential decay function with a time dimension reference constant.

[0070] S5. Finite state machine bypass scheduling and audit closed loop: Based on the recalculated dynamic remaining repair time limit, the underlying verification logic of the state machine is triggered, and the bypass scheduling of the emergency repair state is automatically executed and synchronously written to the structured audit log.

[0071] In this invention, the microservice call chain topology graph constructed in step S1 is the topological foundation for global network centrality metric measurement in step S2; the centrality index output in step S2 and the in-the-wild exploitation probability obtained in step S3 are the core environmental input parameters for dynamic SLA recalculation in step S4; the dynamic remaining repair time limit recalculated based on exponential decay in step S4 is the core constraint logic for breaking the limitations of static countdown; step S5 uses a finite state machine to perform cross-level scheduling, which is the physical execution link at the bottom layer to avoid delays in repairing core node vulnerabilities and to achieve dynamic security orchestration; the above steps work together to break the traditional isolated management boundary based on static vulnerability levels and achieve adaptive vulnerability SLA convergence control in a high-concurrency microservice environment.

[0072] Furthermore, to better illustrate the technical solution of Embodiment 1 of the present invention, a detailed explanation of the vulnerability lifecycle SLA management and intelligent remediation suggestion method is provided, specifically including the following:

[0073] First, S1 constructs a directed weighted graph by collecting microservice traffic, including the following sub-steps:

[0074] S11. Continuously collect remote procedure call (RPC) traffic logs between microservice instances through the service mesh's sidecar proxy.

[0075] S12. To control the memory consumption of computing nodes, a time sliding window is set up, and the effective call relationships within the window are extracted to construct a directed weight graph. .

[0076] Node definition: Node This indicates the currently active microservice instances.

[0077] Edge weight definition: edge weight Set as source node within sliding window To the target node Log-normalized value of queries per second (QPS) for initiating calls to smooth out data noise caused by burst traffic.

[0078] As an optional embodiment, considering the complex real-world scenarios such as IP drift caused by frequent start-up and shutdown of container instances in a microservice mesh, data noise introduced by high-frequency infrastructure probes, and memory and computing resource consumption caused by high-concurrency traffic on the sidecar, the specific implementation steps of step S11 include:

[0079] S111. To address the short lifecycle and dynamic IP allocation characteristics of microservice containers, the topology node labeling method based on network layer IP addresses is abandoned. In the layer 7 network filter of the bypass proxy, a generic service identity identifier (such as SPIFFE ID or KubernetesServiceAccount) carried in the application layer protocol header (such as HTTPHeaders or gRPC Metadata) is extracted as the unique node mapping key for the topology graph. Simultaneously, static bypass filtering rules are configured at the proxy layer to intercept and discard periodic RPC requests with non-business attributes such as path matching for Liveness Probe, Readiness Probe, and Metrics Scraping, thus eliminating data noise that lacks secure cascading transmission attributes.

[0080] S112. To address the risk of memory overflow (OOM) in the bypass agent caused by direct transmission of high-concurrency service traffic details and the network congestion problem of the central node, a preset maximum capacity is allocated within the process where the bypass agent resides. A fixed-length hash table. The source service identifier extracted in step S111 is concatenated with the target service identifier as the hash key, and the time window... The number of calls within the memory is used as the hash value. When new valid traffic is captured, triggering atomic accumulation in local memory, if the number of hash keys at the current moment reaches the capacity limit... It executes an approximate least recently used eviction algorithm (such as W-TinyLFU) based on access frequency and time to remove occasional long-tail calls. It extracts the cumulative number of calls of the removed long-tail calls, aggregates them and adds them to a preset global overflow traffic counter, so as to maintain the macro total amount conservation of micro traffic characteristics within the period while discarding long-tail topology details.

[0081] S113, Set the time window The micro-batch topology data completed by internal aggregation is encapsulated and handed over to an independent asynchronous thread pool queue for reporting. The backlog depth of the current asynchronous reporting queue is monitored in real time. Introduce a tiered and downgraded control mechanism:

[0082] When the accumulation depth Less than the preset warning threshold At that time, perform full micro-batch topology reporting; when the stacking depth satisfy When this occurs, a dynamic high-pass filter degradation strategy is triggered. The base filter query rate per second is set. Maximum queue depth With dimensionless penalty amplification factor Calculate the dynamic truncation threshold :

[0083] ;

[0084] In the formula, the parameters , and All are dimensionless queue count values; parameters It is a dimensionless scalar.

[0085] Iterate through the hash table currently awaiting reporting and forcibly remove hashes with a query rate lower than [per second]. Edge call data is processed, and the culling amount is added to the global overflow traffic counter. Only core topology link data that meets the threshold is reported; when the accumulation depth... If a network connection timeout is detected continuously, a hard circuit breaker mechanism is triggered, the topology detail log of the current collection period is cleared, and a simplified heartbeat probe payload containing only the source service identifier, node liveness status code and global overflow traffic counter value is generated for downgraded reporting.

[0086] As an optional embodiment, considering the frequent changes in node states caused by the frequent scaling up and down of microservice instances in a distributed system, the delayed and disordered reporting of metrics due to asynchronous network transmission, and the extremely sparse global network topology matrix, the specific implementation steps of step S12 include:

[0087] S121. Out-of-order tolerance time-sliding window and live node identification, including: For the problem of out-of-order arrival of topology logs caused by network latency reported by the bypass agent, an event-time-based sliding window mechanism is adopted. A fixed-duration time-sliding window is set. It also introduces a tolerance delay watermark mechanism, which shifts the physical time of window-triggered calculations backward by a preset tolerance. This is to receive late micro-batch aggregation logs. Simultaneously, to address the issue of zombie node remnants caused by frequent service scaling, the set of request nodes within the sliding window is cross-compared with the real-time registry status of the microservice control plane. Only microservice instances that remain in the Ready state within the current time slice are retained, while instances in the Terminating or offline state are removed, thereby converging to generate an accurate set of currently alive nodes. .

[0088] S122. To address localized traffic surges caused by high-concurrency microbursts or abnormal retry storms common in microservice environments, and to prevent the centrality of topology nodes from being severely distorted by extreme value data, logarithmic normalization mapping is performed on edge weights to prevent overflow. Source nodes within the sliding window are extracted. To the target node Total number of calls Calculate the basic query rate per second .

[0089] Set the maximum experience query rate limit that the current cluster architecture can handle for a single link. A smoothing compensation factor is introduced (with a value of...). To avoid the zero-valued logarithm being meaningless, edge weights are constructed. Log-normalized calculation formula:

[0090] ;

[0091] When extreme overload occurs When this occurs, the segmentation truncation mechanism is triggered, forcing output. Through this logarithmic mapping formula, sudden, exponential increases in traffic are smoothly compressed in the numerical space, enabling the output weight parameters to reflect both the strong dependencies of normal business operations and the data robustness against instantaneous traffic surges.

[0092] S123. In large-scale microservice meshes, the fully connected matrix between nodes exhibits extremely sparse characteristics. To control the memory consumption of subsequent centrality calculation nodes, a threshold for the underlying environmental background noise is set. Traverse the initially generated set of edge weights, and for those that satisfy... Perform hard pruning on weakly connected edges (such as occasional probe connectivity checks, bypass data retrieval for non-core business traffic, etc.), forcibly setting their weights to zero and removing them from the graph edge set. Remove from the middle. The pruned directed weight graph... The data is converted to Compressed Sparse Row (CSR) format for in-memory storage and cross-process parameter passing to meet the requirements of low memory overhead in graph computing under limited computing power conditions.

[0093] For example, in this embodiment, a time sliding window Independent determination methods include: extracting node scheduling state machine parameters from the underlying container orchestration system (such as Kubernetes) and obtaining the minimum average lifecycle of microservice instances (such as the minimum time interval from container startup to readiness and receiving traffic). Extract the asynchronous disk flushing cycle of logs from the service mesh bypass agent. and the network's maximum tolerable latency Constructing unidirectional constraint boundary conditions for the time-sliding window: To ensure that complete RPC sessions can be aggregated and that the transient changes in microservice scaling are not obscured by an excessively long window, such that... .Will Set as Preset integer multiples (such as) (times), calculate and solidify The specific value.

[0094] For example, in this embodiment, the maximum experience query rate limit for a single link is... The determination method includes: in a microservice cluster proportional benchmark environment, applying progressively increasing concurrent requests to the core business entry point using traffic stress testing tools. Continuously monitor the CPU utilization, memory level, and request response time of the target service nodes. When a node triggers rate limiting and circuit breaking policies or experiences a non-linear surge in response latency (i.e., reaching a physical performance bottleneck), extract the peak query rate per second captured by the bypass proxy under this critical state. Introduce a system-level disaster recovery buffer coefficient. (range of values) ), calculate and solidify .

[0095] For example, in this embodiment, the underlying ambient background noise threshold The determination method includes: extracting the static execution intervals of the Liveness Probe, Readiness Probe, and Metrics Scraping configured in the microservice registry and container orchestration engine. The frequency of these periodic non-business events is then converted into a basic query rate per second. The calculated result and the preliminary steps determined By substituting the logarithmic normalization formula of the unidirectional edge weights, the mathematical mapping benchmark value of the probe flow in the normalized space is calculated: Extract the maximum number of concurrent retries set in the network retry strategy and use it as the noise fluctuation coefficient. Calculate and solidify the final background noise threshold. In graph computation, edge weights below a constant threshold are identified as occasional non-core business connections and pruned. This mechanism physically separates non-core business traffic, eliminates interference from underlying environmental noise on microservice topology characteristics, thereby reducing the matrix size of the directed weighted graph and solving the problems of memory overflow and computing power bottlenecks in graph computation caused by massive node concurrency.

[0096] Furthermore, S2 quantifies the centrality index using a graph network algorithm, including the following sub-steps:

[0097] S21, Regarding the diagram Given its large scale and high frequency of changes, an asynchronous offline task execution method with weighted PageRank algorithm is used to calculate the global network centrality of each service node. .when The calculation formula is iterated until convergence or the preset maximum number of iterations is reached, and the output range is normalized to... Interval.

[0098] S22. If a node experiences missing traffic data due to network isolation or probe failure, the system assigns a fixed, preset penalty value to that node's basic network centrality. This mechanism prevents the vulnerability SLA of the corresponding microservice node from being abnormally extended due to monitoring data silos.

[0099] As an optional embodiment, for complex real-world scenarios such as graph data read / write conflicts caused by frequent topology changes in microservice meshes, network dangling node effects caused by terminal services (such as underlying database proxies or external API gateways), and polarization of centrality values ​​under a massive number of nodes, the specific implementation steps of step S21 include:

[0100] S211. Topology snapshot extraction and random walk transition matrix construction, including: For continuously asynchronously reported microservice topology data, to avoid triggering read-write lock contention or generating dirty reads when the offline graph computing engine traverses the network structure, the system extracts the graph data structure before each centrality calculation task starts. A global read-only snapshot. A system containing [data / captures] is built based on this snapshot. A weighted adjacency matrix of surviving nodes. Extract any source node. Sum of all outgoing edge weights ,in For nodes The set of target nodes to be invoked. Construct the Markov random walk transition matrix. Its elements The calculation logic is as follows: if node To the node Initiating the call and ,but If there is no calling relationship, then .

[0101] S212. Introducing asynchronous parallel iteration of damping factor and suspension compensation, including: for suspension nodes at the end of the microservice call chain that have no subsequent call behavior, i.e., the sum of outgoing edge weights. To prevent the centrality score (i.e., the random walk probability) in the computational model from being lost during iterations, a damping factor is introduced for the nodes. (For example ) and dangling node penalty compensation term. Initialize the centrality vector of all nodes in the network. In the first In this iteration, any microservice node Original centrality score The calculation formula is as follows:

[0102] ;

[0103] In the formula, For direct node invocation The set of front-end microservice nodes; This is the set of dangling nodes in the snapshot where the sum of outgoing edge weights is zero. The offline computing cluster transforms the above formula into matrix multiplication operations and iterates continuously until the global error convergence condition is met. Or the maximum number of iterations for protection set by the system has been reached. Stop the iteration and output the final set of original centrality scores. ; For the preset tolerance threshold, such as .

[0104] S213. Avoiding numerical polarization and extreme value collapse through interval mapping normalization, including: In highly heterogeneous microservice networks, the original centrality score of edge gateways or core authentication components may be several orders of magnitude higher than that of end-user service nodes. If directly... Investing in subsequent SLA recalculations will result in edge node vulnerabilities being incorrectly assigned near-infinite repair timelines. Therefore, extraction... Maximum score in the set With minimum score The original scores of each node are mapped to linear range transformation logic. Interval, obtain global network centrality :

[0105] ;

[0106] Abnormal operating condition handling mechanism: If the original scores of all nodes in the current snapshot are completely equal, resulting in a denominator of zero, i.e. This typically occurs during system cold starts or in fully symmetrical micro-island networks, triggering the divide-by-zero protection logic and directly assigning a safety baseline centrality to all nodes within that batch. This ensures that, in the absence of effective node differentiation, the subsequent dynamic SLA calculation engine will neither cause excessive tightening of the global remediation timeline nor unnecessarily extend the remediation deadlines for potential core node vulnerabilities, thus maintaining a basic balance of security defenses. The final output... It is a global network centrality parameter that shields the network polarization effect and has dimensionless mathematical properties.

[0107] S214, in the output Simultaneously, record the data for each microservice node within this computation cycle. The baseline flow density .in, , This represents the average query rate per second for that node within the sliding window. To calculate the total number of container replicas for this service at any given time.

[0108] Furthermore, when a vulnerability enters the detected state or transitions to the confirmed state, S3 triggers the acquisition of the in-the-wild exploit probability from an external vulnerability exploitation prediction and scoring system, and configures a degradation protection mechanism, such as... Figure 2 As shown, it includes the following sub-steps:

[0109] S31. When the finite state machine updates the status of a specific vulnerability to "detected" or "confirmed," it encapsulates the context payload, including the public vulnerability and exposure (CVE) number, discovery timestamp, and asset identifier, into a standard event message and asynchronously pushes it into the distributed message middleware. The threat intelligence acquisition module pulls events from the queue through a background consumer process based on a concurrent rate token bucket algorithm, and requests the specific vulnerability in the time series from the external Exploitation Prediction Scoring System (EPSS) via the API interface. Probability of in-the-wild exploitation based on the latest available threat intelligence .

[0110] As an optional implementation, considering the complex real-world conditions in cloud-native microservice environments where high-concurrency vulnerability alerts can easily lead to external API rate limiting and blocking, synchronous HTTP requests blocking the state machine's main thread, and the lack of real-time scoring data for some newly emerging vulnerabilities, the specific implementation steps of step S31 include:

[0111] S311. Event-driven asynchronous decoupling triggering of state machines includes: when a finite state machine updates the state of a specific vulnerability to "confirmed," instead of directly initiating a synchronous external network request, it encapsulates a context payload containing the public vulnerability and exposure (CVE) number, discovery timestamp, and asset identifier into a standard event message and asynchronously pushes it into a distributed message middleware (such as Kafka). The threat intelligence acquisition module, as an independent background consumer process, pulls events from the queue according to a preset concurrent rate token bucket algorithm, physically isolating the high-frequency state transitions of the state machine from low-frequency external network I / O to prevent sudden large-scale vulnerability alerts from causing system-level thread blocking.

[0112] S312, multi-level cache breakdown prevention and micro-batch aggregation query, including: extracting CVE numbers from event payloads, prioritizing queries to the local distributed memory caching system (such as Redis). If the cache hits and the timestamp is close to the current time... The threat intelligence freshness time (TTL) has not exceeded the preset threshold. If the cached value is less than 1 hour, then the cached value is directly extracted as... If the cache misses, the system terminates the external request; if a cache miss occurs, instead of immediately initiating a single-point query, the CVE number is pushed into a micro-batch waiting queue. When the queue length reaches the maximum batch query threshold allowed by the API service provider, or when the waiting time for the first element exceeds the preset maximum delay threshold, the system concatenates the CVE numbers in the queue into a single network request.

[0113] S313. Standardized Interface Interaction and Probabilistic Numerical Parsing, including: The threat intelligence acquisition module initiates batch query requests to the external Exploit Exploit Scoring System (EPSS) endpoint via the RESTful API protocol, carrying authentication headers. The system captures and verifies the returned HTTP status codes and JSON format response messages. It parses the JSON data tree and extracts the epss key-value from the data object corresponding to each queried CVE number. The epss key-value is defined in the data model as a statistical probability estimate of the actual exploitation of the target vulnerability within a future observation window. The extracted floating-point values ​​(data domain strictly bounded by...) are then processed. Perform precision truncation and assign the result to the in-the-wild utilization probability parameter. It is then written back to the distributed memory cache using the original CVE number as the key.

[0114] S314. Punitive alternative mappings for unlisted vulnerabilities, including: zero-day vulnerabilities not yet analyzed and listed in the EPSS database, private component vulnerabilities, or extreme cases where API response timeouts occur due to network hard isolation (such as returning an empty dictionary or non-...). (Status code), the system determines that the acquisition failed and does not generate an error interruption. Extract the normalized value of the static basic score from the Common Vulnerability Scoring System (CVSS) associated with this vulnerability. Introducing a preset unknown threat penalty coefficient (range of values) ), through linear mapping formula Calculate and obtain the baseline probability estimate. Force the estimate to... Injected as a substitute variable .

[0115] Furthermore, the S4 design incorporates recalculation logic based on the time decay variable, including the following sub-steps:

[0116] S41. Set baseline time limits and extract physical elapsed time, including: based on the enterprise security compliance baseline, set the static baseline SLA time corresponding to the current vulnerability level. Extract the initial timestamp of vulnerability detection. Compare with the current system timestamp The physical elapsed time since the computational vulnerability was exposed. Under an ideal static linear management model, the remaining repair time is only manifested as... .

[0117] Furthermore, extract the current moment. Real-time query rate per second Compared to the current number of surviving replicas Calculate real-time flow density Introducing a real-time topological mutation compensation factor. The calculation formula is as follows:

[0118] ;

[0119] When the real-time load density exceeds the baseline density of offline computing, such as when scaling down causes a surge in load at a single point or a surge in traffic, This allows for an upward adjustment of risk; when the load decreases, the value is adjusted accordingly. Maintain a conservative approach to risk assessment.

[0120] S42. Construct a multi-dimensional risk comprehensive penalty factor, including: extracting the global network centrality output from step S2. The probability of in-the-wild utilization obtained in step S3 Mutation compensation factor And the normalized value of the static base severity score of the vulnerability itself. Introduce topology weights based on the tolerance of service network content. Intelligence weight With static benchmark weights ,satisfy Introducing a vulnerability status confidence parameter. And when the vulnerability is detected, set The value range is from 0.5 to 0.8; when the vulnerability is in the confirmed state, set... .

[0121] Furthermore, a multidimensional risk comprehensive penalty factor is constructed through linear combination. : .

[0122] S43. Introducing a time decay variable to construct a dynamic total allowable time limit, including: to achieve the technical objective of accelerating the contraction of the remediation window as the exposure time of high-risk vulnerabilities increases, a nonlinear decay model is constructed using a natural exponential function. A time decay penalty parameter is introduced. This is used to control the steepness of the overall decay curve; a time-dimensional reference constant is introduced. For the duration of physical passage Perform division to generate a time variable. The above-mentioned multidimensional risk comprehensive penalty factors The time variable and the decay penalty parameter are placed together inside the exponential term and are synchronized with the static reference SLA time. Multiply to calculate the dynamic total allowable time limit after dual compression of risk and time. : By introducing a time decay penalty parameter Adjusting the decay slope of the natural exponential function can incorporate multidimensional risk comprehensive penalty factors. The change is mapped to the nonlinear contraction rate of the physical repair time limit, thereby accelerating the closure of the allowable exposure window for high-threat vulnerabilities and forcing the total allowable time limit to converge within the preset enterprise security compliance boundary when facing a surge in external attack extreme values.

[0123] S44. Implement elapsed time deduction and extreme value boundary truncation, including: the dynamic total allowable time limit calculated above. In, the exposure time that has already physically elapsed is deducted. This yields the theoretically dynamic remaining repair time. Simultaneously, to prevent the calculation result from outputting a physically meaningless negative time limit after exceeding the repair deadline, a maximum value function is wrapped in the outermost layer. Boundary truncation is performed. The theoretical formula and boundary conditions are combined to output the final dynamic remaining repair time calculation formula, which can be directly read and scheduled by the finite state machine: .

[0124] As an optional implementation, the risk weighting coefficient , , The determination method includes: extracting business attribute tags from the current microservice mesh, such as the core transaction mesh, internal management mesh, or edge external mesh. For different business attributes, an offline evaluation model is constructed using the Analytic Hierarchy Process (AHP). A subjective judgment matrix is ​​constructed, encompassing three dimensions: topological centrality (representing the cascading explosion radius), in-the-wild exploitation threat (representing external attack intensity), and static severity (representing inherent vulnerability attributes). The maximum eigenvalue and its corresponding eigenvector of the subjective judgment matrix are calculated, and a proportional consistency (CR) test is performed. If the test passes (…), the evaluation is then conducted. Under the premise of normalization, the feature vectors are normalized, and the three extracted components are solidified into topological weights in proportion. Intelligence weight With static benchmark weights Ensure that the requirements are met. .

[0125] As an optional embodiment, the time decay penalty parameter The determination method includes: during the offline configuration phase, setting a worst-case scenario assumption: the comprehensive risk penalty factor for a vulnerability. Reaching the theoretical maximum value This refers to vulnerabilities located in the global core topology, with an EPSS predicted utilization rate of 100% and a perfect CVSS score. The maximum tolerable exposure duration limit for such high-risk vulnerabilities, as specified in the enterprise security compliance baseline, is extracted. For example, requiring after detection Repair must be completed within 24 hours. Substituting the parameters of the worst-case scenario into the dynamic total allowable time equation, and setting the decayed total time equal to this extreme red line: Taking the natural logarithm of both sides of the equation and rearranging the terms, the attenuation penalty parameter can be derived unidirectionally. The value: The calculated scalar It serves as a global constant injection calculation engine for the system.

[0126] Furthermore, S5 performs cross-level scheduling through a finite state machine, such as... Figure 3 As shown, it includes the following sub-steps:

[0127] S51. The system scheduling service executes step S4 in batches at fixed intervals to update all unpatched vulnerabilities. Field.

[0128] S52, Set SLA warning threshold When a certain node is calculated vulnerabilities When the condition is met, the underlying verification logic of the state machine is triggered, bypassing the regular approval queue, and the vulnerability is automatically marked as urgent (fixing_urgent) in the operation and maintenance work order system; otherwise, the status quo is maintained.

[0129] S53. The triggering conditions for bypass scheduling operations are encapsulated as structured JSON data, which contains the current... Value and A snapshot is taken. The structured data described above, along with the old and new states of the vulnerability, are written to the audit table all at once. This operation has the following capabilities: Time complexity, maintaining the traceability of the dynamic SLA shrinkage process.

[0130] As an optional embodiment, the warning threshold The determination steps include:

[0131] S521. Extract the physical build baseline time of the continuous integration pipeline, including: physical links such as code pull, abstract syntax tree (AST) verification, image recompilation, and secure container image scanning involved in emergency microservice fixes. The time consumed is limited by the computing power limit of the computing cluster. Extract the continuous integration / continuous deployment (CI / CD) system's time consumption over a fixed period (e.g., ...). Within a given day, historical execution monitoring logs of all emergency hotfix pipelines were collected. Excluding failures due to human error or syntax errors, statistical distribution analysis was performed on the execution time data of successfully executed pipelines to extract the... percentile ( The corresponding physical execution time is used as the time consumed in building the pipeline infrastructure. (Converted to hours), transforming the system's computing power bottleneck into a fixed time constant.

[0132] S522, Quantitative infrastructure deployment convergence time, including: the theoretical maximum latency required to switch all business traffic to the repaired version image for different underlying computing environments. :

[0133] In a container orchestration platform (such as Kubernetes), extract the percentage of rolling update step size and the waiting time of the new container readiness probe. and the maximum number of replicas per node Calculate the container mesh grayscale release delay;

[0134] In non-containerized environments (such as virtual machine clusters or bare metal servers), extract the concurrent deployment step size of the operation and maintenance automation platform and the physical time required to restart a single instance service. and the convergence determination time of load balancer (LB) health checks. The generalized deployment convergence time of the heterogeneous cluster is calculated. :

[0135] ;

[0136] In the formula, This represents the total number of instances. The number of concurrent operation windows allowed.

[0137] S523. Establish organizational structure response baselines and network fault tolerance buffers, including: extracting the baseline time for manual approval of routine security incidents from the enterprise's standard operating procedures (SOPs). Introducing an emergency response compression factor for scenarios involving skip-level scheduling. (range of values) This represents the minimum physical time cost for performing one-click release or reporting-based verification via the green channel in an emergency. It also calculates the time required to obtain the emergency verification baseline. Extract the statistical maximum network jitter latency of cross-Availability Zone (AZ) image distribution and synchronization in the underlying network architecture, and set it as the fault tolerance buffer time. It is used to absorb fluctuations in the underlying, uncontrollable infrastructure.

[0138] S524, The above-mentioned time consumption of the pipeline construction Generalized deployment convergence time Emergency baseline verification time and network fault tolerance buffer time Perform linear summation:

[0139] ;

[0140] The scalar obtained from the solution The solidified injection is incorporated into the underlying verification configuration of the finite state machine.

[0141] Example 2

[0142] As a second embodiment of the present invention, such as Figure 4 As shown in Example 1, this example also discloses a vulnerability lifecycle SLA management and intelligent remediation suggestion system, specifically including:

[0143] The topology graph construction module is used to continuously collect remote procedure call traffic logs between services through a bypass proxy and extract sliding windows at specific times. The effective call relationships within the microservices are used to construct a directed weighted graph of the microservice call chain. In practice, this module configures filtering rules at the proxy layer and extracts the common service identity identifier from the application layer protocol header as a unique node. Mapping keys and allocate a preset maximum capacity within the process. A hash table to aggregate micro-batch time windows The module also calculates the number of calls within the sliding window. Additionally, it extracts the base query rate per second within the sliding window. Maximum empirical query rate limit for a single link Edge weights are generated through log-normalized mapping. And set the background noise threshold of the underlying environment. Weak edges are removed to output a directed weighted graph under limited computing power conditions. .

[0144] The global network centrality calculation module is used to perform asynchronous offline tasks based on directed weight graphs. Perform a weighted graph network algorithm to compute and generate the individual service nodes. Global network centrality In the specific implementation process, this module extracts the directed weighted graph. A global read-only snapshot is used to construct a weighted adjacency matrix and a Markov random walk transition matrix containing surviving nodes. Introducing a damping factor The original centrality score of the microservice node is updated iteratively with the dangling node compensation item. Once the iteration converges, extract the maximum score from the original centrality score set. With minimum score The original node scores are mapped to a preset interval using linear range transformation logic, and the quantized global network centrality is output. .

[0145] The in-the-wild exploit probability calculation module is used to obtain the in-the-wild exploit probability from an external vulnerability exploitation prediction and scoring system when the vulnerability has progressed to the confirmation stage. In its implementation, this module encapsulates the vulnerability ID and contextual characteristics into an event message and pushes it into a distributed message middleware. The module first queries the local distributed memory cache; if a cache miss occurs, it pushes the vulnerability ID into a micro-batch waiting queue and initiates a batch query to external systems to obtain the probability of exploitation in the wild. For vulnerabilities that are not included in the database or have timed out, their static base severity scores are extracted and normalized. Combined with the unknown threat penalty coefficient Forced injection base probability estimate As an alternative.

[0146] The dynamic SLA recalculation module is used to combine static baseline SLA time. Global network centrality Probability of utilization in the wild Mutation compensation factor Normalized value of static baseline severity score The dynamic remaining repair time limit is calculated using exponential decay logic. In the specific implementation process, this module assigns global network centrality to each network. Probability of utilization in the wild Normalized value of static baseline severity score Corresponding topological weights Intelligence weight With static benchmark weights Linear summation generates a multidimensional risk comprehensive penalty factor. This module extracts the physical elapsed time of the vulnerability. Time dimension reference constant With time decay penalty parameter Together they are placed inside the natural exponential function and the benchmark service level agreement time. Multiply to obtain the dynamic total allowable time limit Subtracting the physical elapsed time After performing the truncation operation, the dynamic remaining repair time limit is output. .

[0147] The finite state machine-based skip scheduling module is used to schedule tasks based on the dynamic remaining repair time limit. This triggers the underlying verification logic of the finite state machine to generate a bypass scheduling instruction and synchronously write it to the structured audit log. In practice, this module periodically updates the dynamic remaining repair time for unpatched vulnerabilities in batches. And determine whether it is less than or equal to the warning threshold. When the conditions are met, the module automatically bypasses the regular approval queue and marks the vulnerability as requiring urgent remediation. Among these conditions is the warning threshold. The time required to build an assembly line Generalized deployment convergence time Emergency baseline verification time and network fault tolerance buffer time Linear summation determines the process. When a skip scheduling event is triggered, the module will include the global network centrality. Probability of use in the wild The structured data from the snapshot, along with the status changes, is written to the audit table.

[0148] In the description of this specification, references to terms such as "an embodiment," "example," "specific example," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0149] The preferred embodiments of the invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention.

Claims

1. A method for vulnerability lifecycle SLA management and intelligent remediation recommendations, characterized in that, include: Microservice call chain topology graph construction: By continuously collecting remote procedure call traffic logs between services through a bypass proxy, and extracting the effective call relationships within a specific time sliding window, a directed weighted graph of the microservice call chain is constructed. Global network centrality quantification calculation: An asynchronous offline task is used to execute a weighted graph network algorithm based on the directed weight graph to calculate the global network centrality of each service node, so as to quantify the cascading damage radius after a node is compromised; Wild exploit probability calculation: When a vulnerability progresses to the confirmed state, the wild exploit probability of the external vulnerability exploitation prediction and scoring system is obtained; Dynamic SLA recalculation: Introducing the baseline service level agreement time and static basic severity score, combined with the global network centrality and the probability of exploitation in the wild, the calculation is performed through exponential decay logic with a time-dimensional reference constant to obtain the dynamic remaining remediation time limit for the target vulnerability; Finite state machine skip scheduling: Based on the recalculated dynamic remaining repair time limit, the underlying verification logic of the finite state machine is triggered, and skip scheduling of the emergency repair state is automatically executed and synchronously written to the structured audit log; The dynamic SLA recalculation includes: Based on the enterprise's security compliance baseline, set the static baseline service level agreement time corresponding to the current vulnerability level, and extract the initial timestamp of vulnerability detection and the current system calculation timestamp to calculate the physical elapsed time of vulnerability exposure; Extract the real-time query rate per second and the current number of live replicas at the current moment, calculate the real-time traffic density, and calculate the real-time topology mutation compensation factor based on the real-time traffic density and the baseline traffic density; The global network centrality, in-the-wild exploitation probability, and static basic severity score normalization values ​​are extracted and assigned corresponding topological weights, intelligence weights, and static baseline weights, respectively. Based on the current vulnerability status, a vulnerability status confidence parameter is introduced. Combined with the real-time topological mutation compensation factor, a multi-dimensional risk comprehensive penalty factor is constructed by performing a summation operation through weighted linear combination logic. Extract the time decay penalty parameter that controls the steepness of the overall decay curve and the preset time dimension reference constant, and divide the physical elapsed time by the time dimension reference constant to obtain the time variable; The multidimensional risk comprehensive penalty factor, time variable, and time decay penalty parameter are put together into the natural exponential function term and multiplied to obtain the nonlinear decay result. The nonlinear decay result is then multiplied with the static baseline service level agreement time to calculate the dynamic total allowable time limit. The physical elapsed time is deducted from the total dynamic allowable time limit, and a boundary truncation operation is performed by wrapping the maximum value function in the outermost layer to output the non-negative dynamic remaining repair time limit.

2. The vulnerability lifecycle SLA management and intelligent remediation recommendation method according to claim 1, characterized in that, The method of continuously collecting remote procedure call traffic logs between services through a bypass proxy includes: The service mesh's bypass proxy uses a layer 7 network filter to extract the general service identity carried in the application layer protocol header as the unique node mapping key of the topology graph, and configures static bypass filtering rules in the proxy layer to intercept periodic requests that are not related to business attributes. A fixed-length hash table with a preset maximum capacity is allocated within the process where the bypass agent is located. The extracted source service identifier and target service identifier are concatenated as the hash key. The number of calls within the time window is used as the hash value for micro-batch topology aggregation. When the capacity of the fixed-length hash table reaches the upper limit, long-tail calls are removed based on the least recently used eviction algorithm. At the same time, the cumulative number of calls of the removed long-tail calls is added to the global overflow traffic counter. The system monitors the backlog depth of the asynchronous reporting queue in real time. When the backlog depth is between the warning threshold and the maximum depth, it calculates an exponentially increasing dynamic truncation threshold based on the backlog depth, removes edge call data below the dynamic truncation threshold, and adds the removed data to the global overflow traffic counter. When the backlog depth reaches the maximum depth or a network timeout occurs, it clears the topology detail log and reports a heartbeat probe payload containing the global overflow traffic counter value.

3. The vulnerability lifecycle SLA management and intelligent remediation recommendation method according to claim 2, characterized in that, The construction of the directed weighted graph of the microservice call chain includes: Extract the total number of calls from the source node to the target node within the sliding window, and calculate the basic query rate per second by combining the duration of the sliding window; Extract the upper limit of the maximum empirical query rate of a single link carried by the current cluster architecture, introduce a smoothing compensation factor, and use log normalization mapping logic to smooth and compress the basic query rate per second and the upper limit of the maximum empirical query rate of a single link to generate edge weights that are robust against instantaneous traffic surges. When extreme overload causes the basic query rate per second to reach the maximum empirical query rate limit of a single link, a segmentation truncation mechanism is triggered to force the output of the preset maximum weight boundary value. Set a background noise threshold for the underlying environment, traverse the initially generated set of edge weights, and perform a pruning operation on weak connections that are below the background noise threshold, forcibly setting their weights to zero and removing them from the graph edge set, so as to generate the directed weighted graph under the condition of limited computing power.

4. The vulnerability lifecycle SLA management and intelligent remediation recommendation method according to claim 1, characterized in that, The global network center metric calculation includes: Extract a global read-only snapshot of the directed weighted graph, and construct a weighted adjacency matrix and a Markov random walk transition matrix containing surviving nodes based on the global read-only snapshot; A damping factor and a penalty compensation term for dangling nodes with no subsequent call behavior are introduced. The original centrality score of each microservice node is continuously updated iteratively through matrix multiplication until the global error convergence condition is met or the preset maximum number of iterations is reached. Extract the maximum and minimum scores from the original centrality score set, and force the original centrality scores of each node to converge to a preset numerical range through linear range transformation logic to obtain the global network centrality, and record the baseline traffic density of each microservice node within the calculation period.

5. The vulnerability lifecycle SLA management and intelligent remediation recommendation method according to claim 1, characterized in that, The calculation of the probability of utilization in the wild includes: When the finite state machine updates the state of a specific vulnerability to confirmed, it encapsulates the payload containing the vulnerability number and context characteristics into a standard event message and pushes it asynchronously into the distributed message middleware. The background consumer process then pulls the event from the queue according to the concurrent rate token bucket algorithm. First, query the local distributed memory cache system to obtain the probability of exploitation in the wild. If the cache is not hit, push the vulnerability number into the micro-batch waiting queue. After the queue length or waiting time meets the set conditions, synthesize a single network request to initiate a batch query to the external vulnerability exploitation prediction and scoring system. For zero-day vulnerabilities that have not yet been analyzed and included, or for situations where response times out due to network hard isolation, the static basic score normalized value associated with the vulnerability is extracted, and a basic probability estimate is generated by a linear mapping formula in combination with the preset unknown threat penalty coefficient as a substitute variable for forced injection.

6. The vulnerability lifecycle SLA management and intelligent remediation recommendation method according to claim 1, characterized in that, The determination of the topology weight, intelligence weight, and static baseline weight includes: Extract the business attribute tags of the current microservice mesh, and construct an offline evaluation model based on the business attributes using the analytic hierarchy process; A subjective judgment matrix is ​​constructed based on three dimensions: topological centrality, in-the-wild exploitation threat, and static severity. Topological centrality represents the cascading explosion radius, in-the-wild exploitation threat represents the external attack heat, and static severity represents the inherent attributes of the vulnerability. Calculate the largest eigenvalue and its corresponding eigenvector of the subjective judgment matrix, and perform a consistency ratio test; If the verification passes, the feature vector is normalized, and the three extracted components are proportionally fixed as the topological weight, the intelligence weight, and the static benchmark weight.

7. The vulnerability lifecycle SLA management and intelligent remediation recommendation method according to claim 1, characterized in that, The finite state machine skip-level scheduling includes: The system scheduling service updates the dynamic remaining repair time for all unpatched vulnerabilities in batches at fixed intervals. Determine whether the calculated dynamic remaining repair time limit is less than or equal to the set warning threshold. When the condition is met, trigger the underlying verification logic of the state machine and automatically mark the vulnerability as an emergency repair status in the operation and maintenance work order system, bypassing the regular approval queue. The conditions that trigger out-of-level scheduling are encapsulated as structured data. The structured data includes a snapshot of the global network centrality value and the probability of exploitation in the wild. The structured data, along with the old and new states of the vulnerability, are written into an audit table at once to maintain the traceability of the dynamic contraction process.

8. The vulnerability lifecycle SLA management and intelligent remediation recommendation method according to claim 7, characterized in that, The methods for determining the early warning threshold include: Extract the physical execution time corresponding to the preset percentile of the statistical distribution data of the monitoring logs of the continuous integration system that executes historical emergency hotfix pipelines within a fixed period in the past, and use it as the pipeline's basic construction time. Based on the underlying computing environment, extract concurrent deployment parameters and convergence time parameters, and calculate the generalized deployment convergence time required for the entire business traffic to switch to the repaired version image; Extract the baseline time for manual approval of routine security events set in the enterprise's standard operation and maintenance procedures, introduce an emergency response compression factor to perform multiplication calculation, and obtain the baseline time for emergency verification. The warning threshold is determined by linearly summing the pipeline infrastructure construction time, the generalized deployment convergence time, the emergency verification baseline time, and the fault tolerance buffer time for cross-availability zone infrastructure fluctuations.

9. A vulnerability lifecycle SLA management and intelligent remediation recommendation system, employing the vulnerability lifecycle SLA management and intelligent remediation recommendation method as described in any one of claims 1 to 8, characterized in that, include: The topology graph construction module is used to continuously collect remote procedure call traffic logs between services through a bypass proxy and extract valid call relationships to generate a directed weighted graph of microservice call chains. The global network centrality calculation module is used to perform weighted graph network algorithms based on a directed weighted graph using asynchronous offline tasks to calculate the global network centrality of each service node. The in-the-wild exploit probability calculation module is used to obtain the in-the-wild exploit probability of the external vulnerability exploitation prediction and scoring system when the vulnerability flow reaches the confirmation status. The dynamic SLA recalculation module combines baseline service level agreement time, global network centrality, out-of-the-wild utilization probability, and static basic severity score to calculate the dynamic remaining repair time limit through exponential decay logic. The finite state machine skip scheduling module is used to trigger the underlying verification logic of the finite state machine based on the dynamic remaining repair time limit to generate skip scheduling instructions and synchronously write them to the structured audit log.

Images